wip support experimental calendar api

insert link in mail
wip initiate dev environment
2026-07-26 20:08:24 +00:00 · 2026-05-01 18:43:37 +02:00 · 2026-05-01 17:43:18 +02:00 · 2026-05-01 17:12:53 +02:00 · 2026-05-01 00:16:34 +02:00 · 2026-04-30 20:01:25 +02:00
221 changed files with 31147 additions and 2081 deletions
@@ -223,8 +223,6 @@ jobs:
      DB_PORT: 5432
      REDIS_URL: redis://localhost:6379/1
      STORAGES_STATICFILES_BACKEND: django.contrib.staticfiles.storage.StaticFilesStorage
-      LIVEKIT_API_SECRET: secret
-      LIVEKIT_API_KEY: devkey
      AWS_S3_ENDPOINT_URL: http://localhost:9000
      AWS_S3_ACCESS_KEY_ID: meet
      AWS_S3_SECRET_ACCESS_KEY: password
@@ -306,7 +304,8 @@ jobs:
        working-directory: src/summary

    env:
-      APP_API_TOKEN: "test-api-token"
+      V1_TENANT_ID: 'test-tenant'
+      AUTHORIZED_TENANTS: '[{"id": "test-tenant", "api_key": "test-api-token", "webhook_url": "https://example.com/webhook", "webhook_api_key": "test-webhook-api-key"}]'
      AWS_STORAGE_BUCKET_NAME: "http://meet-media-storage"
      AWS_S3_ENDPOINT_URL: "minio:9000"
      AWS_S3_ACCESS_KEY_ID: "meet"
@@ -318,8 +317,6 @@ jobs:
      LLM_BASE_URL: "https://configure-your-url.com"
      LLM_API_KEY: "test-llm-secret"
      LLM_MODEL: "test-llm-model"
-      WEBHOOK_API_TOKEN: "test-webhook-secret"
-      WEBHOOK_URL: "https://configure-your-url.com"

    steps:
      - name: Checkout repository
@@ -8,18 +8,92 @@ and this project adheres to

 ## [Unreleased]

+## [1.15.0] - 2026-04-30
+
+### Added
+
+- ✨(backend) add metadata collection of VAD, connection and chat events
+- ✨(backend) introduce add-ons authentication backend
+- 💬(backend) clarify french transcription audio download link text #1299
+- 🚧(addons) introduce initial Microsoft Outlook add-in support (alpha)
+- 🔧(backend) add setting to toggle application token exchange mechanism
+- ✨(backend) support add-ons authentication in external viewset
+
+### Fixed
+
+- 🐛(summary) support webm #1290
+- ⬆️(backend) bump django-lasuite to v0.0.26
+- 🩹(frontend) use a more standard (quality) rating scale
+- 🩹(frontend) fix access control for screen recording feature flag
+- 🩹(frontend) fix reconnect loop caused by connectionObserverStore updates
+
+## [1.14.0] - 2026-04-16
+
+### Added
+
+- 🔒️(helm) Add pod and container securityContext #1197
+- ✨(summary) add routes v2 for async STT and summary tasks #1171
+- ✅(backend) add unit tests for JwtTokenService #1232
+
 ### Changed

+- ⬆️(backend) bump lodash from 4.17.23 to 4.18.1 in /src/mail
+- ⬆️(frontend) bump hono from 4.12.8 to 4.12.12 in /src/frontend
+- ⬆️(backend) bump pygments from 2.19.2 to 2.20.0 in /src/backend
+- ♻️(backend) use Authorization header for LiveKit token authentication
+- 🥅(backend) refine Twirp error handling for participant operations
+- ✨(summary) allow more file extensions #1265
+- ♿️(frontend) refocus reactions toolbar with ctrl+shift+e is activated #1262
+- ♿️(frontend) set an explicit document title on recording download page #1261
+
+### Fixed
+
+- ⬆️(dependencies) update aiohttp to v3.13.4 [SECURITY]
+- ⬆️(dependencies) update vite to v7.3.2 [SECURITY]
+- ⬆️(dependencies) update django to v5.2.13 [SECURITY]
+- 🔒(backend) rely on backend to allow participant update their metadata
+- 🐛(summary) fix failure webhook notification #1233
+- 🐛(summary) relax whisperX payload format #1233
+- ⬆️(backend) upgrade dependencies to fix Pillow CVE-2026-40192
+- ⬆️(frontend) upgrade frontend image to Alpine 3.23 to address CVEs
+
+## [1.13.0] - 2026-03-31
+
+### Changed
+
+- ⬆️(dependencies) update python dependencies
+- ♿️(frontend) add explicit region for call controls #1216
+- ♿️(frontend) improve accessibility of the reaction toolbar #1216
+- ♿️(frontend) enhance sidepanel navigation accessibility #1216
+
+### Fixed
+
+- 🔒️(backend) fix email disclosure in room invitation endpoint #1200
+- 🐛(backend) fix regression in update-participant endpoint #1204
+
+## [1.12.0] - 2026-03-24
+
+### Changed
+
+- ♻️(backend) configurable SESSION_ENGINE #1038 #1154
 - ♿️(frontend) fix sidepanel accessibility aria-label #1182
 - ♿️(frontend) fix more tools heading hierarchy #1181
 - ♿️(fronted) improve button descriptions for More tools actions #1184
 - 💄(spinner) enforce spinner height #1183
 - 💄(custom-background) add upload indicator with preview #1183
+- ♿️(backend) improve logo accessibility in recording email notification #1092
+- ♿️(summary) improve accessibility of transcription download link #1187
+- 💄(frontend) show OS-specific shortcut in participant tile hint #1193
+- ⬆️(frontend) bump flatted from 3.3.1 to 3.4.2 in /src/frontend #1188
+- ⬆️️️(frontend) bump undici from 6.23.0 to 6.24.1 in /src/frontend
+- ⬆️️️(frontend) bump hono from 4.12.2 to 4.12.7 in /src/frontend
+- ⬆️️️(frontend) bump dompurify from 3.3.1 to 3.3.2 in /src/frontend

 ### Fixed

 - 🐛(frontend) disable personal custom background while deleting #1183
 - 🐛(frontend) auto-select new custom background when not logged in #1183
+- 🐛(frontend) fix device selection not applying during conference #1156

 ## [1.11.0] - 2026-03-19

@@ -73,7 +73,9 @@ create-env-files: \
 	env.d/development/crowdin \
 	env.d/development/postgresql \
 	env.d/development/kc_postgresql \
-	env.d/development/summary
+	env.d/development/summary \
+	env.d/development/kube-secret \
+	env.d/development/multi_user_transcriber
 .PHONY: create-env-files

 bootstrap: ## Prepare Docker images for the project
@@ -94,6 +96,7 @@ bootstrap: \
 build: ## build the project containers
 	@$(MAKE) build-backend
 	@$(MAKE) build-frontend
+	@$(MAKE) build-agents
 .PHONY: build

 build-backend: ## build the app-dev container
@@ -105,6 +108,10 @@ build-frontend: ## build the frontend container
 	@$(COMPOSE) build frontend
 .PHONY: build-frontend

+build-agents: ## build the multi-user-transcriber agent container
+	@$(COMPOSE) build multi-user-transcriber
+.PHONY: build-agents
+
 down: ## stop and remove containers, networks, images, and volumes
 	@$(COMPOSE) down
 .PHONY: down
@@ -125,10 +132,24 @@ run-summary: ## start only the summary application and all needed services
 	@$(COMPOSE) up --force-recreate -d celery-summary-summarize
 .PHONY: run-summary

+run-agents: ## start the multi-user-transcriber agent
+	@$(MAKE) run-agent-multi-user-transcriber
+	@$(MAKE) run-agent-metadata-collector
+.PHONY: run-agents
+
+run-agent-multi-user-transcriber: ## start the LiveKit agents (multi users transcriber)
+	@$(COMPOSE) up --force-recreate -d multi-user-transcriber
+.PHONY: run-agent-multi-user-transcriber
+
+run-agent-metadata-collector: ## start the LiveKit agents (metadata collector)
+	@$(COMPOSE) up --force-recreate -d metadata-collector-dev
+.PHONY: run-agent-metadata-collector
+
 run:
 run: ## start the wsgi (production) and development server
 	@$(MAKE) run-backend
 	@$(MAKE) run-summary
+	@$(MAKE) run-agents
 	@$(COMPOSE) up --force-recreate -d frontend
 .PHONY: run

@@ -265,6 +286,12 @@ env.d/development/kc_postgresql:
 env.d/development/summary:
 	cp -n env.d/development/summary.dist env.d/development/summary

+env.d/development/kube-secret:
+	cp -n env.d/development/kube-secret.dist env.d/development/kube-secret
+
+env.d/development/multi_user_transcriber:
+	cp -n env.d/development/multi_user_transcriber.dist env.d/development/multi_user_transcriber
+
 # -- Internationalization

 env.d/development/crowdin:
@@ -352,15 +379,9 @@ frontend-i18n-generate: \

 # -- K8S
 build-k8s-cluster: ## build the kubernetes cluster using kind
-	./bin/start-kind.sh
-.PHONY: build-k8s-cluster
-
-install-external-secrets: ## install the kubernetes secrets from Vaultwarden
-	./bin/install-external-secrets.sh
-.PHONY: build-k8s-cluster
-
-start-tilt: ## start the kubernetes cluster using kind
-	tilt up --namespace=meet -f ./bin/Tiltfile
+build-k8s-cluster: \
+    env.d/development/kube-secret \
+    ./bin/start-kind.sh
 .PHONY: build-k8s-cluster

 start-tilt-keycloak: ## start the kubernetes cluster using kind, without Pro Connect for authentication, use keycloak
@@ -2,7 +2,7 @@ load('ext://uibutton', 'cmd_button', 'bool_input', 'location')
 load('ext://namespace', 'namespace_create', 'namespace_inject')
 namespace_create('meet')

