From fad0195d8112a061ecac4e8168dea019eb8f445d Mon Sep 17 00:00:00 2001
From: Cas Lubbers <clubbers@akamai.com>
Date: Thu, 20 Aug 2026 16:49:02 +0200
Subject: [PATCH 1/3] fix: update user ID reference to UUID in API definitions

---
 src/openapi/api.yaml         | 2 +-
 src/openapi/definitions.yaml | 5 +++++
 2 files changed, 6 insertions(+), 1 deletion(-)

diff --git a/src/openapi/api.yaml b/src/openapi/api.yaml
index d595675e..187a5256 100644
--- a/src/openapi/api.yaml
+++ b/src/openapi/api.yaml
@@ -2146,7 +2146,7 @@ components:
       description: ID of the user
       required: true
       schema:
-        $ref: 'definitions.yaml#/idName'
+        $ref: 'definitions.yaml#/uuid'
     catalogParams:
       name: catalogId
       in: path
diff --git a/src/openapi/definitions.yaml b/src/openapi/definitions.yaml
index 375d8ff2..df8cb85c 100644
--- a/src/openapi/definitions.yaml
+++ b/src/openapi/definitions.yaml
@@ -622,6 +622,11 @@ idName:
   type: string
   x-message: a valid name that consists of lowercase letters, dashes
   example: team-name
+uuid:
+  pattern: '^[0-9a-fA-F]{8}-[0-9a-fA-F]{4}-[0-9a-fA-F]{4}-[0-9a-fA-F]{4}-[0-9a-fA-F]{12}$'
+  type: string
+  x-message: a valid UUID
+  example: 8dd15e48-e30e-4788-9709-724f8ba625c7
 settingsName:
   pattern: '^[a-z](?:[-a-zA-Z0-9]{0,61}[a-zA-Z0-9])?$'
   maxLength: 63

From 73746f21ec9bdd76ef54cb834daedb76cbb9f33e Mon Sep 17 00:00:00 2001
From: Cas Lubbers <clubbers@akamai.com>
Date: Thu, 20 Aug 2026 16:57:49 +0200
Subject: [PATCH 2/3] fix: tests

---
 src/api.authz.test.ts | 8 ++++----
 1 file changed, 4 insertions(+), 4 deletions(-)

diff --git a/src/api.authz.test.ts b/src/api.authz.test.ts
index c8aa2df7..3c94e93d 100644
--- a/src/api.authz.test.ts
+++ b/src/api.authz.test.ts
@@ -249,7 +249,7 @@ describe('API authz tests', () => {
       jest.spyOn(otomiStack, 'editUser').mockResolvedValue(mockUser as any)
 
       await agent
-        .put('/v1/users/user1')
+        .put('/v1/users/6383AB9D-3C42-4650-B8D8-4E58D0E97FEE')
         .send({ ...userData })
         .set('Authorization', `Bearer ${platformAdminToken}`)
         .expect(200)
@@ -259,8 +259,8 @@ describe('API authz tests', () => {
       jest.spyOn(otomiStack, 'deleteUser').mockResolvedValue({} as any)
 
       await agent
-        .delete('/v1/users/user1')
-        .send({ id: 'user1' })
+        .delete('/v1/users/6383AB9D-3C42-4650-B8D8-4E58D0E97FEE')
+        .send({ id: '6383AB9D-3C42-4650-B8D8-4E58D0E97FEE' })
         .set('Authorization', `Bearer ${platformAdminToken}`)
         .expect(200)
     })
@@ -300,7 +300,7 @@ describe('API authz tests', () => {
     test('team admin cannot delete users', async () => {
       await agent
         .delete('/v1/users/user1')
-        .send({ id: 'user1' })
+        .send({ id: 'A4E3926E-19AA-464D-B631-02B85609E91F' })
         .set('Authorization', `Bearer ${teamAdminToken}`)
         .expect(403)
     })

From 72488342f2929710c9e9a30e21bfe471790c91ab Mon Sep 17 00:00:00 2001
From: Cas Lubbers <clubbers@akamai.com>
Date: Thu, 20 Aug 2026 17:15:31 +0200
Subject: [PATCH 3/3] fix: tests

---
 src/patterns.test.ts | 23 +++++++++++++++++++++++
 1 file changed, 23 insertions(+)

diff --git a/src/patterns.test.ts b/src/patterns.test.ts
index 98206311..1d8eab4b 100644
--- a/src/patterns.test.ts
+++ b/src/patterns.test.ts
@@ -122,6 +122,8 @@ const redosCases: Record<string, string[]> = {
 
   url: [`https://${'a.'.repeat(50_000)}!`, `https://example.com/${'a/'.repeat(50_000)}!`],
 
+  uuid: [`${'0'.repeat(100_000)}!`, `${'0-'.repeat(50_000)}!`],
+
   wildcardDomainOrIp: [`${'a.'.repeat(50_000)}!`, `${'a:'.repeat(50_000)}!`],
 
   imageRegistry: [`${'a.'.repeat(50_000)}!`, `${'a/'.repeat(50_000)}!`],
@@ -387,6 +389,27 @@ describe('OpenAPI definition regex patterns', () => {
     })
   })
 
+  describe('uuid', () => {
+    it('accepts valid UUIDs', () => {
+      expectValid('uuid', [
+        '8dd15e48-e30e-4788-9709-724f8ba625c7',
+        '00000000-0000-0000-0000-000000000000',
+        'FFFFFFFF-FFFF-FFFF-FFFF-FFFFFFFFFFFF',
+      ])
+    })
+
+    it('rejects malformed UUIDs', () => {
+      expectInvalid('uuid', [
+        '',
+        '8dd15e48e30e47889709724f8ba625c7',
+        '8dd15e48-e30e-4788-9709-724f8ba625c',
+        '8dd15e48-e30e-4788-9709-724f8ba625c77',
+        'zdd15e48-e30e-4788-9709-724f8ba625c7',
+        '8dd15e48_e30e_4788_9709_724f8ba625c7',
+      ])
+    })
+  })
+
   describe('wildcardDomainOrIp', () => {
     it('accepts supported domains and approximate IPv6 values', () => {
       expectValid('wildcardDomainOrIp', ['example.com', '*.example.com', '2001:db8:0:0:0:0:0:1'])