🔒️(backend) throttle the start recording endpoint

Each recording start writes a Recording row and spins up a recording worker, so a user or buggy client hammering the endpoint is costly even when the calls end in a conflict or a worker failure. Throttle it per authenticated user, mirroring room creation: a short-term limit of 10/minute absorbs bursts and a daily cap of 100/day bounds sustained use. Both are configurable via START_RECORDING_THROTTLE_RATES and START_RECORDING_DAILY_THROTTLE_RATES. Only starting a recording is throttled, as it is the costly action. Stopping a recording only releases resources, so it is left unthrottled and a throttled user can always stop an ongoing recording.
2026-10-14 00:50:48 +00:00 · 2026-10-14 00:02:43 +02:00
29 changed files with 321 additions and 782 deletions
@@ -11,7 +11,7 @@ and this project adheres to
 ### Added

 - ⚡️(backend) add UPPER(email) index for case-insensitive user lookups
- ✨(all) allow any authenticated user to start a recording
+- 🔒️(backend) throttle the start recording endpoint

 ## [1.35.0] - 2026-10-13

@@ -16,13 +16,6 @@ the following command inside your docker container:

 ## [Unreleased]

-### Recording permission
-
-We've introduced the ability for any authenticated participant to start a recording or transcription, but this behavior remains configurable.
-You can keep recording and transcription restricted to room admins and owners by setting `RECORDING_AUTHENTICATED_PARTICIPANTS_ENABLED` to `false`.
-
-## [v1.34.0]
-
 ### Marketing / Brevo integration now uses `django-lasuite`

 The in-house marketing service (`core.services.marketing`) has been removed and
@@ -3,7 +3,7 @@

 La Suite Meet offers a room recording feature that is currently in beta, with ongoing improvements planned. 

-The feature allows users to record their room sessions. When a recording is complete, the user who started it and the room's owners and administrators receive a notification with a link to download the recorded file. The transcript summary is sent to the user who started the recording. Recordings are automatically deleted after `RECORDING_EXPIRATION_DAYS`.
+The feature allows users to record their room sessions. When a recording is complete, the room owner receives a notification with a link to download the recorded file. Recordings are automatically deleted after `RECORDING_EXPIRATION_DAYS`.

 It uses LiveKit Egress to record room sessions. For reference, see the [LiveKit Egress repository](https://github.com/livekit/egress) and the [official documentation](https://docs.livekit.io/home/egress/overview/).

@@ -89,7 +89,6 @@ sequenceDiagram
 | Option                                  | Type        | Default                                                                                                                                                            | Description                                                                                                                                                                                                                                                                                        |
 | --------------------------------------- | ----------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------ |----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|
 | **RECORDING_ENABLE**                    | Boolean     | `False`                                                                                                                                                            | Enable or disable the room recording feature.                                                                                                                                                                                                                                                      |
-| **RECORDING_AUTHENTICATED_PARTICIPANTS_ENABLED**| Boolean     | `True`                                                                                                                                                             | When enabled, any authenticated participant currently connected to a room with the `trusted` or `public` access level can start and stop recordings. When disabled, only room admins and owners can. On `restricted` rooms, only admins and owners can record.                                     |
 | **RECORDING_OUTPUT_FOLDER**             | String      | `"recordings"`                                                                                                                                                     | Folder/prefix where recordings are stored in the object storage.                                                                                                                                                                                                                                   |
 | **RECORDING_WORKER_CLASSES**            | Dict        | `{ "screen_recording": "core.recording.worker.services.VideoCompositeEgressService", "transcript": "core.recording.worker.services.AudioCompositeEgressService" }` | Maps recording types to their worker service classes.                                                                                                                                                                                                                                              |
 | **RECORDING_EXPIRATION_DAYS**           | Integer     | `None`                                                                                                                                                             | Number of days before recordings expire. Should match bucket lifecycle policy. Set to `None` for no expiration.                                                                                                                                                                                    |
@@ -335,6 +335,8 @@ These are the environmental options available on meet backend.
 | SESSION_COOKIE_AGE                              | Session cookie expiration in seconds                                                                                                                         | 43200 (12 hours)                                                                                                                                             |
 | ROOM_CREATION_THROTTLE_RATES                    | Room creation throttle rate per authenticated user | 50/minute                                                                                               | 50/minute                                                                                                                                                    |
 | ROOM_CREATION_DAILY_THROTTLE_RATES              | Daily room creation cap per authenticated user                                                                                                               | 1000/day                                                                                                                                                     |
+| START_RECORDING_THROTTLE_RATES                  | Recording start throttle rate per authenticated user                                                                                                         | 10/minute                                                                                                                                                    |
+| START_RECORDING_DAILY_THROTTLE_RATES            | Daily recording start cap per authenticated user                                                                                                             | 100/day                                                                                                                                                      |
 | REQUEST_ENTRY_THROTTLE_RATES                    | Entry request throttle rates                                                                                                                                 | 150/minute                                                                                                                                                   |
 | CREATION_CALLBACK_THROTTLE_RATES                | Creation callback throttle rates                                                                                                                             | 600/minute                                                                                                                                                   |
 | SPECTACULAR_SETTINGS_ENABLE_DJANGO_DEPLOY_CHECK | Enable Django deploy check                                                                                                                                   | false                                                                                                                                                        |
@@ -409,7 +411,6 @@ These are the environmental options available on meet backend.
 | ALLOW_UNREGISTERED_ROOMS                        | Allow usage of unregistered rooms                                                                                                                            | true                                                                                                                                                         |
 | ROOM_INACTIVITY_DELETION_DAYS                   | Days without being started after which a room is purged. Unset to never purge                                                                                |                                                                                                                                                              |
 | RECORDING_ENABLE                                | Record meeting option                                                                                                                                        | false                                                                                                                                                        |
-| RECORDING_AUTHENTICATED_PARTICIPANTS_ENABLED    | Let any authenticated participant connected to a trusted or public room start/stop recordings. Set to false to reserve recording to room admins/owners       | true                                                                                                                                                         |
 | RECORDING_OUTPUT_FOLDER                         | Folder to store meetings                                                                                                                                     | recordings                                                                                                                                                   |
 | RECORDING_WORKER_CLASSES                        | Worker classes for recording                                                                                                                                 | {"screen_recording": "core.recording.worker.services.VideoCompositeEgressService","transcript": "core.recording.worker.services.AudioCompositeEgressService"} |
 | RECORDING_EXPIRATION_DAYS                       | Recording expiration in days                                                                                                                                 |                                                                                                                                                              |
@@ -55,9 +55,6 @@ def get_frontend_configuration(request):
                "default_resolution": settings.RECORDING_ENCODING_DEFAULT_RESOLUTION,
                "default_profile": settings.RECORDING_ENCODING_DEFAULT_PROFILE,
            },
-            "authenticated_participants_enabled": (
-                settings.RECORDING_AUTHENTICATED_PARTICIPANTS_ENABLED
-            ),
        },
        "background_image": {
            "upload_is_enabled": settings.FILE_UPLOAD_ENABLED,
@@ -187,29 +187,29 @@ class IsPresentInMeeting(permissions.BasePermission):
            return False


-class ParticipantCapability(permissions.BasePermission):
-    """Base permission for in-meeting capabilities opened up to participants.
+class CanManageLobby(permissions.BasePermission):
+    """Grant lobby management (list/accept/deny waiting participants).

-    - Room admins/owners always hold the capability.
-    -  When the room access level is TRUSTED or PUBLIC, any
-      session-authenticated user who is currently connected to the meeting
-      holds it too.
+    - Room admins/owners can always manage the lobby.
+    - When the room access level is TRUSTED, any authenticated user who is
+      currently connected to the meeting can manage the lobby. Presence is
+      verified cache-first (Redis), falling back to the LiveKit API.

    Access level is always read fresh from the DB; only presence is cached,
-    so changing the room access level takes effect immediately.
+    so changing the room to RESTRICTED takes effect immediately.
    """

-    message = "You are not allowed to perform this action."
-    enabled_setting = None
+    message = "You are not allowed to manage this room's lobby."