-DEV_ENV = os.getenv('DEV_ENV', 'dev')
+DEV_ENV = os.getenv('DEV_ENV', 'dev-keycloak')

 if DEV_ENV == 'dev-dinum':
    update_settings(suppress_unused_image_warnings=["localhost:5001/meet-frontend-generic:latest"])
@@ -34,10 +34,11 @@ docker_build(
    'localhost:5001/meet-frontend-dinum:latest',
    context='..',
    dockerfile='../docker/dinum-frontend/Dockerfile',
-    only=['./src/frontend', './docker', './.dockerignore'],
+    only=['./src/frontend', './src/addons', './docker', './.dockerignore'],
    target = 'frontend-production',
    live_update=[
        sync('../src/frontend', '/home/frontend'),
+        sync('../src/addons', '/home/addons'),
    ]
 )
 clean_old_images('localhost:5001/meet-frontend-dinum')
@@ -95,12 +96,19 @@ docker_build(
 )
 clean_old_images('localhost:5001/meet-livekit')

-k8s_yaml(local('cd ../src/helm && helmfile -n meet -e ${DEV_ENV:-dev} template .'))
+load('ext://secret', 'secret_yaml_generic')
+k8s_yaml(secret_yaml_generic(
+    name="secret-dev",
+    from_env_file="../env.d/development/kube-secret"
+))
+
+k8s_yaml(local('cd ../src/helm && helmfile -n meet -e ${DEV_ENV:-dev-keycloak} template .'))

 k8s_resource('minio-bucket', resource_deps=['minio'])
 k8s_resource('meet-backend', resource_deps=['postgresql', 'minio', 'redis', 'livekit-livekit-server'])
 k8s_resource('meet-celery-backend', resource_deps=['redis'])
 k8s_resource('meet-celery-summarize', resource_deps=['redis'])
+k8s_resource('meet-celery-summary-backend', resource_deps=['redis'])
 k8s_resource('meet-celery-transcribe', resource_deps=['redis'])
 k8s_resource('meet-backend-migrate', resource_deps=['meet-backend'])
 k8s_resource('livekit-livekit-server', resource_deps=['redis'])
@@ -246,6 +246,29 @@ services:
      depends_on:
        - redis

+  metadata-collector-dev:
+    build:
+      context: ./src/agents
+    command: ["python", "metadata_collector.py", "dev"]
+    environment:
+      - LIVEKIT_URL=ws://livekit:7880
+      - LIVEKIT_API_KEY=devkey
+      - LIVEKIT_API_SECRET=secret
+      - AWS_S3_ENDPOINT_URL=minio:9000
+      - AWS_S3_ACCESS_KEY_ID=meet
+      - AWS_S3_SECRET_ACCESS_KEY=password
+      - AWS_STORAGE_BUCKET_NAME=meet-media-storage
+      - AWS_S3_SECURE_ACCESS=False
+    volumes:
+      - ./src/agents:/app
+    depends_on:
+      - livekit
+      - minio
+    develop:
+      watch:
+        - action: rebuild
+          path: ./src/agents
+
  redis-summary:
    image: redis
    ports:
@@ -307,6 +330,14 @@ services:
        - action: rebuild
          path: ./src/summary

+  multi-user-transcriber:
+    build:
+      context: ./src/agents
+    env_file:
+      - env.d/development/multi_user_transcriber
+    volumes:
+      - ./src/agents:/app
+
 networks:
  default:
  resource-server:
@@ -38,16 +38,32 @@ COPY ./docker/dinum-frontend/assets/ \
 COPY ./docker/dinum-frontend/fonts/ \
    ./dist/assets/fonts/

+# ---- Addons builder image ----
+FROM node:20-alpine AS addons-builder
+
+WORKDIR /home/addons/outlook
+
+COPY ./src/addons/outlook/package.json ./package.json
+COPY ./src/addons/outlook/package-lock.json ./package-lock.json
+
+RUN npm ci
+
+COPY ./src/addons/outlook/ .
+
+RUN npx webpack --mode production
+
+
 # ---- Front-end image ----
-FROM nginxinc/nginx-unprivileged:alpine3.21 AS frontend-production
+FROM nginxinc/nginx-unprivileged:alpine3.23 AS frontend-production

 USER root
-RUN apk update && apk upgrade libssl3 \
-    libcrypto3 \
-    libxml2>=2.12.7-r2 \
-    libxslt>=1.1.39-r2 \
-    libexpat>=2.7.2-r0 \
-    libpng>=1.6.53-r0
+
+# Security patches for known CVEs
+RUN apk update && apk upgrade  \
+    musl \
+    musl-utils \
+    zlib>=1.3.2-r0 \
+    && apk del curl

 USER nginx

@@ -59,7 +75,11 @@ COPY --from=meet-builder \
    /home/frontend/dist \
    /usr/share/nginx/html

-COPY ./src/frontend/default.conf /etc/nginx/conf.d
+COPY --from=addons-builder \
+    /home/addons/outlook/dist \
+    /usr/share/nginx/html/addons/outlook
+
+COPY ./docker/dinum-frontend/nginx/default.conf /etc/nginx/conf.d
 COPY ./docker/files/usr/local/bin/entrypoint /usr/local/bin/entrypoint

 ENTRYPOINT [ "/usr/local/bin/entrypoint" ]
@@ -0,0 +1,82 @@
+server {
+  listen 8080;
+  server_name localhost;
+  server_tokens off;
+
+  root /usr/share/nginx/html;
+
+  location = /.well-known/windows-app-web-link {
+      default_type application/json;
+      alias /usr/share/nginx/html/.well-known/windows-app-web-link;
+      add_header Content-Disposition "attachment; filename=windows-app-web-link";
+  }
+
+  # Manifest — fetched, never iframed
+  location = /addons/outlook/manifest.xml {
+      alias /usr/share/nginx/html/addons/outlook/manifest.xml;
+
+      add_header Access-Control-Allow-Origin "*";
+      add_header Cache-Control "no-cache, no-store, must-revalidate";
+      add_header X-Frame-Options "DENY";
+      add_header Content-Security-Policy "frame-ancestors 'none'";
+  }
+
+  location = /addons/outlook/assets/ {
+      return 404;
+  }
+
+  location ~* ^/addons/outlook/assets/(.+\.(?:css|js|json|png|jpg|jpeg|gif|ico|svg|woff|woff2|ttf|eot))/?$ {
+      root /usr/share/nginx/html;
+      expires 30d;
+      add_header Cache-Control "public, max-age=2592000, immutable" always;
+      add_header Access-Control-Allow-Origin "*";
+      add_header Vary "Origin" always;
+  }
+
+  location = /addons/outlook/ {
+      return 404;
+  }
+
+  location ~ ^/addons/outlook(/.*)?$ {
+      alias /usr/share/nginx/html/addons/outlook$1;
+      error_page 404 =200 /index.html;
+      add_header Cache-Control "no-cache, no-store, must-revalidate";
+      add_header Pragma "no-cache" always;
+      add_header Expires 0 always;
+
+      set $ms_domains "https://*.live.com https://*.office.com https://*.microsoft.com https://*.office365.com https://*.sharepoint.com";
+
+      set $nonce $request_id;
+
+      set $csp "upgrade-insecure-requests; ";
+      set $csp "${csp}frame-ancestors ${ms_domains}; ";
+      set $csp "${csp}script-src 'nonce-${nonce}' 'strict-dynamic'; ";
+      set $csp "${csp}connect-src 'self' ${ms_domains}; ";
+      set $csp "${csp}frame-src 'none'; ";
+      set $csp "${csp}object-src 'none'; ";
+      set $csp "${csp}base-uri 'none'; ";
+
+      add_header Content-Security-Policy $csp;
+
+      sub_filter 'NONCE_PLACEHOLDER' $nonce;
+      sub_filter_once off;
+  }
+
+  # Serve static files with caching
+  location ~* ^/assets/.*\.(css|js|json|png|jpg|jpeg|gif|ico|svg|woff|woff2|ttf|eot)$ {
+      expires 30d;
+      add_header Cache-Control "public, max-age=2592000";
+  }
+
+  # Serve static files
+  location / {
+      try_files $uri $uri/ /index.html;
+      # Add no-cache headers
+      add_header Cache-Control "no-cache, no-store, must-revalidate";
+      add_header Pragma "no-cache";  # HTTP 1.0 header for backward compatibility
+      add_header Expires 0;
+  }
+
+  # Optionally, handle 404 errors by redirecting to index.html
+  error_page 404 =200 /index.html;
+}
@@ -190,6 +190,7 @@ paths:
        '403':
          $ref: '#/components/responses/ForbiddenError'

+  /rooms/:
    post:
      tags:
        - Rooms
@@ -113,6 +113,7 @@ paths:
        '403':
          $ref: '#/components/responses/ForbiddenError'

+  /rooms/:
    post:
      tags:
        - Rooms
@@ -71,6 +71,9 @@ RECORDING_DOWNLOAD_BASE_URL=http://localhost:3000/recording
 # Telephony
 ROOM_TELEPHONY_ENABLED=True

+# Metadata
+METADATA_COLLECTOR_ENABLED=True
+
 FRONTEND_USE_FRENCH_GOV_FOOTER=False
 FRONTEND_USE_PROCONNECT_BUTTON=False

