🐛(backend) acknowledge unknown LiveKit webhook events instead of 422

Around 0.76% of incoming LiveKit webhooks were being flagged as
unprocessable and returned a 422, even though LiveKit was sending
legitimate data — just with event types we do not handle. This
inflated error metrics and made real webhook issues harder to spot.

Return a 200 for these webhooks instead. When a new, unhandled
event type shows up, log a warning so we can decide whether it is
worth adding explicit handling.

CHANGELOG.md

@@ -8,18 +8,10 @@ and this project adheres to
 
 ## [Unreleased]
 
-### Changed
-
-- 📈(frontend) include LiveKit SIDs in the connection analytics event
-- 🔇(backend) silence expected 401 warnings on /me
-- 🔇(backend) silence noisy request summary info logs
-- ⚡️(frontend) defer loading the Crisp script until idle
-
 ### Fixed
 
 - 🐛(backend) acknowledge unknown LiveKit webhook events instead of 422
 - 🔒️(backend) enforce display name setting on rename API
-- 🔒️(backend) reject inactive users in resource server backend
 
 ## [1.31.0] - 2026-09-08
 

src/backend/core/external_api/authentication.py

@@ -286,10 +286,6 @@ class ResourceServerBackend(LaSuiteBackend):
         if user is None and settings.OIDC_CREATE_USER:
             user = self.create_user(sub)
 
-        if user is not None and not user.is_active:
-            logger.warning("Inactive user attempted authentication: %s", user.pk)
-            raise SuspiciousOperation("User account is disabled.")
-
         return user
 
     def create_user(self, sub):

src/backend/core/logging_filters.py

@@ -1,25 +0,0 @@
-"""Logging filters for the core application."""
-
-import logging
-
-from django.conf import settings
-
-
-class SilenceExpected401(logging.Filter):
-    """Drop the expected 401 from anonymous hits on the /me endpoint.
-
-    The frontend probes `/users/me/` to check authentication; a 401 for
-    anonymous users is normal, not a warning worth logging.
-    """
-
-    def filter(self, record):
-        """Return False for a 401 on a silenced path, True otherwise."""
-        if getattr(record, "status_code", None) != 401:
-            return True
-
-        request = getattr(record, "request", None)
-        path = getattr(request, "path", None)
-        if not path:
-            return True
-
-        return path not in settings.LOGGING_SILENCED_401_PATHS

src/backend/core/tests/test_external_api_authentication.py

@@ -1,96 +0,0 @@
-"""Tests for the external API ResourceServerBackend."""
-
-from django.core.exceptions import SuspiciousOperation
-
-import pytest
-import responses
-from rest_framework.test import APIClient
-
-from core.external_api.authentication import ResourceServerBackend
-from core.factories import UserFactory
-from core.models import User
-
-pytestmark = pytest.mark.django_db
-
-
-def _payload(sub):
-    return {"sub": sub, "active": True, "scope": "lasuite_meet", "client_id": "app"}
-
-
-def test_resource_server_backend_get_or_create_user_active():
-    """An existing active user matching the sub should be returned."""
-
-    user = UserFactory()
-
-    result = ResourceServerBackend().get_or_create_user(
-        access_token="token", id_token=None, payload=_payload(user.sub)
-    )
-
-    assert result == user
-
-
-def test_resource_server_backend_get_or_create_user_inactive():
-    """An inactive user should be rejected even with a valid token."""
-
-    user = UserFactory(is_active=False)
-
-    with pytest.raises(SuspiciousOperation, match="User account is disabled."):
-        ResourceServerBackend().get_or_create_user(
-            access_token="token", id_token=None, payload=_payload(user.sub)
-        )
-
-
-def test_resource_server_backend_get_or_create_user_creates(settings):
-    """An unknown sub should create an active user when OIDC_CREATE_USER is set."""
-
-    settings.OIDC_CREATE_USER = True
-
-    result = ResourceServerBackend().get_or_create_user(
-        access_token="token", id_token=None, payload=_payload("new-sub")
-    )
-
-    assert result.sub == "new-sub"
-    assert result.is_active is True
-    assert User.objects.filter(sub="new-sub").exists()
-
-
-def test_resource_server_backend_get_or_create_user_no_creation(settings):
-    """An unknown sub should return None when OIDC_CREATE_USER is unset."""
-
-    settings.OIDC_CREATE_USER = False
-
-    result = ResourceServerBackend().get_or_create_user(
-        access_token="token", id_token=None, payload=_payload("new-sub")
-    )
-
-    assert result is None
-    assert not User.objects.filter(sub="new-sub").exists()
-
-
-@responses.activate
-def test_api_rooms_list_resource_server_inactive_user(settings):
-    """End to end: a valid introspected token for an inactive user should get 401."""
-
-    settings.OIDC_OP_INTROSPECTION_ENDPOINT = "https://oidc.example.com/introspect"
-    settings.OIDC_OP_URL = "https://oidc.example.com"
-
-    user = UserFactory(is_active=False)
-
-    responses.add(
-        responses.POST,
-        "https://oidc.example.com/introspect",
-        json={
-            "iss": "https://oidc.example.com",
-            "active": True,
-            "sub": user.sub,
-            "scope": "openid lasuite_meet rooms:list",
-            "client_id": "app",
-        },
-    )
-
-    client = APIClient()
-    client.credentials(HTTP_AUTHORIZATION="Bearer rs-token")
-    response = client.get("/external-api/v1.0/rooms/")
-
-    assert response.status_code == 401
-    assert "login failed" in str(response.data).lower()

