fix: display warning message if admin tries to delete other household recipe, remove delete option if user is not allowed to delete it

frontend/components/Domain/Recipe/RecipeContextMenu.vue

@@ -12,7 +12,12 @@
       @confirm="deleteRecipe()"
     >
       <v-card-text>
-        {{ $t("recipe.delete-confirmation") }}
+        <template v-if="isAdminAndNotOwner">
+          {{ $t("recipe.admin-delete-confirmation") }}
+        </template>
+        <template v-else>
+          {{ $t("recipe.delete-confirmation") }}
+        </template>
       </v-card-text>
     </BaseDialog>
     <BaseDialog
@@ -359,16 +364,6 @@ export default defineNuxtComponent({
       },
     };
 
-    // Get Default Menu Items Specified in Props
-    for (const [key, value] of Object.entries(props.useItems)) {
-      if (value) {
-        const item = defaultItems[key];
-        if (item && (item.isPublic || isOwnGroup.value)) {
-          state.menuItems.push(item);
-        }
-      }
-    }
-
     // Add leading and Appending Items
     state.menuItems = [...state.menuItems, ...props.leadingItems, ...props.appendItems];
 
@@ -382,6 +377,30 @@ export default defineNuxtComponent({
     const recipeRefWithScale = computed(() =>
       recipeRef.value ? { scale: props.recipeScale, ...recipeRef.value } : undefined,
     );
+    const isAdminAndNotOwner = computed(() => {
+      return (
+        $auth.user.value?.admin
+        && $auth.user.value?.id !== recipeRef.value?.userId
+      );
+    });
+    const canDelete = computed(() => {
+      const user = $auth.user.value;
+      const recipe = recipeRef.value;
+      return user && recipe && (user.admin || user.id === recipe.userId);
+    });
+
+    // Get Default Menu Items Specified in Props
+    for (const [key, value] of Object.entries(props.useItems)) {
+      if (!value) continue;
+
+      // Skip delete if not allowed
+      if (key === "delete" && !canDelete.value) continue;
+
+      const item = defaultItems[key];
+      if (item && (item.isPublic || isOwnGroup.value)) {
+        state.menuItems.push(item);
+      }
+    }
 
     async function getShoppingLists() {
       const { data } = await api.shopping.lists.getAll(1, -1, { orderBy: "name", orderDirection: "asc" });
@@ -521,6 +540,8 @@ export default defineNuxtComponent({
       icon,
       planTypeOptions,
       firstDayOfWeek,
+      isAdminAndNotOwner,
+      canDelete,
     };
   },
 });

frontend/lang/messages/en-US.json

@@ -472,6 +472,7 @@
     "comment": "Comment",
     "comments": "Comments",
     "delete-confirmation": "Are you sure you want to delete this recipe?",
+    "admin-delete-confirmation": "You're about to delete a recipe that isn't yours using admin permissions. Are you sure?",
     "delete-recipe": "Delete Recipe",
     "description": "Description",
     "disable-amount": "Disable Ingredient Amounts",

mealie/services/recipe/recipe_service.py

@@ -64,6 +64,12 @@ class RecipeService(RecipeServiceBase):
             raise exceptions.NoEntryFound("Recipe not found.")
         return recipe
 
+    def can_delete(self, recipe: Recipe) -> bool:
+        if self.user.admin:
+            return True
+        else:
+            return self.can_update(recipe)
+
     def can_update(self, recipe: Recipe) -> bool:
         if recipe.settings is None:
             raise exceptions.UnexpectedNone("Recipe Settings is None")
@@ -77,7 +83,7 @@ class RecipeService(RecipeServiceBase):
             other_household = self.repos.households.get_one(recipe.household_id)
             if not (other_household and other_household.preferences):
                 return False
-            if not self.user.admin and other_household.preferences.lock_recipe_edits_from_other_households:
+            if other_household.preferences.lock_recipe_edits_from_other_households:
                 return False
         if recipe.settings.locked:
             return False
@@ -423,7 +429,7 @@ class RecipeService(RecipeServiceBase):
     def delete_one(self, slug_or_id: str | UUID) -> Recipe:
         recipe = self.get_one(slug_or_id)
 
-        if not self.can_update(recipe):
+        if not self.can_delete(recipe):
             raise exceptions.PermissionDenied("You do not have permission to delete this recipe.")
 
         data = self.group_recipes.delete(recipe.id, "id")