🔒️(backend) upgrade base image to python:3.13.15-alpine3.24

Fixes an XML injection attack in libexpat (CVE-2026-93990)

.codespellrc

@@ -1,9 +0,0 @@
-[codespell]
-# Files that are not English, or generated
-skip = ./.git,*.pdf,*.po,*.pot,*.json,*.lock,package-lock.json,
-  ./LICENSES,
-  ./src/summary/summary/core/locales,
-  ./src/summary/summary/core/prompt.py
-# Valid words in French (connexion) or in the code (statics)
-ignore-words-list = connexion,statics
-check-filenames = true

.github/ISSUE_TEMPLATE/Bug_report.md

@@ -0,0 +1,28 @@
+---
+name: 🐛 Bug Report
+about: If something is not working as expected 🤔.
+
+---
+
+## Bug Report
+
+**Problematic behavior**
+A clear and concise description of the behavior.
+
+**Expected behavior/code**
+A clear and concise description of what you expected to happen (or code).
+
+**Steps to Reproduce**
+1. Do this...
+2. Then this...
+3. And then the bug happens!
+
+**Environment**
+- Meet version:
+- Platform:
+
+**Possible Solution**
+<!--- Only if you have suggestions on a fix for the bug -->
+
+**Additional context/Screenshots**
+Add any other context about the problem here. If applicable, add screenshots to help explain.

.github/ISSUE_TEMPLATE/Feature_request.md

@@ -0,0 +1,23 @@
+---
+name: ✨ Feature Request
+about: I have a suggestion (and may want to build it 💪)!
+
+---
+
+## Feature Request
+
+**Is your feature request related to a problem or unsupported use case? Please describe.**
+A clear and concise description of what the problem is. For example: I need to do some task and I have an issue...
+
+**Describe the solution you'd like**
+A clear and concise description of what you want to happen. Add any considered drawbacks.
+
+**Describe alternatives you've considered**
+A clear and concise description of any alternative solutions or features you've considered.
+
+**Discovery, Documentation, Adoption, Migration Strategy**
+If you can, explain how users will be able to use this and possibly write out a version the docs (if applicable).
+Maybe a screenshot or design?
+
+**Do you want to work on it through a Pull Request?**
+<!-- Make sure to coordinate with us before you spend too much time working on an implementation! -->

.github/ISSUE_TEMPLATE/Support_question.md

@@ -0,0 +1,22 @@
+---
+name: 🤗 Support Question
+about: If you have a question 💬, or something was not clear from the docs!
+
+---
+
+<!-- ^ Click "Preview" for a nicer view! ^
+We primarily use GitHub as an issue tracker. If however you're encountering an issue not covered in the docs, we may be able to help! -->
+
+---
+
+Please make sure you have read our [main Readme](https://github.com/numerique-gouv/meet).
+
+Also make sure it was not already answered in [an open or close issue](https://github.com/numerique-gouv/meet/issues).
+
+If your question was not covered, and you feel like it should be, fire away! We'd love to improve our docs! 👌
+
+**Topic**
+What's the general area of your question: for example, docker setup, database schema, search functionality,...
+
+**Question**
+Try to be as specific as possible so we can help you as best we can. Please be patient 🙏

.github/PULL_REQUEST_TEMPLATE.md

@@ -0,0 +1,11 @@
+## Purpose
+
+Description...
+
+
+## Proposal
+
+Description...
+
+- [] item 1...
+- [] item 2...

.github/workflows/changelog.yml

@@ -1,19 +0,0 @@
-name: Changelog Workflow
-
-on:
-  push:
-    branches:
-      - main
-  pull_request:
-    types: [opened, synchronize, reopened, labeled, unlabeled]
-
-permissions:
-  contents: read
-
-concurrency:
-  group: ${{ github.workflow }}-${{ github.ref }}-${{ github.event.pull_request.number || github.sha }}
-  cancel-in-progress: true
-
-jobs:
-  changelog:
-    uses: suitenumerique/ci/.github/workflows/_changelog.yml@main

.github/workflows/ci.yml

@@ -11,30 +11,180 @@ permissions:
   contents: read
 
 jobs:
+  lint-git:
+    runs-on: ubuntu-latest
+    if: github.event_name == 'pull_request' # Makes sense only for pull requests
+    permissions:
+      contents: read
+    steps:
+      - name: Checkout repository
+        uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6.1.0
+        with:
+          fetch-depth: 0
+      - name: show
+        run: git log
+      - name: Enforce absence of print statements in code
+        if: always()
+        run: |
+          ! git diff origin/${{ github.event.pull_request.base.ref }}..HEAD -- . ':(exclude).github/workflows/**' | grep "print("
+      - name: Check absence of fixup commits
+        if: always()
+        run: |
+          ! git log | grep 'fixup!'
+      - name: Install uv
+        if: always()
+        uses: astral-sh/setup-uv@37802adc94f370d6bfd71619e3f0bf239e1f3b78 # v7.6.0
+      - name: Lint commit messages added to main
+        if: always()
+        run: uvx --no-build --from gitlint-core==0.19.1 gitlint --commits origin/${{ github.event.pull_request.base.ref }}..HEAD
 
-  lint-python:
-    name: lint ${{ matrix.service }}
-    strategy:
-      fail-fast: false
-      matrix:
-        include:
-          - service: backend
-            working_directory: src/backend
-            pylint_targets: meet demo core
-          - service: agents
-            working_directory: src/agents
-            pylint_targets: ""
-          - service: summary
-            working_directory: src/summary
-            pylint_targets: ""
-    uses: suitenumerique/ci/.github/workflows/_python-lint.yml@main
-    with:
-      working_directory: ${{ matrix.working_directory }}
-      python_version: "3.13"
-      pylint_targets: ${{ matrix.pylint_targets }}
+  check-changelog:
+    runs-on: ubuntu-latest
+    if: |
+      contains(github.event.pull_request.labels.*.name, 'noChangeLog') == false &&
+      github.event_name == 'pull_request'
+    permissions:
+        contents: read
+    steps:
+      - name: Checkout repository
+        uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6.1.0
+        with:
+          fetch-depth: 50
+      - name: Check that the CHANGELOG has been modified in the current branch
+        run: git diff --name-only ${{ github.event.pull_request.base.sha }} ${{ github.event.after }} | grep 'CHANGELOG.md'
+
+  lint-changelog:
+    runs-on: ubuntu-latest
+    permissions:
+      contents: read
+    steps:
+      - name: Checkout repository
+        uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6.1.0
+      - name: Check CHANGELOG max line length
+        run: |
+          max_line_length=$(cat CHANGELOG.md | grep -Ev "^\[.*\]: https://github.com" | wc -L)
+          if [ $max_line_length -ge 80 ]; then
+            echo "ERROR: CHANGELOG has lines longer than 80 characters."
+            exit 1
+          fi
+
+  build-mails:
+    runs-on: ubuntu-latest
+    permissions:
+      contents: read
+    defaults:
+      run:
+        working-directory: src/mail
+    steps:
+      - name: Checkout repository
+        uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6.1.0
+
+      - name: Install Node.js
+        uses: actions/setup-node@249970729cb0ef3589644e2896645e5dc5ba9c38 # v6.5.0
+        with:
+          node-version: "22"
+
+      - name: Restore the mail templates
+        uses: actions/cache@caa296126883cff596d87d8935842f9db880ef25 # v5.1.0
+        id: mail-templates
+        with:
+          path: "src/backend/core/templates/mail"
+          key: mail-templates-${{ hashFiles('src/mail/mjml') }}
+
+      - name: Install yarn
+        if: steps.mail-templates.outputs.cache-hit != 'true'
+        run: npm install -g --ignore-scripts yarn@1.22.22
+
+      - name: Install node dependencies
+        if: steps.mail-templates.outputs.cache-hit != 'true'
+        run: yarn install --frozen-lockfile --ignore-scripts
+
+      - name: Build mails
+        if: steps.mail-templates.outputs.cache-hit != 'true'
+        run: yarn build
+
+      - name: Cache mail templates
+        if: steps.mail-templates.outputs.cache-hit != 'true'
+        uses: actions/cache@caa296126883cff596d87d8935842f9db880ef25 # v5.1.0
+        with:
+          path: "src/backend/core/templates/mail"
+          key: mail-templates-${{ hashFiles('src/mail/mjml') }}
+
+  lint-back:
+    runs-on: ubuntu-latest
+    permissions:
+      contents: read
+    defaults:
+      run:
+        working-directory: src/backend
+    steps:
+      - name: Checkout repository
+        uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6.1.0
+      - name: Install Python
+        uses: actions/setup-python@ece7cb06caefa5fff74198d8649806c4678c61a1 # v6.3.0
+        with:
+          python-version: "3.13"
+      - name: Install uv
+        uses: astral-sh/setup-uv@37802adc94f370d6bfd71619e3f0bf239e1f3b78 # v7.6.0
+      - name: Install the project
+        run: uv sync --locked --all-extras
+
+      - name: Check code formatting with ruff
+        run: uv run --no-sync --no-build ruff format . --diff
+      - name: Lint code with ruff
+        run: uv run --no-sync --no-build ruff check .
+      - name: Lint code with pylint
+        run: uv run --no-sync --no-build pylint meet demo core
+
+  lint-agents:
+    runs-on: ubuntu-latest
+    permissions:
+      contents: read
+    defaults:
+      run:
+        working-directory: src/agents
+    steps:
+      - name: Checkout repository
+        uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6.1.0
+      - name: Install Python
+        uses: actions/setup-python@ece7cb06caefa5fff74198d8649806c4678c61a1 # v6.3.0
+        with:
+          python-version: "3.13"
+      - name: Install uv
+        uses: astral-sh/setup-uv@37802adc94f370d6bfd71619e3f0bf239e1f3b78 # v7.6.0
+      - name: Install the project
+        run: uv sync --locked --all-extras --no-build
+      - name: Check code formatting with ruff
+        run: uv run --no-sync --no-build ruff format . --diff
+      - name: Lint code with ruff
+        run: uv run --no-sync --no-build ruff check .
+
+  lint-summary:
+    runs-on: ubuntu-latest
+    permissions:
+      contents: read
+    defaults:
+      run:
+        working-directory: src/summary
+    steps:
+      - name: Checkout repository
+        uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6.1.0
+      - name: Install Python
+        uses: actions/setup-python@ece7cb06caefa5fff74198d8649806c4678c61a1 # v6.3.0
+        with:
+          python-version: "3.13"
+      - name: Install uv
+        uses: astral-sh/setup-uv@37802adc94f370d6bfd71619e3f0bf239e1f3b78 # v7.6.0
+      - name: Install the project
+        run: uv sync --locked --all-extras
+      - name: Check code formatting with ruff
+        run: uv run --no-sync --no-build ruff format . --diff
+      - name: Lint code with ruff
+        run: uv run --no-sync --no-build ruff check .
 
   test-back:
     runs-on: ubuntu-latest
+    needs: build-mails
     permissions:
       contents: read
     defaults:
@@ -93,8 +243,12 @@ jobs:
           sudo mkdir -p /data/media && \
           sudo mkdir -p /data/static
 
-      - name: Build or restore the mail templates
-        uses: suitenumerique/ci/actions/mail-templates@main
+      - name: Restore the mail templates
+        uses: actions/cache@caa296126883cff596d87d8935842f9db880ef25 # v5.1.0
+        id: mail-templates
+        with:
+          path: "src/backend/core/templates/mail"
+          key: mail-templates-${{ hashFiles('src/mail/mjml') }}
 
       - name: Start MinIO
         run: |

.github/workflows/code-quality.yml

@@ -1,18 +0,0 @@
-name: Project quality Workflow
-
-on:
-  pull_request:
-
-permissions:
-  contents: read
-
-concurrency:
-  group: ${{ github.workflow }}-${{ github.ref }}-${{ github.event.pull_request.number || github.sha }}
-  cancel-in-progress: true
-
-jobs:
-  quality:
-    uses: suitenumerique/ci/.github/workflows/_project-quality.yml@main
-    with:
-      print_check_paths: src/backend src/summary src/agents
-      codespell_ignore_words: ""

.github/workflows/crowdin-download.yml

@@ -0,0 +1,33 @@
+name: Download Crowdin translations
+
+on:
+  workflow_dispatch:
+    types: [file-fully-translated]
+
+permissions:
+  contents: write
+  pull-requests: write
+
+jobs:
+  crowdin:
+    runs-on: ubuntu-latest
+    steps:
+      - name: Checkout
+        uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6.1.0
+
+      - name: Download Crowdin files
+        uses: crowdin/github-action@c7af9bc98b01694653031fef2a0dc6c7888ce9bc # v2.17.0
+        with:
+          upload_sources: false
+          upload_translations: false
+          download_translations: true
+          localization_branch_name: l10n_crowdin_translations
+          create_pull_request: true
+          pull_request_title: "New Crowdin translations"
+          pull_request_body: "New Crowdin pull request with translations"
+          pull_request_base_branch_name: "main"
+        env:
+          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+          CROWDIN_PROJECT_ID: ${{ secrets.CROWDIN_PROJECT_ID }}
+          CROWDIN_PERSONAL_TOKEN: ${{ secrets.CROWDIN_PERSONAL_TOKEN }}
+          CROWDIN_BASE_PATH: ${{ github.workspace }}

.github/workflows/docker-hub.yml

@@ -1,5 +1,5 @@
-name: Docker images
-run-name: Docker images
+name: Docker Hub Workflow
+run-name: Docker Hub Workflow
 
 on:
   workflow_dispatch:
@@ -15,61 +15,265 @@ on:
 permissions:
   contents: read
 
