wip enhancements

src/backend/core/api/viewsets.py

@@ -281,9 +281,23 @@ class RoomViewSet(
 
     def perform_create(self, serializer):
         """Set the current user as owner of the newly created room."""
+        encryption_mode = serializer.validated_data.get("encryption_mode", models.EncryptionMode.NONE)
+
+        # Block encrypted room creation if encryption is not enabled on this instance
+        if encryption_mode != models.EncryptionMode.NONE and not settings.ENCRYPTION_ENABLED:
+            raise drf_exceptions.ValidationError(
+                {"encryption_mode": "Encryption is not enabled on this server."}
+            )
+
+        # Advanced encryption requires the vault service to be configured
+        if encryption_mode == models.EncryptionMode.ADVANCED and not getattr(settings, 'ENCRYPTION_VAULT_URL', ''):
+            raise drf_exceptions.ValidationError(
+                {"encryption_mode": "Advanced encryption requires the encryption service to be configured."}
+            )
+
         # Encrypted rooms must use restricted access to enforce lobby approval
         # before the encryption key is shared with participants.
-        if serializer.validated_data.get("encryption_mode", models.EncryptionMode.NONE) != models.EncryptionMode.NONE:
+        if encryption_mode != models.EncryptionMode.NONE:
             serializer.validated_data["access_level"] = models.RoomAccessLevel.RESTRICTED
 
         room = serializer.save()

src/backend/core/services/lobby.py

@@ -139,11 +139,16 @@ class LobbyService:
         1. The room is public (open to everyone)
         2. The room has TRUSTED access level and the user is authenticated
 
+        Encrypted rooms never bypass the lobby — participants must go through
+        the lobby key exchange to receive the encryption key.
+
         Note: Room access levels can change while participants are waiting in the lobby.
         This function only checks the current state and should be called each time
         a participant requests entry to ensure consistent access control, even for
         participants who have already begun waiting.
         """
+        if hasattr(room, 'encryption_mode') and room.encryption_mode != 'none':
+            return False
         return room.is_public or (
             room.access_level == models.RoomAccessLevel.TRUSTED
             and user.is_authenticated

src/backend/core/utils.py

@@ -93,9 +93,9 @@ def generate_token(
     if sources is None:
         sources = settings.LIVEKIT_DEFAULT_SOURCES
 
-    # In encrypted rooms, authenticated users cannot change their name/metadata
-    # to prevent identity spoofing in the LiveKit room.
-    can_update_metadata = encryption_mode == 'none' or user.is_anonymous
+    # In encrypted rooms, no one can change their name/metadata to prevent
+    # identity spoofing — the admin accepted them based on their declared identity.
+    can_update_metadata = encryption_mode == 'none'
 
     video_grants = VideoGrants(
         room=room,

src/backend/meet/settings.py

@@ -561,12 +561,12 @@ class Base(Configuration):
         "returnTo", environ_name="OIDC_REDIRECT_FIELD_NAME", environ_prefix=None
     )
     OIDC_USERINFO_FULLNAME_FIELDS = values.ListValue(
-        default=["given_name", "usual_name", "family_name"],
+        default=["first_name", "last_name"],
         environ_name="OIDC_USERINFO_FULLNAME_FIELDS",
         environ_prefix=None,
     )
     OIDC_USERINFO_SHORTNAME_FIELD = values.Value(
-        default="given_name",
+        default="first_name",
         environ_name="OIDC_USERINFO_SHORTNAME_FIELD",
         environ_prefix=None,
     )