mirror of
https://github.com/suitenumerique/meet.git
synced 2026-08-04 07:57:41 +00:00
lebaudantoine
f8c6da8021
Apply strict permission validation on the external API room endpoint to enforce the principle of least privilege. Unlike the default API (which allows unauthenticated room retrieval and filters access in the serializer), the external API now only exposes rooms to users with explicit permissions. This change fixes a security issue. Slug-based room retrieval, as supported by the default API, is not introduced here but could be added later if needed. Retrieving rooms by UUID is retained, as guessing a UUID is significantly harder than a slug. A dedicated permission class was created to avoid coupling permissions between the default and external APIs. The external API enforces stricter access rules. Access policies may be revisited based on user and integrator feedback. The external API currently has no production usage.