+env:
+  DOCKER_USER: 1001:127
+  DOCKER_CONTAINER_REGISTRY_HOSTNAME: docker.io
+  DOCKER_CONTAINER_REGISTRY_NAMESPACE: lasuite
+  IS_MULTI_PLATFORM_BUILD: ${{ startsWith(github.ref, 'refs/tags/v') }}
+  BUILD_PLATFORMS: ${{ startsWith(github.ref, 'refs/tags/v') && 'linux/amd64,linux/arm64' || 'linux/amd64' }}
+
 jobs:
-  build-and-push:
-    name: ${{ matrix.service }}
-    strategy:
-      fail-fast: false
-      matrix:
-        include:
-          - service: backend
-            image_name: lasuite/meet-backend
-            context: .
-            file: ./Dockerfile
-            target: backend-production
-          - service: frontend
-            image_name: lasuite/meet-frontend
-            context: .
-            file: ./src/frontend/Dockerfile
-            target: frontend-production
-          - service: frontend-dinum
-            image_name: lasuite/meet-frontend-dinum
-            context: .
-            file: ./docker/dinum-frontend/Dockerfile
-            target: frontend-production
-          - service: summary
-            image_name: lasuite/meet-summary
-            context: ./src/summary
-            file: ./src/summary/Dockerfile
-            target: production
-          - service: agents
-            image_name: lasuite/meet-agents
-            context: ./src/agents
-            file: ./src/agents/Dockerfile
-            target: production
-    uses: suitenumerique/ci/.github/workflows/_docker-publish.yml@main
-    with:
-      image_name: ${{ matrix.image_name }}
-      context: ${{ matrix.context }}
-      file: ${{ matrix.file }}
-      target: ${{ matrix.target }}
-      docker_user: "1001:127"
-      is_multi_platform: ${{ startsWith(github.ref, 'refs/tags/v') }}
-      should_push: ${{ github.event_name != 'pull_request' || startsWith(github.head_ref, 'integration/') }}
-      trivy_scan: true
-    secrets:
-      DOCKER_HUB_USER: ${{ secrets.DOCKER_HUB_USER }}
-      DOCKER_HUB_PASSWORD: ${{ secrets.DOCKER_HUB_PASSWORD }}
+  build-and-push-backend:
+    runs-on: ubuntu-latest
+    permissions:
+      contents: read
+    steps:
+      -
+        name: Checkout repository
+        uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6.1.0
+      -
+        name: Set up QEMU
+        if: env.IS_MULTI_PLATFORM_BUILD == 'true'
+        uses: docker/setup-qemu-action@c7c53464625b32c7a7e944ae62b3e17d2b600130 # v3.7.0
+      -
+        name: Set up Docker Buildx
+        uses: docker/setup-buildx-action@8d2750c68a42422c14e847fe6c8ac0403b4cbd6f # v3.12.0
+      -
+        name: Docker meta
+        id: meta
+        uses: docker/metadata-action@c299e40c65443455700f0fdfc63efafe5b349051 # v5.10.0
+        with:
+          images: '${{ env.DOCKER_CONTAINER_REGISTRY_NAMESPACE }}/meet-backend'
+      -
+        name: Login to DockerHub
+        if: github.event_name != 'pull_request' || startsWith(github.head_ref, 'integration/')
+        uses: docker/login-action@c94ce9fb468520275223c153574b00df6fe4bcc9 # v3.7.0
+        with:
+          username: ${{ secrets.DOCKER_HUB_USER }}
+          password: ${{ secrets.DOCKER_HUB_PASSWORD }}
+      -
+        name: Run trivy scan
+        uses: numerique-gouv/action-trivy-cache@d6e94cfb488f03a0b3e8b8739aad94e74d24d8da # main
+        with:
+          docker-build-args: '--target backend-production -f Dockerfile'
+          docker-image-name: '${{ env.DOCKER_CONTAINER_REGISTRY_HOSTNAME }}/${{ env.DOCKER_CONTAINER_REGISTRY_NAMESPACE }}/meet-backend:${{ github.sha }}'
+      -
+        name: Build and push
+        uses: docker/build-push-action@10e90e3645eae34f1e60eeb005ba3a3d33f178e8 # v6.19.2
+        with:
+          context: .
+          target: backend-production
+          platforms: ${{ env.BUILD_PLATFORMS }}
+          build-args: DOCKER_USER=${{ env.DOCKER_USER }}:-1000
+          push: ${{ github.event_name != 'pull_request' || startsWith(github.head_ref, 'integration/') }}
+          tags: ${{ steps.meta.outputs.tags }}
+          labels: ${{ steps.meta.outputs.labels }}
+
+  build-and-push-frontend-generic:
+    runs-on: ubuntu-latest
+    permissions:
+      contents: read
+    steps:
+      -
+        name: Checkout repository
+        uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6.1.0
+      -
+        name: Set up QEMU
+        if: env.IS_MULTI_PLATFORM_BUILD == 'true'
+        uses: docker/setup-qemu-action@c7c53464625b32c7a7e944ae62b3e17d2b600130 # v3.7.0
+      -
+        name: Set up Docker Buildx
+        uses: docker/setup-buildx-action@8d2750c68a42422c14e847fe6c8ac0403b4cbd6f # v3.12.0
+      -
+        name: Docker meta
+        id: meta
+        uses: docker/metadata-action@c299e40c65443455700f0fdfc63efafe5b349051 # v5.10.0
+        with:
+          images: '${{ env.DOCKER_CONTAINER_REGISTRY_NAMESPACE }}/meet-frontend'
+      -
+        name: Login to DockerHub
+        if: github.event_name != 'pull_request' || startsWith(github.head_ref, 'integration/')
+        uses: docker/login-action@c94ce9fb468520275223c153574b00df6fe4bcc9 # v3.7.0
+        with:
+          username: ${{ secrets.DOCKER_HUB_USER }}
+          password: ${{ secrets.DOCKER_HUB_PASSWORD }}
+      -
+        name: Run trivy scan
+        uses: numerique-gouv/action-trivy-cache@d6e94cfb488f03a0b3e8b8739aad94e74d24d8da # main
+        with:
+          docker-build-args: '-f src/frontend/Dockerfile --target frontend-production'
+          docker-image-name: '${{ env.DOCKER_CONTAINER_REGISTRY_HOSTNAME }}/${{ env.DOCKER_CONTAINER_REGISTRY_NAMESPACE }}/meet-frontend:${{ github.sha }}'
+      -
+        name: Build and push
+        uses: docker/build-push-action@10e90e3645eae34f1e60eeb005ba3a3d33f178e8 # v6.19.2
+        with:
+          context: .
+          file: ./src/frontend/Dockerfile
+          target: frontend-production
+          platforms: ${{ env.BUILD_PLATFORMS }}
+          build-args: DOCKER_USER=${{ env.DOCKER_USER }}:-1000
+          push: ${{ github.event_name != 'pull_request' || startsWith(github.head_ref, 'integration/') }}
+          tags: ${{ steps.meta.outputs.tags }}
+          labels: ${{ steps.meta.outputs.labels }}
+
+  build-and-push-frontend-dinum:
+    runs-on: ubuntu-latest
+    permissions:
+      contents: read
+    steps:
+      -
+        name: Checkout repository
+        uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6.1.0
+      -
+        name: Set up QEMU
+        if: env.IS_MULTI_PLATFORM_BUILD == 'true'
+        uses: docker/setup-qemu-action@c7c53464625b32c7a7e944ae62b3e17d2b600130 # v3.7.0
+      -
+        name: Set up Docker Buildx
+        uses: docker/setup-buildx-action@8d2750c68a42422c14e847fe6c8ac0403b4cbd6f # v3.12.0
+      -
+        name: Docker meta
+        id: meta
+        uses: docker/metadata-action@c299e40c65443455700f0fdfc63efafe5b349051 # v5.10.0
+        with:
+          images: '${{ env.DOCKER_CONTAINER_REGISTRY_NAMESPACE }}/meet-frontend-dinum'
+      -
+        name: Login to DockerHub
+        if: github.event_name != 'pull_request' || startsWith(github.head_ref, 'integration/')
+        uses: docker/login-action@c94ce9fb468520275223c153574b00df6fe4bcc9 # v3.7.0
+        with:
+          username: ${{ secrets.DOCKER_HUB_USER }}
+          password: ${{ secrets.DOCKER_HUB_PASSWORD }}
+      -
+        name: Run trivy scan
+        uses: numerique-gouv/action-trivy-cache@d6e94cfb488f03a0b3e8b8739aad94e74d24d8da # main
+        with:
+          docker-build-args: '-f docker/dinum-frontend/Dockerfile --target frontend-production'
+          docker-image-name: '${{ env.DOCKER_CONTAINER_REGISTRY_HOSTNAME }}/${{ env.DOCKER_CONTAINER_REGISTRY_NAMESPACE }}/meet-frontend-dinum:${{ github.sha }}'
+      -
+        name: Build and push
+        uses: docker/build-push-action@10e90e3645eae34f1e60eeb005ba3a3d33f178e8 # v6.19.2
+        with:
+          context: .
+          file: ./docker/dinum-frontend/Dockerfile
+          target: frontend-production
+          platforms: ${{ env.BUILD_PLATFORMS }}
+          build-args: DOCKER_USER=${{ env.DOCKER_USER }}:-1000
+          push: ${{ github.event_name != 'pull_request' || startsWith(github.head_ref, 'integration/') }}
+          tags: ${{ steps.meta.outputs.tags }}
+          labels: ${{ steps.meta.outputs.labels }}
+
+  build-and-push-summary:
+    runs-on: ubuntu-latest
+    permissions:
+      contents: read
+    steps:
+      -
+        name: Checkout repository
+        uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6.1.0
+      -
+        name: Set up QEMU
+        if: env.IS_MULTI_PLATFORM_BUILD == 'true'
+        uses: docker/setup-qemu-action@c7c53464625b32c7a7e944ae62b3e17d2b600130 # v3.7.0
+      -
+        name: Set up Docker Buildx
+        uses: docker/setup-buildx-action@8d2750c68a42422c14e847fe6c8ac0403b4cbd6f # v3.12.0
+      -
+        name: Docker meta
+        id: meta
+        uses: docker/metadata-action@c299e40c65443455700f0fdfc63efafe5b349051 # v5.10.0
+        with:
+          images: '${{ env.DOCKER_CONTAINER_REGISTRY_NAMESPACE }}/meet-summary'
+      -
+        name: Login to DockerHub
+        if: github.event_name != 'pull_request' || startsWith(github.head_ref, 'integration/')
+        uses: docker/login-action@c94ce9fb468520275223c153574b00df6fe4bcc9 # v3.7.0
+        with:
+          username: ${{ secrets.DOCKER_HUB_USER }}
+          password: ${{ secrets.DOCKER_HUB_PASSWORD }}
+      -
+        name: Run trivy scan
+        uses: numerique-gouv/action-trivy-cache@d6e94cfb488f03a0b3e8b8739aad94e74d24d8da # main
+        continue-on-error: true
+        with:
+          docker-build-args: '-f src/summary/Dockerfile --target production'
+          docker-image-name: '${{ env.DOCKER_CONTAINER_REGISTRY_HOSTNAME }}/${{ env.DOCKER_CONTAINER_REGISTRY_NAMESPACE }}/meet-summary:${{ github.sha }}'
+          docker-context: './src/summary'
+      -
+        name: Build and push
+        uses: docker/build-push-action@10e90e3645eae34f1e60eeb005ba3a3d33f178e8 # v6.19.2
+        with:
+          context: ./src/summary
+          file: ./src/summary/Dockerfile
+          target: production
+          platforms: ${{ env.BUILD_PLATFORMS }}
+          build-args: DOCKER_USER=${{ env.DOCKER_USER }}:-1000
+          push: ${{ github.event_name != 'pull_request' || startsWith(github.head_ref, 'integration/') }}
+          tags: ${{ steps.meta.outputs.tags }}
+          labels: ${{ steps.meta.outputs.labels }}
+
+  build-and-push-agents:
+    runs-on: ubuntu-latest
+    permissions:
+      contents: read
+    steps:
+      -
+        name: Checkout repository
+        uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6.1.0
+      -
+        name: Set up QEMU
+        if: env.IS_MULTI_PLATFORM_BUILD == 'true'
+        uses: docker/setup-qemu-action@c7c53464625b32c7a7e944ae62b3e17d2b600130 # v3.7.0
+      -
+        name: Set up Docker Buildx
+        uses: docker/setup-buildx-action@8d2750c68a42422c14e847fe6c8ac0403b4cbd6f # v3.12.0
+      -
+        name: Docker meta
+        id: meta
+        uses: docker/metadata-action@c299e40c65443455700f0fdfc63efafe5b349051 # v5.10.0
+        with:
+          images: lasuite/meet-agents
+      -
+        name: Login to DockerHub
+        if: github.event_name != 'pull_request' || startsWith(github.head_ref, 'integration/')
+        uses: docker/login-action@c94ce9fb468520275223c153574b00df6fe4bcc9 # v3.7.0
+        with:
+          username: ${{ secrets.DOCKER_HUB_USER }}
+          password: ${{ secrets.DOCKER_HUB_PASSWORD }}
+      -
+        name: Run trivy scan
+        uses: numerique-gouv/action-trivy-cache@d6e94cfb488f03a0b3e8b8739aad94e74d24d8da # main
+        continue-on-error: true
+        with:
+          docker-build-args: '-f src/agents/Dockerfile --target production'
+          docker-image-name: '${{ env.DOCKER_CONTAINER_REGISTRY_HOSTNAME }}/${{ env.DOCKER_CONTAINER_REGISTRY_NAMESPACE }}/meet-agents:${{ github.sha }}'
+          docker-context: './src/agents'
+      -
+        name: Build and push
+        uses: docker/build-push-action@10e90e3645eae34f1e60eeb005ba3a3d33f178e8 # v6.19.2
+        with:
+          context: ./src/agents
+          file: ./src/agents/Dockerfile
+          target: production
+          platforms: ${{ env.BUILD_PLATFORMS }}
+          build-args: DOCKER_USER=${{ env.DOCKER_USER }}:-1000
+          push: ${{ github.event_name != 'pull_request' || startsWith(github.head_ref, 'integration/') }}
+          tags: ${{ steps.meta.outputs.tags }}
+          labels: ${{ steps.meta.outputs.labels }}
 
   notify-argocd:
     permissions:
       contents: read
     needs:
-      - build-and-push
+      - build-and-push-frontend-generic
+      - build-and-push-frontend-dinum
+      - build-and-push-backend
+      - build-and-push-summary
+      - build-and-push-agents
     runs-on: ubuntu-latest
     if: github.event_name != 'pull_request'
     steps:
-      - uses: suitenumerique/ci/actions/argocd-webhook-notification@main
+      - uses: numerique-gouv/action-argocd-webhook-notification@cac2ee67896eb13e84e804f60c4271370424eaa8 # main
         id: notify
         with:
           deployment_repo_path: "${{ secrets.DEPLOYMENT_REPO_URL }}"

.github/workflows/release-helm-chart.yaml

@@ -1,17 +1,33 @@
-name: Release Helm chart
+name: Release Chart
+run-name: Release Chart
 
 on:
   push:
-    branches:
-      - main
     paths:
       - src/helm/meet/**
 
-permissions:
-  contents: read
-
 jobs:
   release:
     permissions:
       contents: write
-    uses: suitenumerique/ci/.github/workflows/_release-helm-chart.yml@main
+    runs-on: ubuntu-latest
+    steps:
+      - name: Checkout
+        uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6.1.0
+        with:
+          fetch-depth: 0
+
+      - name: Cleanup
+        run: rm -rf ./src/helm/extra
+
+      - name: Install Helm
+        uses: azure/setup-helm@1a275c3b69536ee54be43f2070a358922e12c8d4 # v4.3.1
+        env:
+          GITHUB_TOKEN: "${{ secrets.GITHUB_TOKEN }}"
+
+      - name: Publish Helm charts
+        uses: numerique-gouv/helm-gh-pages@2cf477ae49d7c70037ceb1685803f4f7bad9b981 # add-overwrite-option
+        with:
+          charts_dir: ./src/helm
+          linting: on
+          token: ${{ secrets.GITHUB_TOKEN }}

.github/workflows/security.yml

@@ -1,21 +0,0 @@
-name: Security analysis
-
-on:
-  push:
-    branches:
-      - main
-  pull_request:
-    branches:
-      - "**"
-
-permissions: {}
-
-jobs:
-  zizmor:
-    permissions:
-      contents: read
-      actions: read
-      security-events: write
-    uses: suitenumerique/ci/.github/workflows/_zizmor.yml@main
-    with:
-      config: .github/zizmor.yml

.github/zizmor.yml

@@ -1,5 +0,0 @@
-rules:
-  unpinned-uses:
-    config:
-      policies:
-        "suitenumerique/*": ref-pin

CHANGELOG.md

@@ -8,15 +8,6 @@ and this project adheres to
 
 ## [Unreleased]
 
-## [1.32.1] - 2026-09-25
-
-### Fixed
-
-- 🔒️(backend) fix CVE-2026-73228 and CVE-2026-73229 in drf
-- 🔒️(agent) fix CRITICAL CVE-2026-63072 / CVE-2026-63073 in libssl3t64
-
-## [1.32.0] - 2026-09-25
-
 ### Added
 
