feat: Groups/households custom invitations (#4252)

Co-authored-by: Michael Genson <71845777+michael-genson@users.noreply.github.com>

mealie/routes/households/controller_invitations.py

@@ -24,15 +24,24 @@ class GroupInvitationsController(BaseUserController):
         return self.repos.group_invite_tokens.page_all(PaginationQuery(page=1, per_page=-1)).items
 
     @router.post("", response_model=ReadInviteToken, status_code=status.HTTP_201_CREATED)
-    def create_invite_token(self, uses: CreateInviteToken):
+    def create_invite_token(self, body: CreateInviteToken):
         if not self.user.can_invite:
             raise HTTPException(
                 status.HTTP_403_FORBIDDEN,
                 detail="User is not allowed to create invite tokens",
             )
 
+        body.group_id = body.group_id or self.group_id
+        body.household_id = body.household_id or self.household_id
+
+        if not self.user.admin and (body.group_id != self.group_id or body.household_id != self.household_id):
+            raise HTTPException(
+                status.HTTP_403_FORBIDDEN,
+                detail="Only admins can create invite tokens for other groups or households",
+            )
+
         token = SaveInviteToken(
-            uses_left=uses.uses, group_id=self.group_id, household_id=self.household_id, token=url_safe_token()
+            uses_left=body.uses, group_id=body.group_id, household_id=body.household_id, token=url_safe_token()
         )
         return self.repos.group_invite_tokens.create(token)
 

mealie/schema/household/invite_token.py

@@ -7,6 +7,8 @@ from mealie.schema._mealie import MealieModel
 
 class CreateInviteToken(MealieModel):
     uses: int
+    group_id: UUID | None = None
+    household_id: UUID | None = None
 
 
 class SaveInviteToken(MealieModel):