-    def has_object_permission(self, request, view, obj):
-        """Check privileges first, then the participant presence path."""
+    # pylint: disable=too-many-return-statements
+    def has_object_permission(self, request, view, obj):  # noqa: PLR0911
+        """Check privileges first, then the trusted-room presence path."""
        user = request.user

        if not user or not user.is_authenticated:
            return False

-        # Product choice: these capabilities are reserved for session-authenticated
+        # Product choice: lobby management is reserved for session-authenticated
        # users with a real account, not holders of a LiveKit room token.
        if request.auth and hasattr(request.auth, "video"):
            return False
@@ -217,31 +217,16 @@ class ParticipantCapability(permissions.BasePermission):
        if obj.is_administrator_or_owner(user):
            return True

-        is_open_room = obj.access_level in (
-            RoomAccessLevel.TRUSTED,
-            RoomAccessLevel.PUBLIC,
-        )
-        is_enabled = not self.enabled_setting or getattr(settings, self.enabled_setting)
-        if not (is_open_room and is_enabled):
+        if obj.access_level != RoomAccessLevel.TRUSTED:
            return False

+        self.message = "You must be connected to the meeting to manage its lobby."
+
        try:
            return ParticipantsManagement().check_if_in_meeting_cached(
                room_name=str(obj.pk), identity=str(user.sub)
            )
-        except (ParticipantNotFoundException, ParticipantsManagementException):
+        except ParticipantNotFoundException:
+            return False
+        except ParticipantsManagementException:
            return False
-
-
-class CanManageLobby(ParticipantCapability):
-    """Grant lobby management (list/accept/deny waiting participants).
-
-    Public rooms have no lobby: the endpoints short-circuit there, so opening
-    them to participants exposes nothing.
-    """
-
-
-class CanManageRecording(ParticipantCapability):
-    """Grant starting/stopping a room recording (screen recording or transcript)."""
-
-    enabled_setting = "RECORDING_AUTHENTICATED_PARTICIPANTS_ENABLED"
@@ -47,6 +47,18 @@ class RoomCreationDailyUserRateThrottle(RoomCreationUserRateThrottle):
    scope = "room_creation_daily"


+class StartRecordingUserRateThrottle(MonitoredUserRateThrottle):
+    """Throttle recording starts per authenticated user."""
+
+    scope = "start_recording"
+
+
+class StartRecordingDailyUserRateThrottle(StartRecordingUserRateThrottle):
+    """Cap recording starts per authenticated user over a day."""
+
+    scope = "start_recording_daily"
+
+
 class RequestEntryAuthenticatedUserRateThrottle(MonitoredUserRateThrottle):
    """Throttle authenticated user requesting room entry"""

@@ -404,7 +404,11 @@ class RoomViewSet(
        methods=["post"],
        url_path="start-recording",
        permission_classes=[
-            permissions.CanManageRecording,
+            permissions.HasPrivilegesOnRoom,
+        ],
+        throttle_classes=[
+            throttling.StartRecordingUserRateThrottle,
+            throttling.StartRecordingDailyUserRateThrottle,
        ],
    )
    @FeatureFlag.require("recording")
@@ -437,7 +441,11 @@ class RoomViewSet(
                    mode=mode,
                    options=options_data,
                )
-                recording.grant_initial_accesses(starter=self.request.user)
+                models.RecordingAccess.objects.create(
+                    user=self.request.user,
+                    role=models.RoleChoices.OWNER,
+                    recording=recording,
+                )

        except (DjangoValidationError, IntegrityError):
            # DjangoValidationError covers the Python-level check (full_clean);
@@ -481,7 +489,7 @@ class RoomViewSet(
        methods=["post"],
        url_path="stop-recording",
        permission_classes=[
-            permissions.CanManageRecording,
+            permissions.HasPrivilegesOnRoom,
        ],
    )
    @FeatureFlag.require("recording")
@@ -693,29 +693,6 @@ class Recording(BaseModel):
            "update": False,
        }

-    def grant_initial_accesses(self, starter):
-        """Make the starter and the room's owners/administrators OWNER of the recording.
-
-        The starter's access is created first, so it is the oldest one: the
-        transcript summary, which goes to a single owner, is sent to them.
-
-        Room roles are copied when the recording starts: later changes to the
-        room's accesses do not affect existing recordings.
-        """
-        RecordingAccess.objects.create(
-            user=starter, role=RoleChoices.OWNER, recording=self
-        )
-
-        room_privileged_user_ids = (
-            self.room.accesses.filter(role__in=[RoleChoices.OWNER, RoleChoices.ADMIN])
-            .exclude(user=starter)
-            .values_list("user_id", flat=True)
-        )
-        RecordingAccess.objects.bulk_create(
-            RecordingAccess(user_id=user_id, role=RoleChoices.OWNER, recording=self)
-            for user_id in room_privileged_user_ids
-        )
-
    def is_savable(self) -> bool:
        """Determine if the recording can be saved based on its current status."""

@@ -207,23 +207,6 @@ class NotificationService:
            f"Unknown summary service version: {settings.SUMMARY_SERVICE_VERSION}"
        )

-    @staticmethod
-    def _get_summary_recipient(recording: models.Recording):
-        """Return the single user who receives the transcript summary.
-
-        A recording can have several owners (its starter and the room's
-        owners/administrators), but the summary is generated once. It goes to
-        the oldest owner, which is the starter: their access is created first
-        (see `Recording.grant_initial_accesses`).
-        """
-        oldest_owner_access = (
-            models.RecordingAccess.objects.select_related("user")
-            .filter(role=models.RoleChoices.OWNER, recording_id=recording.id)
-            .order_by("created_at")
-            .first()
-        )
-        return oldest_owner_access.user if oldest_owner_access else None
-
    @staticmethod
    def _notify_summary_service_v1(recording: models.Recording):
        """Notify summary service about a new recording."""
@@ -235,7 +218,14 @@ class NotificationService:
            logger.error("Summary service not configured")
            return False

-        recipient = NotificationService._get_summary_recipient(recording)
+        owner_access = (
+            models.RecordingAccess.objects.select_related("user")
+            .filter(
+                role=models.RoleChoices.OWNER,
+                recording_id=recording.id,
+            )
+            .first()
+        )

        if settings.METADATA_COLLECTOR_ENABLED and recording.options.get(
            "collect_metadata", False
@@ -245,7 +235,7 @@ class NotificationService:
        else:
            metadata_filename = None

-        if not recipient:
+        if not owner_access:
            logger.error("No owner found for recording %s", recording.id)
            return False

@@ -254,16 +244,16 @@ class NotificationService:
        )(recording.worker_id)

        payload = {
-            "owner_id": str(recipient.id),
+            "owner_id": str(owner_access.user.id),
            "recording_filename": recording.key,
            "metadata_filename": metadata_filename,
-            "email": recipient.email,
-            "sub": recipient.sub,
+            "email": owner_access.user.email,
+            "sub": owner_access.user.sub,
            "room": recording.room.name,
            "language": recording.options.get("language"),
-            "owner_timezone": str(recipient.timezone),
+            "owner_timezone": str(owner_access.user.timezone),
            "download_link": f"{get_recording_download_base_url()}/{recording.id}",
-            "context_language": recipient.language,
+            "context_language": owner_access.user.language,
            "recording_start_at": (started_at.isoformat() if started_at else None),
            "recording_end_at": (ended_at.isoformat() if ended_at else None),
        }
@@ -303,7 +293,14 @@ class NotificationService:
            logger.error("Summary service not configured")
            return False

-        recipient = NotificationService._get_summary_recipient(recording)
+        owner_access = (
+            models.RecordingAccess.objects.select_related("user")
+            .filter(
+                role=models.RoleChoices.OWNER,
+                recording_id=recording.id,
+            )
+            .first()
+        )
        metadata_filename: None | str = None
        if settings.METADATA_COLLECTOR_ENABLED and recording.options.get(
            "collect_metadata", False
@@ -311,7 +308,7 @@ class NotificationService:
            output_folder = settings.METADATA_COLLECTOR_OUTPUT_FOLDER
            metadata_filename = f"{output_folder}/{recording.id}-metadata.json"

-        if not recipient:
+        if not owner_access:
            logger.error("No owner found for recording %s", recording.id)
            return False