 - ✨(backend) make the LiveKit default video codec configurable
@@ -25,7 +16,6 @@ and this project adheres to
 
 ### Changed
 
-- 🔥(backend) remove unused API viewset and permission helpers
 - 🔊(backend) pin the dockerflow logger level to WARNING
 - 🚑️(summary) serve health endpoints with the dockerflow router
 - ♻️(backend) serve the dockerflow views early in the middleware stack
@@ -37,9 +27,8 @@ and this project adheres to
 - ⬆️(frontend) upgrade posthog-js from 1.414.0 to 1.418.10
 - ⬆️(addons) upgrade i18next from 26.3.6 to 26.4.0
 - ⬆️(frontend) upgrade humanize-duration from 3.33.2 to 3.34.1
-- ⬆️(addons) upgrade i18next from 26.4.0 to 26.4.2
+- ⬆️(addons) upgrade i18next from 26.4.0 to 26.4.1
 - 🔖(helm) release chart 0.0.28
-- ♻️(backend) decouple recording event handling from LiveKit egress statuses
 
 ### Fixed
 
@@ -53,10 +42,7 @@ and this project adheres to
 - 🔒️(backend) reject inactive users in resource server backend
 - 🐛(frontend) fix file permissions in the Docker image
 - 🚸(frontend) inform user that recording waits until a track is published
-- 🔒(backend) upgrade base image to python:3.13.5-alpine3.24
-- 🐛(backend) handle failed and aborted egresses
-- 🩹(frontend) notify participants when a recording fails or is aborted
-- 🔒️(frontend) fix HIGH CVE-2026-93990 in libexpat
+- 🔒(backend) upgrade base image to python:3.13.15-alpine3.24
 
 ## [1.31.0] - 2026-09-08
 
@@ -374,7 +360,7 @@ and this project adheres to
 
 ### Fixed
 
-- ♿️(frontend) improve accessibility of the Effects panel #1401
+- ♿️(frontend) improve accessibilty of the Effects panel #1401
 
 ## [1.20.0] - 2026-06-12
 

bin/_config.sh

@@ -55,12 +55,12 @@ function _docker_compose() {
 function _dc_run() {
     _set_user
 
-    user_args=()
-    if [ -n "$USER_ID" ]; then
-        user_args=("--user=$USER_ID")
+    user_args="--user=$USER_ID"
+    if [ -z $USER_ID ]; then
+        user_args=""
     fi
 
-    _docker_compose run --rm "${user_args[@]}" "$@"
+    _docker_compose run --rm $user_args "$@"
 }
 
 # _dc_exec: wrap docker compose exec command
@@ -74,12 +74,12 @@ function _dc_exec() {
 
     echo "🐳(compose) exec command: '\$@'"
 
-    user_args=()
-    if [ -n "$USER_ID" ]; then
-        user_args=("--user=$USER_ID")
+    user_args="--user=$USER_ID"
+    if [ -z $USER_ID ]; then
+        user_args=""
     fi
 
-    _docker_compose exec "${user_args[@]}" "$@"
+    _docker_compose exec $user_args "$@"
 }
 
 # _django_manage: wrap django's manage.py command with docker compose

bin/buildpack_postfrontend.sh

@@ -40,7 +40,7 @@ if [ -n "$CUSTOM_LOGO_URL" ]; then
     [[ "$IS_SVG" == false ]] && echo "[custom-logo] ERROR: not a valid SVG file" >&2 && exit 1
 
     mv -f "$TMP_FILE" "$LOGO_FILE"
-    echo "[custom-logo] INFO: Custom logo downloaded successfully"
+    echo "[custom-logo] INFO: Custom logo downloaded successfuly"
 fi
 
 mv src/backend/* ./

bin/buildpack_start.sh

@@ -7,7 +7,7 @@ gunicorn -b 0.0.0.0:8000 meet.wsgi:application --log-file - &
 bin/run &
 
 # if the current shell is killed, also terminate all its children     
-trap 'pkill -TERM -P $$' SIGTERM
+trap "pkill SIGTERM -P $$" SIGTERM
 
 # wait for a single child to finish,
 wait -n

bin/install-external-secrets.sh

@@ -1,6 +1,7 @@
 #!/usr/bin/env bash
 set -o errexit
 
+CURRENT_DIR=$(pwd)
 NAMESPACE=${1:-meet}
 SECRET_NAME=${2:-bitwarden-cli-meet}
 TEMP_SECRET_FILE=$(mktemp)
@@ -29,10 +30,10 @@ check_secret_exists() {
 # Collect user input securely
 get_user_input() {
     echo "Please provide the following information:"
-    read -r -p "Enter your Vaultwarden email login: " LOGIN
-    read -r -s -p "Enter your Vaultwarden password: " PASSWORD
+    read -p "Enter your Vaultwarden email login: " LOGIN
+    read -s -p "Enter your Vaultwarden password: " PASSWORD
     echo
-    read -r -p "Enter your Vaultwarden server url: " URL
+    read -p "Enter your Vaultwarden server url: " URL
 }
 
 # Create and apply the secret
@@ -76,7 +77,7 @@ main() {
         exit 0
     fi
 
-    echo -e "${TEMP_SECRET_FILE}"
+    echo -e ${TEMP_SECRET_FILE}
 
     get_user_input
     echo -e "\nCreating Vaultwarden secret…"

bin/install-hooks.sh

@@ -3,7 +3,7 @@
 mkdir -p "$(dirname -- "${BASH_SOURCE[0]}")/../.git/hooks/"
 PRE_COMMIT_FILE="$(dirname -- "${BASH_SOURCE[0]}")/../.git/hooks/pre-commit"
 
-cat <<'EOF' >"$PRE_COMMIT_FILE"
+cat <<'EOF' >$PRE_COMMIT_FILE
 #!/bin/bash
 
 # directories containing potential secrets
@@ -27,4 +27,4 @@ for d in $DIRS; do
 done
 EOF
 
-chmod +x "$PRE_COMMIT_FILE"
+chmod +x $PRE_COMMIT_FILE

bin/prepare-release.sh

@@ -68,7 +68,7 @@ fi
 
 # Ask user for release version number
 echo ""
-read -r -p "Enter release version number (e.g., 1.2.3): " VERSION
+read -p "Enter release version number (e.g., 1.2.3): " VERSION
 
 # Validate version format (basic semver check)
 if ! [[ $VERSION =~ ^[0-9]+\.[0-9]+\.[0-9]+$ ]]; then

bin/update-git-submodule.sh

@@ -1,5 +1,4 @@
 #!/usr/bin/env bash
 
 git submodule update --init --recursive
-# shellcheck disable=SC2016
 git submodule foreach 'git fetch origin; git checkout $(git rev-parse --abbrev-ref HEAD); git reset --hard origin/$(git rev-parse --abbrev-ref HEAD); git submodule update --recursive; git clean -dfx'

bin/validate-helm-configuration.sh

@@ -8,6 +8,6 @@ environments=$(awk '/environments:/ {flag=1; next} flag && NF {print} !NF {flag=
 
 for env in $environments; do
 	echo "################### $env lint ###################"
-	helmfile -e "$env" -f src/helm/helmfile.yaml lint || exit 1
+	helmfile -e $env -f src/helm/helmfile.yaml lint || exit 1
 	echo -e "\n"
 done

docker/compose.d/compose.bureautix.yml

@@ -1,7 +1,7 @@
 # Bureautix proxy overrides
 #
 # Builds submitted through the Docker API of the Podman service get none of
-# the proxy variables in their RUN steps. We need to pass the http_proxy explicitly
+# the proxy variables in their RUN steps. We need to pass the http_proxy explicitely
 # otherwise all connections fail during the build.
 
 x-proxy-vars: &proxy-vars

docker/dinum-frontend/Dockerfile

@@ -57,8 +57,7 @@ RUN npx webpack --mode production
 FROM nginxinc/nginx-unprivileged:1.30.4-alpine3.24 AS frontend-production
 
 USER root
-RUN apk upgrade --no-cache libexpat && \
-    apk del curl
+RUN apk del curl
 USER nginx
 
 USER nginx

docs/installation/kubernetes.md

@@ -317,7 +317,7 @@ These are the environmental options available on meet backend.
 | DJANGO_ALLOWED_HOSTS                            | Hosts that are allowed                                                                                                                                       | []                                                                                                                                                            |
 | DJANGO_SECRET_KEY                               | Secret key used for Django security                                                                                                                          |                                                                                                                                                               |
 | DJANGO_SILENCED_SYSTEM_CHECKS                   | Silence Django system checks                                                                                                                                 | []                                                                                                                                                            |
-| DJANGO_ALLOW_UNSECURE_USER_LISTING              | Allow insecure user listing                                                                                                                                  | false                                                                                                                                                         |
+| DJANGO_ALLOW_UNSECURE_USER_LISTING              | Allow unsecure user listing                                                                                                                                  | false                                                                                                                                                         |
 | DB_ENGINE                                       | Database engine used                                                                                                                                         | django.db.backends.postgresql_psycopg2                                                                                                                        |
 | DB_NAME                                         | Name of the database                                                                                                                                         | meet                                                                                                                                                          |
 | DB_USER                                         | User used to connect to database                                                                                                                             | dinum                                                                                                                                                         |

renovate.json

@@ -1,5 +1,5 @@
 {
-  "extends": ["github>suitenumerique/ci//renovate/default"],
+  "extends": ["github>numerique-gouv/renovate-configuration"],
   "dependencyDashboard": true,
   "labels": ["dependencies", "noChangeLog"],
   "packageRules": [

src/addons/outlook/package-lock.json

@@ -10,7 +10,7 @@
       "license": "MIT",
       "dependencies": {
         "core-js": "3.50.0",
-        "i18next": "26.4.2",
+        "i18next": "26.4.1",
         "i18next-browser-languagedetector": "8.2.1",
         "regenerator-runtime": "0.14.1"
       },
@@ -9367,9 +9367,9 @@
       }
     },
     "node_modules/i18next": {
-      "version": "26.4.2",
-      "resolved": "https://registry.npmjs.org/i18next/-/i18next-26.4.2.tgz",
-      "integrity": "sha512-RX+R0VLg13IbvRuJSxnqykUFS9vQZTl8wYpWPCIUDWVrSGjsQywB5Y+pjzrkboxGAuYfJZVH1InFTdgBdxq6ug==",
+      "version": "26.4.1",
+      "resolved": "https://registry.npmjs.org/i18next/-/i18next-26.4.1.tgz",
+      "integrity": "sha512-9YbX5E6gd1H+yaOSX3izCsPj5iWXyH7X4oC+iuHHJJw8AeHglzOK5SJf+1CHxaYKYigcea+8jvzSxqYx46YvyA==",
       "funding": [
         {
           "type": "individual",

src/addons/outlook/package.json

@@ -27,7 +27,7 @@
   },
   "dependencies": {
     "core-js": "3.50.0",
-    "i18next": "26.4.2",
+    "i18next": "26.4.1",
     "i18next-browser-languagedetector": "8.2.1",
     "regenerator-runtime": "0.14.1"
   },

src/addons/outlook/src/success/success.js

@@ -21,7 +21,7 @@ const { initI18n, translateUI } = require("../common/i18n");
         document.querySelector("#close-msg").style.display = "block";
       })
       .catch((e) => {
-        console.error(`Error occurred: ${e}`);
+        console.error(`Error occured: ${e}`);
       })
       .finally(() => {
         // NOTE: doesn't work with the desktop client — the browser considers

src/agents/Dockerfile

@@ -5,7 +5,6 @@ RUN sed -i "s|^URIs: http://|URIs: https://|" /etc/apt/sources.list.d/debian.sou
     && apt-get update && apt-get install -y --no-install-recommends  \
     libglib2.0-0 \
     libgobject-2.0-0 \
-    libssl3t64 \
     && rm -rf /var/lib/apt/lists/*
 
 

src/agents/pyproject.toml

@@ -1,7 +1,7 @@
 
 [project]
 name = "agents"
-version = "1.32.1"
+version = "1.31.0"
 requires-python = ">=3.12"
 dependencies = [
     "livekit-agents==1.6.7",

src/agents/uv.lock

@@ -9,7 +9,7 @@ resolution-markers = [
 
 [[package]]
 name = "agents"
-version = "1.32.1"
+version = "1.31.0"
 source = { virtual = "." }
 dependencies = [
     { name = "httpx" },

src/backend/core/api/permissions.py

@@ -12,6 +12,10 @@ from ..services.participants_management import (
     ParticipantsManagementException,
 )
 
+ACTION_FOR_METHOD_TO_PERMISSION = {
+    "versions_detail": {"DELETE": "versions_destroy", "GET": "versions_retrieve"}
+}
+
 
 class IsAuthenticated(permissions.BasePermission):
     """
@@ -23,6 +27,15 @@ class IsAuthenticated(permissions.BasePermission):
         return bool(request.auth) or request.user.is_authenticated
 
 
+class IsAuthenticatedOrSafe(IsAuthenticated):
+    """Allows access to authenticated users (or anonymous users but only on safe methods)."""
+
+    def has_permission(self, request, view):
+        if request.method in permissions.SAFE_METHODS:
+            return True
+        return super().has_permission(request, view)
+
+
 class IsSelf(IsAuthenticated):
     """
     Allows access only to authenticated users. Alternative method checking the presence

src/backend/core/api/viewsets.py

@@ -95,6 +95,60 @@ from .feature_flag import FeatureFlag
 logger = getLogger(__name__)
 
 
+class NestedGenericViewSet(viewsets.GenericViewSet):
+    """
+    A generic Viewset aims to be used in a nested route context.
+    e.g: `/api/v1.0/resource_1/<resource_1_pk>/resource_2/<resource_2_pk>/`
+
+    It allows to define all url kwargs and lookup fields to perform the lookup.
+    """
+
+    lookup_fields: list[str] = ["pk"]
+    lookup_url_kwargs: list[str] = []
+
+    def __getattribute__(self, file):
+        """
+        This method is overridden to allow to get the last lookup field or lookup url kwarg
+        when accessing the `lookup_field` or `lookup_url_kwarg` attribute. This is useful
+        to keep compatibility with all methods used by the parent class `GenericViewSet`.
+        """
+        if file in ["lookup_field", "lookup_url_kwarg"]:
+            return getattr(self, file + "s", [None])[-1]
+
+        return super().__getattribute__(file)
+
+    def get_queryset(self):
+        """
+        Get the list of files for this view.
+
+        `lookup_fields` attribute is enumerated here to perform the nested lookup.
+        """
+        queryset = super().get_queryset()
+
+        # The last lookup field is removed to perform the nested lookup as it corresponds
+        # to the object pk, it is used within get_object method.
+        lookup_url_kwargs = (
+            self.lookup_url_kwargs[:-1]
+            if self.lookup_url_kwargs
+            else self.lookup_fields[:-1]
+        )
+
+        filter_kwargs = {}
+        for index, lookup_url_kwarg in enumerate(lookup_url_kwargs):
+            if lookup_url_kwarg not in self.kwargs:
+                raise KeyError(
+                    f"Expected view {self.__class__.__name__} to be called with a URL "
+                    f'keyword argument named "{lookup_url_kwarg}". Fix your URL conf, or '
+                    "set the `.lookup_fields` attribute on the view correctly."
+                )
+
+            filter_kwargs.update(
+                {self.lookup_fields[index]: self.kwargs[lookup_url_kwarg]}
+            )
+
+        return queryset.filter(**filter_kwargs)
+
+
 class SerializerPerActionMixin:
     """
     A mixin to allow to define serializer classes for each action.