src/backend/meet/settings.py

@@ -469,9 +469,6 @@ class Base(Configuration):
 
     # Sentry
     SENTRY_DSN = values.Value(None, environ_name="SENTRY_DSN")
-    SENTRY_TRACES_SAMPLE_RATE = values.FloatValue(
-        0.0, environ_name="SENTRY_TRACES_SAMPLE_RATE", environ_prefix=None
-    )
 
     # Easy thumbnails
     THUMBNAIL_EXTENSION = "webp"
@@ -1113,12 +1110,6 @@ class Base(Configuration):
         environ_prefix=None,
     )
 
-    LOGGING_SILENCED_401_PATHS = values.ListValue(
-        default=["/api/v1.0/users/me/"],
-        environ_name="LOGGING_SILENCED_401_PATHS",
-        environ_prefix=None,
-    )
-
     # Logging
     # We want to make it easy to log to console but by default we log production
     # to Sentry and don't want to log to console.
@@ -1131,16 +1122,10 @@ class Base(Configuration):
                 "style": "{",
             },
         },
-        "filters": {
-            "silence_expected_401": {
-                "()": "core.logging_filters.SilenceExpected401",
-            },
-        },
         "handlers": {
             "console": {
                 "class": "logging.StreamHandler",
                 "formatter": "simple",
-                "filters": ["silence_expected_401"],
             },
         },
         # Override root logger to send it to console
@@ -1151,13 +1136,6 @@ class Base(Configuration):
             ),
         },
         "loggers": {
-            "request.summary": {
-                "level": values.Value(
-                    "WARNING",
-                    environ_name="LOGGING_LEVEL_REQUEST_SUMMARY",
-                    environ_prefix="",
-                )
-            },
             "core": {
                 "handlers": ["console"],
                 "level": values.Value(
@@ -1233,14 +1211,7 @@ class Base(Configuration):
                 dsn=cls.SENTRY_DSN,
                 environment=cls.__name__.lower(),  # build, test, development, production
                 release=get_release(),
-                traces_sample_rate=cls.SENTRY_TRACES_SAMPLE_RATE,
-                integrations=[
-                    DjangoIntegration(
-                        transaction_style="url",
-                        middleware_spans=True,
-                        cache_spans=True,
-                    )
-                ],
+                integrations=[DjangoIntegration()],
             )
             sentry_sdk.set_tag("application", "backend")
 

src/frontend/src/features/rooms/livekit/components/ConnectionObserver.tsx

@@ -71,30 +71,20 @@ export const ConnectionObserver = () => {
   useEffect(() => {
     if (!isAnalyticsEnabled) return
 
