Compare commits

...

4 Commits

Author SHA1 Message Date
briquet cae6c19da8 🔖(minor) bump release to 1.37.0 2026-11-01 14:07:10 +01:00
briquet 455daf1e8f ⚡️(docker) build frontend assets natively for arm64 images
Release images were building the JS bundles under QEMU for arm64, which
took most of the 10 to 17 minutes spent on each frontend image on CI.

Since the output is mostly static files, we can use the build platform
for the multi stage build steps of frontend images and share them
between architectures.
2026-10-31 11:41:06 +01:00
briquet 73b182b34a ⬆️(backend) upgrade django-lasuite to v1.0.0
Upgrade django-lasuite from 0.0.29 to 1.0.0.

An inactive token on the external API is now refused with a 401 error
instead of a 400.
2026-10-31 11:22:28 +01:00
briquet 6a1622cd50 🔒️(frontend) keep rooms out of search engine
Room URLs were appearing in search engine results.
The indexing is now restricted  to allow only the landing page.

- Emit a separate `home.html` during the Vite build without a `noindex` tag
- Configure Nginx to serve `home.html` exclusively at `/`
- Serve all other routes with a `noindex` meta tag and an
  `X-Robots-Tag: noindex` header
2026-10-31 11:22:28 +01:00
28 changed files with 189 additions and 45 deletions
+5
View File
@@ -8,10 +8,15 @@ and this project adheres to
## [Unreleased]
## [1.37.0] - 2026-11-01
### Changed
- ⬆️(summary) update ffmpeg to 8.1.3-r0
- ✨(frontend) replace the Crisp chat with the La Suite support form
- 🔒️(frontend) keep rooms out of search engine and AI indexes
- ⬆️(backend) upgrade django-lasuite to v1.0.0
- ⚡️(docker) build frontend assets natively for arm64 images
## [1.36.3] - 2026-10-23
+7
View File
@@ -16,11 +16,18 @@ the following command inside your docker container:
## [Unreleased]
## v1.37.0
### Crisp support chat replaced by the La Suite support form
The Crisp chat is gone, the support button, now open the La Suite support form. They are hidden unless these `FRONTEND_SUPPORT` keys are all set.
The former help links for recording/transcription are now redirecting to the adhoc page in the official documentation
### Pages hidden from search engines
Every page except `/` now carries a `noindex` tag and, with the provided nginx configurations, an `X-Robots-Tag` header to stay out of search indexes.
A new `robots.txt` also blocks the main AI crawlers. If you maintain your own nginx configuration, copy the `location = /` and `location = /home.html` blocks from `src/frontend/default.conf`, and the `X-Robots-Tag` header from its `location /`.
## [v1.35.0]
### Purging deleted rooms
+12
View File
@@ -38,6 +38,17 @@ server {
add_header Cache-Control "public, max-age=2592000";
}
location = / {
try_files /home.html /index.html;
add_header Cache-Control "no-cache, no-store, must-revalidate";
add_header Pragma "no-cache";
add_header Expires 0;
}
location = /home.html {
internal;
}
# Serve static files
location / {
try_files $uri $uri/ /index.html;
@@ -45,6 +56,7 @@ server {
add_header Cache-Control "no-cache, no-store, must-revalidate";
add_header Pragma "no-cache"; # HTTP 1.0 header for backward compatibility
add_header Expires 0;
add_header X-Robots-Tag "noindex, nofollow" always;
}
# Optionally, handle 404 errors by redirecting to index.html
+4 -3
View File
@@ -1,5 +1,5 @@
# ---- Front-end image ----
FROM node:22.23.4-alpine AS frontend-deps
FROM --platform=$BUILDPLATFORM node:22.23.4-alpine AS frontend-deps
RUN apk upgrade --no-cache ca-certificates
@@ -41,7 +41,7 @@ COPY ./docker/dinum-frontend/fonts/ \
./dist/assets/fonts/
