fix: Security Issues (#3530)

Co-authored-by: boc-the-git <3479092+boc-the-git@users.noreply.github.com>

mealie/routes/auth/auth.py

@@ -72,3 +72,9 @@ async def refresh_token(current_user: PrivateUser = Depends(get_current_user)):
     """Use a valid token to get another token"""
     access_token = security.create_access_token(data=dict(sub=str(current_user.id)))
     return MealieAuthToken.respond(access_token)
+
+
+@user_router.post("/logout")
+async def logout(response: Response):
+    response.delete_cookie("mealie.access_token")
+    return {"message": "Logged out"}

mealie/routes/users/crud.py

@@ -11,14 +11,7 @@ from mealie.routes.users._helpers import assert_user_change_allowed
 from mealie.schema.response import ErrorResponse, SuccessResponse
 from mealie.schema.response.pagination import PaginationQuery
 from mealie.schema.user import ChangePassword, UserBase, UserIn, UserOut
-from mealie.schema.user.user import (
-    GroupInDB,
-    UserPagination,
-    UserRatings,
-    UserRatingSummary,
-    UserSummary,
-    UserSummaryPagination,
-)
+from mealie.schema.user.user import UserPagination, UserRatings, UserRatingSummary, UserSummary, UserSummaryPagination
 
 user_router = UserAPIRouter(prefix="/users", tags=["Users: CRUD"])
 admin_router = AdminAPIRouter(prefix="/users", tags=["Users: Admin CRUD"])
@@ -100,10 +93,6 @@ class UserController(BaseUserController):
     def get_logged_in_user_favorites(self):
         return UserRatings(ratings=self.repos.user_ratings.get_by_user(self.user.id, favorites_only=True))
 
-    @user_router.get("/self/group", response_model=GroupInDB)
-    def get_logged_in_user_group(self):
-        return self.group
-
     @user_router.put("/password")
     def update_password(self, password_change: ChangePassword):
         """Resets the User Password"""

mealie/schema/user/user.py

@@ -206,7 +206,7 @@ class UpdateGroup(GroupBase):
 
 
 class GroupInDB(UpdateGroup):
-    users: list[UserOut] | None = None
+    users: list[UserSummary] | None = None
     preferences: ReadGroupPreferences | None = None
     webhooks: list[ReadWebhook] = []