@@ -0,0 +1,4 @@
+WHISPERX_BASE_URL=https://configure-your-url.com
+WHISPERX_API_KEY=<key>
+LLM_BASE_URL=https://configure-your-url.com
+LLM_API_KEY=<key>
@@ -0,0 +1,9 @@
+LIVEKIT_URL=ws://livekit:7880
+LIVEKIT_API_KEY=devkey
+LIVEKIT_API_SECRET=secret
+
+STT_PROVIDER=kyutai
+ENABLE_SILERO_VAD=False
+
+KYUTAI_STT_BASE_URL=
+KYUTAI_API_KEY=
@@ -36,6 +36,12 @@
        "matchPackageNames": ["django"],
        "allowedVersions": "<6.0.0"
    },
+    {
+        "groupName": "allowed brevo versions",
+        "matchManagers": ["pep621"],
+        "matchPackageNames": ["brevo-python"],
+        "allowedVersions": "<3.0.0"
+    },
    {
      "enabled": false,
      "groupName": "ignored js dependencies",
@@ -0,0 +1,8 @@
+{
+  "plugins": [
+    "office-addins"
+  ],
+  "extends": [
+    "plugin:office-addins/recommended"
+  ]
+}
@@ -0,0 +1,12 @@
+{
+  "presets": [
+    [
+      "@babel/preset-env",
+      {
+        "targets": {
+          "esmodules": false
+        }
+      }
+    ],
+  ]
+}
@@ -0,0 +1,190 @@
+<?xml version="1.0" encoding="UTF-8" standalone="yes"?>
+<OfficeApp xmlns="http://schemas.microsoft.com/office/appforoffice/1.1" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xmlns:bt="http://schemas.microsoft.com/office/officeappbasictypes/1.0" xmlns:mailappor="http://schemas.microsoft.com/office/mailappversionoverrides/1.0" xsi:type="MailApp">
+  <Id>a025f0f6-757a-4790-97f3-99c66c4a5795</Id>
+  <Version>0.0.1.0</Version>
+  <ProviderName>__APP_NAME__</ProviderName>
+  <DefaultLocale>fr-FR</DefaultLocale>
+  <DisplayName DefaultValue="__APP_NAME__"/>
+  <Description DefaultValue="Ajoutez facilement un lien de réunion __APP_NAME__ à vos emails et événements Outlook."/>
+  <IconUrl DefaultValue="https://localhost:3000/assets/icon-64.png"/>
+  <HighResolutionIconUrl DefaultValue="https://localhost:3000/assets/icon-128.png"/>
+  <SupportUrl DefaultValue="https://lasuite.crisp.help/fr/category/visio-15sakkg/"/>
+  <AppDomains>
+    <AppDomain>https://localhost:3000/</AppDomain>
+  </AppDomains>
+  <Hosts>
+    <Host Name="Mailbox"/>
+  </Hosts>
+  <Requirements>
+    <Sets>
+      <Set Name="Mailbox" MinVersion="1.1"/>
+    </Sets>
+  </Requirements>
+  <FormSettings>
+    <Form xsi:type="ItemRead">
+      <DesktopSettings>
+        <SourceLocation DefaultValue="https://localhost:3000/taskpane.html"/>
+        <RequestedHeight>250</RequestedHeight>
+      </DesktopSettings>
+    </Form>
+    <Form xsi:type="ItemEdit">
+      <DesktopSettings>
+        <SourceLocation DefaultValue="https://localhost:3000/taskpane.html"/>
+      </DesktopSettings>
+    </Form>
+  </FormSettings>
+  <Permissions>ReadWriteItem</Permissions>
+  <Rule xsi:type="RuleCollection" Mode="Or">
+    <Rule xsi:type="ItemIs" ItemType="Message" FormType="Read"/>
+    <Rule xsi:type="ItemIs" ItemType="Message" FormType="Edit"/>
+    <Rule xsi:type="ItemIs" ItemType="Appointment" FormType="Edit"/>
+  </Rule>
+  <DisableEntityHighlighting>false</DisableEntityHighlighting>
+  <VersionOverrides xmlns="http://schemas.microsoft.com/office/mailappversionoverrides" xsi:type="VersionOverridesV1_0">
+    <Requirements>
+      <bt:Sets DefaultMinVersion="1.3">
+        <bt:Set Name="Mailbox"/>
+      </bt:Sets>
+    </Requirements>
+    <Hosts>
+      <Host xsi:type="MailHost">
+        <DesktopFormFactor>
+          <FunctionFile resid="Commands.Url"/>
+
+          <!-- ─── Mail: Read ─────────────────────────────────────────── -->
+          <ExtensionPoint xsi:type="MessageReadCommandSurface">
+            <OfficeTab id="TabDefault">
+              <Group id="msgReadGroup">
+                <Label resid="GroupLabel"/>
+                <Control xsi:type="Button" id="msgReadOpenPaneButton">
+                  <Label resid="TaskpaneButton.Label"/>
+                  <Supertip>
+                    <Title resid="TaskpaneButton.Label"/>
+                    <Description resid="TaskpaneButton.Tooltip"/>
+                  </Supertip>
+                  <Icon>
+                    <bt:Image size="16" resid="Icon.16x16"/>
+                    <bt:Image size="32" resid="Icon.32x32"/>
+                    <bt:Image size="80" resid="Icon.80x80"/>
+                  </Icon>
+                  <Action xsi:type="ShowTaskpane">
+                    <SourceLocation resid="Taskpane.Url"/>
+                  </Action>
+                </Control>
+              </Group>
+            </OfficeTab>
+          </ExtensionPoint>
+
+          <!-- ─── Mail: Compose ─────────────────────────────────────── -->
+          <ExtensionPoint xsi:type="MessageComposeCommandSurface">
+            <OfficeTab id="TabDefault">
+              <Group id="msgComposeGroup">
+                <Label resid="GroupLabel"/>
+                <Control xsi:type="Button" id="msgComposeGenerateLinkButton">
+                  <Label resid="GenerateLink.Label"/>
+                  <Supertip>
+                    <Title resid="GenerateLink.Label"/>
+                    <Description resid="GenerateLink.Tooltip"/>
+                  </Supertip>
+                  <Icon>
+                    <bt:Image size="16" resid="Add.16x16"/>
+                    <bt:Image size="32" resid="Add.32x32"/>
+                    <bt:Image size="80" resid="Add.80x80"/>
+                  </Icon>
+                  <Action xsi:type="ExecuteFunction">
+                    <FunctionName>generateMeetingLinkFromMail</FunctionName>
+                  </Action>
+                </Control>
+                <Control xsi:type="Button" id="msgComposeOpenPaneButton">
+                  <Label resid="TaskpaneButton.Label"/>
+                  <Supertip>
+                    <Title resid="TaskpaneButton.Label"/>
+                    <Description resid="TaskpaneButton.Tooltip"/>
+                  </Supertip>
+                  <Icon>
+                    <bt:Image size="16" resid="Settings.16x16"/>
+                    <bt:Image size="32" resid="Settings.32x32"/>
+                    <bt:Image size="80" resid="Settings.80x80"/>
+                  </Icon>
+                  <Action xsi:type="ShowTaskpane">
+                    <SourceLocation resid="Taskpane.Url"/>
+                  </Action>
+                </Control>
+              </Group>
+            </OfficeTab>
+          </ExtensionPoint>
+
+          <!-- ─── Calendar: Compose (New/Edit appointment) ──────────── -->
+          <ExtensionPoint xsi:type="AppointmentOrganizerCommandSurface">
+            <OfficeTab id="TabDefault">
+              <Group id="apptComposeGroup">
+                <Label resid="GroupLabel"/>
+                <Control xsi:type="Button" id="apptGenerateLinkButton">
+                  <Label resid="GenerateLink.Label"/>
+                  <Supertip>
+                    <Title resid="GenerateLink.Label"/>
+                    <Description resid="GenerateLink.Tooltip"/>
+                  </Supertip>
+                  <Icon>
+                    <bt:Image size="16" resid="Add.16x16"/>
+                    <bt:Image size="32" resid="Add.32x32"/>
+                    <bt:Image size="80" resid="Add.80x80"/>
+                  </Icon>
+                  <Action xsi:type="ExecuteFunction">
+                    <FunctionName>generateMeetingLinkFromCalendar</FunctionName>
+                  </Action>
+                </Control>
+
+                <Control xsi:type="Button" id="apptOpenSettingsButton">
+                  <Label resid="OpenSettings.Label"/>
+                  <Supertip>
+                    <Title resid="OpenSettings.Label"/>
+                    <Description resid="OpenSettings.Tooltip"/>
+                  </Supertip>
+                  <Icon>
+                    <bt:Image size="16" resid="Settings.16x16"/>
+                    <bt:Image size="32" resid="Settings.32x32"/>
+                    <bt:Image size="80" resid="Settings.80x80"/>
+                  </Icon>
+                  <Action xsi:type="ShowTaskpane">
+                    <SourceLocation resid="Taskpane.Url"/>
+                  </Action>
+                </Control>
+
+              </Group>
+            </OfficeTab>
+          </ExtensionPoint>
+
+        </DesktopFormFactor>
+      </Host>
+    </Hosts>
+    <Resources>
+      <bt:Images>
+        <bt:Image id="Settings.16x16" DefaultValue="https://localhost:3000/assets/settings-16.png"/>
+        <bt:Image id="Settings.32x32" DefaultValue="https://localhost:3000/assets/settings-32.png"/>
+        <bt:Image id="Settings.80x80" DefaultValue="https://localhost:3000/assets/settings-80.png"/>
+        <bt:Image id="Add.16x16" DefaultValue="https://localhost:3000/assets/add-16.png"/>
+        <bt:Image id="Add.32x32" DefaultValue="https://localhost:3000/assets/add-32.png"/>
+        <bt:Image id="Add.80x80" DefaultValue="https://localhost:3000/assets/add-80.png"/>
+        <bt:Image id="Icon.16x16" DefaultValue="https://localhost:3000/assets/icon-16.png"/>
+        <bt:Image id="Icon.32x32" DefaultValue="https://localhost:3000/assets/icon-32.png"/>
+        <bt:Image id="Icon.80x80" DefaultValue="https://localhost:3000/assets/icon-80.png"/>
+      </bt:Images>
+      <bt:Urls>
+        <bt:Url id="Commands.Url" DefaultValue="https://localhost:3000/commands.html"/>
+        <bt:Url id="Taskpane.Url" DefaultValue="https://localhost:3000/taskpane.html"/>
+      </bt:Urls>
+      <bt:ShortStrings>
+        <bt:String id="GroupLabel" DefaultValue="__APP_NAME__"/>
+        <bt:String id="TaskpaneButton.Label" DefaultValue="Ouvrir les paramètres"/>
+        <bt:String id="GenerateLink.Label" DefaultValue="Ajouter un lien __APP_NAME__"/>
+        <bt:String id="OpenSettings.Label" DefaultValue="Paramètres"/>
+      </bt:ShortStrings>
+      <bt:LongStrings>
+        <bt:String id="TaskpaneButton.Tooltip" DefaultValue="Ouvre les paramètres de connexion __APP_NAME__."/>
+        <bt:String id="GenerateLink.Tooltip" DefaultValue="Génère un lien de réunion __APP_NAME__ et l'insère dans l'événement."/>
+        <bt:String id="OpenSettings.Tooltip" DefaultValue="Ouvre les paramètres de connexion __APP_NAME__."/>
+      </bt:LongStrings>
+    </Resources>
+  </VersionOverrides>
+</OfficeApp>
@@ -0,0 +1,63 @@
+{
+  "name": "office-addin-taskpane-js",
+  "version": "0.0.1",
+  "repository": {
+    "type": "git",
+    "url": "https://github.com/suitenumerique/meet.git"
+  },
+  "license": "MIT",
+  "config": {
+    "app_to_debug": "outlook",