# ---- Addons builder image ----
FROM node:22.23.4-alpine AS addons-builder
FROM --platform=$BUILDPLATFORM node:22.23.4-alpine AS addons-builder
RUN apk upgrade --no-cache ca-certificates
@@ -65,7 +65,8 @@ RUN apk upgrade --no-cache libexpat && \
apk add --no-cache --upgrade 'pcre2>=10.49-r0' 'tiff>=4.7.2-r0' \
'libx11>=1.8.14-r0' 'ca-certificates>=20261020-r0' \
'brotli-libs>=1.2.1-r0' && \
apk del curl
apk del curl && \
rm -f /usr/share/nginx/html/50x.html
USER nginx
USER nginx
+13
View File
@@ -43,6 +43,7 @@ server {
add_header Cache-Control "no-cache, no-store, must-revalidate";
add_header Pragma "no-cache" always;
add_header Expires 0 always;
add_header X-Robots-Tag "noindex, nofollow" always;
set $ms_domains "https://*.live.com https://*.office.com https://*.microsoft.com https://*.office365.com https://*.sharepoint.com";
@@ -76,6 +77,17 @@ server {
add_header Cache-Control "public, max-age=2592000";
}
location = / {
try_files /home.html /index.html;
add_header Cache-Control "no-cache, no-store, must-revalidate";
add_header Pragma "no-cache";
add_header Expires 0;
}
location = /home.html {
internal;
}
# Serve static files
location / {
try_files $uri $uri/ /index.html;
@@ -83,6 +95,7 @@ server {
add_header Cache-Control "no-cache, no-store, must-revalidate";
add_header Pragma "no-cache"; # HTTP 1.0 header for backward compatibility
add_header Expires 0;
add_header X-Robots-Tag "noindex, nofollow" always;
}
# Optionally, handle 404 errors by redirecting to index.html
@@ -2,6 +2,7 @@
<html lang="fr">
<head>
<meta charset="UTF-8" />
<meta name="robots" content="noindex, nofollow" />
<title data-app-name></title>
<meta http-equiv="X-UA-Compatible" content="IE=Edge" />
<script nonce="NONCE_PLACEHOLDER" src="https://appsforoffice.microsoft.com/lib/1/hosted/office.js"></script>
@@ -4,6 +4,7 @@
<meta charset="UTF-8" />
<meta http-equiv="X-UA-Compatible" content="IE=Edge" />
<meta name="viewport" content="width=device-width, initial-scale=1">
<meta name="robots" content="noindex, nofollow" />
<title data-app-name></title>
<link rel="stylesheet" href="../styles/spinner.css" />
<script nonce="NONCE_PLACEHOLDER" src="/addons/outlook/config.js"></script>
@@ -4,6 +4,7 @@
<meta charset="UTF-8" />
<meta http-equiv="X-UA-Compatible" content="IE=Edge" />
<meta name="viewport" content="width=device-width, initial-scale=1">
<meta name="robots" content="noindex, nofollow" />
<title data-app-name></title>
<link rel="stylesheet" href="taskpane.css" />
<script nonce="NONCE_PLACEHOLDER" src="/addons/outlook/config.js"></script>
@@ -4,6 +4,7 @@
<meta charset="UTF-8" />
<meta http-equiv="X-UA-Compatible" content="IE=Edge" />
<meta name="viewport" content="width=device-width, initial-scale=1">
<meta name="robots" content="noindex, nofollow" />
<title data-app-name></title>
<link rel="stylesheet" href="../styles/spinner.css" />
<script nonce="NONCE_PLACEHOLDER" src="/addons/outlook/config.js"></script>
+1 -1
View File
@@ -1,7 +1,7 @@
[project]
name = "agents"
version = "1.36.3"
version = "1.37.0"
requires-python = ">=3.12"
dependencies = [
"livekit-agents==1.7.0",
+1 -1
View File
@@ -9,7 +9,7 @@ resolution-markers = [
[[package]]
name = "agents"
version = "1.36.3"
version = "1.37.0"
source = { virtual = "." }
dependencies = [
{ name = "boto3" },
@@ -184,7 +184,7 @@ def test_api_rooms_list_with_application_disabled(mock_rs_authenticate, settings
@responses.activate
def test_api_rooms_list_with_invalid_rs_token(settings):
"""Listing rooms with invalid resource server token should return 400."""