@@ -338,8 +335,8 @@ class NotificationService:
            }

        payload = {
-            "user_sub": recipient.sub,
-            "user_email": recipient.email,
+            "user_sub": owner_access.user.sub,
+            "user_email": owner_access.user.email,
            "cloud_storage_url": generate_download_s3_url(
                recording.key,
                expires_in=settings.SUMMARY_SERVICE_CLOUD_STORAGE_SIGNED_URL_EXPIRY_SECONDS,
@@ -348,20 +345,20 @@ class NotificationService:
            "language": recording.options.get(
                "language", get_language().split("-")[0].lower()
            ),
-            "context_language": recipient.language,
+            "context_language": owner_access.user.language,
            "push_to_docs_config": {
-                "user_email": recipient.email,
+                "user_email": owner_access.user.email,
                "title": NotificationService._generate_title(
-                    locale=recipient.language
+                    locale=owner_access.user.language
                    or recording.options.get("language", get_language()),
                    room=recording.room.name,
                    recording_datetime=started_at,
-                    owner_timezone=str(recipient.timezone),
+                    owner_timezone=str(owner_access.user.timezone),
                ),
                "download_link": f"{get_recording_download_base_url()}/{recording.id}",
                "form_link": form_link,
                "auto_create_summary": is_user_feature_flag_enabled(
-                    recipient, UserFeatureFlag.TRANSCRIPT_SUMMARY_ENABLED
+                    owner_access.user, UserFeatureFlag.TRANSCRIPT_SUMMARY_ENABLED
                ),
            },
            "metadata": metadata_payload,
@@ -534,24 +534,3 @@ def test_notify_summary_service_v2_payload_json_serializable_without_timestamps(
    assert isinstance(title, str)
    # ...so the payload serializes exactly the way ``requests`` serializes it.
    json.dumps(payload)
-
-
-def test_summary_recipient_is_oldest_owner():
-    """With several owners, the summary goes to the oldest one."""
-    recording = factories.RecordingFactory()
-    oldest = factories.UserRecordingAccessFactory(
-        recording=recording, role=models.RoleChoices.OWNER
-    )
-    for _ in range(2):
-        factories.UserRecordingAccessFactory(
-            recording=recording, role=models.RoleChoices.OWNER
-        )
-
-    assert NotificationService._get_summary_recipient(recording) == oldest.user
-
-
-def test_summary_recipient_none_without_owner():
-    """No owner: nobody to send the summary to."""
-    recording = factories.RecordingFactory()
-
-    assert NotificationService._get_summary_recipient(recording) is None
@@ -974,19 +974,3 @@ def test_request_entry_accepts_signed_credential(generate_config, _notify):
    assert response.json()["livekit"] == {"token": "test-token"}
    generate_config.assert_called_once()
    assert generate_config.call_args.kwargs["participant_id"] == public_id
-
-
-@mock.patch(
-    "core.services.participants_management.ParticipantsManagement.check_if_in_meeting",
-    return_value=True,
-)
-def test_lobby_not_affected_by_recording_setting(mock_check, settings):
-    """The recording opt-out must not leak into the lobby capability."""
-    settings.RECORDING_AUTHENTICATED_PARTICIPANTS_ENABLED = False
-    room = RoomFactory(access_level=RoomAccessLevel.TRUSTED)
-    user = UserFactory()
-    client = APIClient()
-    client.force_login(user)
-    response = client.get(f"/api/v1.0/rooms/{room.id}/waiting-participants/")
-
-    assert response.status_code == 200
@@ -1,380 +0,0 @@
-"""Trusted and public rooms: any authenticated participant present in the meeting can record."""
-
-# pylint: disable=redefined-outer-name,unused-argument,protected-access
-
-from unittest import mock
-
-import pytest
-from rest_framework.test import APIClient
-
-from core.factories import RecordingFactory, RoomFactory, UserFactory
-from core.models import (
-    Recording,
-    RecordingStatusChoices,
-    RoleChoices,
-    RoomAccessLevel,
-)
-from core.recording.event.notification import NotificationService
-from core.services.presence import PresenceCache
-
-pytestmark = pytest.mark.django_db
-
-
-@pytest.fixture
-def mock_worker_manager():
-    """Mock the worker service factory and mediator."""
-    with (
-        mock.patch("core.api.viewsets.get_worker_service"),
-        mock.patch("core.api.viewsets.WorkerServiceMediator") as mediator_class,
-    ):
-        mediator = mock.Mock()
-        mediator_class.return_value = mediator
-        yield mediator
-
-
-@pytest.fixture(autouse=True)
-def enable_recording(settings):
-    """Recording must be enabled for the endpoints to be reachable."""
-    settings.RECORDING_ENABLE = True
-
-
-@pytest.mark.parametrize(
-    "access_level", [RoomAccessLevel.TRUSTED, RoomAccessLevel.PUBLIC]
-)
-@mock.patch(
-    "core.services.participants_management.ParticipantsManagement.check_if_in_meeting",
-    return_value=True,
-)
-def test_open_room_present_user_can_start_recording(
-    mock_check, access_level, mock_worker_manager
-):
-    """Authenticated + present in a trusted/public room -> 201, starter owns it."""
-    user = UserFactory()
-    room = RoomFactory(access_level=access_level)
-
-    client = APIClient()
-    client.force_login(user)
-
-    response = client.post(
-        f"/api/v1.0/rooms/{room.id}/start-recording/", {"mode": "screen_recording"}
-    )
-
-    assert response.status_code == 201
-    mock_check.assert_called_once_with(room_name=str(room.id), identity=str(user.sub))
-    recording = Recording.objects.get()
-    mock_worker_manager.start.assert_called_once_with(recording)
-    access = recording.accesses.get()
-    assert access.user == user
-    assert access.role == RoleChoices.OWNER
-
-
-@mock.patch(
-    "core.services.participants_management.ParticipantsManagement.check_if_in_meeting",
-    return_value=True,
-)
-def test_presence_is_cached_until_participant_leaves(mock_check, mock_worker_manager):
-    """Presence is memoized; clearing it forces a LiveKit re-check."""
-    user = UserFactory()
-    room = RoomFactory(access_level=RoomAccessLevel.TRUSTED)
-    RecordingFactory(room=room, status=RecordingStatusChoices.ACTIVE)
-
-    client = APIClient()
-    client.force_login(user)
-
-    url = f"/api/v1.0/rooms/{room.id}/stop-recording/"
-
-    assert client.post(url).status_code == 200
-    assert client.post(url).status_code == 200
-    assert mock_check.call_count == 1
-
-    # participant_left webhook
-    PresenceCache().clear(room.id, str(user.sub))
-    mock_check.return_value = False
-
-    assert client.post(url).status_code == 403
-    assert mock_check.call_count == 2
-
-
-@pytest.mark.parametrize(
-    "access_level", [RoomAccessLevel.TRUSTED, RoomAccessLevel.PUBLIC]
-)
-@mock.patch(
-    "core.services.participants_management.ParticipantsManagement.check_if_in_meeting",
-    return_value=False,
-)
-def test_open_room_absent_user_forbidden(mock_check, access_level, mock_worker_manager):
-    """Authenticated but not connected to the meeting -> 403."""
-    room = RoomFactory(access_level=access_level)
-    user = UserFactory()
-    client = APIClient()
-    client.force_login(user)
-
-    response = client.post(
-        f"/api/v1.0/rooms/{room.id}/start-recording/", {"mode": "screen_recording"}
-    )
-
-    assert response.status_code == 403
-    assert response.json() == {"detail": "You are not allowed to perform this action."}
-    assert Recording.objects.count() == 0
-
-
-@mock.patch(
-    "core.services.participants_management.ParticipantsManagement.check_if_in_meeting",
-    return_value=True,
-)
-def test_restricted_room_present_user_forbidden(mock_check, mock_worker_manager):
-    """Presence is not enough on restricted rooms; LiveKit is not even asked."""
-    room = RoomFactory(access_level=RoomAccessLevel.RESTRICTED)
-    user = UserFactory()
-    client = APIClient()
-    client.force_login(user)
-    response = client.post(
-        f"/api/v1.0/rooms/{room.id}/start-recording/", {"mode": "screen_recording"}
-    )
-
-    assert response.status_code == 403
-    mock_check.assert_not_called()
-    assert Recording.objects.count() == 0
-
-
-@pytest.mark.parametrize(
-    "access_level", [RoomAccessLevel.TRUSTED, RoomAccessLevel.PUBLIC]
-)
-@mock.patch(
-    "core.services.participants_management.ParticipantsManagement.check_if_in_meeting",
-    return_value=True,
-)
-def test_open_room_present_user_can_stop_recording(
-    mock_check, access_level, mock_worker_manager
-):
-    """Any present authenticated user can stop the active recording."""
-    room = RoomFactory(access_level=access_level)
-    recording = RecordingFactory(room=room, status=RecordingStatusChoices.ACTIVE)