+    "app_type_to_debug": "desktop",
+    "dev_server_port": 3000
+  },
+  "scripts": {
+    "build": "webpack --mode production",
+    "build:dev": "webpack --mode development",
+    "dev-server": "webpack serve --mode development",
+    "lint": "office-addin-lint check",
+    "lint:fix": "office-addin-lint fix",
+    "prettier": "office-addin-lint prettier",
+    "signin": "office-addin-dev-settings m365-account login",
+    "signout": "office-addin-dev-settings m365-account logout",
+    "start": "office-addin-debugging start manifest.xml",
+    "stop": "office-addin-debugging stop manifest.xml",
+    "validate": "office-addin-manifest validate manifest.xml",
+    "watch": "webpack --mode development --watch"
+  },
+  "dependencies": {
+    "core-js": "^3.36.0",
+    "regenerator-runtime": "^0.14.1"
+  },
+  "devDependencies": {
+    "@babel/core": "^7.24.0",
+    "@babel/preset-env": "^7.25.4",
+    "@types/office-js": "^1.0.377",
+    "@types/office-runtime": "^1.0.35",
+    "acorn": "^8.11.3",
+    "babel-loader": "^9.1.3",
+    "copy-webpack-plugin": "^12.0.2",
+    "eslint-plugin-office-addins": "^4.0.3",
+    "file-loader": "^6.2.0",
+    "html-loader": "^5.0.0",
+    "html-webpack-inject-attributes-plugin": "^1.0.6",
+    "html-webpack-plugin": "^5.6.0",
+    "office-addin-cli": "^2.0.3",
+    "office-addin-debugging": "^6.0.3",
+    "office-addin-dev-certs": "^2.0.3",
+    "office-addin-lint": "^3.0.3",
+    "office-addin-manifest": "^2.0.3",
+    "office-addin-prettier-config": "^2.0.1",
+    "os-browserify": "^0.3.0",
+    "process": "^0.11.10",
+    "source-map-loader": "^5.0.0",
+    "webpack": "^5.95.0",
+    "webpack-cli": "^5.1.4",
+    "webpack-dev-server": "5.1.0"
+  },
+  "prettier": "office-addin-prettier-config",
+  "browserslist": [
+    "last 2 versions",
+    "ie 11"
+  ]
+}
@@ -0,0 +1,11 @@
+<!DOCTYPE html>
+<html lang="fr">
+<head>
+    <meta charset="UTF-8" />
+    <title data-app-name></title>
+    <meta http-equiv="X-UA-Compatible" content="IE=Edge" />
+    <script nonce="NONCE_PLACEHOLDER" src="https://appsforoffice.microsoft.com/lib/1/hosted/office.js"></script>
+    <script nonce="NONCE_PLACEHOLDER" src="/addons/outlook/config.js"></script>
+</head>
+<body></body>
+</html>
@@ -0,0 +1,117 @@
+/* global Office */
+const { createRoom, initSession } = require("../common/api");
+const { startPolling } = require("../common/polling");
+const { saveSession, loadSession } = require("../common/session");
+const { openTransitDialog } = require("../common/transitDialog");
+const { buildMeetingMessage } = require("../common/messageBuilder");
+const { applyAppName } = require("../common/helpers");
+
+Office.onReady(function (info) {
+  if (info.host === Office.HostType.Outlook) {
+    applyAppName();
+  }
+});
+
+function notify(message) {
+  Office.context.mailbox.item.notificationMessages.replaceAsync("meetNotif", {
+    type: Office.MailboxEnums.ItemNotificationMessageType.InformationalMessage,
+    message,
+    persistent: false,
+    icon: "Icon.16x16",
+  });
+}
+
+function insertMeetingLink(event, session) {
+  createRoom(session)
+    .then((data) => {
+      const { url, message } = buildMeetingMessage(data);
+      const item = Office.context.mailbox.item;
+
+      return new Promise((resolve, reject) => {
+        item.body.getAsync(Office.CoercionType.Html, (getResult) => {
+          if (getResult.status !== Office.AsyncResultStatus.Succeeded) {
+            notify(`Erreur de lecture : ${getResult.error.message}`);
+            resolve();
+            return;
+          }
+
+          const newBody = getResult.value + message;
+          item.body.setAsync(newBody, { coercionType: Office.CoercionType.Html }, (setResult) => {
+            if (setResult.status !== Office.AsyncResultStatus.Succeeded) {
+              notify(`Erreur d'insertion : ${setResult.error.message}`);
+              resolve();
+              return;
+            }
+
+            if (item.itemType !== Office.MailboxEnums.ItemType.Appointment) {
+              notify("Lien de réunion inséré !");
+              resolve();
+              return;
+            }
+
+            item.location.setAsync(url, (locationResult) => {
+              if (locationResult.status !== Office.AsyncResultStatus.Succeeded) {
+                notify(`Erreur de localisation : ${locationResult.error.message}`);
+              } else {
+                notify("Lien de réunion inséré !");
+              }
+              resolve();
+            });
+          });
+        });
+      });
+    })
+    .catch((err) => {
+      notify(`Erreur : ${err.message}`);
+    })
+    .finally(() => {
+      event.completed();
+    });
+}
+
+function connect(event) {
+  initSession()
+    .then((data) => {
+      const stopPolling = startPolling(data.csrf_token, {
+        onSuccess: (sessionData) => {
+          saveSession(sessionData).then(() => {
+            insertMeetingLink(event, sessionData);
+          });
+        },
+        onTimeout: () => {
+          notify("Connexion expirée, veuillez réessayer.");
+          event.completed();
+        },
+        onError: (err) => {
+          notify("Une erreur est survenue, veuillez ré-essayer");
+          event.completed();
+        },
+      });
+      openTransitDialog(data.transit_token, {
+        onCancel: () => {
+          stopPolling();
+          event.completed();
+        },
+        onError: (err) => {
+          stopPolling();
+          event.completed();
+        },
+      });
+    })
+    .catch((err) => {
+      notify(`Erreur : ${err.message}`);
+      event.completed();
+    });
+}
+
+function generateMeetingLink(event) {
+  const session = loadSession();
+  if (session?.access_token) {
+    insertMeetingLink(event, session);
+  } else {
+    connect(event);
+  }
+}
+
+Office.actions.associate("generateMeetingLinkFromCalendar", generateMeetingLink);
+Office.actions.associate("generateMeetingLinkFromMail", generateMeetingLink);
@@ -0,0 +1,82 @@
+const { URLS } = require("./urls");
+
+function getCsrfToken() {
+  return document.cookie
+    .split(";")
+    .filter((cookie) => cookie.trim().startsWith("csrftoken="))
+    .map((cookie) => cookie.split("=")[1])
+    .pop();
+}
+
+function authHeaders(session) {
+  return {
+    "Content-Type": "application/json",
+    Authorization: `Bearer ${session.access_token}`,
+  };
+}
+
+/**
+ * Builds headers for CSRF-protected requests.
+ *
+ * Two CSRF flows coexist in this addon:
+ *
+ * 1. Cookie-based (Django default): used by `exchange`, called from the
+ *    OAuth success page in a normal browser context. Django's CSRF
+ *    middleware has already set the `csrftoken` cookie via the auth
+ *    redirect, so we read it from `document.cookie` and echo it back
+ *    as `X-CSRFToken`. The middleware verifies the header matches the
+ *    cookie. No `csrfToken` argument needed — `getCsrfToken()` handles it.
+ *
+ * 2. Body-passed token: used by `poll`, called from the Office dialog /
+ *    taskpane iframe. Cookie access inside Office iframes is unreliable
+ *    across Outlook clients, so we can't depend on `document.cookie`
+ *    being populated. Instead, `init` returns the CSRF token in its JSON
+ *    response body, and callers pass it explicitly to subsequent calls.
+ *    The token still travels as `X-CSRFToken` — only its source differs.
+ *
+ * The `csrfToken` parameter takes precedence when provided; falls back
+ * to the cookie when omitted.
+ */
+function csrfHeaders(csrfToken) {
+  const token = csrfToken || getCsrfToken();
+  return {
+    "Content-Type": "application/json",
+    ...(token && { "X-CSRFToken": token }),
+  };
+}
+
+async function request(path, { session, csrf, csrfToken, ...opts } = {}) {
+  const headers = {
+    ...(session && authHeaders(session)),
+    ...(csrf && csrfHeaders(csrfToken)),
+    ...opts.headers,
+  };
+  const res = await fetch(path, {
+    ...opts,
+    headers,
+    credentials: csrf ? "include" : opts.credentials,
+  });
+  if (!res.ok) throw new Error(`HTTP ${res.status}`);
+  return res.json();
+}
+
+module.exports = {
+  initSession: () => request(URLS.init, { method: "POST" }),
+  pollSession: (csrfToken) =>
+    request(URLS.poll, {
+      method: "POST",
+      csrf: true,
+      csrfToken,
+    }),
+  exchangeSession: (transitToken) =>
+    request(URLS.exchange, {
+      method: "POST",
+      csrf: true,
+      body: JSON.stringify({ transit_token: transitToken }),
+    }),
+  createRoom: (session) =>
+    request(URLS.rooms, {
+      method: "POST",
+      session,
+    }),
+};
@@ -0,0 +1,16 @@
+const { APP_NAME } = require("./index");
+
+function isOfficeReady() {
+  return typeof Office !== "undefined" && Office?.context?.roamingSettings != null;
+}
+
+function applyAppName() {
+  document.querySelectorAll("[data-app-name]").forEach((el) => {
+    el.textContent = APP_NAME;
+  });
+}
+
+module.exports = {
+  isOfficeReady,
+  applyAppName,
+};
@@ -0,0 +1,7 @@
+const BASE_URL = window.__APP_CONFIG__?.BASE_URL || "https://meet.127.0.0.1.nip.io";
+const APP_NAME = window.__APP_CONFIG__?.APP_NAME || "LaSuite Meet";
+
+module.exports = {
+  BASE_URL,
+  APP_NAME,
+};
@@ -0,0 +1,52 @@
+const { APP_NAME } = require("./index");
+
+function _formatPin(pin) {
+  if (!pin) return "";
+  const clean = String(pin).replace(/\s+/g, "");
+  if (!clean) return "";
+  if (/^\d{10}$/.test(clean)) {
+    return clean.replace(/(\d{3})(\d{3})(\d{4})/, "$1 $2 $3") + "#";
+  }
+  return clean + "#";
+}
+
+// todo - support international format
+function _formatPhone(phone) {
+  if (!phone) return "";
+  const clean = String(phone).replace(/\s+/g, "");
+  if (/^\+33\d{9}$/.test(clean)) {
+    return clean.replace(/^\+33(\d)(\d{2})(\d{2})(\d{2})(\d{2})$/, "+33 $1 $2 $3 $4 $5");
+  }
+  return clean;
+}
+
+// todo - escape html / link
+function buildMeetingMessage(data) {
+  if (!data?.url) {
+    throw new Error("buildMeetingMessage: missing url in data");
+  }
+
+  const url = data.url;
+  const phone = _formatPhone(data.telephony?.phone_number);
+  const pin = _formatPin(data.telephony?.pin_code);
+
+  const telephonyBlock =
+    phone && pin
+      ? `
+
+Ou appelez (audio uniquement)
+(FR) ${phone}
+Code : ${pin}`
+      : "";
+
+  const message = `<pre style="font-family:inherit; font-size:inherit; border:none; background:none; margin:16px 0;">
