fix: address CRITICAL security issues - permission escalation and encoding inconsistency

backend/src/v1/schedule_items/schemas.py

@@ -5,7 +5,7 @@ from enum import Enum
 from typing import ClassVar
 from uuid import UUID
 
-from pydantic import BaseModel, ConfigDict, Field
+from pydantic import BaseModel, ConfigDict, EmailStr, Field
 
 
 class AttachmentType(str, Enum):
@@ -99,7 +99,9 @@ class ScheduleItemListRequest(BaseModel):
 
 
 class ScheduleItemShareRequest(BaseModel):
-    email: str = Field(..., description="Email of user to share with")
+    model_config: ClassVar[ConfigDict] = ConfigDict(extra="forbid")
+
+    email: EmailStr = Field(..., description="Email of user to share with")
     permission_view: bool = Field(True, description="Grant view permission")
     permission_edit: bool = Field(False, description="Grant edit permission")
     permission_invite: bool = Field(False, description="Grant invite permission")