-    user = UserFactory()
-    client = APIClient()
-    client.force_login(user)
-    response = client.post(f"/api/v1.0/rooms/{room.id}/stop-recording/")
-
-    assert response.status_code == 200
-    mock_worker_manager.stop.assert_called_once_with(recording)
-
-
-@mock.patch(
-    "core.services.participants_management.ParticipantsManagement.check_if_in_meeting"
-)
-def test_admin_does_not_need_presence(mock_check, mock_worker_manager):
-    """Admins/owners keep recording rights on any room, without a LiveKit check."""
-    user = UserFactory()
-    room = RoomFactory(access_level=RoomAccessLevel.RESTRICTED)
-    room.accesses.create(user=user, role=RoleChoices.ADMIN)
-    client = APIClient()
-    client.force_login(user)
-    response = client.post(
-        f"/api/v1.0/rooms/{room.id}/start-recording/", {"mode": "screen_recording"}
-    )
-
-    assert response.status_code == 201
-    mock_check.assert_not_called()
-
-
-@pytest.mark.parametrize(
-    "access_level", [RoomAccessLevel.TRUSTED, RoomAccessLevel.PUBLIC]
-)
-def test_open_room_anonymous_forbidden(access_level):
-    """Anonymous users never record, even on public rooms."""
-    room = RoomFactory(access_level=access_level)
-    response = APIClient().post(
-        f"/api/v1.0/rooms/{room.id}/start-recording/", {"mode": "screen_recording"}
-    )
-    assert response.status_code == 401
-
-
-@pytest.mark.parametrize(
-    "access_level", [RoomAccessLevel.TRUSTED, RoomAccessLevel.PUBLIC]
-)
-@mock.patch(
-    "core.services.participants_management.ParticipantsManagement.check_if_in_meeting",
-    return_value=True,
-)
-def test_participant_path_disabled_by_setting(
-    mock_check, access_level, settings, mock_worker_manager
-):
-    """Self-hosters can opt out: participants then get 403, LiveKit not asked."""
-    settings.RECORDING_AUTHENTICATED_PARTICIPANTS_ENABLED = False
-    room = RoomFactory(access_level=access_level)
-    RecordingFactory(room=room, status=RecordingStatusChoices.ACTIVE)
-    user = UserFactory()
-    client = APIClient()
-    client.force_login(user)
-
-    start = client.post(
-        f"/api/v1.0/rooms/{room.id}/start-recording/", {"mode": "screen_recording"}
-    )
-    stop = client.post(f"/api/v1.0/rooms/{room.id}/stop-recording/")
-
-    assert start.status_code == 403
-    assert stop.status_code == 403
-    mock_check.assert_not_called()
-    mock_worker_manager.start.assert_not_called()
-    mock_worker_manager.stop.assert_not_called()
-
-
-@mock.patch(
-    "core.services.participants_management.ParticipantsManagement.check_if_in_meeting"
-)
-def test_participant_path_disabled_admin_still_records(
-    mock_check, settings, mock_worker_manager
-):
-    """The setting only removes the participant path, never admin rights."""
-    settings.RECORDING_AUTHENTICATED_PARTICIPANTS_ENABLED = False
-    user = UserFactory()
-    room = RoomFactory(access_level=RoomAccessLevel.TRUSTED)
-    room.accesses.create(user=user, role=RoleChoices.OWNER)
-    client = APIClient()
-    client.force_login(user)
-
-    response = client.post(
-        f"/api/v1.0/rooms/{room.id}/start-recording/", {"mode": "screen_recording"}
-    )
-
-    assert response.status_code == 201
-    mock_check.assert_not_called()
-
-
-@mock.patch(
-    "core.services.participants_management.ParticipantsManagement.check_if_in_meeting",
-    return_value=True,
-)
-def test_public_room_lobby_is_open_but_empty(mock_check):
-    """Participants pass the lobby permission on public rooms, which have no lobby."""
-    room = RoomFactory(access_level=RoomAccessLevel.PUBLIC)
-    user = UserFactory()
-    client = APIClient()
-    client.force_login(user)
-
-    listing = client.get(f"/api/v1.0/rooms/{room.id}/waiting-participants/")
-    entry = client.post(
-        f"/api/v1.0/rooms/{room.id}/enter/",
-        {"participant_id": "2f7f162f-e7d1-421b-90e7-02bfbfbf8def", "allow_entry": True},
-    )
-
-    assert listing.status_code == 200
-    assert listing.json() == {"participants": []}
-    assert entry.status_code == 404
-    assert entry.json() == {"message": "Room has no lobby system."}
-
-
-@pytest.mark.parametrize("enabled", [True, False])
-def test_config_exposes_authenticated_participants_setting(settings, enabled):
-    """The frontend reads the setting from /config/ to gate the UI."""
-    settings.RECORDING_AUTHENTICATED_PARTICIPANTS_ENABLED = enabled
-
-    response = APIClient().get("/api/v1.0/config/")
-
-    assert response.status_code == 200
-    assert response.json()["recording"]["authenticated_participants_enabled"] is enabled
-
-
-@mock.patch(
-    "core.services.participants_management.ParticipantsManagement.check_if_in_meeting",
-    return_value=True,
-)
-def test_room_owners_and_admins_get_access_to_participant_recording(
-    mock_check, mock_worker_manager
-):
-    """Starter and room owners/admins all own the recording; members get nothing."""
-    starter = UserFactory()
-    room_owner = UserFactory()
-    room_admin = UserFactory()
-    room_member = UserFactory()
-    room = RoomFactory(access_level=RoomAccessLevel.TRUSTED)
-    room.accesses.create(user=room_owner, role=RoleChoices.OWNER)
-    room.accesses.create(user=room_admin, role=RoleChoices.ADMIN)
-    room.accesses.create(user=room_member, role=RoleChoices.MEMBER)
-    client = APIClient()
-    client.force_login(starter)
-    response = client.post(
-        f"/api/v1.0/rooms/{room.id}/start-recording/", {"mode": "screen_recording"}
-    )
-
-    assert response.status_code == 201
-    recording = Recording.objects.get()
-    assert dict(recording.accesses.values_list("user_id", "role")) == {
-        starter.id: RoleChoices.OWNER,
-        room_owner.id: RoleChoices.OWNER,
-        room_admin.id: RoleChoices.OWNER,
-    }
-
-    # Room admins can see and download it; plain members cannot.
-    client.force_login(room_admin)
-    assert client.get(f"/api/v1.0/recordings/{recording.id}/").status_code == 200
-    client.force_login(room_member)
-    assert client.get(f"/api/v1.0/recordings/{recording.id}/").status_code == 404
-
-
-@mock.patch(
-    "core.services.participants_management.ParticipantsManagement.check_if_in_meeting"
-)
-def test_room_admin_starter_is_not_duplicated(mock_check, mock_worker_manager):
-    """A room admin who starts the recording gets an exclusive access."""
-    starter = UserFactory()
-    co_owner = UserFactory()
-    room = RoomFactory(access_level=RoomAccessLevel.RESTRICTED)
-    room.accesses.create(user=starter, role=RoleChoices.ADMIN)
-    room.accesses.create(user=co_owner, role=RoleChoices.OWNER)
-    client = APIClient()
-    client.force_login(starter)
-    response = client.post(
-        f"/api/v1.0/rooms/{room.id}/start-recording/", {"mode": "screen_recording"}
-    )
-
-    assert response.status_code == 201
-    recording = Recording.objects.get()
-    assert dict(recording.accesses.values_list("user_id", "role")) == {
-        starter.id: RoleChoices.OWNER,
-        co_owner.id: RoleChoices.OWNER,
-    }
-
-
-@mock.patch(
-    "core.services.participants_management.ParticipantsManagement.check_if_in_meeting",
-    return_value=True,
-)
-def test_participant_can_stop_recording_started_by_someone_else(
-    mock_check, mock_worker_manager
-):
-    """Stopping is room-wide on trusted rooms, not tied to who started it."""
-    room = RoomFactory(access_level=RoomAccessLevel.TRUSTED)
-    recording = RecordingFactory(room=room, status=RecordingStatusChoices.ACTIVE)
-    recording.accesses.create(user=UserFactory(), role=RoleChoices.OWNER)
-    user = UserFactory()
-    client = APIClient()
-    client.force_login(user)
-
-    response = client.post(f"/api/v1.0/rooms/{room.id}/stop-recording/")
-
-    assert response.status_code == 200
-    mock_worker_manager.stop.assert_called_once_with(recording)
-
-
-@mock.patch(
-    "core.services.participants_management.ParticipantsManagement.check_if_in_meeting",
-    return_value=True,
-)
-def test_summary_goes_to_starter_among_several_owners(mock_check, mock_worker_manager):
-    """The starter's access is created first, so the summary goes to them."""
-    starter = UserFactory()
-    room = RoomFactory(access_level=RoomAccessLevel.TRUSTED)
-    for _ in range(2):
-        room.accesses.create(user=UserFactory(), role=RoleChoices.OWNER)
-    client = APIClient()
-    client.force_login(starter)
-
-    response = client.post(
-        f"/api/v1.0/rooms/{room.id}/start-recording/", {"mode": "transcript"}
-    )
-
-    assert response.status_code == 201
-    recording = Recording.objects.get()
-    assert recording.accesses.count() == 3
-    assert NotificationService._get_summary_recipient(recording) == starter
@@ -11,7 +11,7 @@ from livekit import api as livekit_api
 from rest_framework.test import APIClient