-    const handleConnection = async () => {
+    const handleConnection = () => {
       // Preserve original connection timestamp across reconnections to measure
       // total session duration from first connect to final disconnect.
       if (connectionStartTimeRef.current != null) return
       connectionStartTimeRef.current = Date.now()
-      const participantSid = room.localParticipant.sid
-      const roomSid = await room.getSid().catch(() => undefined)
-      void captureMediaEvent('connection-event', {
-        livekit_room_sid: roomSid,
-        livekit_participant_sid: participantSid,
-      })
+      void captureMediaEvent('connection-event', {})
     }
 
     const handleReconnect = () => {
       captureEvent('reconnect-event')
     }
 
-    const handleReconnected = async () => {
-      const participantSid = room.localParticipant.sid
-      const roomSid = await room.getSid().catch(() => undefined)
-      captureEvent('reconnected-event', {
-        livekit_room_sid: roomSid,
-        livekit_participant_sid: participantSid,
-      })
+    const handleReconnected = () => {
+      captureEvent('reconnected-event')
     }
 
     const handleSignalingConnect = () => {

src/frontend/src/features/rooms/livekit/components/controls/Options/SupportMenuItem.tsx

@@ -2,20 +2,23 @@ import { RiQuestionLine } from '@remixicon/react'
 import { MenuItem } from 'react-aria-components'
 import { useTranslation } from 'react-i18next'
 import { menuRecipe } from '@/primitives/menuRecipe'
-import { useIsSupportEnabled, openSupportChat } from '@/features/support/hooks/useSupport'
+import { Crisp } from 'crisp-sdk-web'
+import { useIsSupportEnabled } from '@/features/support/hooks/useSupport'
 
 export const SupportMenuItem = () => {
   const { t } = useTranslation('rooms', { keyPrefix: 'options.items' })
   const isSupportEnabled = useIsSupportEnabled()
 
-  if (!isSupportEnabled) {
+  if (!isSupportEnabled || !Crisp) {
     return
   }
 
   return (
     <MenuItem
       className={menuRecipe({ icon: true, variant: 'dark' }).item}
-      onAction={openSupportChat}
+      onAction={() => {
+        Crisp?.chat.open()
+      }}
     >
       <RiQuestionLine size={20} />
       {t('support')}

src/frontend/src/features/support/hooks/useSupport.tsx

@@ -1,45 +1,20 @@
-import { useEffect, useState } from 'react'
+import { useEffect } from 'react'
+import { Crisp } from 'crisp-sdk-web'
 import { type ApiUser } from '@/features/auth/api/ApiUser'
 import { useUser } from '@/features/auth/api/useUser'
 import { useConfig } from '@/api/useConfig'
 
-type CrispSdk = (typeof import('crisp-sdk-web'))['Crisp']
-
-let crisp: CrispSdk | undefined
-let crispPromise: Promise<CrispSdk> | undefined
-
-const loadCrisp = (): Promise<CrispSdk> => {
-  crispPromise ??= import('crisp-sdk-web')
-    .then((module) => {
-      crisp = module.Crisp
-      return module.Crisp
-    })
-    .catch((error) => {
-      crispPromise = undefined
-      throw error
-    })
-
-  return crispPromise
-}
-
-export const openSupportChat = () => {
-  if (!crisp?.isCrispInjected()) return
-  crisp.chat.open()
-}
-
 export const initializeSupportSession = (user: ApiUser) => {
-  if (!crisp?.isCrispInjected()) return
-
+  if (!Crisp.isCrispInjected()) return
   const { id, email } = user
-  crisp.setTokenId(`meet-${id}`)
-  if (email) crisp.user.setEmail(email)
+  Crisp.setTokenId(`meet-${id}`)
+  if (email) Crisp.user.setEmail(email)
 }
 
 export const terminateSupportSession = () => {
-  if (!crisp?.isCrispInjected()) return
-
-  crisp.setTokenId()
-  crisp.session.reset()
+  if (!Crisp.isCrispInjected()) return
+  Crisp.setTokenId()
+  Crisp.session.reset()
 }
 
 export type useSupportProps = {
@@ -47,70 +22,26 @@ export type useSupportProps = {
   isDisabled?: boolean
 }
 