+────────────────────────────────────────
+Rejoindre la réunion ${APP_NAME}
+
+<a href="${url}">${url}</a>${telephonyBlock}
+────────────────────────────────────────</pre>`;
+
+  return { url, message };
+}
+
+module.exports = { buildMeetingMessage };
@@ -0,0 +1,47 @@
+const { pollSession } = require("./api");
+
+const POLLING_INTERVAL_MS = 1000;
+const POLLING_TIMEOUT_MS = 3 * 60 * 1000;
+const POLLING_MAX_ATTEMPTS = POLLING_TIMEOUT_MS / POLLING_INTERVAL_MS;
+
+function isPollAuthenticated(sessionData) {
+  return sessionData.state === "authenticated" && sessionData.access_token;
+}
+
+function startPolling(csrfToken, { onSuccess, onTimeout, onError }) {
+  let pollCount = 0;
+  let timeoutId = null;
+  let cancelled = false;
+
+  const poll = () => {
+    if (pollCount++ >= POLLING_MAX_ATTEMPTS) {
+      onTimeout?.();
+      return;
+    }
+
+    pollSession(csrfToken)
+      .then((sessionData) => {
+        if (cancelled) return;
+        if (isPollAuthenticated(sessionData)) {
+          onSuccess?.(sessionData);
+          return;
+        }
+        timeoutId = setTimeout(poll, POLLING_INTERVAL_MS);
+      })
+      .catch((err) => {
+        if (cancelled) return;
+        onError?.(err);
+      });
+  };
+
+  poll();
+
+  return () => {
+    cancelled = true;
+    if (timeoutId) clearTimeout(timeoutId);
+  };
+}
+
+module.exports = {
+  startPolling,
+};
@@ -0,0 +1,104 @@
+const { isOfficeReady } = require("./helpers");
+
+const SESSION_KEY = "meetSession";
+
+// DEV NOTE:
+// Office.context.roamingSettings persists data in the user's mailbox and
+// synchronizes it via Exchange across all Outlook clients (desktop, web, mobile)
+// where the user signs in. This means anything stored here (including tokens)
+// leaves the local device boundary and is replicated across environments.
+//
+// Microsoft guidance explicitly advises NOT storing secrets (e.g., OAuth access
+// tokens, refresh tokens, or other sensitive credentials) in roamingSettings,
+// as it is not a secure storage mechanism and lacks OS-level protections.
+//
+// That said, for the current alpha version we accept this trade-off for simplicity,
+// with the expectation that a more secure approach (e.g., in-memory tokens) will replace this.
+function saveSession(data) {
+  if (!isOfficeReady()) {
+    return Promise.reject(new Error("Office not ready"));
+  }
+
+  if (!data || !data.access_token) {
+    return Promise.reject(new Error("Missing access_token"));
+  }
+
+  const expiresInSeconds = Number(data.expires_in);
+  const expiresAt =
+    Number.isFinite(expiresInSeconds) && expiresInSeconds > 0
+      ? new Date(Date.now() + expiresInSeconds * 1000).toISOString()
+      : null;
+
+  const payload = JSON.stringify({
+    ...data,
+    expiresAt,
+    savedAt: new Date().toISOString(),
+  });
+
+  return new Promise((resolve, reject) => {
+    const rs = Office.context.roamingSettings;
+    rs.set(SESSION_KEY, payload);
+    rs.saveAsync((result) => {
+      if (result.status === Office.AsyncResultStatus.Succeeded) {
+        resolve();
+      } else {
+        reject(new Error(result.error?.message || "saveAsync failed"));
+      }
+    });
+  });
+}
+
+function loadSession() {
+  if (!isOfficeReady()) {
+    return null;
+  }
+
+  let session = null;
+  try {
+    const stored = Office.context.roamingSettings.get(SESSION_KEY);
+    if (stored) session = JSON.parse(stored);
+  } catch (e) {
+    clearSession();
+    return null;
+  }
+
+  if (!session) return null;
+
+  // Fail closed if expiry is missing — backend is expected to send expires_in.
+  if (!session.expiresAt) {
+    clearSession();
+    return null;
+  }
+
+  const expiresTs = Date.parse(session.expiresAt);
+  if (!Number.isFinite(expiresTs) || Date.now() >= expiresTs) {
+    clearSession();
+    return null;
+  }
+
+  return session;
+}
+
+function clearSession() {
+  if (!isOfficeReady()) {
+    return Promise.resolve();
+  }
+
+  return new Promise((resolve) => {
+    try {
+      const rs = Office.context.roamingSettings;
+      rs.remove(SESSION_KEY);
+      rs.saveAsync((result) => {
+        resolve();
+      });
+    } catch (e) {
+      resolve();
+    }
+  });
+}
+
+module.exports = {
+  saveSession,
+  loadSession,
+  clearSession,
+};
@@ -0,0 +1,43 @@
+const { URLS } = require("./urls");
+
+const DIALOG_SIGNALS = {
+  ready: "ready",
+  done: "done",
+};
+
+const DIALOG_HEIGHT = 60;
+const DIALOG_WIDTH = 50;
+
+function openTransitDialog(transitToken, { onCancel, onError }) {
+  Office.context.ui.displayDialogAsync(
+    URLS.transitDialog,
+    { height: DIALOG_HEIGHT, width: DIALOG_WIDTH, displayInIframe: false },
+    (asyncResult) => {
+      if (asyncResult.status === Office.AsyncResultStatus.Failed) {
+        onError?.(asyncResult.error);
+        return;
+      }
+
+      const dialog = asyncResult.value;
+
+      dialog.addEventHandler(Office.EventType.DialogMessageReceived, (arg) => {
+        if (arg.message === DIALOG_SIGNALS.ready) {
+          dialog.messageChild(transitToken);
+          return;
+        }
+        if (arg.message === DIALOG_SIGNALS.done) {
+          return;
+        }
+        onCancel?.();
+        dialog.close();
+      });
+
+      return dialog;
+    }
+  );
+}
+
+module.exports = {
+  openTransitDialog,
+  DIALOG_SIGNALS,
+};
@@ -0,0 +1,18 @@
+const TRANSIT_TOKEN_KEY = "transitToken";
+
+function save(token) {
+  sessionStorage.setItem(TRANSIT_TOKEN_KEY, token);
+}
+
+function consume() {
+  try {
+    const token = sessionStorage.getItem(TRANSIT_TOKEN_KEY);
+    sessionStorage.removeItem(TRANSIT_TOKEN_KEY);
+    return token;
+  } catch (err) {
+    console.error("Failed to read transit token:", err);
+    return null;
+  }
+}
+
+module.exports = { save, consume };
@@ -0,0 +1,15 @@
+const { BASE_URL } = require("./index");
+
+const ADDONS_BASE_URL = `${BASE_URL}/api/v1.0/addons/sessions`;
+
+const URLS = {
+  authenticate: `${BASE_URL}/api/v1.0/authenticate/`,
+  successPage: `${BASE_URL}/addons/outlook/success.html`,
+  transitDialog: `${BASE_URL}/addons/outlook/transit.html`,
+  init: `${ADDONS_BASE_URL}/init/`,
+  poll: `${ADDONS_BASE_URL}/poll/`,
+  exchange: `${ADDONS_BASE_URL}/exchange/`,
+  rooms: `${BASE_URL}/external-api/v1.0/rooms/`,
+};
+
+module.exports = { URLS };
@@ -0,0 +1,81 @@
+html, body {
+    margin: 0;
+    padding: 0;
+    height: 100%;
+}
+
+body {
+    display: flex;
+    align-items: center;
+    justify-content: center;
+    font-family: -apple-system, BlinkMacSystemFont, "Segoe UI", sans-serif;
+}
+
+#sideload-msg {
+    display: none;
+}
+
+#status {
+    display: none;
+}
+
+.spinner-container {
+    display: inline-flex;
+    align-items: center;
+    justify-content: center;
+    width: 56px;
+    height: 56px;
+}
+
+.spinner-svg {
+    width: 56px;
+    height: 56px;
+}
+
+/* Background arc (light gray ring) */
+.spinner-track {
+    stroke: #E5E7EB; /* primary.100 equivalent */
+    fill: none;
+    stroke-width: 3;
+    stroke-linecap: round;
+}
+
+/* Foreground rotating arc */
+.spinner-arc {
+    stroke: #000091; /* primary.800 equivalent */
+    fill: none;
+    stroke-width: 3;
+    stroke-linecap: round;
+    /* circumference = 2 * PI * r where r = 11 -> ~69.115 */
+    /* show 30% -> dashoffset = c - 0.3 * c = ~48.38 */
+    stroke-dasharray: 69.115 69.115;
+    stroke-dashoffset: 48.38;
+    transform-origin: center;
+    animation: spinner-rotate 1s ease-in-out infinite;
+}
+
+@keyframes spinner-rotate {
+    0% {
+        transform: rotate(0deg);
+    }
+    100% {
+        transform: rotate(360deg);
+    }
+}
+
+/* Hourglass fallback for reduced motion */
+.spinner-fallback {
+    display: none;
+    color: #000091;
+}
+
+@media (prefers-reduced-motion: reduce) {
+    .spinner-svg {
+        display: none;
+    }
+    .spinner-fallback {
+        display: inline-flex;
+        align-items: center;
+        justify-content: center;
+    }
+}
@@ -0,0 +1,44 @@
+<!DOCTYPE html>
+<html lang="fr">
+<head>
+    <meta charset="UTF-8" />
+    <meta http-equiv="X-UA-Compatible" content="IE=Edge" />
+    <meta name="viewport" content="width=device-width, initial-scale=1">
+    <title data-app-name></title>
+    <link rel="stylesheet" href="../styles/spinner.css" />
+    <script nonce="NONCE_PLACEHOLDER" src="/addons/outlook/config.js"></script>
+</head>
+    <body>
+        <div id="sideload-msg">Veuillez charger le complément.</div>
+        <div class="spinner-container"
+             role="progressbar"
+             aria-label="Chargement..."
+        >
+            <svg class="spinner-svg"
+                 viewBox="0 0 28 28"
+                 fill="none"
+                 xmlns="http://www.w3.org/2000/svg"
+            >
+                <!-- Background track -->
+                <circle class="spinner-track" cx="14" cy="14" r="11"
+                />
+                <!-- Rotating arc -->
+                <circle class="spinner-arc" cx="14" cy="14" r="11"
+                />
+            </svg>
+
+            <!-- Fallback hourglass icon (Remix Icon RiHourglassFill SVG path) -->
+            <span class="spinner-fallback" aria-hidden="true">
+                        <svg width="22"
+                             height="22"
+                             viewBox="0 0 24 24"
+                             fill="currentColor"
+                             xmlns="http://www.w3.org/2000/svg"
+                             style="display: block; transform: translateY(1px);"
+                        >
+                            <path d="M6 2H18V4L13 12L18 20V22H6V20L11 12L6 4V2ZM8.535 4L13 11.143L17.465 4H8.535Z"/>
+                        </svg>
+                    </span>
+        </div>
+    </body>
+</html>
@@ -0,0 +1,20 @@
+const { applyAppName } = require("../common/helpers");
+const { exchangeSession } = require("../common/api");
+const { consume } = require("../common/transitToken");
+
+applyAppName();
+
+const transitToken = consume();
+
+if (!transitToken) {
+  console.error("Transit token not found in sessionStorage");
+  window.close();
+} else {
+  exchangeSession(transitToken)
+    .catch((e) => {
+      console.error(`Error occured: ${e}`);
+    })
+    .finally(() => {
+      window.close();
+    });
+}
@@ -0,0 +1,56 @@
+<!DOCTYPE html>
+<html lang="fr">
+<head>
+    <meta charset="UTF-8" />
+    <meta http-equiv="X-UA-Compatible" content="IE=Edge" />