src/backend/core/migrations/0023_alter_recording_status.py

@@ -1,18 +0,0 @@
-# Generated by Django 5.2.16 on 2026-09-23 16:49
-
-from django.db import migrations, models
-
-
-class Migration(migrations.Migration):
-
-    dependencies = [
-        ('core', '0022_user_default_room_access_level_and_more'),
-    ]
-
-    operations = [
-        migrations.AlterField(
-            model_name='recording',
-            name='status',
-            field=models.CharField(choices=[('initiated', 'Initiated'), ('active', 'Active'), ('stopped', 'Stopped'), ('saved', 'Saved'), ('aborted', 'Aborted'), ('failed', 'Failed'), ('failed_to_start', 'Failed to Start'), ('failed_to_stop', 'Failed to Stop'), ('notification_succeeded', 'Notification succeeded'), ('external_process_successful', 'External process successful'), ('external_process_failed', 'External process failed')], default='initiated', max_length=50),
-        ),
-    ]

src/backend/core/models.py

@@ -58,7 +58,6 @@ class RecordingStatusChoices(models.TextChoices):
     STOPPED = "stopped", _("Stopped")
     SAVED = "saved", _("Saved")
     ABORTED = "aborted", _("Aborted")
-    FAILED = "failed", _("Failed")
     FAILED_TO_START = "failed_to_start", _("Failed to Start")
     FAILED_TO_STOP = "failed_to_stop", _("Failed to Stop")
     NOTIFICATION_SUCCEEDED = "notification_succeeded", _("Notification succeeded")
@@ -80,13 +79,17 @@ class RecordingStatusChoices(models.TextChoices):
             cls.STOPPED,
             cls.SAVED,
             cls.ABORTED,
-            cls.FAILED,
             cls.EXTERNAL_PROCESS_SUCCESSFUL,
             cls.EXTERNAL_PROCESS_FAILED,
             cls.FAILED_TO_START,
             cls.FAILED_TO_STOP,
         }
 
+    @classmethod
+    def is_unsuccessful(cls, status):
+        """Determine if the recording status represents an unsuccessful state."""
+        return status in {cls.ABORTED, cls.FAILED_TO_START, cls.FAILED_TO_STOP}
+
 
 class RecordingModeChoices(models.TextChoices):
     """Recording mode choices."""
@@ -579,7 +582,6 @@ class Recording(BaseModel):
     4. NOTIFICATION_SUCCEEDED: External service has been notified of this recording
 
     Error States:
-    - FAILED: Egress failed mid-recording
     - FAILED_TO_START: Worker failed to initialize recording
     - FAILED_TO_STOP: Worker failed during stop operation
     - ABORTED: Recording was terminated before completion

src/backend/core/recording/enums.py

@@ -8,50 +8,3 @@ class FileExtension(Enum):
 
     OGG = "ogg"
     MP4 = "mp4"
-
-
-class RecordingWorkerEvent(Enum):
-    """Lifecycle events a recording worker reports about a recording.
-
-    It is intended to be free of SFU-specific vocabulary.
-    """
-
-    # The worker accepted the request but is not recording yet.
-    STARTING = "starting"
-    # The worker is recording.
-    STARTED = "started"
-    # The worker stopped recording and is flushing the media file.
-    SAVING = "saving"
-
-    # The recording ended, its media file is available.
-    COMPLETED = "completed"
-    # The recording ended on its configured limit, its media file is available.
-    LIMIT_REACHED = "limit reached"
-    # The worker stopped before it ever started recording, there is no media file.
-    ABORTED = "aborted"
-    # The worker hit a runtime error once recording had started; its media file
-    # may be available.
-    FAILED = "failed"
-
-    @classmethod
-    def is_terminal(cls, event):
-        """Determine if the event ends the recording's lifecycle (successful or not)."""
-
-        return event in TERMINAL_EVENTS
-
-
-SUCCESSFUL_EVENTS = frozenset(
-    {
-        RecordingWorkerEvent.COMPLETED,
-        RecordingWorkerEvent.LIMIT_REACHED,
-    }
-)
-
-UNSUCCESSFUL_EVENTS = frozenset(
-    {
-        RecordingWorkerEvent.ABORTED,
-        RecordingWorkerEvent.FAILED,
-    }
-)
-
-TERMINAL_EVENTS = SUCCESSFUL_EVENTS | UNSUCCESSFUL_EVENTS

src/backend/core/recording/services/recording_events.py

@@ -1,13 +1,13 @@
-"""Recording-related Events Service"""
+"""Recording-related LiveKit Events Service"""
+
+# pylint: disable=no-member
 
 from logging import getLogger
 
+from livekit import api
+
 from core import models, utils
 from core.models import Recording
-from core.recording.enums import (
-    UNSUCCESSFUL_EVENTS,
-    RecordingWorkerEvent,
-)
 from core.recording.event.notification import notification_service
 from core.services.room_management import (
     RoomManagement,
@@ -26,110 +26,22 @@ class RecordingNotSavableError(Exception):
     """Recording cannot be saved because it is either in an error state or has already been saved"""
 
 
-# Notification sent to the room's participants, per event and recording mode.
-NOTIFICATION_PREFIXES = {
-    models.RecordingModeChoices.SCREEN_RECORDING: "screenRecording",
-    models.RecordingModeChoices.TRANSCRIPT: "transcription",
-}
-NOTIFICATION_SUFFIXES = {
-    RecordingWorkerEvent.LIMIT_REACHED: "LimitReached",
-    RecordingWorkerEvent.FAILED: "Failed",
-    RecordingWorkerEvent.ABORTED: "Aborted",
-}
-
-
-def get_notification_type(recording_mode, event):
-    """Generate corresponding notification type string."""
-    try:
-        return f"{NOTIFICATION_PREFIXES[recording_mode]}{NOTIFICATION_SUFFIXES[event]}"
-    except KeyError:
-        return None
-
-
-# Recording status in the room's metadata, per event.
-ROOM_METADATA_RECORDING_STATUSES = {
-    RecordingWorkerEvent.STARTED: "started",
-    RecordingWorkerEvent.SAVING: "saving",
-}
-
-
 class RecordingEventsService:
-    """Handles recording-related worker events.
-
-    Two entry points: `handle_update` for the events a running recording
-    reports, and `handle_terminal_event` for the one ending it.
-    """
+    """Handles recording-related LiveKit webhook events."""
 
     @staticmethod
-    def log_worker_error(recording, event, error=None, error_code=None):
-        """Log FAILED at error level and expected ABORTED outcomes at info level."""
-
-        if event == RecordingWorkerEvent.FAILED:
-            log = logger.error
-        elif event == RecordingWorkerEvent.ABORTED:
-            log = logger.info
-        else:
-            return
-
-        log(
-            "Recording worker reported %s for recording %s (room=%s, mode=%s): %s (error_code=%s)",
-            event.value,
-            recording.id,
-            recording.room.id,
-            recording.mode,
-            error or "no error reported",
-            error_code or "no error_code reported",
-        )
-
-    @staticmethod
-    def _notify_participants(recording: Recording, event: RecordingWorkerEvent):
-        """Notify the room's participants that a recording ended on the given event."""
-        recording_mode = recording.options.get("original_mode", None) or recording.mode
-
-        notification_type = get_notification_type(recording_mode, event)
-        if not notification_type:
-            logger.warning(
-                "Could not find notification type for: "
-                "room=%s, recording_id=%s, mode=%s, event=%s",
-                recording.room.id,
-                recording.id,
-                recording_mode,
-                event.value,
-            )
-            return
-
-        try:
-            utils.notify_participants(
-                room_name=str(recording.room.id),
-                notification_data={"type": notification_type},
-            )
-        except utils.NotificationError as e:
-            raise RecordingEventsError(
-                f"Failed to notify participants in room '{recording.room.id}' about "
-                f"recording {event.value} (recording_id={recording.id})"
-            ) from e
-
-    @staticmethod
-    def _log_notification_failure(recording, event: RecordingWorkerEvent):
-        """Log a participant notification error on an unsuccessful recording."""
-
-        logger.exception(
-            "Failed to notify participants that recording %s %s (room=%s)",
-            recording.id,
-            event.value,
-            recording.room.id,
-        )
-
-    @staticmethod
-    def handle_update(recording: Recording, event: RecordingWorkerEvent):
-        """Handle non-terminal worker events and sync recording state to room metadata.
-
-        Terminal events are dispatched through `handle_terminal_event` instead.
-        """
+    def handle_update(recording: Recording, egress_status):
+        """Handle egress status updates and sync recording state to room metadata."""
 
         room_name = str(recording.room.id)
 
-        recording_status = ROOM_METADATA_RECORDING_STATUSES.get(event)
+        status_mapping = {
+            api.EgressStatus.EGRESS_ACTIVE: "started",
+            api.EgressStatus.EGRESS_ENDING: "saving",
+            api.EgressStatus.EGRESS_ABORTED: "aborted",
+        }
+
+        recording_status = status_mapping.get(egress_status)
         if recording_status:
             try:
                 RoomManagement.update_metadata(
@@ -143,113 +55,42 @@ class RecordingEventsService:
             except RoomManagementException as e:
                 logger.exception("Failed to update room's metadata: %s", e)
 
-    def handle_terminal_event(self, recording: Recording, event: RecordingWorkerEvent):
-        """Run the appropriate handlers for a terminal event, given the recording's state."""
-
-        if not RecordingWorkerEvent.is_terminal(event):
-            logger.warning(
-                "Ignoring non-terminal event %s dispatched as a terminal event "
-                "for recording %s.",
-                event.value,
-                recording.id,
-            )
-            return
-
-        if event in UNSUCCESSFUL_EVENTS:
-            self._flag_unsuccessful_recording(recording, event)
-        else:
-            self._save_successful_recording(recording, event)
-
-    def _flag_unsuccessful_recording(
-        self, recording: Recording, event: RecordingWorkerEvent
-    ):
-        """Persist the outcome of a recording the worker announced as unsuccessful."""
-
-        # Aborted
-        if event == RecordingWorkerEvent.ABORTED:
-            if recording.status == models.RecordingStatusChoices.ACTIVE:
-                self._apply_outcome(recording, event, self._handle_aborted)
-            return
-
-        # Failed
-        if event == RecordingWorkerEvent.FAILED:
-            if recording.is_savable():
-                self._apply_outcome(recording, event, self._handle_failed)
-            return
-
-        logger.error(
-            "Unsuccessful event %s has no handler; recording %s keeps status '%s'.",
-            event.value,
-            recording.id,
-            recording.status,
-        )
-
-    def _save_successful_recording(
-        self, recording: Recording, event: RecordingWorkerEvent
-    ):
-        """Save a recording whose media file the worker made available."""
-
-        # Limit reached
-        if (
-            event == RecordingWorkerEvent.LIMIT_REACHED
-            and recording.status == models.RecordingStatusChoices.ACTIVE
-        ):
-            self._apply_outcome(recording, event, self._handle_limit_reached)
-
-        try:
-            self._handle_successful(recording)
-        except RecordingNotSavableError:
-            logger.warning(
-                "Recording %s is not savable on a completed recording "
-                "(already saved or in an error state); ignoring.",
-                recording.id,
-            )
-
-    def _apply_outcome(
-        self, recording: Recording, event: RecordingWorkerEvent, handler
-    ):
-        """Keep notification failure non-fatal."""
-
-        try:
-            handler(recording)
-        except RecordingEventsError:
-            self._log_notification_failure(recording, event)
-
-    @classmethod
-    def _handle_limit_reached(cls, recording: Recording):
+    @staticmethod
+    def handle_limit_reached(recording: Recording):
         """Stop recording and notify participants when limit is reached."""
 
         recording.status = models.RecordingStatusChoices.STOPPED
         recording.save()
 
-        cls._notify_participants(recording, RecordingWorkerEvent.LIMIT_REACHED)
+        notification_mapping = {
+            models.RecordingModeChoices.SCREEN_RECORDING: "screenRecordingLimitReached",
+            models.RecordingModeChoices.TRANSCRIPT: "transcriptionLimitReached",
+        }
 
-    @classmethod
-    def _handle_failed(cls, recording: Recording):
-        """Set recording status to failed, matching the worker event, and notify participants.
+        notification_type = notification_mapping.get(recording.mode)
+        if not notification_type:
+            return
 
-        FAILED: used when an actual runtime/pipeline error occurs after the
-        recording has started
-        """
-        recording.status = models.RecordingStatusChoices.FAILED
-        recording.save()
-
-        cls._notify_participants(recording, RecordingWorkerEvent.FAILED)
-
-    @classmethod
-    def _handle_aborted(cls, recording: Recording):
-        """Set recording status to aborted, matching the worker event, and notify participants.
-
-        ABORTED: used when the worker stops before it ever became
-        active/recording
-        """
-        recording.status = models.RecordingStatusChoices.ABORTED
-        recording.save()
-
-        cls._notify_participants(recording, RecordingWorkerEvent.ABORTED)
+        try:
+            utils.notify_participants(
+                room_name=str(recording.room.id),
+                notification_data={"type": notification_type},
+            )
+        except utils.NotificationError as e:
+            logger.exception(
+                "Failed to notify participants about recording limit reached: "
+                "room=%s, recording_id=%s, mode=%s",
+                recording.room.id,
+                recording.id,
+                recording.mode,
+            )
+            raise RecordingEventsError(
+                f"Failed to notify participants in room '{recording.room.id}' about "
+                f"recording limit reached (recording_id={recording.id})"
+            ) from e
 
     @staticmethod
-    def _handle_successful(recording: Recording):
+    def handle_complete(recording: Recording):
         """Notify external services and save recording."""
 
         if not recording.is_savable():

src/backend/core/recording/worker/services.py

@@ -2,8 +2,6 @@
 
 # pylint: disable=no-member
 
-import logging
-
 from asgiref.sync import async_to_sync
 from livekit import api as livekit_api
 
@@ -12,8 +10,6 @@ from ..enums import FileExtension
 from .exceptions import WorkerConnectionError, WorkerResponseError
 from .factories import WorkerServiceConfig
 
-logger = logging.getLogger(__name__)
-
 
 class BaseEgressService:
     """Base egress defining common methods to manage and interact with LiveKit egress processes."""
@@ -24,7 +20,7 @@ class BaseEgressService:
 
     def _get_filepath(self, filename: str, extension: str) -> str:
         """Construct the file path for a given filename and extension.
-        Insecure method, doesn't handle paths robustly and securely.
+        Unsecure method, doesn't handle paths robustly and securely.
         """
         return f"{self._config.output_folder}/{filename}.{extension}"
 
@@ -53,22 +49,6 @@ class BaseEgressService:
         finally:
             await lkapi.aclose()
 
-    @staticmethod
-    def _log_egress_error(response, event: str):
-        """Log the reason LiveKit reported an unsuccessful egress on stop.
-
-        Mirrors the logging done in the 'egress_ended' webhook. The
-        StopEgress response carries the same error fields.
-        """
-        logger.error(
-            "Egress %s on stop (egress_id=%s, status=%s): %s (error_code=%s)",
-            event,
-            response.egress_id,
-            livekit_api.EgressStatus.Name(response.status),
-            response.error or "no error reported",
-            response.error_code or "no error_code reported",
-        )
-
     def stop(self, worker_id: str) -> str:
         """Stop an ongoing egress worker.
         The StopEgressRequest is shared among all types of egress,
@@ -86,26 +66,14 @@ class BaseEgressService:
                 "LiveKit response is missing the recording status."
             )
 
