From 37fd0c8510a761344b5c4e1f06119d6d724f2e3e Mon Sep 17 00:00:00 2001 From: Michael Genson Date: Thu, 14 May 2026 19:06:18 +0000 Subject: [PATCH] context var for disabling restricted models --- mealie/routes/_base/base_controllers.py | 7 +++++++ mealie/services/query_filter/builder.py | 3 ++- mealie/services/query_filter/context.py | 3 +++ 3 files changed, 12 insertions(+), 1 deletion(-) create mode 100644 mealie/services/query_filter/context.py diff --git a/mealie/routes/_base/base_controllers.py b/mealie/routes/_base/base_controllers.py index 5476e7407..b6b428eb2 100644 --- a/mealie/routes/_base/base_controllers.py +++ b/mealie/routes/_base/base_controllers.py @@ -27,6 +27,12 @@ from mealie.schema.household.household import HouseholdInDB from mealie.schema.user.user import GroupInDB, PrivateUser from mealie.services.event_bus_service.event_bus_service import EventBusService from mealie.services.event_bus_service.event_types import EventDocumentDataBase, EventTypes +from mealie.services.query_filter.context import allow_filter_restricted + + +def _set_no_restricted_filter() -> None: + """FastAPI dependency that disables restricted model traversal for the current request.""" + allow_filter_restricted.set(False) class _BaseController(ABC): # noqa: B024 @@ -94,6 +100,7 @@ class BasePublicGroupExploreController(BasePublicController): """ group: GroupInDB = Depends(get_public_group) + _no_restricted_filter: None = Depends(_set_no_restricted_filter) @property def group_id(self) -> UUID4 | None | NotSet: diff --git a/mealie/services/query_filter/builder.py b/mealie/services/query_filter/builder.py index 5e480474f..499d1a631 100644 --- a/mealie/services/query_filter/builder.py +++ b/mealie/services/query_filter/builder.py @@ -18,6 +18,7 @@ from mealie.db.models._model_utils.datetime import NaiveDateTime from mealie.db.models._model_utils.guid import GUID from mealie.schema._mealie.mealie_model import MealieModel +from .context import allow_filter_restricted from .keywords import PlaceholderKeyword, RelationalKeyword from .operators import LogicalOperator, RelationalOperator @@ -355,7 +356,7 @@ class QueryFilterBuilder: continue nested_model, model_attr, query = self.get_model_and_model_attr_from_attr_string( - component.attribute_name, model, query=query + component.attribute_name, model, query=query, allow_restricted=allow_filter_restricted.get() ) attr_model_map[i] = nested_model diff --git a/mealie/services/query_filter/context.py b/mealie/services/query_filter/context.py new file mode 100644 index 000000000..7e3041fe2 --- /dev/null +++ b/mealie/services/query_filter/context.py @@ -0,0 +1,3 @@ +from contextvars import ContextVar + +allow_filter_restricted: ContextVar[bool] = ContextVar("allow_filter_restricted", default=True)