 from ...factories import RoomFactory, UserFactory
-from ...models import Recording, RoomAccessLevel
+from ...models import Recording
 from ...recording.worker.exceptions import RecordingStartError

 pytestmark = pytest.mark.django_db
@@ -42,13 +42,8 @@ def mock_worker_manager(mock_worker_service):
        yield mock_mediator


-@pytest.mark.parametrize(
-    "recording_enabled, expected_status",
-    [(True, 401), (False, 404)],
-)
-def test_start_recording_anonymous(settings, recording_enabled, expected_status):
+def test_start_recording_anonymous():
    """Anonymous users should not be allowed to start room recordings."""
-    settings.RECORDING_ENABLE = recording_enabled
    room = RoomFactory()
    client = APIClient()

@@ -57,24 +52,14 @@ def test_start_recording_anonymous(settings, recording_enabled, expected_status)
        {"mode": "screen_recording"},
    )

-    assert response.status_code == expected_status
+    assert response.status_code == 401
    assert Recording.objects.count() == 0


-@pytest.mark.parametrize("authenticated_participants_enabled", [True, False])
-def test_start_recording_restricted_room_non_owner_and_non_administrator(
-    settings, authenticated_participants_enabled
-):
-    """
-    On restricted rooms, non-owner and non-administrator users should not be
-    allowed to start recordings, whether or not authenticated participants
-    are allowed to record.
-    """
+def test_start_recording_non_owner_and_non_administrator(settings):
+    """Non-owner and Non-Administrator users should not be allowed to start room recordings."""
    settings.RECORDING_ENABLE = True
-    settings.RECORDING_AUTHENTICATED_PARTICIPANTS_ENABLED = (
-        authenticated_participants_enabled
-    )
-    room = RoomFactory(access_level=RoomAccessLevel.RESTRICTED)
+    room = RoomFactory()
    user = UserFactory()
    client = APIClient()
    client.force_login(user)
@@ -0,0 +1,212 @@
+"""
+Test rooms API endpoints in the Meet core app: start recording throttling.
+"""
+
+# pylint: disable=redefined-outer-name,unused-argument
+
+from unittest import mock
+
+import pytest
+from rest_framework.test import APIClient
+
+from ...api.throttling import (
+    StartRecordingDailyUserRateThrottle,
+    StartRecordingUserRateThrottle,
+)
+from ...factories import RoomFactory, UserFactory
+from ...models import Recording
+
+pytestmark = pytest.mark.django_db
+
+
+@pytest.fixture
+def start_recording_throttle(monkeypatch):
+    """Lower the start recording rates."""
+    rates = StartRecordingUserRateThrottle.THROTTLE_RATES
+    monkeypatch.setitem(rates, "start_recording", "2/minute")
+    monkeypatch.setitem(rates, "start_recording_daily", "100/day")
+
+
+@pytest.fixture
+def daily_start_recording_throttle(monkeypatch):
+    """Lower the daily start recording rate and control the clock."""
+    rates = StartRecordingDailyUserRateThrottle.THROTTLE_RATES
+    monkeypatch.setitem(rates, "start_recording", "100/minute")
+    monkeypatch.setitem(rates, "start_recording_daily", "3/day")
+    now = [1_000_000.0]
+    monkeypatch.setattr(StartRecordingUserRateThrottle, "timer", lambda self: now[0])
+    return now
+
+
+@mock.patch("core.api.viewsets.WorkerServiceMediator")
+@mock.patch("core.api.viewsets.get_worker_service")
+def test_start_recording_throttled(
+    mock_get_worker_service, mock_mediator_class, start_recording_throttle, settings
+):
+    """Starting a recording should return 429 when exceeding the per-minute rate."""
+    settings.RECORDING_ENABLE = True
+    user = UserFactory()
+    client = APIClient()
+    client.force_login(user)
+
+    for _ in range(2):
+        room = RoomFactory(users=[(user, "owner")])
+        response = client.post(
+            f"/api/v1.0/rooms/{room.id}/start-recording/",
+            {"mode": "screen_recording"},
+        )
+        assert response.status_code == 201
+
+    room = RoomFactory(users=[(user, "owner")])
+    response = client.post(
+        f"/api/v1.0/rooms/{room.id}/start-recording/",
+        {"mode": "screen_recording"},
+    )
+
+    assert response.status_code == 429
+    assert 0 < int(response["Retry-After"]) <= 60
+    assert Recording.objects.count() == 2
+    assert mock_mediator_class.return_value.start.call_count == 2
+
+
+@mock.patch("core.api.viewsets.WorkerServiceMediator")
+@mock.patch("core.api.viewsets.get_worker_service")
+def test_start_recording_throttle_counts_failed_attempts(
+    mock_get_worker_service, mock_mediator_class, start_recording_throttle, settings
+):
+    """Failed recording starts should count toward the rate."""
+    settings.RECORDING_ENABLE = True
+    user = UserFactory()
+    room = RoomFactory(users=[(user, "owner")])
+    Recording.objects.create(room=room, mode="screen_recording", status="active")
+    client = APIClient()
+    client.force_login(user)
+
+    for _ in range(2):
+        response = client.post(
+            f"/api/v1.0/rooms/{room.id}/start-recording/",
+            {"mode": "screen_recording"},
+        )
+        assert response.status_code == 409
+
+    response = client.post(
+        f"/api/v1.0/rooms/{room.id}/start-recording/",
+        {"mode": "screen_recording"},
+    )
+
+    assert response.status_code == 429
+
+
+@mock.patch("core.api.viewsets.WorkerServiceMediator")
+@mock.patch("core.api.viewsets.get_worker_service")
+def test_start_recording_throttle_per_user(
+    mock_get_worker_service, mock_mediator_class, start_recording_throttle, settings
+):
+    """Starting a recording should succeed when another user is throttled."""
+    settings.RECORDING_ENABLE = True
+    client = APIClient()
+
+    user = UserFactory()
+    client.force_login(user)
+    for _ in range(2):
+        room = RoomFactory(users=[(user, "owner")])
+        response = client.post(
+            f"/api/v1.0/rooms/{room.id}/start-recording/",
+            {"mode": "screen_recording"},
+        )
+        assert response.status_code == 201
+
+    room = RoomFactory(users=[(user, "owner")])
+    response = client.post(
+        f"/api/v1.0/rooms/{room.id}/start-recording/",
+        {"mode": "screen_recording"},
+    )
+    assert response.status_code == 429
+
+    other_user = UserFactory()
+    client.force_login(other_user)
+    room = RoomFactory(users=[(other_user, "owner")])
+    response = client.post(
+        f"/api/v1.0/rooms/{room.id}/start-recording/",
+        {"mode": "screen_recording"},
+    )
+
+    assert response.status_code == 201
+
+
+@mock.patch("core.api.viewsets.WorkerServiceMediator")
+@mock.patch("core.api.viewsets.get_worker_service")
+def test_start_recording_throttle_does_not_limit_other_actions(
+    mock_get_worker_service, mock_mediator_class, start_recording_throttle, settings
+):
+    """Other room actions should succeed when starting a recording is throttled."""
+    settings.RECORDING_ENABLE = True
+    user = UserFactory()
+    client = APIClient()
+    client.force_login(user)
+
+    rooms = RoomFactory.create_batch(3, users=[(user, "owner")])
+    for room in rooms[:2]:
+        response = client.post(
+            f"/api/v1.0/rooms/{room.id}/start-recording/",
+            {"mode": "screen_recording"},
+        )
+        assert response.status_code == 201
+
+    response = client.post(
+        f"/api/v1.0/rooms/{rooms[2].id}/start-recording/",
+        {"mode": "screen_recording"},
+    )
+    assert response.status_code == 429
+
+    Recording.objects.filter(room=rooms[0]).update(status="active")
+    response = client.post(f"/api/v1.0/rooms/{rooms[0].id}/stop-recording/")
+    assert response.status_code == 200
+
+    response = client.get("/api/v1.0/rooms/")
+    assert response.status_code == 200
+
+    response = client.post("/api/v1.0/rooms/", {"name": "New room"})
+    assert response.status_code == 201
+
+
+@mock.patch("core.api.viewsets.WorkerServiceMediator")
+@mock.patch("core.api.viewsets.get_worker_service")
+def test_start_recording_daily_throttled(
+    mock_get_worker_service,
+    mock_mediator_class,
+    daily_start_recording_throttle,
+    settings,
+):
+    """Starting a recording should return 429 when exceeding the daily rate."""
+    settings.RECORDING_ENABLE = True
+    now = daily_start_recording_throttle
+    user = UserFactory()
+    client = APIClient()
+    client.force_login(user)
+
+    for _ in range(3):
+        room = RoomFactory(users=[(user, "owner")])
+        response = client.post(
+            f"/api/v1.0/rooms/{room.id}/start-recording/",
+            {"mode": "screen_recording"},
+        )
+        assert response.status_code == 201
+        now[0] += 120
+
+    room = RoomFactory(users=[(user, "owner")])
+    response = client.post(
+        f"/api/v1.0/rooms/{room.id}/start-recording/",
+        {"mode": "screen_recording"},
+    )
+    assert response.status_code == 429
+    assert 60 < int(response["Retry-After"]) <= 86400
+
+    now[0] += 86400
+    room = RoomFactory(users=[(user, "owner")])
+    response = client.post(
+        f"/api/v1.0/rooms/{room.id}/start-recording/",
+        {"mode": "screen_recording"},
+    )
+
+    assert response.status_code == 201
@@ -10,7 +10,7 @@ import pytest
 from rest_framework.test import APIClient