+        # To avoid exposing EgressStatus values and coupling with LiveKit outside of this class,
+        # the response status is mapped to simpler "ABORTED", "STOPPED" or "FAILED_TO_STOP" strings.
+        if response.status == livekit_api.EgressStatus.EGRESS_ABORTED:
+            return "ABORTED"
+
         if response.status == livekit_api.EgressStatus.EGRESS_ENDING:
             return "STOPPED"
 
-        if response.status == livekit_api.EgressStatus.EGRESS_LIMIT_REACHED:
-            return "STOPPED"
-
-        # Cases below should be very infrequent as status changes should be
-        # received and processed by `handle_ended`, thus `stop` would not
-        # be called (unless failure and stop are very close in time).
-        # We therefore accept not to notify the user in this code branch.
-        # This could be fixed in a future refactoring.
-        if response.status == livekit_api.EgressStatus.EGRESS_ABORTED:
-            self._log_egress_error(response, "aborted")
-            return "ABORTED"
-
-        if response.status == livekit_api.EgressStatus.EGRESS_FAILED:
-            self._log_egress_error(response, "failed")
-            return "FAILED"
-
-        self._log_egress_error(response, "failed to stop")
         return "FAILED_TO_STOP"
 
     def start(self, room_name, recording_id):

src/backend/core/services/livekit_events.py

@@ -12,12 +12,15 @@ from django.conf import settings
 from livekit import api
 
 from core import models
-from core.recording.enums import RecordingWorkerEvent
 from core.recording.services.metadata_collector import (
     MetadataCollectorException,
     MetadataCollectorService,
 )
-from core.recording.services.recording_events import RecordingEventsService
+from core.recording.services.recording_events import (
+    RecordingEventsError,
+    RecordingEventsService,
+    RecordingNotSavableError,
+)
 
 from .lobby import LobbyService
 from .presence import PresenceCache
@@ -81,30 +84,6 @@ class LiveKitWebhookEventType(Enum):
     INGRESS_ENDED = "ingress_ended"
 
 
-# LiveKit egress statuses mapped to recording worker event statuses
-EGRESS_STATUS_TO_RECORDING_EVENT = {
-    api.EgressStatus.EGRESS_STARTING: RecordingWorkerEvent.STARTING,
-    api.EgressStatus.EGRESS_ACTIVE: RecordingWorkerEvent.STARTED,
-    api.EgressStatus.EGRESS_ENDING: RecordingWorkerEvent.SAVING,
-    api.EgressStatus.EGRESS_COMPLETE: RecordingWorkerEvent.COMPLETED,
-    api.EgressStatus.EGRESS_LIMIT_REACHED: RecordingWorkerEvent.LIMIT_REACHED,
-    api.EgressStatus.EGRESS_ABORTED: RecordingWorkerEvent.ABORTED,
-    api.EgressStatus.EGRESS_FAILED: RecordingWorkerEvent.FAILED,
-}
-
-
-def to_recording_event(egress_status):
-    """Translate a LiveKit egress status into a recording worker event."""
-
-    event = EGRESS_STATUS_TO_RECORDING_EVENT.get(egress_status)
-    if event is None:
-        logger.warning(
-            "Unmapped LiveKit egress status '%s', ignoring the event.",
-            egress_status,
-        )
-    return event
-
-
 class LiveKitEventsService:
     """Service for processing and handling LiveKit webhook events and notifications."""
 
@@ -194,20 +173,12 @@ class LiveKitEventsService:
                 f"Recording with worker ID {egress_id} does not exist"
             ) from err
 
-        event = to_recording_event(data.egress_info.status)
-        if event is None:
-            return
-
-        self.recording_events.handle_update(recording, event)
+        egress_status = data.egress_info.status
+        self.recording_events.handle_update(recording, egress_status)
 
     def _handle_egress_ended(self, data):
-        """Handle 'egress_ended' event.
+        """Handle 'egress_ended' event."""
 
-        Egress ended is sent with one of these statuses:
-        EGRESS_COMPLETE, EGRESS_FAILED, EGRESS_ABORTED, EGRESS_LIMIT_REACHED
-        """
-
-        # Fetch recording
         try:
             recording = models.Recording.objects.select_related("room").get(
                 worker_id=data.egress_info.egress_id
@@ -217,17 +188,6 @@ class LiveKitEventsService:
                 f"Recording with worker ID {data.egress_info.egress_id} does not exist"
             ) from err
 
-        event = to_recording_event(data.egress_info.status)
-
-        # Log if/why the recording failed
-        self.recording_events.log_worker_error(
-            recording,
-            event,
-            error=data.egress_info.error,
-            error_code=data.egress_info.error_code,
-        )
-
-        # Update room
         try:
             room_name = str(recording.room.id)
             RoomManagement.update_metadata(
@@ -241,17 +201,38 @@ class LiveKitEventsService:
         except RoomManagementException as e:
             logger.exception("Failed to update room's metadata: %s", e)
 
-        # Stop metadata collector
         if recording.options.get("metadata_collector_dispatch_id", None) is not None:
             try:
                 MetadataCollectorService().stop(recording)
             except MetadataCollectorException:
                 logger.warning("Failed to stop the MetadataCollectorService")
 
-        if event is None:
-            return
+        if (
+            data.egress_info.status == api.EgressStatus.EGRESS_LIMIT_REACHED
+            and recording.status == models.RecordingStatusChoices.ACTIVE
+        ):
+            try:
+                self.recording_events.handle_limit_reached(recording)
+            except RecordingEventsError as e:
+                raise ActionFailedError(
+                    f"Failed to process limit reached event for recording {recording}"
+                ) from e
 
-        self.recording_events.handle_terminal_event(recording, event)
+        # Finalize the recording, the egress has uploaded the file to the storage
+        if data.egress_info.status in [
+            api.EgressStatus.EGRESS_COMPLETE,
+            api.EgressStatus.EGRESS_LIMIT_REACHED,
+        ]:
+            try:
+                self.recording_events.handle_complete(recording)
+            except RecordingNotSavableError:
+                logger.warning(
+                    "Recording %s is not savable on egress complete "
+                    "(already saved or in an error state); ignoring.",
+                    recording.id,
+                )
+
+        # Silently ignoring EGRESS_ABORTED, EGRESS_FAILED
 
     @staticmethod
     def _is_connection_test_room(room_name: str) -> bool:

src/backend/core/services/room_management.py

@@ -76,6 +76,10 @@ class RoomManagement:
 
         except TwirpError as e:
             if e.code == "not_found":
+                logger.warning(
+                    "Room %s not found in LiveKit, skipping metadata update",
+                    room_name,
+                )
                 raise RoomNotFoundException("Room does not exist") from e
 
             logger.exception(

src/backend/core/tests/files/test_api_files_list.py

@@ -27,7 +27,7 @@ def test_api_files_list_anonymous_not_allowed():
 
 def test_api_files_list_authentificated_user_allowed():
     """
-    Authenticated users should be allowed to list files
+    Authentificated users should be allowed to list files
     """
     user = factories.UserFactory()
     client = APIClient()

src/backend/core/tests/recording/service/test_recording_events.py

@@ -2,23 +2,18 @@
 Test RecordingEventsService service.
 """
 
-# pylint: disable=redefined-outer-name,protected-access
+# pylint: disable=redefined-outer-name
 
-import logging
 from unittest import mock
 
 import pytest
 
 from core.factories import RecordingFactory
-from core.recording.enums import RecordingWorkerEvent
 from core.recording.services.recording_events import (
     RecordingEventsError,
     RecordingEventsService,
     RecordingNotSavableError,
 )
-from core.services.room_management import (
-    RoomManagementException,
-)
 from core.utils import NotificationError
 
 pytestmark = pytest.mark.django_db
@@ -39,10 +34,10 @@ def service():
 )
 @mock.patch("core.utils.notify_participants")
 def test_handle_limit_reached_success(mock_notify, mode, notification_type, service):
-    """Test _handle_limit_reached stops recording and notifies participants."""
+    """Test handle_limit_reached stops recording and notifies participants."""
 
     recording = RecordingFactory(status="active", mode=mode)
-    service._handle_limit_reached(recording)
+    service.handle_limit_reached(recording)
 
     assert recording.status == "stopped"
     mock_notify.assert_called_once_with(
@@ -53,69 +48,13 @@ def test_handle_limit_reached_success(mock_notify, mode, notification_type, serv
 @pytest.mark.parametrize(
     ("mode", "notification_type"),
     (
-        ("screen_recording", "screenRecordingFailed"),
-        ("transcript", "transcriptionFailed"),
+        ("screen_recording", "screenRecordingLimitReached"),
+        ("transcript", "transcriptionLimitReached"),
     ),
 )
 @mock.patch("core.utils.notify_participants")
-def test_handle_failed_success(mock_notify, mode, notification_type, service):
-    """Test _handle_failed marks recording as failed and notifies participants."""
-
-    recording = RecordingFactory(status="active", mode=mode)
-    service._handle_failed(recording)
-
-    assert recording.status == "failed"
-    mock_notify.assert_called_once_with(
-        room_name=str(recording.room.id), notification_data={"type": notification_type}
-    )
-
-
-@pytest.mark.parametrize(
-    ("mode", "notification_type"),
-    (
-        ("screen_recording", "screenRecordingAborted"),
-        ("transcript", "transcriptionAborted"),
-    ),
-)
-@mock.patch("core.utils.notify_participants")
-def test_handle_aborted_success(mock_notify, mode, notification_type, service):
-    """Test _handle_aborted marks recording as aborted and notifies participants."""
-
-    recording = RecordingFactory(status="active", mode=mode)
-    service._handle_aborted(recording)
-
-    assert recording.status == "aborted"
-    mock_notify.assert_called_once_with(
-        room_name=str(recording.room.id), notification_data={"type": notification_type}
-    )
-
-
-@pytest.mark.parametrize(
-    ("mode", "notification_prefix"),
-    (("screen_recording", "screenRecording"), ("transcript", "transcription")),
-)
-@pytest.mark.parametrize(
-    ("handler", "expected_status", "event", "notification_suffix"),
-    (
-        ("_handle_limit_reached", "stopped", "limit reached", "LimitReached"),
-        ("_handle_failed", "failed", "failed", "Failed"),
-        ("_handle_aborted", "aborted", "aborted", "Aborted"),
-    ),
-)
-@mock.patch("core.utils.notify_participants")
-def test_handle_event_notification_error(  # noqa: PLR0913, PLR0917
-    mock_notify,
-    handler,
-    expected_status,
-    event,
-    notification_suffix,
-    mode,
-    notification_prefix,
-    service,
-):  # pylint: disable=too-many-arguments,too-many-positional-arguments
-    """Test handlers raise RecordingEventsError when notifying participants fails,
-    while still applying the recording status of their event.
-    """
+def test_handle_limit_reached_error(mock_notify, mode, notification_type, service):
+    """Test handle_limit_reached raises RecordingEventsError when notification fails."""
 
     mock_notify.side_effect = NotificationError("Error notifying")
 
@@ -123,15 +62,14 @@ def test_handle_event_notification_error(  # noqa: PLR0913, PLR0917
 
     with pytest.raises(
         RecordingEventsError,
-        match=rf"Failed to notify participants in room '.+' "
-        rf"about recording {event} \(recording_id=.+\)",
+        match=r"Failed to notify participants in room '.+' "
+        r"about recording limit reached \(recording_id=.+\)",
     ):
-        getattr(service, handler)(recording)
+        service.handle_limit_reached(recording)
 
-    assert recording.status == expected_status
+    assert recording.status == "stopped"
     mock_notify.assert_called_once_with(
-        room_name=str(recording.room.id),
-        notification_data={"type": f"{notification_prefix}{notification_suffix}"},
+        room_name=str(recording.room.id), notification_data={"type": notification_type}
     )
 
 
@@ -144,19 +82,19 @@ def test_handle_event_notification_error(  # noqa: PLR0913, PLR0917
     "core.recording.services.recording_events.notification_service."
     "notify_external_services"
 )
-def test_handle_successful_saves_recording(  # pylint: disable=too-many-arguments, too-many-positional-arguments
+def test_handle_complete_saves_recording(  # pylint: disable=too-many-arguments, too-many-positional-arguments
     mock_notify_external_services,
     notify_return_value,
     expected_status,
     status,
     service,
 ):
-    """Test _handle_successful notifies external services and saves a savable recording."""
+    """Test handle_complete notifies external services and saves a savable recording."""
 
     mock_notify_external_services.return_value = notify_return_value
 
     recording = RecordingFactory(status=status)
-    service._handle_successful(recording)
+    service.handle_complete(recording)
 
     mock_notify_external_services.assert_called_once_with(recording)
 
@@ -166,293 +104,23 @@ def test_handle_successful_saves_recording(  # pylint: disable=too-many-argument
 
 @pytest.mark.parametrize(
     "status",
-    [
-        "initiated",
-        "saved",
-        "notification_succeeded",
-        "aborted",
-        "failed",
-        "failed_to_start",
-    ],
+    ["initiated", "saved", "notification_succeeded", "aborted", "failed_to_start"],
 )
 @mock.patch(
     "core.recording.services.recording_events.notification_service."
     "notify_external_services"
 )
-def test_handle_successful_non_savable_recording(
+def test_handle_complete_non_savable_recording(
     mock_notify_external_services, status, service
 ):
-    """Test _handle_successful refuses recordings that are already saved or in error."""
+    """Test handle_complete refuses recordings that are already saved or in error."""
 
