fix: /me only works on current user's collection

src/auth/operations/me.js

@@ -1,11 +1,20 @@
 const jwt = require('jsonwebtoken');
+const httpStatus = require('http-status');
 const getExtractJWT = require('../getExtractJWT');
 
+const { APIError } = require('../../errors');
+
 async function me({ req }) {
   const extractJWT = getExtractJWT(this.config);
 
   if (req.user) {
+    const requestedSlug = req.route.path.split('/').filter((r) => r !== '')[0];
     const user = { ...req.user };
+
+    if (user.collection !== requestedSlug) {
+      throw new APIError('Incorrect collection', httpStatus.FORBIDDEN);
+    }
+
     delete user.collection;
 
     const response = {