 from ...factories import RecordingFactory, RoomFactory, UserFactory
-from ...models import Recording, RecordingStatusChoices, RoomAccessLevel
+from ...models import Recording, RecordingStatusChoices
 from ...recording.worker.exceptions import RecordingStopError

 pytestmark = pytest.mark.django_db
@@ -41,20 +41,15 @@ def mock_worker_manager(mock_worker_service):
        yield mock_mediator


-@pytest.mark.parametrize(
-    "recording_enabled, expected_status",
-    [(True, 401), (False, 404)],
-)
-def test_stop_recording_anonymous(settings, recording_enabled, expected_status):
+def test_stop_recording_anonymous():
    """Anonymous users should not be allowed to stop room recordings."""
-    settings.RECORDING_ENABLE = recording_enabled
    room = RoomFactory()
    RecordingFactory(room=room, status=RecordingStatusChoices.ACTIVE)
    client = APIClient()

    response = client.post(f"/api/v1.0/rooms/{room.id}/stop-recording/")

-    assert response.status_code == expected_status
+    assert response.status_code == 401
    # Verify recording status hasn't changed
    assert Recording.objects.filter(status=RecordingStatusChoices.ACTIVE).count() == 1

@@ -62,7 +57,7 @@ def test_stop_recording_anonymous(settings, recording_enabled, expected_status):
 def test_stop_recording_non_owner_and_non_administrator(settings):
    """Non-owner and Non-Administrator users should not be allowed to stop room recordings."""
    settings.RECORDING_ENABLE = True
-    room = RoomFactory(access_level=RoomAccessLevel.RESTRICTED)
+    room = RoomFactory()
    user = UserFactory()
    RecordingFactory(room=room, status=RecordingStatusChoices.ACTIVE)
    client = APIClient()
@@ -395,6 +395,16 @@ class Base(Configuration):
                environ_name="ROOM_CREATION_DAILY_THROTTLE_RATES",
                environ_prefix=None,
            ),
+            "start_recording": values.Value(
+                default="10/minute",
+                environ_name="START_RECORDING_THROTTLE_RATES",
+                environ_prefix=None,
+            ),
+            "start_recording_daily": values.Value(
+                default="100/day",
+                environ_name="START_RECORDING_DAILY_THROTTLE_RATES",
+                environ_prefix=None,
+            ),
            "request_entry": values.Value(
                default="150/minute",
                environ_name="REQUEST_ENTRY_THROTTLE_RATES",
@@ -794,14 +804,6 @@ class Base(Configuration):
    RECORDING_ENABLE = values.BooleanValue(
        False, environ_name="RECORDING_ENABLE", environ_prefix=None
    )
-    # Let any authenticated participant connected to a trusted or public room
-    # start/stop recordings. Disable to keep recording reserved to room
-    # admins/owners.
-    RECORDING_AUTHENTICATED_PARTICIPANTS_ENABLED = values.BooleanValue(
-        True,
-        environ_name="RECORDING_AUTHENTICATED_PARTICIPANTS_ENABLED",
-        environ_prefix=None,
-    )
    RECORDING_OUTPUT_FOLDER = values.Value(
        "recordings", environ_name="RECORDING_OUTPUT_FOLDER", environ_prefix=None
    )
@@ -43,7 +43,6 @@ export interface ApiConfig {
      default_resolution?: string | null
      default_profile?: string | null
    }
-    authenticated_participants_enabled?: boolean
  }
  background_image: {
    upload_is_enabled: boolean
@@ -31,10 +31,6 @@ import { useRecordingEncoding } from '../hooks/useRecordingEncoding'
 import { openSettingsDialog } from '@/stores/settings'
 import { useSidePanel } from '@/features/rooms/livekit/hooks/useSidePanel'
 import { useIsAdminOrOwner } from '@/features/rooms/livekit/hooks/useIsAdminOrOwner'
-import {
-  useCanRecord,
-  useIsRecordingOpenToParticipants,
-} from '../hooks/useCanRecord'
 import { FeatureFlags } from '@/features/analytics/enums'
 import { LimitDescription } from './LimitDescription'
 import { captureEvent, reportError } from '@/features/analytics/telemetry'
@@ -48,8 +44,6 @@ export const ScreenRecordingSidePanel = () => {
  const [includeTranscript, setIncludeTranscript] = useState(false)

  const isAdminOrOwner = useIsAdminOrOwner()
-  const canRecord = useCanRecord()
-  const isRecordingOpenToParticipants = useIsRecordingOpenToParticipants()

  const hasScreenRecordingAccess = useHasRecordingAccess(
    RecordingMode.ScreenRecording,
@@ -132,13 +126,11 @@ export const ScreenRecordingSidePanel = () => {
    }
  }