-const IDLE_TIMEOUT_MS = 10_000
-
-const scheduleWhenIdle = (callback: () => void): (() => void) => {
-  if (typeof window.requestIdleCallback === 'function') {
-    const handle = window.requestIdleCallback(callback, {
-      timeout: IDLE_TIMEOUT_MS,
-    })
-    return () => window.cancelIdleCallback(handle)
-  }
-
-  const handle = window.setTimeout(callback, 1)
-  return () => window.clearTimeout(handle)
-}
-
+// Configure Crisp chat for real-time support across all pages.
 export const useSupport = ({ id, isDisabled }: useSupportProps) => {
   const { user } = useUser()
-  const [isInjected, setIsInjected] = useState(
-    () => crisp?.isCrispInjected() ?? false
-  )
 
   useEffect(() => {
-    if (!id || isDisabled) return
-
-    if (crisp?.isCrispInjected()) {
-      setIsInjected(true)
-      return
-    }
-
-    let cancelled = false
-
-    const cancelIdle = scheduleWhenIdle(() => {
-      void loadCrisp()
-        .then((sdk) => {
-          if (cancelled) return
-
-          if (!sdk.isCrispInjected()) {
-            sdk.configure(id)
-            sdk.setHideOnMobile(true)
-          }
-
-          setIsInjected(true)
-        })
-        .catch((error) => {
-          if (!cancelled) {
-            console.error('Failed to initialize support chat', error)
-          }
-        })
-    })
-
-    return () => {
-      cancelled = true
-      cancelIdle()
-    }
+    if (!id || Crisp.isCrispInjected() || isDisabled) return
+    Crisp.configure(id)
+    Crisp.setHideOnMobile(true)
   }, [id, isDisabled])
 
   useEffect(() => {
-    if (!user || !isInjected || isDisabled) return
+    if (!user) return
     initializeSupportSession(user)
-  }, [user, isInjected, isDisabled])
+  }, [user])
 
   return null
 }
 
-// Some users block the chat widget, so check its availability safely.
+// Some users may block Crisp chat widget with browser ad blockers or anti-tracking plugins
+// So we need to safely check if Crisp is available and not blocked
 const isCrispAvailable = () => {
   try {
     return !!window?.$crisp?.is

src/frontend/src/locales/de/rooms.json

@@ -480,7 +480,7 @@
       "destination": "Ein neues Dokument wird erstellt auf",
       "destinationUnknown": "Ein neues Dokument wird erstellt",
       "language": "Meeting-Sprache:",
-      "recording": "Auch eine Videoaufzeichnung starten"
+      "recording": "Auch eine Aufzeichnung starten"
     },
     "button": {
       "start": "Meeting-Transkription starten",

src/frontend/src/locales/en/rooms.json

@@ -480,7 +480,7 @@
       "destination": "A new document will be created on",
       "destinationUnknown": "A new document will be created",
       "language": "Meeting language:",
-      "recording": "Also start a video recording"
+      "recording": "Also start a recording"
     },
     "button": {
       "start": "Start transcribing the meeting",

src/frontend/src/locales/es/rooms.json

@@ -479,7 +479,7 @@
       "destination": "Se creará un nuevo documento en",
       "destinationUnknown": "Se creará un nuevo documento",
       "language": "Idioma de la reunión:",
-      "recording": "Iniciar también una grabación de vídeo"
+      "recording": "Iniciar también una grabación"
     },
     "button": {
       "start": "Empezar a transcribir la reunión",

src/frontend/src/locales/fr/rooms.json

@@ -480,7 +480,7 @@
       "destination": "Un nouveau document sera créé sur",
       "destinationUnknown": "Un nouveau document sera créé",
       "language": "Langue de la réunion :",
-      "recording": "Démarrer aussi un enregistrement vidéo"
+      "recording": "Démarrer aussi un enregistrement"
     },
     "button": {
       "start": "Commencer à transcrire la réunion",

src/frontend/src/locales/nl/rooms.json

@@ -480,7 +480,7 @@
       "destination": "Er wordt een nieuw document aangemaakt op",
       "destinationUnknown": "Een nieuw document wordt aangemaakt",
       "language": "Vergadertalen:",
-      "recording": "Start ook een video-opname"
+      "recording": "Start ook een opname"
     },
     "button": {
       "start": "Begin met het transcriberen van de vergadering",