From ac720d7ad4c627d7bb7547a2ab3fddcb03500daa Mon Sep 17 00:00:00 2001
From: lebaudantoine <lebaud.antoine131@gmail.com>
Date: Sun, 28 Sep 2025 22:18:03 +0200
Subject: [PATCH] wip

---
 src/backend/core/api/serializers.py           | 46 -------------------
 .../core/external_api/authentication.py       |  4 ++
 src/backend/core/external_api/serializers.py  |  5 +-
 3 files changed, 5 insertions(+), 50 deletions(-)

diff --git a/src/backend/core/api/serializers.py b/src/backend/core/api/serializers.py
index 5b16c3cc..3b0743e4 100644
--- a/src/backend/core/api/serializers.py
+++ b/src/backend/core/api/serializers.py
@@ -301,49 +301,3 @@ class UpdateParticipantSerializer(BaseParticipantsManagementSerializer):
                 ) from e
 
         return attrs
-
-
-class IntegrationJwtSerializer(BaseValidationOnlySerializer):
-    """Validate room creation callback data."""
-
-    email = serializers.EmailField(required=True)
-
-
-class IntegrationRoomSerializer(serializers.ModelSerializer):
-    """Serialize Room model for the API."""
-
-    class Meta:
-        model = models.Room
-        fields = ["id", "name", "slug", "configuration", "access_level", "pin_code"]
-        read_only_fields = ["id", "slug", "pin_code"]
-
-    def to_representation(self, instance):
-        """
-        Add users only for administrator users.
-        Add LiveKit credentials for public instance or related users/groups
-        """
-        output = super().to_representation(instance)
-        request = self.context.get("request")
-
-        if not request:
-            return output
-
-        role = instance.get_role(request.user)
-        is_admin_or_owner = models.RoleChoices.check_administrator_role(
-            role
-        ) or models.RoleChoices.check_owner_role(role)
-
-        if is_admin_or_owner:
-            access_serializer = NestedResourceAccessSerializer(
-                instance.accesses.select_related("resource", "user").all(),
-                context=self.context,
-                many=True,
-            )
-            output["accesses"] = access_serializer.data
-
-        if not is_admin_or_owner:
-            del output["configuration"]
-
-        output["is_administrable"] = is_admin_or_owner
-
-        return output
diff --git a/src/backend/core/external_api/authentication.py b/src/backend/core/external_api/authentication.py
index dcbc4491..b9e2f758 100644
--- a/src/backend/core/external_api/authentication.py
+++ b/src/backend/core/external_api/authentication.py
@@ -47,10 +47,14 @@ class IntegrationJWTAuthentication(authentication.BaseAuthentication):
                 token,
                 settings.INTEGRATIONS_JWT_SECRET_KEY,
                 algorithms=[settings.INTEGRATIONS_JWT_ALG],
+                issuer=settings.INTEGRATIONS_JWT_ISSUER,
             )
         except jwt.ExpiredSignatureError as e:
             logger.error("Token expired")
             raise exceptions.AuthenticationFailed("Token expired.") from e
+        except jwt.InvalidIssuerError as e:
+            logger.error("Invalid JWT issuer: %s", e)
+            raise exceptions.AuthenticationFailed("Invalid token.") from e
         except jwt.InvalidTokenError as e:
             logger.error("Invalid JWT token: %s", e)
             raise exceptions.AuthenticationFailed("Invalid token.") from e
diff --git a/src/backend/core/external_api/serializers.py b/src/backend/core/external_api/serializers.py
index 5c77109e..b34e13c3 100644
--- a/src/backend/core/external_api/serializers.py
+++ b/src/backend/core/external_api/serializers.py
@@ -25,10 +25,7 @@ class RoomSerializer(serializers.ModelSerializer):
         read_only_fields = ["id", "name", "slug", "pin_code", "access_level"]
 
     def to_representation(self, instance):
-        """
-        Add users only for administrator users.
-        Add LiveKit credentials for public instance or related users/groups
-        """
+        """Wip."""
         output = super().to_representation(instance)
         request = self.context.get("request")