✨(backend) expose room configuration to all API consumers

Update room serialization to include room configuration for all
users fetching the API response, not only room owners.
This behavior was inherited from the original upstream project.

At the moment, exposing this configuration does not appear to
introduce meaningful security concerns or provide attackers with
additional capabilities.

The decision will continue to be reviewed from a security
perspective, but sharing the configuration improves frontend
consistency and synchronization.

src/backend/core/api/serializers.py

@@ -166,11 +166,6 @@ class RoomSerializer(serializers.ModelSerializer):
             )
             output["accesses"] = access_serializer.data
 
-        configuration = output["configuration"]
-
-        if not is_admin_or_owner:
-            del output["configuration"]
-
         should_access_room = (
             (
                 instance.access_level == models.RoomAccessLevel.TRUSTED
@@ -187,7 +182,7 @@ class RoomSerializer(serializers.ModelSerializer):
                 room_id=room_id,
                 user=request.user,
                 username=username,
-                configuration=configuration,
+                configuration=output["configuration"],
                 is_admin_or_owner=is_admin_or_owner,
             )
         else:

src/backend/core/models.py

@@ -388,6 +388,7 @@ class Room(Resource):
         choices=RoomAccessLevel.choices,
         default=settings.RESOURCE_DEFAULT_ACCESS_LEVEL,
     )
+    # Public configuration exposed to any room participant via the API
     configuration = models.JSONField(
         blank=True,
         default=dict,

src/backend/core/tests/rooms/test_api_rooms_retrieve.py

@@ -28,6 +28,7 @@ def test_api_rooms_retrieve_anonymous_private_pk():
 
     assert response.status_code == 200
     assert response.json() == {
+        "configuration": {},
         "access_level": "restricted",
         "id": str(room.id),
         "is_administrable": False,
@@ -47,6 +48,7 @@ def test_api_rooms_retrieve_anonymous_trusted_pk():
 
     assert response.status_code == 200
     assert response.json() == {
+        "configuration": {},
         "access_level": "trusted",
         "id": str(room.id),
         "is_administrable": False,
@@ -65,6 +67,7 @@ def test_api_rooms_retrieve_anonymous_private_pk_no_dashes():
 
     assert response.status_code == 200
     assert response.json() == {
+        "configuration": {},
         "access_level": "restricted",
         "id": str(room.id),
         "is_administrable": False,
@@ -81,6 +84,7 @@ def test_api_rooms_retrieve_anonymous_private_slug():
 
     assert response.status_code == 200
     assert response.json() == {
+        "configuration": {},
         "access_level": "restricted",
         "id": str(room.id),
         "is_administrable": False,
@@ -97,6 +101,7 @@ def test_api_rooms_retrieve_anonymous_private_slug_not_normalized():
 
     assert response.status_code == 200
     assert response.json() == {
+        "configuration": {},
         "access_level": "restricted",
         "id": str(room.id),
         "is_administrable": False,
@@ -200,6 +205,7 @@ def test_api_rooms_retrieve_anonymous_public(mock_token):
     assert response.status_code == 200
     expected_name = f"{room.id!s}"
     assert response.json() == {
+        "configuration": {},
         "access_level": str(room.access_level),
         "id": str(room.id),
         "is_administrable": False,
@@ -246,6 +252,7 @@ def test_api_rooms_retrieve_authenticated_public(mock_token):
 
     expected_name = f"{room.id!s}"
     assert response.json() == {
+        "configuration": {"can_publish_sources": ["camera"]},
         "access_level": str(room.access_level),
         "id": str(room.id),
         "is_administrable": False,
@@ -297,6 +304,7 @@ def test_api_rooms_retrieve_authenticated_trusted(mock_token):
 
     expected_name = f"{room.id!s}"
     assert response.json() == {
+        "configuration": {},
         "access_level": str(room.access_level),
         "id": str(room.id),
         "is_administrable": False,
@@ -338,6 +346,7 @@ def test_api_rooms_retrieve_authenticated():
     assert response.status_code == 200
 
     assert response.json() == {
+        "configuration": {},
         "access_level": "restricted",
         "id": str(room.id),
         "is_administrable": False,
@@ -383,6 +392,7 @@ def test_api_rooms_retrieve_members(mock_token, django_assert_num_queries, setti
 
     expected_name = str(room.id)
     assert content_dict == {
+        "configuration": {"can_publish_sources": ["camera"]},
         "access_level": str(room.access_level),
         "id": str(room.id),
         "is_administrable": False,