     recording = RecordingFactory(status=status)
 
     with pytest.raises(RecordingNotSavableError):
-        service._handle_successful(recording)
+        service.handle_complete(recording)
 
     mock_notify_external_services.assert_not_called()
 
     recording.refresh_from_db()
     assert recording.status == status
-
-
-@pytest.mark.parametrize(
-    ("event", "recording_status"),
-    (
-        (RecordingWorkerEvent.STARTED, "started"),
-        (RecordingWorkerEvent.SAVING, "saving"),
-    ),
-)
-@mock.patch("core.services.room_management.RoomManagement.update_metadata")
-def test_handle_update_syncs_room_metadata(
-    mock_update_metadata, event, recording_status, service
-):
-    """Test handle_update updates the room's metadata."""
-
-    recording = RecordingFactory(status="active")
-    service.handle_update(recording, event)
-
-    mock_update_metadata.assert_called_once_with(
-        str(recording.room.id), {"recording_status": recording_status}
-    )
-
-
-@pytest.mark.parametrize(
-    "event",
-    (
-        RecordingWorkerEvent.STARTING,
-        RecordingWorkerEvent.COMPLETED,
-        RecordingWorkerEvent.LIMIT_REACHED,
-        RecordingWorkerEvent.ABORTED,
-        RecordingWorkerEvent.FAILED,
-    ),
-)
-@mock.patch("core.services.room_management.RoomManagement.update_metadata")
-def test_handle_update_ignores_events_without_a_metadata_status(
-    mock_update_metadata, event, service
-):
-    """Test handle_update doesn't update metadata for events it doesn't match."""
-
-    recording = RecordingFactory(status="active")
-    service.handle_update(recording, event)
-
-    mock_update_metadata.assert_not_called()
-
-
-@pytest.mark.parametrize(
-    ("event", "initial_status", "expected_status", "notification_type"),
-    (
-        (RecordingWorkerEvent.LIMIT_REACHED, "active", "saved", "LimitReached"),
-        (RecordingWorkerEvent.LIMIT_REACHED, "stopped", "saved", None),
-        (RecordingWorkerEvent.LIMIT_REACHED, "saved", "saved", None),
-        (RecordingWorkerEvent.ABORTED, "active", "aborted", "Aborted"),
-        (RecordingWorkerEvent.ABORTED, "failed_to_stop", "failed_to_stop", None),
-        (RecordingWorkerEvent.FAILED, "active", "failed", "Failed"),
-        (RecordingWorkerEvent.FAILED, "stopped", "failed", "Failed"),
-        (RecordingWorkerEvent.FAILED, "aborted", "aborted", None),
-        (RecordingWorkerEvent.COMPLETED, "active", "saved", None),
-        (RecordingWorkerEvent.COMPLETED, "saved", "saved", None),
-    ),
-)
-@mock.patch(
-    "core.recording.services.recording_events.notification_service."
-    "notify_external_services"
-)
-@mock.patch("core.utils.notify_participants")
-def test_handle_terminal_event_dispatches_on_event_and_status(  # noqa: PLR0913, PLR0917
-    mock_notify,
-    mock_notify_external_services,
-    event,
-    initial_status,
-    expected_status,
-    notification_type,
-    service,
-):  # pylint: disable=too-many-arguments,too-many-positional-arguments
-    """Test handle_terminal_event chooses the right handler from the event and status."""
-
-    mock_notify_external_services.return_value = False
-
-    recording = RecordingFactory(status=initial_status, mode="screen_recording")
-    service.handle_terminal_event(recording, event)
-
-    recording.refresh_from_db()
-    assert recording.status == expected_status
-
-    if notification_type is None:
-        mock_notify.assert_not_called()
-    else:
-        mock_notify.assert_called_once_with(
-            room_name=str(recording.room.id),
-            notification_data={"type": f"screenRecording{notification_type}"},
-        )
-
-
-@pytest.mark.parametrize(
-    "event",
-    (
-        RecordingWorkerEvent.STARTING,
-        RecordingWorkerEvent.STARTED,
-        RecordingWorkerEvent.SAVING,
-    ),
-)
-@mock.patch(
-    "core.recording.services.recording_events.notification_service."
-    "notify_external_services"
-)
-@mock.patch("core.utils.notify_participants")
-def test_handle_terminal_event_ignores_non_terminal_events(
-    mock_notify, mock_notify_external_services, event, service, caplog
-):
-    """Test handle_terminal_event refuses non-terminal events."""
-
-    recording = RecordingFactory(status="active")
-
-    with caplog.at_level(logging.WARNING):
-        service.handle_terminal_event(recording, event)
-
-    assert f"Ignoring non-terminal event {event.value}" in caplog.text
-    mock_notify.assert_not_called()
-    mock_notify_external_services.assert_not_called()
-
-    recording.refresh_from_db()
-    assert recording.status == "active"
-
-
-@pytest.mark.parametrize(
-    ("event", "expected_status"),
-    (
-        (RecordingWorkerEvent.LIMIT_REACHED, "saved"),
-        (RecordingWorkerEvent.ABORTED, "aborted"),
-        (RecordingWorkerEvent.FAILED, "failed"),
-    ),
-)
-@mock.patch(
-    "core.recording.services.recording_events.notification_service."
-    "notify_external_services"
-)
-@mock.patch("core.utils.notify_participants")
-def test_handle_terminal_event_survives_a_notification_failure(  # noqa: PLR0913, PLR0917
-    mock_notify,
-    mock_notify_external_services,
-    event,
-    expected_status,
-    service,
-    caplog,
-):  # pylint: disable=too-many-arguments,too-many-positional-arguments
-    """Test handle_terminal_event logs a notification failure instead of raising.
-
-    The recording status must still be persisted: participants missing their
-    notification should not disturb recording.
-    """
-
-    mock_notify_external_services.return_value = False
-    mock_notify.side_effect = NotificationError("Error notifying")
-
-    recording = RecordingFactory(status="active")
-
-    with caplog.at_level(logging.ERROR):
-        service.handle_terminal_event(recording, event)
-
-    assert f"Failed to notify participants that recording {recording.id}" in caplog.text
-
-    recording.refresh_from_db()
-    assert recording.status == expected_status
-
-
-@pytest.mark.parametrize(
-    "status",
-    ["failed_to_start", "aborted", "failed", "failed_to_stop", "saved", "initiated"],
-)
-@mock.patch(
-    "core.recording.services.recording_events.notification_service."
-    "notify_external_services"
-)
-def test_handle_terminal_event_ignores_a_non_savable_recording(
-    mock_notify_external_services, status, service, caplog
-):
-    """Test handle_terminal_event handles a redelivered event idempotently.
-
-    A terminal event may be redelivered for an already finalized recording;
-    this must not raise, otherwise the webhook would 500 and be retried.
-    """
-
-    recording = RecordingFactory(status=status)
-
-    with caplog.at_level(logging.WARNING):
-        service.handle_terminal_event(recording, RecordingWorkerEvent.COMPLETED)
-
-    assert f"Recording {recording.id} is not savable" in caplog.text
-    mock_notify_external_services.assert_not_called()
-
-    recording.refresh_from_db()
-    assert recording.status == status
-
-
-@mock.patch("core.services.room_management.RoomManagement.update_metadata")
-def test_handle_update_survives_a_metadata_failure(
-    mock_update_metadata, service, caplog
-):
-    """Test handle_update logs a metadata failure instead of raising."""
-
-    mock_update_metadata.side_effect = RoomManagementException("Error updating")
-
-    recording = RecordingFactory(status="active")
-
-    with caplog.at_level(logging.ERROR):
-        service.handle_update(recording, RecordingWorkerEvent.SAVING)
-
-    assert "Failed to update room's metadata" in caplog.text
-
-
-@pytest.mark.parametrize(
-    ("event", "expected_level"),
-    (
-        (RecordingWorkerEvent.ABORTED, logging.INFO),
-        (RecordingWorkerEvent.FAILED, logging.ERROR),
-    ),
-)
-def test_log_worker_error_reports_an_unsuccessful_event(
-    event, expected_level, service, caplog
-):
-    """Test log_worker_error records the reason the recording did not succeed."""
-
-    recording = RecordingFactory(status="active", mode="screen_recording")
-
-    with caplog.at_level(logging.INFO):
-        service.log_worker_error(
-            recording, event, error="could not connect to the room", error_code=500
-        )
-
-    assert (
-        f"Recording worker reported {event.value} for recording {recording.id}"
-        in caplog.text
-    )
-    assert "could not connect to the room" in caplog.text
-    assert "error_code=500" in caplog.text
-    worker_logs = [
-        record
-        for record in caplog.records
-        if record.name == "core.recording.services.recording_events"
-    ]
-    assert [record.levelno for record in worker_logs] == [expected_level]
-
-
-@pytest.mark.parametrize(
-    "event",
-    (
-        RecordingWorkerEvent.STARTING,
-        RecordingWorkerEvent.STARTED,
-        RecordingWorkerEvent.SAVING,
-        RecordingWorkerEvent.COMPLETED,
-        RecordingWorkerEvent.LIMIT_REACHED,
-        None,
-    ),
-)
-def test_log_worker_error_stays_quiet_on_anything_else(event, service, caplog):
-    """Test log_worker_error ignores events other than FAILED and ABORTED."""
-
-    recording = RecordingFactory(status="active")
-
-    with caplog.at_level(logging.INFO):
-        service.log_worker_error(recording, event, error="some error", error_code=500)
-
-    assert "Recording worker reported" not in caplog.text

src/backend/core/tests/recording/test_api_recordings_retrieve.py

@@ -224,7 +224,6 @@ def test_api_recording_retrieve_expired(settings):
         RecordingStatusChoices.INITIATED,
         RecordingStatusChoices.ACTIVE,
         RecordingStatusChoices.SAVED,
-        RecordingStatusChoices.FAILED,
         RecordingStatusChoices.FAILED_TO_START,
         RecordingStatusChoices.FAILED_TO_STOP,
         RecordingStatusChoices.ABORTED,

src/backend/core/tests/recording/worker/test_services.py

@@ -4,7 +4,6 @@ Test worker service classes.
 
 # pylint: disable=protected-access,redefined-outer-name,unused-argument,no-member
 
-import logging
 from unittest.mock import AsyncMock, Mock, patch
 
 import pytest
@@ -155,9 +154,9 @@ def test_base_egress_filepath_construction(service, filename, extension, expecte
     "response_status,expected_result",
     [
         (livekit_api.EgressStatus.EGRESS_ABORTED, "ABORTED"),
-        (livekit_api.EgressStatus.EGRESS_FAILED, "FAILED"),
         (livekit_api.EgressStatus.EGRESS_COMPLETE, "FAILED_TO_STOP"),
         (livekit_api.EgressStatus.EGRESS_ENDING, "STOPPED"),
+        (livekit_api.EgressStatus.EGRESS_FAILED, "FAILED_TO_STOP"),
     ],
 )
 def test_base_egress_stop_with_status(service, response_status, expected_result):
@@ -176,32 +175,6 @@ def test_base_egress_stop_with_status(service, response_status, expected_result)
     assert result == expected_result
 
 
-@pytest.mark.parametrize(
-    "response_status,event",
-    [
-        (livekit_api.EgressStatus.EGRESS_ABORTED, "aborted"),
-        (livekit_api.EgressStatus.EGRESS_FAILED, "failed"),
-        (livekit_api.EgressStatus.EGRESS_COMPLETE, "failed to stop"),
-    ],
-)
-def test_base_egress_stop_logs_livekit_error(service, response_status, event, caplog):
-    """Should log the reason LiveKit reported for an unsuccessful stop."""
-    mock_response = Mock(
-        status=response_status,
-        egress_id="test_worker_id",
-        error="could not connect to the room",
-        error_code=500,
-    )
-    service._handle_request = Mock(return_value=mock_response)
-
-    with caplog.at_level(logging.ERROR):
-        service.stop("test_worker_id")
-
-    assert f"Egress {event} on stop (egress_id=test_worker_id" in caplog.text
-    assert "could not connect to the room" in caplog.text
-    assert "error_code=500" in caplog.text
-
-
 def test_base_egress_stop_missing_status(service):
     """Test stop method when response is missing status"""
     # Mock _handle_request with missing status

src/backend/core/tests/rooms/test_api_rooms_participants_management.py

@@ -458,7 +458,7 @@ def test_mute_participant_livekit_token_presence_check_twirp_error_forbidden(
     room = RoomFactory()
 
     mock_livekit_client.room.get_participant.side_effect = TwirpError(
-        msg="an error occurred", code="not_found", status=500
+        msg="an error occured", code="not_found", status=500
     )
 
     user = AnonymousUser()

src/backend/core/tests/services/test_livekit_events.py

@@ -3,7 +3,6 @@ Test LiveKitEvents service.
 """
 # pylint: disable=W0621,W0613, W0212, E0611
 
-import logging
 import uuid
 from unittest import mock
 
@@ -11,16 +10,13 @@ import pytest
 from livekit.api import EgressStatus
 
 from core.factories import RecordingFactory, RoomFactory
-from core.recording.enums import RecordingWorkerEvent
 from core.recording.services.recording_events import RecordingEventsService
 from core.services.livekit_events import (
-    EGRESS_STATUS_TO_RECORDING_EVENT,
     ActionFailedError,
     AuthenticationError,
     InvalidPayloadError,
     LiveKitEventsService,
     api,
-    to_recording_event,
 )
 from core.services.lobby import LobbyService
 from core.services.room_management import RoomManagementException
@@ -81,7 +77,7 @@ def test_initialization(
 def test_handle_egress_ended_success(  # pylint: disable=too-many-arguments, too-many-positional-arguments
     mock_update_metadata, mock_notify, mode, notification_type, service
 ):
-    """Should successfully stop recording and notify all participant."""
+    """Should successfully stop recording and notifies all participant."""
 
     recording = RecordingFactory(worker_id="worker-1", mode=mode, status="active")
     mock_data = mock.MagicMock()
@@ -108,6 +104,7 @@ def test_handle_egress_ended_success(  # pylint: disable=too-many-arguments, too
     (
         (EgressStatus.EGRESS_ACTIVE, "started"),
         (EgressStatus.EGRESS_ENDING, "saving"),
+        (EgressStatus.EGRESS_ABORTED, "aborted"),
     ),
 )
 @mock.patch("core.services.room_management.RoomManagement.update_metadata")
@@ -128,6 +125,29 @@ def test_handle_egress_updated_success(
     )
 
 
+@pytest.mark.parametrize(
+    "egress_status",
+    (
+        EgressStatus.EGRESS_FAILED,
+        EgressStatus.EGRESS_LIMIT_REACHED,
+    ),
+)
+@mock.patch("core.services.room_management.RoomManagement.update_metadata")
+def test_handle_egress_updated_non_handled(
+    mock_update_metadata, egress_status, service
+):
+    """Should ignore certain egress status and don't trigger metadata updates."""
+
+    recording = RecordingFactory(worker_id="worker-1", status="initiated")
+    mock_data = mock.MagicMock()
+    mock_data.egress_info.egress_id = recording.worker_id
+    mock_data.egress_info.status = egress_status
+
+    service._handle_egress_updated(mock_data)
+
+    mock_update_metadata.assert_not_called()
+
+
 @pytest.mark.parametrize(
     ("mode", "notification_type"),
     (
@@ -160,38 +180,33 @@ def test_handle_egress_ended_metadata_update_fails(  # pylint: disable=too-many-
     assert recording.status == "saved"
 
 
-@mock.patch(
-    "core.recording.services.recording_events.notification_service."
-    "notify_external_services"
-)
 @mock.patch("core.utils.notify_participants")
 @mock.patch("core.services.room_management.RoomManagement.update_metadata")
 def test_handle_egress_ended_notification_fails(
-    mock_update_metadata, mock_notify, mock_notify_external_services, service
+    mock_update_metadata, mock_notify, service
 ):
-    """Should still stop and save the recording when notifying participants fails."""
-
-    mock_notify_external_services.return_value = False
-    mock_notify.side_effect = NotificationError("Error notifying")
+    """Should raise ActionFailedError when notification fails but still stop recording."""
 
     recording = RecordingFactory(worker_id="worker-1", status="active")
     mock_data = mock.MagicMock()
     mock_data.egress_info.egress_id = recording.worker_id
     mock_data.egress_info.status = EgressStatus.EGRESS_LIMIT_REACHED
 
-    service._handle_egress_ended(mock_data)
+    mock_notify.side_effect = NotificationError("Error notifying")
+
+    with pytest.raises(
+        ActionFailedError,
+        match=r"Failed to process limit reached event for recording .+",
+    ):
+        service._handle_egress_ended(mock_data)
+
+    recording.refresh_from_db()
+    assert recording.status == "stopped"
 
-    mock_notify.assert_called_once_with(
-        room_name=str(recording.room.id),
-        notification_data={"type": "screenRecordingLimitReached"},
-    )
     mock_update_metadata.assert_called_once_with(
         str(recording.room.id), remove_keys=["recording_mode", "recording_status"]
     )
 
-    recording.refresh_from_db()
-    assert recording.status == "saved"
-
 
 @mock.patch("core.utils.notify_participants")
 @mock.patch("core.services.room_management.RoomManagement.update_metadata")
@@ -217,25 +232,17 @@ def test_handle_egress_ended_recording_not_found(
     assert recording.status == "active"
 
