fix: update user ID reference to UUID in API definitions

[CasLubbers]

No description provided.

[Copilot]

Pull request overview

Updates the OpenAPI specification to treat userId path parameters as UUIDs (instead of the existing idName string pattern), improving alignment between the API contract and a UUID-based user identifier.

Changes:

• Added a reusable uuid schema to definitions.yaml (string + UUID regex + example).
• Updated the userParams parameter schema reference to use definitions.yaml#/uuid.

Reviewed changes

Copilot reviewed 2 out of 2 changed files in this pull request and generated 1 comment.

File	Description
src/openapi/definitions.yaml	Adds a shared uuid schema definition for reuse across the spec.
src/openapi/api.yaml	Switches userParams path parameter validation from idName to uuid.

---

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.

[Copilot]

Pull request overview

Copilot reviewed 3 out of 3 changed files in this pull request and generated no new comments.

Suppressed comments (2)

src/openapi/api.yaml:2149

• Since userId is now constrained to a UUID schema, the parameter description should reflect that to avoid confusing API consumers.

      description: ID of the user
      required: true
      schema:
        $ref: 'definitions.yaml#/uuid'

src/api.authz.test.ts:303

• This test still uses a non-UUID path parameter (/v1/users/user1) while the OpenAPI spec now validates userId against definitions.yaml#/uuid. With express-openapi-validator in the request pipeline, this request will likely be rejected with a 400 before authorization is checked, so the test may no longer assert the intended 403 behavior. Use a UUID in the path (and keep it consistent with the body).

        .delete('/v1/users/user1')
        .send({ id: 'A4E3926E-19AA-464D-B631-02B85609E91F' })

[Copilot]

Pull request overview

Copilot reviewed 4 out of 4 changed files in this pull request and generated no new comments.

Suppressed comments (1)

src/api.authz.test.ts:302

• This test mixes a legacy user ID in the path (/v1/users/user1) with a UUID in the request body. Since the OpenAPI userId path parameter now references the uuid schema, this request would likely be rejected at request validation (400) before authz is evaluated (403). Use the same UUID in the path here (and consider updating other remaining /v1/users/user1 usages in this file for consistency with the new schema).

        .delete('/v1/users/user1')