From 534cf000b25e41a2949385edde696cbe4322d187 Mon Sep 17 00:00:00 2001
From: lebaudantoine <lebaud.antoine131@gmail.com>
Date: Fri, 15 May 2026 18:29:33 +0200
Subject: [PATCH] =?UTF-8?q?=E2=9C=A8(backend)=20expose=20room=20configurat?=
 =?UTF-8?q?ion=20to=20all=20API=20consumers?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Update room serialization to include room configuration for all
users fetching the API response, not only room owners.
This behavior was inherited from the original upstream project.

At the moment, exposing this configuration does not appear to
introduce meaningful security concerns or provide attackers with
additional capabilities.

The decision will continue to be reviewed from a security
perspective, but sharing the configuration improves frontend
consistency and synchronization.
---
 src/backend/core/api/serializers.py                    |  7 +------
 src/backend/core/models.py                             |  1 +
 .../core/tests/rooms/test_api_rooms_retrieve.py        | 10 ++++++++++
 3 files changed, 12 insertions(+), 6 deletions(-)

diff --git a/src/backend/core/api/serializers.py b/src/backend/core/api/serializers.py
index 2801fd86..f12f9b4c 100644
--- a/src/backend/core/api/serializers.py
+++ b/src/backend/core/api/serializers.py
@@ -166,11 +166,6 @@ class RoomSerializer(serializers.ModelSerializer):
             )
             output["accesses"] = access_serializer.data
 
-        configuration = output["configuration"]
-
-        if not is_admin_or_owner:
-            del output["configuration"]
-
         should_access_room = (
             (
                 instance.access_level == models.RoomAccessLevel.TRUSTED
@@ -187,7 +182,7 @@ class RoomSerializer(serializers.ModelSerializer):
                 room_id=room_id,
                 user=request.user,
                 username=username,
-                configuration=configuration,
+                configuration=output["configuration"],
                 is_admin_or_owner=is_admin_or_owner,
             )
         else:
diff --git a/src/backend/core/models.py b/src/backend/core/models.py
index 9e921ae5..45fb271f 100644
--- a/src/backend/core/models.py
+++ b/src/backend/core/models.py
@@ -388,6 +388,7 @@ class Room(Resource):
         choices=RoomAccessLevel.choices,
         default=settings.RESOURCE_DEFAULT_ACCESS_LEVEL,
     )
+    # Public configuration exposed to any room participant via the API
     configuration = models.JSONField(
         blank=True,
         default=dict,
diff --git a/src/backend/core/tests/rooms/test_api_rooms_retrieve.py b/src/backend/core/tests/rooms/test_api_rooms_retrieve.py
index ebc9e7d5..50dd1bc4 100644
--- a/src/backend/core/tests/rooms/test_api_rooms_retrieve.py
+++ b/src/backend/core/tests/rooms/test_api_rooms_retrieve.py
@@ -28,6 +28,7 @@ def test_api_rooms_retrieve_anonymous_private_pk():
 
     assert response.status_code == 200
     assert response.json() == {
+        "configuration": {},
         "access_level": "restricted",
         "id": str(room.id),
         "is_administrable": False,
@@ -47,6 +48,7 @@ def test_api_rooms_retrieve_anonymous_trusted_pk():
 
     assert response.status_code == 200
     assert response.json() == {
+        "configuration": {},
         "access_level": "trusted",
         "id": str(room.id),
         "is_administrable": False,
@@ -65,6 +67,7 @@ def test_api_rooms_retrieve_anonymous_private_pk_no_dashes():
 
     assert response.status_code == 200
     assert response.json() == {
+        "configuration": {},
         "access_level": "restricted",
         "id": str(room.id),
         "is_administrable": False,
@@ -81,6 +84,7 @@ def test_api_rooms_retrieve_anonymous_private_slug():
 
     assert response.status_code == 200
     assert response.json() == {
+        "configuration": {},
         "access_level": "restricted",
         "id": str(room.id),
         "is_administrable": False,
@@ -97,6 +101,7 @@ def test_api_rooms_retrieve_anonymous_private_slug_not_normalized():
 
     assert response.status_code == 200
     assert response.json() == {
+        "configuration": {},
         "access_level": "restricted",
         "id": str(room.id),
         "is_administrable": False,
@@ -200,6 +205,7 @@ def test_api_rooms_retrieve_anonymous_public(mock_token):
     assert response.status_code == 200
     expected_name = f"{room.id!s}"
     assert response.json() == {
+        "configuration": {},
         "access_level": str(room.access_level),
         "id": str(room.id),
         "is_administrable": False,
@@ -246,6 +252,7 @@ def test_api_rooms_retrieve_authenticated_public(mock_token):
 
     expected_name = f"{room.id!s}"
     assert response.json() == {
+        "configuration": {"can_publish_sources": ["camera"]},
         "access_level": str(room.access_level),
         "id": str(room.id),
         "is_administrable": False,
@@ -297,6 +304,7 @@ def test_api_rooms_retrieve_authenticated_trusted(mock_token):
 
     expected_name = f"{room.id!s}"
     assert response.json() == {
+        "configuration": {},
         "access_level": str(room.access_level),
         "id": str(room.id),
         "is_administrable": False,
@@ -338,6 +346,7 @@ def test_api_rooms_retrieve_authenticated():
     assert response.status_code == 200
 
     assert response.json() == {
+        "configuration": {},
         "access_level": "restricted",
         "id": str(room.id),
         "is_administrable": False,
@@ -383,6 +392,7 @@ def test_api_rooms_retrieve_members(mock_token, django_assert_num_queries, setti
 
     expected_name = str(room.id)
     assert content_dict == {
+        "configuration": {"can_publish_sources": ["camera"]},
         "access_level": str(room.access_level),
         "id": str(room.id),
         "is_administrable": False,