 
-@pytest.mark.parametrize(
-    "egress_status",
-    (
-        EgressStatus.EGRESS_FAILED,
-        EgressStatus.EGRESS_ABORTED,
-        EgressStatus.EGRESS_LIMIT_REACHED,
-    ),
-)
 @mock.patch("core.utils.notify_participants")
 @mock.patch("core.services.room_management.RoomManagement.update_metadata")
-def test_handle_egress_ended_recording_should_not_be_saved(
-    mock_update_metadata, mock_notify, egress_status, service
+def test_handle_egress_ended_recording_not_active(
+    mock_update_metadata, mock_notify, service
 ):
-    """Don't update status for recordings that must not be saved."""
+    """Should ignore non-active recordings."""
 
     recording = RecordingFactory(worker_id="worker-1", status="failed_to_stop")
     mock_data = mock.MagicMock()
     mock_data.egress_info.egress_id = "worker-1"
-    mock_data.egress_info.status = egress_status
+    mock_data.egress_info.status = EgressStatus.EGRESS_LIMIT_REACHED
 
     service._handle_egress_ended(mock_data)
 
@@ -248,24 +255,12 @@ def test_handle_egress_ended_recording_should_not_be_saved(
     assert recording.status == "failed_to_stop"
 
 
-@mock.patch(
-    "core.recording.services.recording_events.notification_service."
-    "notify_external_services"
-)
 @mock.patch("core.utils.notify_participants")
 @mock.patch("core.services.room_management.RoomManagement.update_metadata")
-def test_handle_egress_ended_complete_does_not_notify_participants(
-    mock_update_metadata, mock_notify, mock_notify_external_services, service
+def test_handle_egress_ended_recording_not_limit_reached(
+    mock_update_metadata, mock_notify, service
 ):
-    """Shouldn't notify participants on a successful egress.
-
-    EGRESS_COMPLETE is the only ended status that notifies no one: limit
-    reached, aborted and failed egresses each send their own notification.
-    A stopped recording is simply finalized, which is the nominal flow once
-    the egress uploaded the file of a user-initiated stop.
-    """
-
-    mock_notify_external_services.return_value = False
+    """Should ignore egress non-limit-reached statuses."""
 
     recording = RecordingFactory(worker_id="worker-1", status="stopped")
     mock_data = mock.MagicMock()
@@ -278,10 +273,7 @@ def test_handle_egress_ended_complete_does_not_notify_participants(
     mock_update_metadata.assert_called_once_with(
         str(recording.room.id), remove_keys=["recording_mode", "recording_status"]
     )
-    mock_notify_external_services.assert_called_once_with(recording)
-
-    recording.refresh_from_db()
-    assert recording.status == "saved"
+    assert recording.status == "stopped"
 
 
 @mock.patch("core.services.livekit_events.MetadataCollectorService")
@@ -341,163 +333,96 @@ def test_handle_egress_ended_does_not_call_metadata_collector_stop_when_conditio
     mock_collector.stop.assert_not_called()
 
 
-@pytest.mark.parametrize(
-    ("egress_status", "recording_status", "event", "expected_level"),
-    (
-        (EgressStatus.EGRESS_ABORTED, "active", "aborted", logging.INFO),
-        (EgressStatus.EGRESS_FAILED, "active", "failed", logging.ERROR),
-        # The synchronous stop may already have persisted the terminal status,
-        # and the error details exist only in the webhook payload.
-        (EgressStatus.EGRESS_ABORTED, "aborted", "aborted", logging.INFO),
-        (EgressStatus.EGRESS_FAILED, "failed", "failed", logging.ERROR),
-    ),
-)
-@mock.patch("core.utils.notify_participants")
-@mock.patch("core.services.room_management.RoomManagement.update_metadata")
-def test_handle_egress_ended_logs_livekit_error(  # noqa: PLR0913, PLR0917
-    mock_update_metadata,
-    mock_notify,
-    egress_status,
-    recording_status,
-    event,
-    expected_level,
-    service,
-    caplog,
-):  # pylint: disable=too-many-arguments,too-many-positional-arguments
-    """Should log the reason LiveKit reported an unsuccessful egress."""
-
-    recording = RecordingFactory(worker_id="worker-1", status=recording_status)
-    mock_data = mock.MagicMock()
-    mock_data.egress_info.egress_id = recording.worker_id
-    mock_data.egress_info.status = egress_status
-    mock_data.egress_info.error = "could not connect to the room"
-    mock_data.egress_info.error_code = 500
-
-    with caplog.at_level(logging.INFO):
-        service._handle_egress_ended(mock_data)
-
-    assert (
-        f"Recording worker reported {event} for recording {recording.id}" in caplog.text
-    )
-    assert "could not connect to the room" in caplog.text
-    assert "error_code=500" in caplog.text
-
-    worker_logs = [
-        record
-        for record in caplog.records
-        if record.name == "core.recording.services.recording_events"
-    ]
-    assert [record.levelno for record in worker_logs] == [expected_level]
-
-
-@pytest.mark.parametrize(
-    "egress_status",
-    (EgressStatus.EGRESS_COMPLETE, EgressStatus.EGRESS_LIMIT_REACHED),
-)
 @mock.patch(
     "core.recording.services.recording_events.notification_service."
     "notify_external_services"
 )
 @mock.patch("core.utils.notify_participants")
 @mock.patch("core.services.room_management.RoomManagement.update_metadata")
-def test_handle_egress_ended_does_not_log_error_on_successful_egress(  # noqa: PLR0913, PLR0917
+@pytest.mark.parametrize(
+    "egress_status",
+    [EgressStatus.EGRESS_COMPLETE, EgressStatus.EGRESS_LIMIT_REACHED],
+)
+@pytest.mark.parametrize(
+    "notify_return_value, recording_status",
+    [(True, "notification_succeeded"), (False, "saved")],
+)
+def test_handle_egress_ended_finalizes_recording(  # noqa: PLR0913, PLR0917
     mock_update_metadata,
     mock_notify,
     mock_notify_external_services,
+    notify_return_value,
+    recording_status,
     egress_status,
     service,
-    caplog,
 ):  # pylint: disable=too-many-arguments,too-many-positional-arguments
-    """Shouldn't log an egress error when LiveKit reports a successful egress."""
+    """Should notify external services and save the recording on egress completion
+    (EGRESS_COMPLETE or EGRESS_LIMIT_REACHED).
+    """
+    mock_notify_external_services.return_value = notify_return_value
 
     recording = RecordingFactory(worker_id="worker-1", status="active")
     mock_data = mock.MagicMock()
     mock_data.egress_info.egress_id = recording.worker_id
     mock_data.egress_info.status = egress_status
 
-    with caplog.at_level(logging.ERROR):
-        service._handle_egress_ended(mock_data)
+    service._handle_egress_ended(mock_data)
 
-    assert "Recording worker reported" not in caplog.text
+    mock_notify_external_services.assert_called_once_with(recording)
+
+    recording.refresh_from_db()
+    assert recording.status == recording_status
 
 
-@mock.patch("core.utils.notify_participants")
+@pytest.mark.parametrize(
+    "egress_status",
+    [
+        EgressStatus.EGRESS_STARTING,
+        EgressStatus.EGRESS_ACTIVE,
+        EgressStatus.EGRESS_ENDING,
+        EgressStatus.EGRESS_FAILED,
+        EgressStatus.EGRESS_ABORTED,
+    ],
+)
 @mock.patch("core.services.room_management.RoomManagement.update_metadata")
-def test_handle_egress_ended_logs_livekit_error_before_cleaning_up(
-    mock_update_metadata, mock_notify, service, caplog
+def test_handle_egress_ended_does_not_save_on_wrong_status(
+    mock_update_metadata, egress_status, service
 ):
-    """Should log the failure reason even when the cleanup fails afterwards."""
-
-    mock_update_metadata.side_effect = RuntimeError("LiveKit is unreachable")
+    """Shouldn't save on invalid status."""
 
     recording = RecordingFactory(worker_id="worker-1", status="active")
     mock_data = mock.MagicMock()
     mock_data.egress_info.egress_id = recording.worker_id
-    mock_data.egress_info.status = EgressStatus.EGRESS_FAILED
-    mock_data.egress_info.error = "could not connect to the room"
-    mock_data.egress_info.error_code = 500
+    mock_data.egress_info.status = egress_status
 
-    with caplog.at_level(logging.ERROR), pytest.raises(RuntimeError):
-        service._handle_egress_ended(mock_data)
+    service._handle_egress_ended(mock_data)
 
-    assert (
-        f"Recording worker reported failed for recording {recording.id}" in caplog.text
-    )
-    assert "could not connect to the room" in caplog.text
-
-
-def test_egress_status_mapping_covers_every_livekit_status():
-    """Every egress status LiveKit can report must translate to a recording event."""
-
-    unmapped = [
-        name
-        for name in EgressStatus.keys()
-        if getattr(EgressStatus, name) not in EGRESS_STATUS_TO_RECORDING_EVENT
-    ]
-
-    assert not unmapped
+    recording.refresh_from_db()
+    assert recording.status == "active"
 
 
 @pytest.mark.parametrize(
-    ("egress_status", "expected_event"),
-    (
-        (EgressStatus.EGRESS_STARTING, RecordingWorkerEvent.STARTING),
-        (EgressStatus.EGRESS_ACTIVE, RecordingWorkerEvent.STARTED),
-        (EgressStatus.EGRESS_ENDING, RecordingWorkerEvent.SAVING),
-        (EgressStatus.EGRESS_COMPLETE, RecordingWorkerEvent.COMPLETED),
-        (EgressStatus.EGRESS_LIMIT_REACHED, RecordingWorkerEvent.LIMIT_REACHED),
-        (EgressStatus.EGRESS_ABORTED, RecordingWorkerEvent.ABORTED),
-        (EgressStatus.EGRESS_FAILED, RecordingWorkerEvent.FAILED),
-    ),
+    "status", ["failed_to_start", "aborted", "failed_to_stop", "saved", "initiated"]
 )
-def test_to_recording_event_translates_egress_status(egress_status, expected_event):
-    """Should translate a LiveKit egress status into a recording worker event."""
-
-    assert to_recording_event(egress_status) == expected_event
-
-
-def test_to_recording_event_returns_none_on_unmapped_status(caplog):
-    """Should warn and return None when LiveKit reports an unknown status."""
-
-    with caplog.at_level(logging.WARNING):
-        event = to_recording_event(999)
-
-    assert event is None
-    assert "Unmapped LiveKit egress status" in caplog.text
-
-
 @mock.patch("core.services.room_management.RoomManagement.update_metadata")
-def test_handle_egress_updated_ignores_unmapped_status(mock_update_metadata, service):
-    """Shouldn't touch the room's metadata when the egress status is unknown."""
+def test_handle_egress_ended_ignores_non_savable_recording(
+    mock_update_metadata, status, service
+):
+    """Should handle non-savable recordings idempotently without raising.
 
-    RecordingFactory(worker_id="worker-1", status="active")
+    'egress_ended' may be redelivered (e.g. for an already-saved recording);
+    this must not raise, otherwise the webhook would 500 and LiveKit would retry.
+    """
+
+    recording = RecordingFactory(worker_id="worker-1", status=status)
     mock_data = mock.MagicMock()
-    mock_data.egress_info.egress_id = "worker-1"
-    mock_data.egress_info.status = 999
+    mock_data.egress_info.egress_id = recording.worker_id
+    mock_data.egress_info.status = EgressStatus.EGRESS_COMPLETE
 
-    service._handle_egress_updated(mock_data)
+    service._handle_egress_ended(mock_data)
 
-    mock_update_metadata.assert_not_called()
+    recording.refresh_from_db()
+    assert recording.status == status
 
 
 @mock.patch.object(LobbyService, "clear_room_cache")

src/backend/core/tests/services/test_sip_management.py

@@ -1,5 +1,5 @@
 """
-Test SIP management service.
+Test SIP mamagement service.
 """
 
 # pylint: disable=W0212

src/backend/core/tests/test_models_recording.py

@@ -157,7 +157,6 @@ def test_models_recording_is_savable_normal():
 @pytest.mark.parametrize(
     "status",
     [
-        RecordingStatusChoices.FAILED,
         RecordingStatusChoices.FAILED_TO_STOP,
         RecordingStatusChoices.FAILED_TO_START,
         RecordingStatusChoices.ABORTED,
@@ -280,7 +279,6 @@ def test_models_recording_is_saved_false_initiated():
 @pytest.mark.parametrize(
     "status",
     [
-        RecordingStatusChoices.FAILED,
         RecordingStatusChoices.FAILED_TO_STOP,
         RecordingStatusChoices.FAILED_TO_START,
         RecordingStatusChoices.ABORTED,

src/backend/pyproject.toml

@@ -7,7 +7,7 @@ build-backend = "uv_build"
 
 [project]
 name = "meet"
-version = "1.32.1"
+version = "1.31.0"
 authors = [{ "name" = "DINUM", "email" = "dev@mail.numerique.gouv.fr" }]
 classifiers = [
     "Development Status :: 5 - Production/Stable",
@@ -41,7 +41,7 @@ dependencies = [
     "django-timezone-field>=5.1",
     "django-pydantic-field==0.5.4",
     "django==5.2.16",
-    "djangorestframework==3.17.2",
+    "djangorestframework==3.17.1",
     "drf_spectacular==0.30.0",
     "dockerflow==2026.3.4",
     "easy_thumbnails==2.10.1",

src/backend/uv.lock

@@ -754,14 +754,14 @@ wheels = [
 
 [[package]]
 name = "djangorestframework"
-version = "3.17.2"
+version = "3.17.1"
 source = { registry = "https://pypi.org/simple" }
 dependencies = [
     { name = "django" },
 ]
-sdist = { url = "https://files.pythonhosted.org/packages/3b/35/c96055e700fdff25da3a7b7756cfd1d4dc54f38b9bc6d6c5e19e3a0fdc20/djangorestframework-3.17.2.tar.gz", hash = "sha256:89ed713b6dc83e1539f214b7d10808ae19bb8511004beba886225da6d5c9dafa", size = 906683, upload-time = "2026-08-05T07:47:22.5Z" }
+sdist = { url = "https://files.pythonhosted.org/packages/ca/d7/c016e69fac19ff8afdc89db9d31d9ae43ae031e4d1993b20aca179b8301a/djangorestframework-3.17.1.tar.gz", hash = "sha256:a6def5f447fe78ff853bff1d47a3c59bf38f5434b031780b351b0c73a62db1a5", size = 905742, upload-time = "2026-03-24T16:58:33.705Z" }
 wheels = [
-    { url = "https://files.pythonhosted.org/packages/a2/46/c14108e400b208c394325eb63fbae06c81341b6447fa1a6f9da718b17fe7/djangorestframework-3.17.2-py3-none-any.whl", hash = "sha256:cb0546a7415d5b46c04e0f4fe0a54b2109f4fdd5e83ca773c8c6183a6493d042", size = 899109, upload-time = "2026-08-05T07:47:20.853Z" },
+    { url = "https://files.pythonhosted.org/packages/5a/e1/2c516bdc83652b1a60c6119366ac2c0607b479ed05cd6093f916ca8928f8/djangorestframework-3.17.1-py3-none-any.whl", hash = "sha256:c3c74dd3e83a5a3efc37b3c18d92bd6f86a6791c7b7d4dff62bb068500e76457", size = 898844, upload-time = "2026-03-24T16:58:31.845Z" },
 ]
 