"""Listing rooms with invalid resource server token should return 401."""
settings.OIDC_OP_INTROSPECTION_ENDPOINT = "https://oidc.example.com/introspect"
settings.OIDC_OP_URL = "https://oidc.example.com"
@@ -202,9 +202,8 @@ def test_api_rooms_list_with_invalid_rs_token(settings):
client.credentials(HTTP_AUTHORIZATION="Bearer invalid-token-123")
response = client.get("/external-api/v1.0/rooms/")
# Return 400 instead of 401 because ResourceServerAuthentication raises
# SuspiciousOperation when the introspected user is not active
assert response.status_code == 400
assert response.status_code == 401
assert "introspected user is not active" in str(response.data).lower()
def test_api_rooms_list_missing_scope():
@@ -422,7 +421,7 @@ def test_api_rooms_retrieve_with_expired_token(settings):
@responses.activate
def test_api_rooms_retrieve_with_invalid_rs_token(settings):
"""Retrieving rooms with invalid resource server token should return 400."""
"""Retrieving rooms with invalid resource server token should return 401."""
settings.OIDC_OP_INTROSPECTION_ENDPOINT = "https://oidc.example.com/introspect"
settings.OIDC_OP_URL = "https://oidc.example.com"
@@ -443,9 +442,8 @@ def test_api_rooms_retrieve_with_invalid_rs_token(settings):
client.credentials(HTTP_AUTHORIZATION="Bearer invalid-token-123")
response = client.get(f"/external-api/v1.0/rooms/{room.id}/")
# Return 400 instead of 401 because ResourceServerAuthentication raises
# SuspiciousOperation when the introspected user is not active
assert response.status_code == 400
assert response.status_code == 401
assert "introspected user is not active" in str(response.data).lower()
def test_api_rooms_retrieve_requires_scope():
@@ -647,7 +645,7 @@ def test_api_rooms_create_with_expired_token(settings):
@responses.activate
def test_api_rooms_create_with_invalid_rs_token(settings):
"""Creating rooms with invalid resource server token should return 400."""
"""Creating rooms with invalid resource server token should return 401."""
settings.OIDC_OP_INTROSPECTION_ENDPOINT = "https://oidc.example.com/introspect"
settings.OIDC_OP_URL = "https://oidc.example.com"
@@ -665,9 +663,8 @@ def test_api_rooms_create_with_invalid_rs_token(settings):
client.credentials(HTTP_AUTHORIZATION="Bearer invalid-token-123")
response = client.post("/external-api/v1.0/rooms/")
# Return 400 instead of 401 because ResourceServerAuthentication raises
# SuspiciousOperation when the introspected user is not active
assert response.status_code == 400
assert response.status_code == 401
assert "introspected user is not active" in str(response.data).lower()
def test_api_rooms_create_inactive_user():
@@ -2971,6 +2968,36 @@ def test_api_rooms_missing_token_is_audited_as_denial(audit_events):
assert event["url"]["path"] == "/external-api/v1.0/rooms/"
@responses.activate
def test_api_rooms_invalid_rs_token_is_audited_as_denial(audit_events, settings):
"""A token refused by the identity provider is recorded as a denial."""
settings.OIDC_OP_INTROSPECTION_ENDPOINT = "https://oidc.example.com/introspect"
settings.OIDC_OP_URL = "https://oidc.example.com"
responses.add(
responses.POST,
"https://oidc.example.com/introspect",
json={"iss": "https://oidc.example.com", "active": False},
)
client = APIClient()
client.credentials(HTTP_AUTHORIZATION="Bearer invalid-token-123")
response = client.get("/external-api/v1.0/rooms/")
assert response.status_code == 401
assert response.headers["WWW-Authenticate"] == "Bearer"
responses.assert_call_count("https://oidc.example.com/introspect", 1)
[event] = find_events(audit_events, "room.list")
assert event["event"]["category"] == ["api", "authentication"]
assert event["event"]["reason"] == "authentication_failed"
assert event["lasuite"]["outcome"] == "denied"
assert event["lasuite"]["actor"] == {"type": "anonymous"}
assert event["http"]["response"] == {"status_code": 401}
assert event["error"]["message"] == response.json()["detail"]
def test_api_rooms_missing_scope_is_audited_as_denial(audit_events):
"""A token without the required scope is a permission denial by the application."""