-  if (!canRecord) {
+  if (!isAdminOrOwner) {
    return (
      <NoAccessView
        i18nKeyPrefix={keyPrefix}
-        i18nKey={
-          isRecordingOpenToParticipants ? 'notLoggedIn' : 'notAdminOrOwner'
-        }
+        i18nKey="notAdminOrOwner"
        helpArticle={data?.support?.help_article_recording}
        imagePath="/assets/intro-slider/4.png"
        handleRequest={handleRequestScreenRecording}
@@ -6,8 +6,7 @@ import { useRoomContext } from '@livekit/components-react'
 import {
  RecordingMode,
  useHasRecordingAccess,
-  useHasFeatureWithoutRecordingRights,
-  useIsRecordingOpenToParticipants,
+  useHasFeatureWithoutAdminRights,
  useRecordingStatuses,
 } from '../index'
 import { useState } from 'react'
@@ -59,13 +58,12 @@ export const TranscriptSidePanel = () => {
    RecordingMode.ScreenRecording,
    FeatureFlags.ScreenRecording
  )
-  const hasFeatureWithoutRecordingRights = useHasFeatureWithoutRecordingRights(
+  const hasFeatureWithoutAdminRights = useHasFeatureWithoutAdminRights(
    RecordingMode.Transcript,
    FeatureFlags.Transcript
  )

  const isAdminOrOwner = useIsAdminOrOwner()
-  const isRecordingOpenToParticipants = useIsRecordingOpenToParticipants()

  const isMetadataCollectorEnabled = useIsMetadataCollectorEnabled()

@@ -145,13 +143,11 @@ export const TranscriptSidePanel = () => {
    }
  }

-  if (hasFeatureWithoutRecordingRights) {
+  if (hasFeatureWithoutAdminRights) {
    return (
      <NoAccessView
        i18nKeyPrefix={keyPrefix}
-        i18nKey={
-          isRecordingOpenToParticipants ? 'notLoggedIn' : 'notAdminOrOwner'
-        }
+        i18nKey="notAdminOrOwner"
        helpArticle={data?.support?.help_article_transcript}
        imagePath="/assets/intro-slider/3.png"
        handleRequest={handleRequestTranscription}
@@ -1,30 +0,0 @@
-import { useConfig } from '@/api/useConfig'
-import { useUser } from '@/features/auth/api/useUser'
-import { ApiAccessLevel } from '@/features/rooms/api/ApiRoom'
-import { useIsAdminOrOwner } from '@/features/rooms/livekit/hooks/useIsAdminOrOwner'
-import { useRoomData } from '@/features/rooms/livekit/hooks/useRoomData'
-
-// Room access levels on which authenticated participants can record.
-const OPEN_ACCESS_LEVELS = [ApiAccessLevel.TRUSTED, ApiAccessLevel.PUBLIC]
-
-export const useIsRecordingOpenToParticipants = () => {
-  const roomData = useRoomData()
-  const { data: config } = useConfig()
-
-  return (
-    config?.recording?.authenticated_participants_enabled === true &&
-    !!roomData?.id &&
-    !!roomData?.access_level &&
-    OPEN_ACCESS_LEVELS.includes(roomData.access_level)
-  )
-}
-
-export const useCanRecord = () => {
-  const isAdminOrOwner = useIsAdminOrOwner()
-  const { isLoggedIn } = useUser()
-  const isRecordingOpenToParticipants = useIsRecordingOpenToParticipants()
-
-  return (
-    isAdminOrOwner || (isLoggedIn === true && isRecordingOpenToParticipants)
-  )
-}
@@ -2,21 +2,21 @@ import { useFeatureFlagEnabled } from 'posthog-js/react'
 import { useIsAnalyticsEnabled } from '@/features/analytics/hooks/useIsAnalyticsEnabled'
 import type { RecordingMode } from '../types'
 import { useIsRecordingModeEnabled } from './useIsRecordingModeEnabled'
-import { useCanRecord } from './useCanRecord'
+import { useIsAdminOrOwner } from '@/features/rooms/livekit/hooks/useIsAdminOrOwner'
 import type { FeatureFlags } from '@/features/analytics/enums'

-export const useHasFeatureWithoutRecordingRights = (
+export const useHasFeatureWithoutAdminRights = (
  mode: RecordingMode,
  featureFlag: FeatureFlags
 ) => {
  const featureEnabled = useFeatureFlagEnabled(featureFlag)
  const isAnalyticsEnabled = useIsAnalyticsEnabled()
  const isRecordingModeEnabled = useIsRecordingModeEnabled(mode)
-  const canRecord = useCanRecord()
+  const isAdminOrOwner = useIsAdminOrOwner()

  return (
    (featureEnabled || !isAnalyticsEnabled) &&
    isRecordingModeEnabled &&
-    !canRecord
+    !isAdminOrOwner
  )
 }
@@ -2,7 +2,7 @@ import { useFeatureFlagEnabled } from 'posthog-js/react'
 import { useIsAnalyticsEnabled } from '@/features/analytics/hooks/useIsAnalyticsEnabled'
 import type { RecordingMode } from '../types'
 import { useIsRecordingModeEnabled } from './useIsRecordingModeEnabled'
-import { useCanRecord } from './useCanRecord'
+import { useIsAdminOrOwner } from '@/features/rooms/livekit/hooks/useIsAdminOrOwner'
 import type { FeatureFlags } from '@/features/analytics/enums'

 export const useHasRecordingAccess = (
@@ -12,11 +12,11 @@ export const useHasRecordingAccess = (
  const featureEnabled = useFeatureFlagEnabled(featureFlag)
  const isAnalyticsEnabled = useIsAnalyticsEnabled()
  const isRecordingModeEnabled = useIsRecordingModeEnabled(mode)
-  const canRecord = useCanRecord()
+  const isAdminOrOwner = useIsAdminOrOwner()