 [[package]]
@@ -1187,7 +1187,7 @@ wheels = [
 
 [[package]]
 name = "meet"
-version = "1.32.1"
+version = "1.31.0"
 source = { editable = "." }
 dependencies = [
     { name = "aiohttp" },
@@ -1273,7 +1273,7 @@ requires-dist = [
     { name = "django-redis", specifier = "==7.0.0" },
     { name = "django-storages", extras = ["s3"], specifier = "==1.14.6" },
     { name = "django-timezone-field", specifier = ">=5.1" },
-    { name = "djangorestframework", specifier = "==3.17.2" },
+    { name = "djangorestframework", specifier = "==3.17.1" },
     { name = "dockerflow", specifier = "==2026.3.4" },
     { name = "drf-spectacular", specifier = "==0.30.0" },
     { name = "easy-thumbnails", specifier = "==2.10.1" },

src/frontend/Dockerfile

@@ -45,8 +45,7 @@ RUN npm run build
 FROM nginxinc/nginx-unprivileged:1.30.4-alpine3.24 AS frontend-production
 
 USER root
-RUN apk upgrade --no-cache libexpat && \
-    apk del curl
+RUN apk del curl
 USER nginx
 
 # Un-privileged user running the application

src/frontend/package-lock.json

@@ -1,12 +1,12 @@
 {
   "name": "meet",
-  "version": "1.32.1",
+  "version": "1.31.0",
   "lockfileVersion": 3,
   "requires": true,
   "packages": {
     "": {
       "name": "meet",
-      "version": "1.32.1",
+      "version": "1.31.0",
       "dependencies": {
         "@fontsource-variable/atkinson-hyperlegible-next": "5.3.0",
         "@fontsource-variable/lexend": "5.3.0",

src/frontend/package.json

@@ -1,7 +1,7 @@
 {
   "name": "meet",
   "private": true,
-  "version": "1.32.1",
+  "version": "1.31.0",
   "type": "module",
   "scripts": {
     "dev": "panda codegen && vite",

src/frontend/panda.config.ts

@@ -121,7 +121,7 @@ const config: Config = {
     },
     tokens: defineTokens({
       /* we take a few things from the panda preset but for now we clear out some stuff.
-       * This way we'll only add the things we need step by step and prevent using lots of different things.
+       * This way we'll only add the things we need step by step and prevent using lots of differents things.
        */
       ...pandaPreset.theme.tokens,
       colors: defineTokens.colors({

src/frontend/src/features/notifications/MainNotificationToast.tsx

@@ -96,10 +96,6 @@ export const MainNotificationToast = () => {
         case NotificationType.ScreenRecordingStopped:
         case NotificationType.TranscriptionLimitReached:
         case NotificationType.ScreenRecordingLimitReached:
-        case NotificationType.TranscriptionFailed:
-        case NotificationType.ScreenRecordingFailed:
-        case NotificationType.TranscriptionAborted:
-        case NotificationType.ScreenRecordingAborted:
           toastQueue.add(
             {
               participant,

src/frontend/src/features/notifications/NotificationType.ts

@@ -10,15 +10,11 @@ export enum NotificationType {
   TranscriptionStarted = 'transcriptionStarted',
   TranscriptionStopped = 'transcriptionStopped',
   TranscriptionLimitReached = 'transcriptionLimitReached',
-  TranscriptionFailed = 'transcriptionFailed',
-  TranscriptionAborted = 'transcriptionAborted',
   TranscriptionRequested = 'transcriptionRequested',
   ScreenRecordingStarted = 'screenRecordingStarted',
   ScreenRecordingStopped = 'screenRecordingStopped',
   ScreenRecordingRequested = 'screenRecordingRequested',
   ScreenRecordingLimitReached = 'screenRecordingLimitReached',
-  ScreenRecordingFailed = 'screenRecordingFailed',
-  ScreenRecordingAborted = 'screenRecordingAborted',
   RecordingSaving = 'recordingSaving',
   PermissionsRemoved = 'permissionsRemoved',
   RoleChanged = 'roleChanged',

src/frontend/src/features/notifications/components/ToastAnyRecording.tsx

@@ -22,20 +22,12 @@ export function ToastAnyRecording({ state, ...props }: Readonly<ToastProps>) {
         return 'transcript.stopped'
       case NotificationType.TranscriptionLimitReached:
         return 'transcript.limitReached'
-      case NotificationType.TranscriptionFailed:
-        return 'transcript.failed'
-      case NotificationType.TranscriptionAborted:
-        return 'transcript.aborted'
       case NotificationType.ScreenRecordingStarted:
         return 'screenRecording.started'
       case NotificationType.ScreenRecordingStopped:
         return 'screenRecording.stopped'
       case NotificationType.ScreenRecordingLimitReached:
         return 'screenRecording.limitReached'
-      case NotificationType.ScreenRecordingFailed:
-        return 'screenRecording.failed'
-      case NotificationType.ScreenRecordingAborted:
-        return 'screenRecording.aborted'
       default:
         return
     }

src/frontend/src/features/notifications/components/ToastRegion.tsx

@@ -58,10 +58,6 @@ const renderToast = (
     case NotificationType.ScreenRecordingStarted:
     case NotificationType.ScreenRecordingStopped:
     case NotificationType.ScreenRecordingLimitReached:
-    case NotificationType.TranscriptionFailed:
-    case NotificationType.ScreenRecordingFailed:
-    case NotificationType.TranscriptionAborted:
-    case NotificationType.ScreenRecordingAborted:
       return <ToastAnyRecording key={toast.key} toast={toast} state={state} />
 
     case NotificationType.TranscriptionRequested:

src/frontend/src/features/recording/types.ts

@@ -9,9 +9,8 @@ export enum RecordingStatus {
   Stopped = 'stopped',
   Saved = 'saved',
   Aborted = 'aborted',
-  Failed = 'failed',
-  FailedToStart = 'failed_to_start',
-  FailedToStop = 'failed_to_stop',
+  FailedToStart = 'failedToStart',
+  FailedToStop = 'failedToStop',
   NotificationSucceed = 'notification_succeeded',
   ExternalProcessSuccessful = 'external_process_successful',
   ExternalProcessFailed = 'external_process_failed',

src/frontend/src/features/rooms/components/Conference.tsx

@@ -158,7 +158,7 @@ export const Conference = ({
            *
            * Issue: On Firefox behind proxy configurations, WebSocket signaling fails to establish.
            * Symptom: Client receives HTTP 200 instead of expected 101 (Switching Protocols).
-           * Root Cause: Certificate/security issue where the initial request is considered insecure.
+           * Root Cause: Certificate/security issue where the initial request is considered unsecure.
            *
            * Solution: Pre-establish a WebSocket connection to the signaling server, which fails.
            * This "primes" the connection, allowing subsequent WebSocket establishments to work correctly.

src/frontend/src/locales/de/notifications.json

@@ -37,8 +37,6 @@
     "started": "{{name}} hat die Meeting-Transkription gestartet.",
     "stopped": "{{name}} hat die Meeting-Transkription gestoppt.",
     "limitReached": "Die Transkription hat die maximal zulässige Dauer überschritten und wird automatisch gespeichert.",
-    "failed": "Die Transkription wurde unerwartet beendet und konnte nicht gespeichert werden.",
-    "aborted": "Die Transkription konnte nicht gestartet werden.",
     "requested": "{{name}} möchte die Meeting-Transkription starten."
   },
   "screenRecording": {
@@ -46,8 +44,6 @@
     "started": "{{name}} hat die Meeting-Aufzeichnung gestartet.",
     "stopped": "{{name}} hat die Meeting-Aufzeichnung gestoppt.",
     "limitReached": "Die Aufzeichnung hat die maximal zulässige Dauer überschritten und wird automatisch gespeichert.",
-    "failed": "Die Aufzeichnung wurde unerwartet beendet und konnte nicht gespeichert werden.",
-    "aborted": "Die Aufzeichnung konnte nicht gestartet werden.",
     "requested": "{{name}} möchte die Meeting-Aufzeichnung starten."
   },
   "recordingSave": {

src/frontend/src/locales/en/notifications.json

@@ -37,8 +37,6 @@
     "started": "{{name}} started the meeting transcription.",
     "stopped": "{{name}} stopped the meeting transcription.",
     "limitReached": "The transcription has exceeded the maximum allowed duration and will be automatically saved.",
-    "failed": "The transcription stopped unexpectedly and could not be saved.",
-    "aborted": "The transcription could not be started.",
     "requested": "{{name}} wants to start the meeting transcription."
   },
   "screenRecording": {
@@ -46,8 +44,6 @@
     "started": "{{name}} started the meeting recording.",
     "stopped": "{{name}} stopped the meeting recording.",
     "limitReached": "The recording has exceeded the maximum allowed duration and will be automatically saved.",
-    "failed": "The recording stopped unexpectedly and could not be saved.",
-    "aborted": "The recording could not be started.",
     "requested": "{{name}} wants to start the meeting recording."
   },
   "recordingSave": {

src/frontend/src/locales/es/notifications.json

@@ -37,8 +37,6 @@
     "started": "{{name}} ha iniciado la transcripción de la reunión.",
     "stopped": "{{name}} ha detenido la transcripción de la reunión.",
     "limitReached": "La transcripción ha superado la duración máxima permitida, se va a guardar automáticamente.",
-    "failed": "La transcripción se ha interrumpido de forma inesperada y no se ha podido guardar.",
-    "aborted": "No se ha podido iniciar la transcripción.",
     "requested": "{{name}} ha solicitado iniciar la transcripción."
   },
   "screenRecording": {
@@ -46,8 +44,6 @@
     "started": "{{name}} ha iniciado la grabación de la reunión.",
     "stopped": "{{name}} ha detenido la grabación de la reunión.",
     "limitReached": "La grabación ha superado la duración máxima permitida, se va a guardar automáticamente.",
-    "failed": "La grabación se ha interrumpido de forma inesperada y no se ha podido guardar.",
-    "aborted": "No se ha podido iniciar la grabación.",
     "requested": "{{name}} ha solicitado iniciar la grabación."
   },
   "recordingSave": {

src/frontend/src/locales/fr/notifications.json

@@ -37,8 +37,6 @@
     "started": "{{name}} a démarré la transcription de la réunion.",
     "stopped": "{{name}} a arrêté la transcription de la réunion.",
     "limitReached": "La transcription a dépassé la durée maximale autorisée, elle va être automatiquement sauvegardée.",
-    "failed": "La transcription s'est interrompue de façon inattendue et n'a pas pu être sauvegardée.",
-    "aborted": "La transcription n'a pas pu être démarrée.",
     "requested": "{{name}} a demandé à démarrer la transcription."
   },
   "screenRecording": {
@@ -46,8 +44,6 @@
     "started": "{{name}} a démarré l'enregistrement de la réunion.",
     "stopped": "{{name}} a arrêté l'enregistrement de la réunion.",
     "limitReached": "L'enregistrement a dépassé la durée maximale autorisée, il va être automatiquement sauvegardé.",
-    "failed": "L'enregistrement s'est interrompu de façon inattendue et n'a pas pu être sauvegardé.",
-    "aborted": "L'enregistrement n'a pas pu être démarré.",
     "requested": "{{name}} a demandé à démarrer l'enregistrement."
   },
   "recordingSave": {

src/frontend/src/locales/nl/notifications.json

@@ -37,8 +37,6 @@
     "started": "{{name}} is de transcriptie van de vergadering gestart.",
     "stopped": "{{name}} heeft de transcriptie van de vergadering gestopt.",
     "limitReached": "De transcriptie heeft de maximaal toegestane duur overschreden en wordt automatisch opgeslagen.",
-    "failed": "De transcriptie is onverwacht gestopt en kon niet worden opgeslagen.",
-    "aborted": "De transcriptie kon niet worden gestart.",
     "requested": "{{name}} wil graag de transcriptie starten."
   },
   "screenRecording": {
@@ -46,8 +44,6 @@
     "started": "{{name}} is begonnen met het opnemen van de vergadering.",
     "stopped": "{{name}} is gestopt met het opnemen van de vergadering.",
     "limitReached": "De opname heeft de maximaal toegestane duur overschreden en wordt automatisch opgeslagen.",
-    "failed": "De opname is onverwacht gestopt en kon niet worden opgeslagen.",
-    "aborted": "De opname kon niet worden gestart.",
     "requested": "{{name}} wil graag de opname starten."
   },
   "recordingSave": {

src/helm/meet/generate-readme.sh

@@ -1,9 +1,10 @@
 #!/usr/bin/env bash
 
-if ! docker image ls | grep readme-generator-for-helm; then
+docker image ls | grep readme-generator-for-helm
+if [ "$?" -ne "0" ]; then
 	git clone https://github.com/bitnami/readme-generator-for-helm.git /tmp/readme-generator-for-helm
-	cd /tmp/readme-generator-for-helm || exit 1
+	cd /tmp/readme-generator-for-helm
 	docker build -t readme-generator-for-helm:latest .
-	cd "$(dirname -- "${BASH_SOURCE[0]}")" || exit 1
+	cd $(dirname -- "${BASH_SOURCE[0]}")
 fi
 docker run --rm -it -v .:/source -w /source readme-generator-for-helm:latest readme-generator -v values.yaml -r README.md

src/helm/meet/templates/_helpers.tpl

@@ -51,7 +51,7 @@ app.kubernetes.io/instance: {{ .Release.Name }}
 {{- end }}
 
 {{/*
-transform dictionary of environment variables
+transform dictionnary of environment variables
 Usage : {{ include "meet.env.transformDict" .Values.envVars }}
 
 Example:

src/mail/package-lock.json

@@ -1,12 +1,12 @@
 {
   "name": "mail_mjml",
-  "version": "1.32.1",
+  "version": "1.31.0",
   "lockfileVersion": 3,
   "requires": true,
   "packages": {
     "": {
       "name": "mail_mjml",
-      "version": "1.32.1",
+      "version": "1.31.0",
       "license": "MIT",
       "dependencies": {
         "@html-to/text-cli": "0.6.1",

src/mail/package.json

@@ -1,6 +1,6 @@
 {
   "name": "mail_mjml",
-  "version": "1.32.1",
+  "version": "1.31.0",
   "description": "An util to generate html and text django's templates from mjml templates",
   "type": "module",
   "dependencies": {

src/sdk/package-lock.json

@@ -1,12 +1,12 @@
 {
   "name": "sdk",
-  "version": "1.32.1",
+  "version": "1.31.0",
   "lockfileVersion": 3,
   "requires": true,
   "packages": {
     "": {
       "name": "sdk",
-      "version": "1.32.1",
+      "version": "1.31.0",
       "license": "ISC",
       "workspaces": [
         "./library",

src/sdk/package.json

@@ -1,6 +1,6 @@
 {
   "name": "sdk",
-  "version": "1.32.1",
+  "version": "1.31.0",
   "author": "",
   "license": "ISC",
   "description": "",

src/summary/pyproject.toml

@@ -1,7 +1,7 @@
 
 [project]
 name = "summary"
-version = "1.32.1"
+version = "1.31.0"
 requires-python = ">=3.13"
 dependencies = [
     "fastapi[standard]>=0.105.0",

src/summary/uv.lock

@@ -1516,7 +1516,7 @@ wheels = [
 
 [[package]]
 name = "summary"
-version = "1.32.1"
+version = "1.31.0"
 source = { editable = "." }
 dependencies = [
     { name = "celery" },