user = UserFactory()
+2 -2
View File
@@ -7,7 +7,7 @@ build-backend = "uv_build"
[project]
name = "meet"
version = "1.36.3"
version = "1.37.0"
authors = [{ "name" = "DINUM", "email" = "dev@mail.numerique.gouv.fr" }]
classifiers = [
"Development Status :: 5 - Production/Stable",
@@ -33,7 +33,7 @@ dependencies = [
"django-cors-headers==4.9.0",
"django-countries==9.0.0",
"django-filter==26.1",
"django-lasuite[all]==0.0.29",
"django-lasuite[all]==1.0.0",
"django-parler==2.4",
"redis==5.2.1",
"django-redis==7.0.0",
+22 -11
View File
@@ -837,26 +837,28 @@ wheels = [
[[package]]
name = "django-lasuite"
version = "0.0.29"
version = "1.0.0"
source = { registry = "https://pypi.org/simple" }
dependencies = [
{ name = "django" },
{ name = "djangorestframework" },
{ name = "joserfc" },
{ name = "mozilla-django-oidc" },
{ name = "pyjwt" },
{ name = "requests" },
{ name = "requests-toolbelt" },
]
sdist = { url = "https://files.pythonhosted.org/packages/f4/ab/72a79b7133fb2d17835bef40f45f7e6d2b4343469c37fd00386122e9068d/django_lasuite-0.0.29.tar.gz", hash = "sha256:831cb859e45e33963c9d89168c2de14f9844e805000b0f0d1512ffd0b9731a39", size = 35248, upload-time = "2026-08-25T13:03:43.597Z" }
sdist = { url = "https://files.pythonhosted.org/packages/0f/cc/35335b826b039c43da68a0e624e154f60c3ac6c83f01f9b4ad6ce91faf03/django_lasuite-1.0.0.tar.gz", hash = "sha256:8921aaba5a78f1f9728cee2cc4596755478108f17146d4a2fccb393c043a05a3", size = 45815, upload-time = "2026-10-30T14:57:31.764Z" }
wheels = [
{ url = "https://files.pythonhosted.org/packages/a1/cf/86648643221816f18ebd5a3e59b6d2a85ee85b38b19c7abe939f798a2845/django_lasuite-0.0.29-py3-none-any.whl", hash = "sha256:33bcff90ced2709190ef01241badb17ceed08a32725b9cdd3105650b36da303b", size = 54899, upload-time = "2026-08-25T13:03:42.212Z" },
{ url = "https://files.pythonhosted.org/packages/a4/6f/d1df3f2881cda711e569b8e685ad3a846ca9c71226340597cee1c09beae0/django_lasuite-1.0.0-py3-none-any.whl", hash = "sha256:23d589be9496b1f484772b49f3c4c4a81e70affd537e3c50abf15303c84d7cb0", size = 68529, upload-time = "2026-10-30T14:57:30.416Z" },
]
[package.optional-dependencies]
all = [
{ name = "celery" },
{ name = "cryptography" },
{ name = "django-configurations" },
{ name = "djangorestframework" },
{ name = "joserfc" },
{ name = "mozilla-django-oidc" },
{ name = "pyjwt" },
{ name = "python-icap" },
{ name = "requests" },
{ name = "requests-toolbelt" },
]
[[package]]
@@ -1358,7 +1360,7 @@ wheels = [
[[package]]
name = "meet"
version = "1.36.3"
version = "1.37.0"
source = { editable = "." }
dependencies = [
{ name = "aiohttp" },
@@ -1440,7 +1442,7 @@ requires-dist = [
{ name = "django-cors-headers", specifier = "==4.9.0" },
{ name = "django-countries", specifier = "==9.0.0" },
{ name = "django-filter", specifier = "==26.1" },
{ name = "django-lasuite", extras = ["all"], specifier = "==0.0.29" },
{ name = "django-lasuite", extras = ["all"], specifier = "==1.0.0" },
{ name = "django-parler", specifier = "==2.4" },
{ name = "django-pydantic-field", specifier = "==0.5.4" },
{ name = "django-redis", specifier = "==7.0.0" },
@@ -2258,6 +2260,15 @@ wheels = [
{ url = "https://files.pythonhosted.org/packages/a6/a3/17c284b4f4d8ad50f0f9ba70ad8fcc35c777aeafcdbbffdd91bbdc5ab379/python_frontmatter-1.3.0-py3-none-any.whl", hash = "sha256:9f7dd9260bec99044219159a329f64f039087f9d1a2124c9442556f2fe6f82ec", size = 10562, upload-time = "2026-05-20T19:21:43.323Z" },