  return (
    (featureEnabled || !isAnalyticsEnabled) &&
-    canRecord &&
+    isAdminOrOwner &&
    isRecordingModeEnabled
  )
 }
@@ -1,11 +1,7 @@
 // hooks
 export { useIsRecordingModeEnabled } from './hooks/useIsRecordingModeEnabled'
 export { useHasRecordingAccess } from './hooks/useHasRecordingAccess'
-export { useHasFeatureWithoutRecordingRights } from './hooks/useHasFeatureWithoutRecordingRights'
-export {
-  useCanRecord,
-  useIsRecordingOpenToParticipants,
-} from './hooks/useCanRecord'
+export { useHasFeatureWithoutAdminRights } from './hooks/useHasFeatureWithoutAdminRights'
 export { useRecordingStatuses } from './hooks/useRecordingStatuses'
 export {
  useRecordingEncoding,
@@ -507,22 +507,6 @@
        "buttonLabel": "Anfragen"
      }
    },
-    "notLoggedIn": {
-      "heading": "Zum Transkribieren anmelden",
-      "body": "In diesem Meeting kann jede angemeldete Person eine Transkription (Beta) starten.",
-      "linkMore": "Dokumentation öffnen",
-      "linkAriaLabel": "Dokumentation zum Transkriptionszugang öffnen – öffnet in neuem Tab",
-      "dividerLabel": "ODER",
-      "login": {
-        "heading": "Anmeldung erforderlich",
-        "body": "Melden Sie sich an und kehren Sie dann zu diesem Bereich zurück, um die Transkription zu starten."
-      },
-      "request": {
-        "heading": "Transkription anfragen",
-        "body": "Die Moderation wird benachrichtigt und kann die Transkription starten.",
-        "buttonLabel": "Anfragen"
-      }
-    },
    "premium": {
      "heading": "Advanced-Funktion",
      "body": "Diese Funktion ist für Sie nicht verfügbar. Bitte wenden Sie sich an den Support, um weitere Informationen zu erhalten.",
@@ -578,22 +562,6 @@
        "buttonLabel": "Anfrage senden"
      }
    },
-    "notLoggedIn": {
-      "heading": "Zum Aufnehmen anmelden",
-      "body": "In diesem Meeting kann jede angemeldete Person eine Videoaufnahme (Beta) starten.",
-      "linkMore": "Dokumentation öffnen",
-      "linkAriaLabel": "Dokumentation zum Aufzeichnungszugang öffnen – öffnet in neuem Tab",
-      "dividerLabel": "ODER",
-      "login": {
-        "heading": "Anmeldung erforderlich",
-        "body": "Melden Sie sich an und kehren Sie dann zu diesem Bereich zurück, um die Aufnahme zu starten."
-      },
-      "request": {
-        "heading": "Aufnahme anfragen",
-        "body": "Die Moderation wird benachrichtigt und kann die Aufnahme starten.",
-        "buttonLabel": "Anfrage senden"
-      }
-    },
    "premium": {
      "heading": "Advanced-Funktion",
      "body": "Diese Funktion ist für Sie nicht verfügbar. Bitte wenden Sie sich an den Support, um weitere Informationen zu erhalten.",
@@ -507,22 +507,6 @@
        "buttonLabel": "Request"
      }
    },
-    "notLoggedIn": {
-      "heading": "Log in to transcribe",
-      "body": "In this meeting, any logged-in participant can start a transcription (beta).",
-      "linkMore": "Open documentation",
-      "linkAriaLabel": "Open documentation about transcription access - opens in new window",
-      "dividerLabel": "OR",
-      "login": {
-        "heading": "Login Required",
-        "body": "Log in, then come back to this panel to start the transcription."
-      },
-      "request": {
-        "heading": "Request Transcription",
-        "body": "The host will be notified and can enable transcription for you.",
-        "buttonLabel": "Request"
-      }
-    },
    "premium": {
      "heading": "Advanced feature",
      "body": "This feature is not available to you. Please contact support for more information.",
@@ -578,22 +562,6 @@
        "buttonLabel": "Request"
      }
    },
-    "notLoggedIn": {
-      "heading": "Log in to record",
-      "body": "In this meeting, any logged-in participant can start a recording (beta).",
-      "linkMore": "Open documentation",
-      "linkAriaLabel": "Open documentation about recording access - opens in new window",
-      "dividerLabel": "OR",
-      "login": {
-        "heading": "Login Required",
-        "body": "Log in, then come back to this panel to start the recording."
-      },
-      "request": {
-        "heading": "Request Recording",
-        "body": "The host will be notified and can enable recording for you.",
-        "buttonLabel": "Request"
-      }
-    },
    "premium": {
      "heading": "Advanced feature",
      "body": "This feature is not available to you. Please contact support for more information.",
@@ -506,22 +506,6 @@
        "buttonLabel": "Solicitar"
      }
    },
-    "notLoggedIn": {
-      "heading": "Inicia sesión para transcribir",
-      "body": "En esta reunión, cualquier participante con sesión iniciada puede iniciar una transcripción (beta).",
-      "linkMore": "Abrir la documentación",
-      "linkAriaLabel": "Abrir la documentación sobre el acceso a la transcripción - se abre en una nueva ventana",
-      "dividerLabel": "O",
-      "login": {
-        "heading": "Inicio de sesión necesario",
-        "body": "Inicia sesión y vuelve a este panel para iniciar la transcripción."
-      },
-      "request": {
-        "heading": "Pedírselo al organizador",
-        "body": "El anfitrión recibirá una notificación y podrá iniciar la transcripción por ti.",
-        "buttonLabel": "Solicitar"
-      }
-    },
    "premium": {
      "heading": "Función avanzada",
      "body": "Esta función no está disponible para ti. Ponte en contacto con el soporte para obtener más información.",
@@ -577,22 +561,6 @@
        "buttonLabel": "Solicitar"
      }
    },
-    "notLoggedIn": {
-      "heading": "Inicia sesión para grabar",
-      "body": "En esta reunión, cualquier participante con sesión iniciada puede iniciar una grabación (beta).",
-      "linkMore": "Abrir la documentación",
-      "linkAriaLabel": "Abrir la documentación sobre el acceso a la grabación - se abre en una nueva ventana",
-      "dividerLabel": "O",
-      "login": {
-        "heading": "Inicio de sesión necesario",
-        "body": "Inicia sesión y vuelve a este panel para iniciar la grabación."
-      },
-      "request": {
-        "heading": "Pedírselo al organizador",
-        "body": "El anfitrión recibirá una notificación y podrá iniciar la grabación por ti.",
-        "buttonLabel": "Solicitar"
-      }
-    },
    "premium": {
      "heading": "Función avanzada",
      "body": "Esta función no está disponible para ti. Ponte en contacto con el soporte para obtener más información.",
@@ -507,22 +507,6 @@
        "buttonLabel": "Demander"
      }
    },
-    "notLoggedIn": {
-      "heading": "Connectez-vous pour transcrire",
-      "body": "Dans cette réunion, tout participant connecté peut lancer une transcription (beta).",
-      "linkMore": "Ouvrir la documentation",
-      "linkAriaLabel": "Ouvrir la documentation sur l'accès à la transcription - ouvre dans une nouvelle fenêtre",
-      "dividerLabel": "OU",
-      "login": {
-        "heading": "Connexion requise",
-        "body": "Connectez-vous, puis revenez sur ce panneau pour lancer la transcription."
-      },
-      "request": {
-        "heading": "Demander à l'organisateur",
-        "body": "L'hôte recevra une notification et pourra démarrer la transcription pour vous.",
-        "buttonLabel": "Demander"
-      }
-    },
    "premium": {
      "heading": "Fonctionnalité avancée",
      "body": "Cette fonctionnalité ne vous est pas ouverte. Contactez le support pour obtenir plus d'informations.",
@@ -578,22 +562,6 @@
        "buttonLabel": "Demander"
      }
    },
-    "notLoggedIn": {
-      "heading": "Connectez-vous pour enregistrer",
-      "body": "Dans cette réunion, tout participant connecté peut lancer un enregistrement (beta).",
-      "linkMore": "Ouvrir la documentation",
-      "linkAriaLabel": "Ouvrir la documentation sur l'accès à l'enregistrement - ouvre dans une nouvelle fenêtre",
-      "dividerLabel": "OU",
-      "login": {
-        "heading": "Connexion requise",
-        "body": "Connectez-vous, puis revenez sur ce panneau pour lancer l'enregistrement."
-      },
-      "request": {
-        "heading": "Demander à l'organisateur",
-        "body": "L'hôte recevra une notification et pourra démarrer l'enregistrement pour vous.",
-        "buttonLabel": "Demander"
-      }
-    },
    "premium": {
      "heading": "Fonctionnalité avancée",
      "body": "Cette fonctionnalité ne vous est pas ouverte. Contactez le support pour obtenir plus d'informations.",
@@ -507,22 +507,6 @@
        "buttonLabel": "Aanvragen"
      }
    },
-    "notLoggedIn": {
-      "heading": "Log in om te transcriberen",
-      "body": "In deze vergadering kan elke ingelogde deelnemer een transcriptie starten (beta).",
-      "linkMore": "Documentatie openen",
-      "linkAriaLabel": "Documentatie over transcriptietoegang openen - opent in nieuw venster",
-      "dividerLabel": "OF",
-      "login": {
-        "heading": "Inloggen vereist",
-        "body": "Log in en kom daarna terug naar dit paneel om de transcriptie te starten."
-      },
-      "request": {
-        "heading": "Transcriptie aanvragen",
-        "body": "De host wordt op de hoogte gebracht en kan de transcriptie voor u inschakelen.",
-        "buttonLabel": "Aanvragen"
-      }
-    },
    "premium": {
      "heading": "Geavanceerde functie",
      "body": "Deze functie is niet voor u beschikbaar. Neem contact op met de ondersteuning voor meer informatie.",
@@ -578,22 +562,6 @@
        "buttonLabel": "Aanvragen"
      }
    },
-    "notLoggedIn": {
-      "heading": "Log in om op te nemen",
-      "body": "In deze vergadering kan elke ingelogde deelnemer een opname starten (beta).",
-      "linkMore": "Documentatie openen",
-      "linkAriaLabel": "Documentatie over opnametoegang openen - opent in nieuw venster",
-      "dividerLabel": "OF",
-      "login": {
-        "heading": "Inloggen vereist",
-        "body": "Log in en kom daarna terug naar dit paneel om de opname te starten."
-      },
-      "request": {
-        "heading": "Opname aanvragen",
-        "body": "De host wordt op de hoogte gebracht en kan de opname voor u inschakelen.",
-        "buttonLabel": "Aanvragen"
-      }
-    },
    "premium": {
      "heading": "Geavanceerde functie",
      "body": "Deze functie is niet voor u beschikbaar. Neem contact op met de ondersteuning voor meer informatie.",