fix: Limit shopping list owners to current group (#3305)

* add route for getting group-only users

* add new api route to frontend

* update shopping list user getAll call

* tests

* fixed bad import

* replace UserOut with UserSummary

* fix params

frontend/lib/api/types/user.ts

@@ -238,6 +238,10 @@ export interface UserIn {
   canOrganize?: boolean;
   password: string;
 }
+export interface UserSummary {
+  id: string;
+  fullName?: string;
+}
 export interface ValidateResetToken {
   token: string;
 }

frontend/lib/api/user/users.ts

@@ -1,5 +1,6 @@
 import { BaseCRUDAPI } from "../base/base-clients";
-import { RequestResponse } from "../types/non-generated";
+import { QueryValue, route } from "~/lib/api/base/route";
+import { PaginationData, RequestResponse } from "~/lib/api/types/non-generated";
 import {
   ChangePassword,
   DeleteTokenResponse,
@@ -11,11 +12,13 @@ import {
   UserFavorites,
   UserIn,
   UserOut,
+  UserSummary,
 } from "~/lib/api/types/user";
 
 const prefix = "/api";
 
 const routes = {
+  groupUsers: `${prefix}/users/group-users`,
   usersSelf: `${prefix}/users/self`,
   groupsSelf: `${prefix}/users/self/group`,
   passwordReset: `${prefix}/users/reset-password`,
@@ -36,6 +39,10 @@ export class UserApi extends BaseCRUDAPI<UserIn, UserOut, UserBase> {
   baseRoute: string = routes.users;
   itemRoute = (itemid: string) => routes.usersId(itemid);
 
+  async getGroupUsers(page = 1, perPage = -1, params = {} as Record<string, QueryValue>) {
+    return await this.requests.get<PaginationData<UserSummary>>(route(routes.groupUsers, { page, perPage, ...params }));
+  }
+
   async getSelfGroup(): Promise<RequestResponse<GroupInDB>> {
     return await this.requests.get(routes.groupsSelf, {});
   }

frontend/pages/shopping-lists/_id.vue

@@ -245,7 +245,7 @@ import { useUserApi } from "~/composables/api";
 import MultiPurposeLabelSection from "~/components/Domain/ShoppingList/MultiPurposeLabelSection.vue"
 import ShoppingListItem from "~/components/Domain/ShoppingList/ShoppingListItem.vue";
 import { ShoppingListItemCreate, ShoppingListItemOut, ShoppingListMultiPurposeLabelOut, ShoppingListOut } from "~/lib/api/types/group";
-import { UserOut } from "~/lib/api/types/user";
+import { UserSummary } from "~/lib/api/types/user";
 import RecipeList from "~/components/Domain/Recipe/RecipeList.vue";
 import ShoppingListItemEditor from "~/components/Domain/ShoppingList/ShoppingListItemEditor.vue";
 import { useFoodStore, useLabelStore, useUnitStore } from "~/composables/store";
@@ -817,10 +817,10 @@ export default defineComponent({
     // ===============================================================
     // Shopping List Settings
 
-    const allUsers = ref<UserOut[]>([]);
+    const allUsers = ref<UserSummary[]>([]);
     const currentUserId = ref<string | undefined>();
     async function fetchAllUsers() {
-      const { data } = await userApi.users.getAll(1, -1, { orderBy: "full_name", orderDirection: "asc" });
+      const { data } = await userApi.users.getGroupUsers(1, -1, { orderBy: "full_name", orderDirection: "asc" });
       if (!data) {
         return;
       }

frontend/types/components.d.ts

@@ -14,6 +14,7 @@ import BaseDivider from "@/components/global/BaseDivider.vue";
 import BaseOverflowButton from "@/components/global/BaseOverflowButton.vue";
 import BasePageTitle from "@/components/global/BasePageTitle.vue";
 import BaseStatCard from "@/components/global/BaseStatCard.vue";
+import BaseWizard from "@/components/global/BaseWizard.vue";
 import ButtonLink from "@/components/global/ButtonLink.vue";
 import ContextMenu from "@/components/global/ContextMenu.vue";
 import CrudTable from "@/components/global/CrudTable.vue";
@@ -32,7 +33,6 @@ import ReportTable from "@/components/global/ReportTable.vue";
 import SafeMarkdown from "@/components/global/SafeMarkdown.vue";
 import StatsCards from "@/components/global/StatsCards.vue";
 import ToggleState from "@/components/global/ToggleState.vue";
-import BaseWizard from "@/components/global/BaseWizard.vue";
 import DefaultLayout from "@/components/layout/DefaultLayout.vue";
 
 declare module "vue" {
@@ -53,6 +53,7 @@ declare module "vue" {
     BaseOverflowButton: typeof BaseOverflowButton;
     BasePageTitle: typeof BasePageTitle;
     BaseStatCard: typeof BaseStatCard;
+    BaseWizard: typeof BaseWizard;
     ButtonLink: typeof ButtonLink;
     ContextMenu: typeof ContextMenu;
     CrudTable: typeof CrudTable;
@@ -71,7 +72,6 @@ declare module "vue" {
     SafeMarkdown: typeof SafeMarkdown;
     StatsCards: typeof StatsCards;
     ToggleState: typeof ToggleState;
-    BaseWizard: typeof BaseWizard;
     // Layout Components
     DefaultLayout: typeof DefaultLayout;
   }