+    <meta name="viewport" content="width=device-width, initial-scale=1">
+    <title data-app-name></title>
+    <link rel="stylesheet" href="taskpane.css" />
+    <script nonce="NONCE_PLACEHOLDER" src="/addons/outlook/config.js"></script>
+    <script nonce="NONCE_PLACEHOLDER" src="https://appsforoffice.microsoft.com/lib/1/hosted/office.js"></script>
+</head>
+<body>
+<div id="sideload-msg">Veuillez charger le complément.</div>
+
+<div id="app-body">
+
+    <!-- Loading -->
+    <div id="view-loading">
+        <p class="intro-text">Chargement...</p>
+    </div>
+
+    <!-- Unauthenticated -->
+    <div id="view-unauth" style="display:none;">
+        <p class="intro-text">
+            <span>Ajoutez facilement un lien de réunion <span data-app-name></span> à vos événements Outlook.</span>
+        </p>
+        <hr class="divider" />
+        <button class="proconnect-button" id="btn-connect">
+            <span class="proconnect-sr-only">S'identifier avec ProConnect</span>
+        </button>
+        <p>
+            <a
+                    href="https://www.proconnect.gouv.fr/"
+                    target="_blank"
+                    rel="noopener noreferrer"
+                    title="Qu’est-ce que ProConnect ? - nouvelle fenêtre"
+            >
+                Qu’est-ce que ProConnect ?
+            </a>
+        </p>
+    </div>
+
+    <!-- Authenticated -->
+    <div id="view-auth" style="display:none;">
+        <div id="btn-container">
+            <button id="btn-generate">Ajouter une réunion <span data-app-name></span></button>
+            <button id="btn-disconnect">Se déconnecter</button>
+        </div>
+    </div>
+</div>
+<footer id="version-tag">
+    <span class="version-badge">alpha</span>
+    <span class="version-number">0.0.1</span>
+</footer>
+</body>
+</html>
@@ -0,0 +1,128 @@
+const { APP_NAME } = require("../common");
+
+const { applyAppName } = require("../common/helpers");
+const { initSession, createRoom } = require("../common/api");
+const { startPolling } = require("../common/polling");
+const { openTransitDialog } = require("../common/transitDialog");
+const { loadSession, saveSession, clearSession } = require("../common/session");
+
+const { buildMeetingMessage } = require("../common/messageBuilder");
+
+// todo - support loading view while polling
+// todo - support error view
+function showView(name) {
+  document.getElementById("view-loading").style.display = "none";
+  document.getElementById("view-unauth").style.display = "none";
+  document.getElementById("view-auth").style.display = "none";
+  document.getElementById(`view-${name}`).style.display = "block";
+}
+
+function connect() {
+  initSession()
+    .then((data) => {
+      const stopPolling = startPolling(data.csrf_token, {
+        onSuccess: (sessionData) => {
+          saveSession(sessionData).then(() => showView("auth"));
+        },
+        onTimeout: () => {
+          showView("unauth");
+        },
+        onError: (err) => {
+          console.error(err);
+        },
+      });
+      openTransitDialog(data.transit_token, {
+        onCancel: () => stopPolling(),
+        onError: (err) => {
+          stopPolling();
+        },
+      });
+    })
+    .catch((err) => {
+      console.error(err);
+    });
+}
+
+function disconnect() {
+  clearSession().finally(() => showView("unauth"));
+}
+
+function _setButtonLoading() {
+  const btn = document.getElementById("btn-generate");
+  btn.disabled = true;
+  btn.textContent = "Génération...";
+}
+
+function _setButtonIdle() {
+  const btn = document.getElementById("btn-generate");
+  btn.disabled = false;
+  btn.textContent = `Ajouter une réunion ${APP_NAME}`;
+}
+
+function generateMeetingLink() {
+  const session = loadSession();
+  if (!session?.access_token) {
+    console.error("Session introuvable. Veuillez vous reconnecter.");
+    showView("unauth");
+    return;
+  }
+
+  _setButtonLoading();
+
+  createRoom(session)
+    .then((data) => {
+      const { url, message } = buildMeetingMessage(data);
+      const item = Office.context.mailbox.item;
+      return new Promise((resolve, reject) => {
+        item.body.getAsync(Office.CoercionType.Html, (getResult) => {
+          if (getResult.status !== Office.AsyncResultStatus.Succeeded) {
+            reject(getResult.error);
+            return;
+          }
+
+          item.body.setAsync(
+            getResult.value + message,
+            { coercionType: Office.CoercionType.Html },
+            (setResult) => {
+              if (setResult.status !== Office.AsyncResultStatus.Succeeded) {
+                reject(setResult.error);
+                return;
+              }
+
+              // ─── If calendar event, also set location ──────────────
+              if (item.itemType === Office.MailboxEnums.ItemType.Appointment) {
+                item.location.setAsync(url, () => resolve());
+                return;
+              }
+
+              resolve();
+            }
+          );
+        });
+      });
+    })
+    .catch((err) => {
+      console.error(err);
+    })
+    .finally(() => {
+      _setButtonIdle();
+    });
+}
+
+Office.onReady((info) => {
+  if (info.host === Office.HostType.Outlook) {
+    applyAppName();
+    document.getElementById("sideload-msg").style.display = "none";
+    document.getElementById("app-body").style.display = "flex";
+    document.getElementById("btn-connect").onclick = connect;
+    document.getElementById("btn-disconnect").onclick = disconnect;
+    document.getElementById("btn-generate").onclick = generateMeetingLink;
+
+    const session = loadSession();
+    if (session?.state === "authenticated" && session?.access_token) {
+      showView("auth");
+    } else {
+      showView("unauth");
+    }
+  }
+});
@@ -0,0 +1,48 @@
+<!DOCTYPE html>
+<html lang="fr">
+    <head>
+        <meta charset="UTF-8" />
+        <meta http-equiv="X-UA-Compatible" content="IE=Edge" />
+        <meta name="viewport" content="width=device-width, initial-scale=1">
+        <title data-app-name></title>
+        <link rel="stylesheet" href="../styles/spinner.css" />
+        <script nonce="NONCE_PLACEHOLDER" src="/addons/outlook/config.js"></script>
+        <script nonce="NONCE_PLACEHOLDER" src="https://appsforoffice.microsoft.com/lib/1/hosted/office.js"></script>
+    </head>
+    <body>
+        <div id="sideload-msg">Veuillez charger le complément.</div>
+        <div
+            class="spinner-container"
+            role="progressbar"
+            aria-label="Chargement..."
+        >
+            <svg
+                class="spinner-svg"
+                viewBox="0 0 28 28"
+                fill="none"
+                xmlns="http://www.w3.org/2000/svg"
+            >
+                <!-- Background track -->
+                <circle class="spinner-track" cx="14" cy="14" r="11"
+                />
+                <!-- Rotating arc -->
+                <circle class="spinner-arc" cx="14" cy="14" r="11"
+                />
+            </svg>
+
+            <!-- Fallback hourglass icon (Remix Icon RiHourglassFill SVG path) -->
+            <span class="spinner-fallback" aria-hidden="true">
+                <svg
+                    width="22"
+                    height="22"
+                    viewBox="0 0 24 24"
+                    fill="currentColor"
+                    xmlns="http://www.w3.org/2000/svg"
+                    style="display: block; transform: translateY(1px);"
+                >
+                    <path d="M6 2H18V4L13 12L18 20V22H6V20L11 12L6 4V2ZM8.535 4L13 11.143L17.465 4H8.535Z"/>
+                </svg>
+            </span>
+        </div>
+    </body>
+</html>
@@ -0,0 +1,53 @@
+const { applyAppName } = require("../common/helpers");
+const { URLS } = require("../common/urls");
+const { save } = require("../common/transitToken");
+const { DIALOG_SIGNALS } = require("../common/transitDialog");
+
+// Initiate the authentication flow, then return to the success page
+function getAuthenticateUrl() {
+  const url = new URL(URLS.authenticate);
+  url.searchParams.set("returnTo", URLS.successPage);
+  return url.toString();
+}
+
+Office.onReady(function (info) {
+  if (info.host === Office.HostType.Outlook) {
+    applyAppName();
+  }
+
+  Office.context.ui.addHandlerAsync(
+    Office.EventType.DialogParentMessageReceived,
+    function (arg) {
+      const transitToken = arg.message;
+
+      if (typeof transitToken !== "string" || transitToken.trim() === "") {
+        console.error("Invalid transit token received from parent dialog.");
+        return;
+      }
+
+      // Runs inside the dialog window.
+      // Flow:
+      // transit.html saves token → navigates to /authenticate → OAuth redirect →
+      // success.html. sessionStorage survives because it's per-window-per-origin
+      // and the dialog window persists across same-origin navigations.
+      // Fragile: if the IdP opens the redirect in a new tab/window, this breaks
+      // silently.
+      // An alternative could be to pass the token via the OAuth `state` param
+      // and read it back from the redirect URL.
+      try {
+        save(transitToken);
+        Office.context.ui.messageParent(DIALOG_SIGNALS.done);
+        window.location.href = getAuthenticateUrl();
+      } catch (err) {
+        console.error("Failed to store transit token:", err);
+      }
+    },
+    function (result) {
+      if (result.status !== Office.AsyncResultStatus.Succeeded) {
+        console.error("Failed to register DialogParentMessageReceived handler.", result.error);
+        return;
+      }
+      Office.context.ui.messageParent(DIALOG_SIGNALS.ready);
+    }
+  );
+});
@@ -0,0 +1,128 @@
+/* eslint-disable no-undef */
+
+const devCerts = require("office-addin-dev-certs");
+const CopyWebpackPlugin = require("copy-webpack-plugin");
+const HtmlWebpackPlugin = require("html-webpack-plugin");
+const htmlWebpackInjectAttributesPlugin = require("html-webpack-inject-attributes-plugin");
+
+async function getHttpsOptions() {
+  const httpsOptions = await devCerts.getHttpsServerOptions();
+  return { ca: httpsOptions.ca, key: httpsOptions.key, cert: httpsOptions.cert };
+}
+
+module.exports = async (env, options) => {
+  const config = {
+    devtool: "source-map",
+    entry: {
+      polyfill: ["core-js/stable", "regenerator-runtime/runtime"],
+      taskpane: ["./src/taskpane/taskpane.js", "./src/taskpane/taskpane.html"],
