Add missing required_alternate_scopes across OAS-gated views

Several views using IsAuthenticatedOrTokenMatchesOASRequirements were
missing scope entries for methods they actually expose (GET on
list/retrieve-only viewsets, PUT/PATCH/DELETE on ModelViewSets), and
two had a stale POST entry for a method that doesn't exist
(SellerStoreWorkingHoursView, OrderGroupViewSet). Fixes:
- SellerStoreView, SellerStoreWorkingHoursView (apps/stores/views.py)
- AddressViewSet (apps/locations/views.py)
- SellerReviewViewSet (apps/reviews/views.py)
- SellerProductViewSet (apps/catalog/views.py)
- OrderGroupViewSet, OrderViewSet, SellerOrderViewSet,
  NotificationViewSet (apps/orders/views.py)

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>

apps/catalog/views.py

@@ -51,7 +51,11 @@ class SellerProductViewSet(viewsets.ModelViewSet):
     # TODO: IsStoreOwner?
     permission_classes = [IsAuthenticatedOrTokenMatchesOASRequirements]
     required_alternate_scopes = {
+        "GET": [[]],
         "POST": [[]],
+        "PUT": [[]],
+        "PATCH": [[]],
+        "DELETE": [[]],
     }
 
     def get_queryset(self):

apps/locations/views.py

@@ -29,7 +29,11 @@ class AddressViewSet(viewsets.ModelViewSet):
     serializer_class = AddressSerializer
     permission_classes = [IsAuthenticatedOrTokenMatchesOASRequirements]
     required_alternate_scopes = {
+        "GET": [[]],
         "POST": [[]],
+        "PUT": [[]],
+        "PATCH": [[]],
+        "DELETE": [[]],
     }
 
     def get_queryset(self):

apps/orders/views.py

@@ -129,7 +129,7 @@ class OrderGroupViewSet(mixins.ListModelMixin, mixins.RetrieveModelMixin, viewse
     serializer_class = OrderGroupSerializer
     permission_classes = [IsAuthenticatedOrTokenMatchesOASRequirements]
     required_alternate_scopes = {
-        "POST": [[]],
+        "GET": [[]],
     }
 
     def get_queryset(self):
@@ -145,6 +145,7 @@ class OrderViewSet(mixins.RetrieveModelMixin, viewsets.GenericViewSet):
     serializer_class = OrderSerializer
     permission_classes = [IsAuthenticatedOrTokenMatchesOASRequirements]
     required_alternate_scopes = {
+        "GET": [[]],
         "POST": [[]],
     }
 
@@ -171,6 +172,7 @@ class SellerOrderViewSet(mixins.ListModelMixin, mixins.RetrieveModelMixin, views
     # TODO: IsStoreOwner
     permission_classes = [IsAuthenticatedOrTokenMatchesOASRequirements]
     required_alternate_scopes = {
+        "GET": [[]],
         "POST": [[]],
     }
     filterset_fields = ['status']
@@ -219,6 +221,7 @@ class NotificationViewSet(mixins.ListModelMixin, mixins.RetrieveModelMixin, view
     serializer_class = NotificationSerializer
     permission_classes = [IsAuthenticatedOrTokenMatchesOASRequirements]
     required_alternate_scopes = {
+        "GET": [[]],
         "POST": [[]],
     }
 

apps/reviews/views.py

@@ -38,6 +38,7 @@ class SellerReviewViewSet(mixins.ListModelMixin, viewsets.GenericViewSet):
     # TODO:
     permission_classes = [IsAuthenticatedOrTokenMatchesOASRequirements]
     required_alternate_scopes = {
+        "GET": [[]],
         "POST": [[]],
     }
 

apps/stores/views.py

@@ -72,7 +72,9 @@ class SellerStoreView(APIView):
     serializer_class = SellerStoreSerializer
     permission_classes = [IsAuthenticatedOrTokenMatchesOASRequirements]
     required_alternate_scopes = {
+        "GET": [[]],
         "POST": [[]],
+        "PATCH": [[]],
     }
 
     def get(self, request):
@@ -109,7 +111,8 @@ class SellerStoreWorkingHoursView(APIView):
     # TODO:
     permission_classes = [IsAuthenticatedOrTokenMatchesOASRequirements]
     required_alternate_scopes = {
-        "POST": [[]],
+        "GET": [[]],
+        "PUT": [[]],
     }
 
     def get(self, request):