Permissions: meal and recipe routes write to the shopping list without shopping rights

[ulsklyc]

Found while preparing the read-only work in #1265; it has to be settled before its kitchen and shopping packages (P3, P4).

Today

The server decides which module a request belongs to by its path (server/scopes.js: meals covers /meals and /recipes, shopping covers /shopping). Three routes write into the shopping list but are judged as meals, and one route goes the other way:

• POST /meals/:id/to-shopping-list (server/routes/meals.js): inserts shopping_items and sets meal_ingredients.on_shopping_list.
• POST /meals/week-to-shopping-list (server/routes/meals.js): the same for a whole week.
• POST /recipes/:id/to-shopping-list (server/routes/recipes.js): inserts shopping_items.
• POST /shopping/:listId/import-meal-plan (server/routes/shopping.js): judged as shopping, inserts shopping_items and sets meal_ingredients.on_shopping_list, which is meal-plan data.

None of them checks the other module. A member with meals: write and shopping: none can add items to a shopping list they cannot see, and a token scoped to meals can do the same. In the other direction, shopping: write with meals: read changes meal-plan flags.

Decision

The target module is checked as well: writing into a module needs write access to that module, for member permissions and for token scopes, whichever route the request comes through.

Proposal

• The three to-shopping-list routes additionally require shopping: write; import-meal-plan additionally requires meals: write. A missing right answers 403 with the same shape as the path guard.
• One test per route and per axis (member permission, token scope) that is red today.
• The read-only interface (Read-only permissions: the remaining twelve pages still draw their write controls #1265 P3/P4) then hides the "to shopping list" and "import meal plan" controls by the target module, with the shared helper from P0.