+      commands: "./src/commands/commands.js",
+      transit: ["./src/transit/transit.js", "./src/transit/transit.html"],
+      success: ["./src/success/success.js", "./src/success/success.html"],
+    },
+    output: {
+      clean: true,
+    },
+    resolve: {
+      extensions: [".html", ".js"],
+    },
+    module: {
+      rules: [
+        {
+          test: /\.js$/,
+          exclude: /node_modules/,
+          use: {
+            loader: "babel-loader",
+          },
+        },
+        {
+          test: /\.html$/,
+          exclude: /node_modules/,
+          use: {
+            loader: "html-loader",
+            options: {
+              sources: {
+                urlFilter: (attribute, value) => {
+                  // Don't try to resolve the runtime-injected config
+                  if (value.includes("config.js")) {
+                    return false;
+                  }
+                  return true;
+                },
+              },
+            },
+          },
+        },
+        {
+          test: /\.(png|jpg|jpeg|gif|ico)$/,
+          type: "asset/resource",
+          generator: {
+            filename: "assets/[name][ext][query]",
+          },
+        },
+      ],
+    },
+    plugins: [
+      new HtmlWebpackPlugin({
+        filename: "taskpane.html",
+        template: "./src/taskpane/taskpane.html",
+        chunks: ["polyfill", "taskpane"],
+        scriptLoading: "defer",
+        attributes: {
+          nonce: "NONCE_PLACEHOLDER",
+        },
+      }),
+      new CopyWebpackPlugin({
+        patterns: [
+          {
+            from: "assets/*",
+            to: "assets/[name][ext][query]",
+          }
+        ],
+      }),
+      new HtmlWebpackPlugin({
+        filename: "commands.html",
+        template: "./src/commands/commands.html",
+        chunks: ["polyfill", "commands"],
+        scriptLoading: "defer",
+        attributes: {
+          nonce: "NONCE_PLACEHOLDER",
+        },
+      }),
+      new HtmlWebpackPlugin({
+        filename: "transit.html",
+        template: "./src/transit/transit.html",
+        chunks: ["polyfill", "transit"],
+        scriptLoading: "defer",
+        attributes: {
+          nonce: "NONCE_PLACEHOLDER",
+        },
+      }),
+      new HtmlWebpackPlugin({
+        filename: "success.html",
+        template: "./src/success/success.html",
+        chunks: ["polyfill", "success"],
+        scriptLoading: "defer",
+        attributes: {
+          nonce: "NONCE_PLACEHOLDER",
+        },
+      }),
+      new htmlWebpackInjectAttributesPlugin(),
+    ],
+    devServer: {
+      headers: {
+        "Access-Control-Allow-Origin": "*",
+      },
+      server: {
+        type: "https",
+        options:
+          env.WEBPACK_BUILD || options.https !== undefined
+            ? options.https
+            : await getHttpsOptions(),
+      },
+      port: process.env.npm_package_config_dev_server_port || 3000,
+    },
+  };
+
+  return config;
+};
@@ -0,0 +1,17 @@
+{
+  "name": "thunderbird",
+  "version": "1.0.0",
+  "main": "index.js",
+  "private": true,
+  "scripts": {
+    "dev": "web-ext run",
+    "lint": "web-ext lint --source-dir=./src"
+  },
+  "keywords": [],
+  "author": "",
+  "license": "ISC",
+  "description": "",
+  "devDependencies": {
+    "web-ext": "^10.1.0"
+  }
+}
@@ -0,0 +1,48 @@
+import { buildMeetingMessage } from "./lib/meeting-message.js";
+
+console.log("[meeting-link] background loaded at", new Date().toISOString());
+
+(async () => {
+  try {
+    console.log("[meeting-link] browser.calendar exists?", !!browser.calendar);
+    if (browser.calendar) {
+      console.log("[meeting-link] calendar namespace keys:",
+        Object.keys(browser.calendar));
+    }
+
+    // Try the most basic read call — list configured calendars.
+    // The exact method name varies between experiment versions; we'll
+    // try the common one first.
+    if (browser.calendar.calendars?.query) {
+      const calendars = await browser.calendar.calendars.query({});
+      console.log("[meeting-link] calendars found:", calendars.length, calendars);
+    } else {
+      console.warn("[meeting-link] calendars.query not present — namespace shape:",
+        browser.calendar);
+    }
+
+  } catch (err) {
+    console.error("[meeting-link] calendar probe failed:", err);
+  }
+})();
+
+// Hardcoded for Spike 1. Spike 2 replaces this with a fetch() to your API.
+const STUB_MEETING_DATA = {
+  url: "https://meet.example.com/m/abc-123-xyz",
+  telephony: {
+    phone_number: "+33123456789",
+    pin_code: "1234567890",
+  },
+};
+
+browser.runtime.onMessage.addListener(async (msg) => {
+  if (msg?.type === "GET_MEETING_MESSAGE") {
+    try {
+      const built = buildMeetingMessage(STUB_MEETING_DATA);
+      return { ok: true, ...built };
+    } catch (err) {
+      console.error("[meeting-link] build failed", err);
+      return { ok: false, error: String(err.message || err) };
+    }
+  }
+});
@@ -0,0 +1,41 @@
+{
+  "manifest_version": 3,
+  "name": "Meeting Link (dev)",
+  "version": "0.1.0",
+  "description": "Spike 0 — verifying the dev loop",
+  "browser_specific_settings": {
+    "gecko": {
+      "id": "meeting-link-dev@yourcompany.example",
+      "strict_min_version": "128.0"
+    }
+  },
+  "background": {
+    "scripts": ["background.js"],
+    "type": "module"
+  },
+  "compose_action": {
+    "default_title": "Insert meeting link",
+    "default_popup": "popup/popup.html",
+    "default_icon": "icons/icon-32.png"
+  },
+  "permissions": ["compose"],
+  "experiment_apis": {
+    "calendar_provider": {
+      "schema": "experiments/calendar/schema/calendar-provider.json",
+      "parent": {
+        "scopes": ["addon_parent"],
+        "paths": [["calendar", "provider"]],
+        "script": "experiments/calendar/parent/ext-calendar-provider.js",
+        "events": ["startup"]
+      }
+    },
+    "calendar_calendars": {
+      "schema": "experiments/calendar/schema/calendar-calendars.json",
+      "parent": {
+        "scopes": ["addon_parent"],
+        "paths": [["calendar", "calendars"]],
+        "script": "experiments/calendar/parent/ext-calendar-calendars.js"
+      }
+    }
+  }
+}
@@ -0,0 +1,18 @@
+<!doctype html>
+<html>
+    <head>
+        <meta charset="utf-8">
+        <title>Meeting link</title>
+        <style>
+            body { font: 13px system-ui; padding: 12px; min-width: 240px; margin: 0; }
+            button { font: inherit; padding: 6px 12px; cursor: pointer; }
+            #status { margin-top: 8px; color: #555; min-height: 1.2em; white-space: pre-wrap; }
+            #status.error { color: #b00020; }
+        </style>
+    </head>
+    <body>
+        <button id="insert">Insert meeting link</button>
+        <div id="status"></div>
+        <script src="popup.js"></script>
+    </body>
+</html>
@@ -0,0 +1,65 @@
+const insertBtn = document.getElementById("insert");
+const statusEl = document.getElementById("status");
+
+function setStatus(text, isError = false) {
+  statusEl.textContent = text;
+  statusEl.classList.toggle("error", isError);
+}
+
+insertBtn.addEventListener("click", async () => {
+  insertBtn.disabled = true;
+  setStatus("Generating link…");
+
+  try {
+    // 1. Find the compose tab this popup belongs to.
+    //    A compose_action popup is anchored to a compose window, so the
+    //    "active tab in the current window" is the compose tab itself.
+    const [composeTab] = await browser.tabs.query({
+      active: true,
+      currentWindow: true,
+    });
+    if (!composeTab) throw new Error("No compose tab found");
+
+    // 2. Read the current compose state — we need to know if we're
+    //    in HTML mode or plain-text mode, and we need the existing body
+    //    so we can append rather than overwrite.
+    const details = await browser.compose.getComposeDetails(composeTab.id);
+
+    // 3. Ask the background to produce the meeting message.
+    const reply = await browser.runtime.sendMessage({
+      type: "GET_MEETING_MESSAGE",
+    });
+    if (!reply?.ok) throw new Error(reply?.error || "Background error");
+
+    // 4. Append to the existing body in the right format.
+    if (details.isPlainText) {
+      const newBody = (details.plainTextBody || "") + "\n\n" + reply.text;
+      await browser.compose.setComposeDetails(composeTab.id, {
+        plainTextBody: newBody,
+      });
+    } else {
+      const newBody = appendHtmlBeforeBodyEnd(details.body || "", reply.html);
+      await browser.compose.setComposeDetails(composeTab.id, {
+        body: newBody,
+      });
+    }
+
+    setStatus("Inserted ✓");
+    setTimeout(() => window.close(), 600);
+  } catch (err) {
+    console.error("[meeting-link] popup insert failed", err);
+    setStatus("Failed: " + (err.message || err), true);
+    insertBtn.disabled = false;
+  }
+});
+
+/**
+ * Append HTML right before </body>, or fall back to concatenation if no
+ * </body> tag is present (Thunderbird's compose body is usually a full
+ * HTML document, but be defensive).
+ */
+function appendHtmlBeforeBodyEnd(currentHtml, fragment) {
+  const idx = currentHtml.toLowerCase().lastIndexOf("</body>");
+  if (idx === -1) return currentHtml + fragment;
+  return currentHtml.slice(0, idx) + fragment + currentHtml.slice(idx);
+}
@@ -0,0 +1,30 @@
+// web-ext-config.cjs
+const os = require("os");
+const path = require("path");
+
+function thunderbirdBinary() {
+  if (process.env.WEB_EXT_FIREFOX) return process.env.WEB_EXT_FIREFOX;
+  switch (process.platform) {
+    case "darwin":
+      return "/Applications/Thunderbird Beta.app/Contents/MacOS/thunderbird";
+    case "linux":
+      return "/usr/bin/thunderbird"; // adjust to your install
+    case "win32":
+      return "C:\\Program Files\\Mozilla Thunderbird\\thunderbird.exe";
+    default:
+      throw new Error("Unsupported platform: " + process.platform);
+  }
+}
+
+module.exports = {
+  sourceDir: "./src",
+  artifactsDir: "./web-ext-artifacts",
+  run: {
+    firefox: thunderbirdBinary(),
+    firefoxProfile: path.join(os.homedir(), ".thunderbird-dev-profile"),
+    profileCreateIfMissing: true,
+    keepProfileChanges: true,
+    browserConsole: true,
+  },
+  ignoreFiles: ["package-lock.json", "web-ext-config.cjs", "*.md"],
+};
@@ -1,4 +1,4 @@
-FROM python:3.13-slim AS base
+FROM python:3.13.13-slim AS base

