context var for disabling restricted models

mealie/routes/_base/base_controllers.py

@@ -27,6 +27,12 @@ from mealie.schema.household.household import HouseholdInDB
 from mealie.schema.user.user import GroupInDB, PrivateUser
 from mealie.services.event_bus_service.event_bus_service import EventBusService
 from mealie.services.event_bus_service.event_types import EventDocumentDataBase, EventTypes
+from mealie.services.query_filter.context import allow_filter_restricted
+
+
+def _set_no_restricted_filter() -> None:
+    """FastAPI dependency that disables restricted model traversal for the current request."""
+    allow_filter_restricted.set(False)
 
 
 class _BaseController(ABC):  # noqa: B024
@@ -94,6 +100,7 @@ class BasePublicGroupExploreController(BasePublicController):
     """
 
     group: GroupInDB = Depends(get_public_group)
+    _no_restricted_filter: None = Depends(_set_no_restricted_filter)
 
     @property
     def group_id(self) -> UUID4 | None | NotSet:

mealie/services/query_filter/builder.py

@@ -18,6 +18,7 @@ from mealie.db.models._model_utils.datetime import NaiveDateTime
 from mealie.db.models._model_utils.guid import GUID
 from mealie.schema._mealie.mealie_model import MealieModel
 
+from .context import allow_filter_restricted
 from .keywords import PlaceholderKeyword, RelationalKeyword
 from .operators import LogicalOperator, RelationalOperator
 
@@ -355,7 +356,7 @@ class QueryFilterBuilder:
                 continue
 
             nested_model, model_attr, query = self.get_model_and_model_attr_from_attr_string(
-                component.attribute_name, model, query=query
+                component.attribute_name, model, query=query, allow_restricted=allow_filter_restricted.get()
             )
             attr_model_map[i] = nested_model
 

mealie/services/query_filter/context.py

@@ -0,0 +1,3 @@
+from contextvars import ContextVar
+
+allow_filter_restricted: ContextVar[bool] = ContextVar("allow_filter_restricted", default=True)