🐛(backend) allow any string as sub in the API serializer

The API serializer was too restrictive on the `sub` field, expecting
a UUID. This worked in our development and production setups because
our Keycloak is configured to emit UUID subs, but it broke for other
providers.

Per the OIDC spec and the DB model, `sub` can be any string. Align
the serializer with this and accept arbitrary string values.

Fixes #1525.

src/backend/core/api/serializers.py

@@ -297,8 +297,8 @@ class RoomInviteSerializer(serializers.Serializer):
 class BaseParticipantsManagementSerializer(BaseValidationOnlySerializer):
     """Base serializer for participant management operations."""
 
-    participant_identity = serializers.UUIDField(
-        help_text="LiveKit participant identity (UUID format)"
+    participant_identity = serializers.CharField(
+        help_text="LiveKit participant identity (matching the user's sub format)"
     )
 
 

src/backend/core/tests/rooms/test_api_rooms_participants_management.py

@@ -719,13 +719,13 @@ def test_update_participant_invalid_payload():
     )
     client.force_authenticate(user=user)
 
-    payload = {"participant_identity": "invalid-uuid"}
+    payload = {"participant_identity": ["test"]}
 
     url = reverse("rooms-update-participant", kwargs={"pk": room.id})
     response = client.post(url, payload, format="json")
 
     assert response.status_code == status.HTTP_400_BAD_REQUEST
-    assert "Must be a valid UUID." in str(response.data)
+    assert "Not a valid string." in str(response.data)
 
 
 def test_update_participant_no_update_fields():
@@ -918,7 +918,7 @@ def test_remove_participant_invalid_payload():
     )
     client.force_authenticate(user=user)
 
-    payload = {"participant_identity": "invalid-uuid"}
+    payload = {"participant_identity": ["invalid-uuid"]}
 
     url = reverse("rooms-remove-participant", kwargs={"pk": room.id})
     response = client.post(url, payload, format="json")