]
[[package]]
name = "python-icap"
version = "0.2.0"
source = { registry = "https://pypi.org/simple" }
sdist = { url = "https://files.pythonhosted.org/packages/5c/0a/123c30f4041eabb94c587d35fb64aa9498435d028a8577340a4e5adc5224/python_icap-0.2.0.tar.gz", hash = "sha256:627869ac29119074542de6ae95370914854fdb35ee0a13c8ae4c55847cfcb80e", size = 684516, upload-time = "2026-07-08T22:21:58.842Z" }
wheels = [
{ url = "https://files.pythonhosted.org/packages/d8/f2/b437a5e08b94dfc4cd8505cfc3e63922247e9ce3957707550ab08c514560/python_icap-0.2.0-py3-none-any.whl", hash = "sha256:b648d55b68abe387849a124d1b4a443801342a566afd2141f4515953ed4bd738", size = 70680, upload-time = "2026-07-08T22:21:57.307Z" },
]
[[package]]
name = "python-magic"
version = "0.4.27"
+3 -2
View File
@@ -1,4 +1,4 @@
FROM node:22.23.4-alpine AS frontend-deps
FROM --platform=$BUILDPLATFORM node:22.23.4-alpine AS frontend-deps
RUN apk upgrade --no-cache ca-certificates
@@ -54,7 +54,8 @@ RUN apk upgrade --no-cache libexpat && \
apk add --no-cache --upgrade 'pcre2>=10.49-r0' 'tiff>=4.7.2-r0' \
'libx11>=1.8.14-r0' 'ca-certificates>=20261020-r0' \
'brotli-libs>=1.2.1-r0' && \
apk del curl
apk del curl && \
rm -f /usr/share/nginx/html/50x.html
USER nginx
# Un-privileged user running the application
+12
View File
@@ -16,6 +16,17 @@ server {
add_header Cache-Control "public, max-age=2592000";
}
location = / {
try_files /home.html /index.html;
add_header Cache-Control "no-cache, no-store, must-revalidate";
add_header Pragma "no-cache";
add_header Expires 0;
}
location = /home.html {
internal;
}
# Serve static files
location / {
try_files $uri $uri/ /index.html;
@@ -23,6 +34,7 @@ server {
add_header Cache-Control "no-cache, no-store, must-revalidate";
add_header Pragma "no-cache"; # HTTP 1.0 header for backward compatibility
add_header Expires 0;
add_header X-Robots-Tag "noindex, nofollow" always;
}
# Optionally, handle 404 errors by redirecting to index.html
+1
View File
@@ -7,6 +7,7 @@
<link rel="icon" type="image/png" sizes="16x16" href="/favicon-16x16.png">
<link rel="manifest" href="/site.webmanifest">
<meta name="viewport" content="width=device-width, initial-scale=1.0" />
<meta name="robots" content="noindex, nofollow" />
<title>%VITE_APP_TITLE%</title>
</head>
<body>
+2 -2
View File
@@ -1,12 +1,12 @@
{
"name": "meet",
"version": "1.36.3",
"version": "1.37.0",
"lockfileVersion": 3,
"requires": true,
"packages": {
"": {
"name": "meet",
"version": "1.36.3",
"version": "1.37.0",
"dependencies": {
"@fontsource-variable/atkinson-hyperlegible-next": "5.3.0",
"@fontsource-variable/lexend": "5.3.0",
+1 -1
View File
@@ -1,7 +1,7 @@
{
"name": "meet",
"private": true,
"version": "1.36.3",
"version": "1.37.0",
"type": "module",
"scripts": {
"dev": "panda codegen && vite",
+18
View File
@@ -0,0 +1,18 @@
User-agent: GPTBot
User-agent: OAI-SearchBot
User-agent: ChatGPT-User
User-agent: ClaudeBot
User-agent: Claude-SearchBot
User-agent: Claude-User
User-agent: PerplexityBot
User-agent: Perplexity-User
User-agent: Google-Extended
User-agent: Applebot-Extended
User-agent: CCBot
User-agent: Meta-ExternalAgent
User-agent: Amazonbot
User-agent: Bytespider
Disallow: /
User-agent: *
Allow: /
+21 -2
View File
@@ -1,5 +1,6 @@
import { readFileSync } from 'node:fs'
import { defineConfig, loadEnv } from 'vite'
