From ffdb8a56d31946616e5fc6433d65c3f3b0b56b30 Mon Sep 17 00:00:00 2001 From: lebaudantoine Date: Mon, 27 Jul 2026 19:29:42 +0200 Subject: [PATCH] =?UTF-8?q?=F0=9F=90=9B(backend)=20allow=20any=20string=20?= =?UTF-8?q?as=20sub=20in=20the=20API=20serializer?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit The API serializer was too restrictive on the `sub` field, expecting a UUID. This worked in our development and production setups because our Keycloak is configured to emit UUID subs, but it broke for other providers. Per the OIDC spec and the DB model, `sub` can be any string. Align the serializer with this and accept arbitrary string values. Fixes #1525. --- src/backend/core/api/serializers.py | 4 ++-- .../tests/rooms/test_api_rooms_participants_management.py | 6 +++--- 2 files changed, 5 insertions(+), 5 deletions(-) diff --git a/src/backend/core/api/serializers.py b/src/backend/core/api/serializers.py index fff4c337..315f8900 100644 --- a/src/backend/core/api/serializers.py +++ b/src/backend/core/api/serializers.py @@ -297,8 +297,8 @@ class RoomInviteSerializer(serializers.Serializer): class BaseParticipantsManagementSerializer(BaseValidationOnlySerializer): """Base serializer for participant management operations.""" - participant_identity = serializers.UUIDField( - help_text="LiveKit participant identity (UUID format)" + participant_identity = serializers.CharField( + help_text="LiveKit participant identity (matching the user's sub format)" ) diff --git a/src/backend/core/tests/rooms/test_api_rooms_participants_management.py b/src/backend/core/tests/rooms/test_api_rooms_participants_management.py index 1aa0a74f..5c00bd00 100644 --- a/src/backend/core/tests/rooms/test_api_rooms_participants_management.py +++ b/src/backend/core/tests/rooms/test_api_rooms_participants_management.py @@ -719,13 +719,13 @@ def test_update_participant_invalid_payload(): ) client.force_authenticate(user=user) - payload = {"participant_identity": "invalid-uuid"} + payload = {"participant_identity": ["test"]} url = reverse("rooms-update-participant", kwargs={"pk": room.id}) response = client.post(url, payload, format="json") assert response.status_code == status.HTTP_400_BAD_REQUEST - assert "Must be a valid UUID." in str(response.data) + assert "Not a valid string." in str(response.data) def test_update_participant_no_update_fields(): @@ -918,7 +918,7 @@ def test_remove_participant_invalid_payload(): ) client.force_authenticate(user=user) - payload = {"participant_identity": "invalid-uuid"} + payload = {"participant_identity": ["invalid-uuid"]} url = reverse("rooms-remove-participant", kwargs={"pk": room.id}) response = client.post(url, payload, format="json")