import { readFileSync, writeFileSync } from 'node:fs'
import { join } from 'node:path'
import { defineConfig, loadEnv, type Plugin } from 'vite'
import react from '@vitejs/plugin-react'
import { visualizer } from 'rollup-plugin-visualizer'
import svgr from 'vite-plugin-svgr'
@@ -25,6 +26,23 @@ if (mediapipeVersion !== livekitMediapipeVersion) {
)
}
const NOINDEX_TAG = '<meta name="robots" content="noindex, nofollow" />'
const homePage = (): Plugin => ({
name: 'home-page',
apply: 'build',
writeBundle({ dir = 'dist' }) {
const html = readFileSync(join(dir, 'index.html'), 'utf-8')
if (!html.includes(NOINDEX_TAG)) {
throw new Error(
`${dir}/index.html does not contain ${NOINDEX_TAG}, so home.html ` +
`cannot be generated from it. The two must stay in sync.`
)
}
writeFileSync(join(dir, 'home.html'), html.replace(NOINDEX_TAG, ''))
},
})
// https://vitejs.dev/config/
export default defineConfig(({ mode }) => {
const env = loadEnv(mode, process.cwd())
@@ -66,6 +84,7 @@ export default defineConfig(({ mode }) => {
},
],
}),
homePage(),
env.VITE_ANALYZE === 'true' &&
visualizer({
open: true,
@@ -51,6 +51,7 @@ data:
add_header Cache-Control "no-cache, no-store, must-revalidate";
add_header Pragma "no-cache" always;
add_header Expires 0 always;
add_header X-Robots-Tag "noindex, nofollow" always;
set $ms_domains "https://*.live.com https://*.office.com https://*.microsoft.com https://*.office365.com https://*.sharepoint.com";
@@ -84,6 +85,17 @@ data:
add_header Cache-Control "public, max-age=2592000";
}
location = / {
try_files /home.html /index.html;
add_header Cache-Control "no-cache, no-store, must-revalidate";
add_header Pragma "no-cache";
add_header Expires 0;
}
location = /home.html {
internal;
}
# Serve static files
location / {
try_files $uri $uri/ /index.html;
@@ -91,6 +103,7 @@ data:
add_header Cache-Control "no-cache, no-store, must-revalidate";
add_header Pragma "no-cache"; # HTTP 1.0 header for backward compatibility
add_header Expires 0;
add_header X-Robots-Tag "noindex, nofollow" always;
}
# Optionally, handle 404 errors by redirecting to index.html
+2 -2
View File
@@ -1,12 +1,12 @@
{
"name": "mail_mjml",
"version": "1.36.3",
"version": "1.37.0",
"lockfileVersion": 3,
"requires": true,
"packages": {
"": {
"name": "mail_mjml",
"version": "1.36.3",
"version": "1.37.0",
"license": "MIT",
"dependencies": {
"@html-to/text-cli": "0.6.1",
+1 -1
View File
@@ -1,6 +1,6 @@
{
"name": "mail_mjml",
"version": "1.36.3",
"version": "1.37.0",
"description": "An util to generate html and text django's templates from mjml templates",
"type": "module",
"dependencies": {
+2 -2
View File
@@ -1,12 +1,12 @@
{
"name": "sdk",
"version": "1.36.3",
"version": "1.37.0",
"lockfileVersion": 3,
"requires": true,
"packages": {
"": {
"name": "sdk",
"version": "1.36.3",
"version": "1.37.0",
"license": "ISC",
"workspaces": [
"./library",
+1 -1
View File
@@ -1,6 +1,6 @@
{
"name": "sdk",
"version": "1.36.3",
"version": "1.37.0",
"author": "",
"license": "ISC",
"description": "",
+1 -1
View File
@@ -1,7 +1,7 @@
[project]
name = "summary"
version = "1.36.3"
version = "1.37.0"
requires-python = ">=3.13"
dependencies = [
"certifi>=2026.10.19",
+1 -1
View File
@@ -1484,7 +1484,7 @@ wheels = [
[[package]]
name = "summary"
version = "1.36.3"
version = "1.37.0"
source = { editable = "." }
dependencies = [
{ name = "boto3" },