 # Install system dependencies required by LiveKit
 RUN apt-get update && apt-get install -y \
@@ -15,19 +15,30 @@ COPY pyproject.toml .
 RUN mkdir /install && \
  pip install --prefix=/install .

+FROM base AS development
+
+WORKDIR /app
+
+COPY pyproject.toml .
+RUN pip install --no-cache-dir ".[dev]"
+
+COPY . .
+
+CMD ["python", "metadata_collector.py", "dev"]
+
 FROM base AS production

 WORKDIR /app

+COPY --from=builder /install /usr/local
+
 # Remove pip to reduce attack surface in production
 RUN pip uninstall -y pip

+# Un-privileged user running the application
 ARG DOCKER_USER
 USER ${DOCKER_USER}

-# Un-privileged user running the application
-COPY --from=builder /install /usr/local
+COPY ./*.py /app/

-COPY . .
-
-CMD ["python", "multi-user-transcriber.py", "start"]
+CMD ["python", "multi_user_transcriber.py", "start"]
@@ -0,0 +1,5 @@
+"""Storage parsers specific exceptions."""
+
+
+class MissingConfigError(Exception):
+    """Raised when a variable is not set in configuration."""
@@ -0,0 +1,382 @@
+"""Metadata agent that extracts metadata from active room."""
+
+import asyncio
+import json
+import logging
+import os
+from dataclasses import asdict, dataclass
+from datetime import datetime, timezone
+from io import BytesIO
+from typing import List, Optional
+
+from dotenv import load_dotenv
+from livekit import api, rtc
+from livekit.agents import (
+    Agent,
+    AgentServer,
+    AgentSession,
+    AutoSubscribe,
+    JobContext,
+    JobProcess,
+    JobRequest,
+    RoomInputOptions,
+    RoomIO,
+    RoomOutputOptions,
+    WorkerPermissions,
+    cli,
+    utils,
+)
+from livekit.plugins import silero
+from minio import Minio
+from minio.error import S3Error
+
+from exceptions import MissingConfigError
+
+load_dotenv()
+
+logger = logging.getLogger("metadata-collector")
+
+AGENT_NAME = os.getenv("METADATA_COLLECTOR_AGENT_NAME", "metadata-collector")
+
+
+def prewarm(proc: JobProcess):
+    """Preload voice activity detection model."""
+    proc.userdata["vad"] = silero.VAD.load()
+
+
+server = AgentServer(
+    permissions=WorkerPermissions(
+        can_publish=False,
+        can_publish_data=False,
+        can_subscribe=True,
+        hidden=True,
+    ),
+)
+server.setup_fnc = prewarm
+
+
+@dataclass
+class MetadataEvent:
+    """A single timestamped event recorded during a meeting."""
+
+    participant_id: str
+    type: str
+    timestamp: datetime
+    data: Optional[str] = None
+
+    def serialize(self) -> dict:
+        """Return a JSON-serializable dictionary representation of the event."""
+        data = asdict(self)
+        data["timestamp"] = self.timestamp.isoformat()
+        return data
+
+
+class VADAgent(Agent):
+    """Agent that monitors voice activity for a specific participant."""
+
+    def __init__(self, participant_identity: str, events: List):
+        """Initialize with a participant identity and shared events list."""
+        super().__init__(
+            instructions="not-needed",
+        )
+        self.participant_identity = participant_identity
+        self.events = events
+
+    async def on_enter(self) -> None:
+        """Initialize VAD monitoring for this participant."""
+
+        @self.session.on("user_state_changed")
+        def on_user_state(event):
+            timestamp = datetime.now(timezone.utc)
+
+            if event.new_state == "speaking":
+                event = MetadataEvent(
+                    participant_id=self.participant_identity,
+                    type="speech_start",
+                    timestamp=timestamp,
+                )
+                self.events.append(event)
+
+            elif event.old_state == "speaking":
+                event = MetadataEvent(
+                    participant_id=self.participant_identity,
+                    type="speech_end",
+                    timestamp=timestamp,
+                )
+                self.events.append(event)
+
+
+class MetadataCollector:
+    """Collect meeting events across all participants in a room.
+
+    Creates one AgentSession per participant to capture VAD events
+    (speech start/end), and listens for connection, disconnection,
+    and chat events. Persists all collected events as JSON to S3
+    on shutdown.
+    """
+
+    def __init__(self, ctx: JobContext, recording_id: str):
+        """Initialize metadata agent."""
+        self.minio_client = Minio(
+            endpoint=os.getenv("AWS_S3_ENDPOINT_URL"),
+            access_key=os.getenv("AWS_S3_ACCESS_KEY_ID"),
+            secret_key=os.getenv("AWS_S3_SECRET_ACCESS_KEY"),
+            secure=os.getenv("AWS_S3_SECURE_ACCESS", "False").lower() == "true",
+        )
+
+        if (bucket_name := os.getenv("AWS_STORAGE_BUCKET_NAME")) is not None:
+            self.bucket_name = bucket_name
+        else:
+            raise MissingConfigError
+
+        self.ctx = ctx
+        self._sessions: dict[str, AgentSession] = {}
+        self._tasks: set[asyncio.Task] = set()
+
+        output_folder = os.getenv("AWS_S3_OUTPUT_FOLDER", "metadata")
+        self.output_filename = f"{output_folder}/{recording_id}-metadata.json"
+
+        # Storage for events
+        self.events = []
+        self.participants = {}
+
+        logger.info("MetadataCollector initialized")
+
+    def start(self):
+        """Start listening for room-level events."""
+        self.ctx.room.on("participant_disconnected", self.on_participant_disconnected)
+        self.ctx.room.on("participant_name_changed", self.on_participant_name_changed)
+
+        self.ctx.room.register_text_stream_handler("lk.chat", self.handle_chat_stream)
+
+        logger.info("Started listening for participant events")
+
+    async def on_chat_message_received(
+        self, reader: rtc.TextStreamReader, participant_identity: str
+    ):
+        """Read a complete chat message and record it as an event."""
+        full_text = await reader.read_all()
+        logger.info("Received chat message from %s", participant_identity)
+
+        self.events.append(
+            MetadataEvent(
+                participant_id=participant_identity,
+                type="chat_received",
+                timestamp=datetime.now(timezone.utc),
+                data=full_text,
+            )
+        )
+
+    def handle_chat_stream(self, reader, participant_identity):
+        """Schedule async processing of an incoming chat stream."""
+        task = asyncio.create_task(
+            self.on_chat_message_received(reader, participant_identity)
+        )
+        self._tasks.add(task)
+        task.add_done_callback(lambda _: self._tasks.remove(task))
+
+    def save(self):
+        """Serialize collected events and upload as JSON to S3."""
+        logger.info("Persisting metadata…")
+
+        participants = []
+        for k, v in self.participants.items():
+            participants.append({"participantId": k, "name": v})
+
+        sorted_events = sorted(self.events, key=lambda e: e.timestamp)
+
+        payload = {
+            "events": [event.serialize() for event in sorted_events],
+            "participants": participants,
+        }
+
+        data = json.dumps(payload, indent=2).encode("utf-8")
+        stream = BytesIO(data)
+
+        try:
+            self.minio_client.put_object(
+                self.bucket_name,
+                self.output_filename,
+                stream,
+                length=len(data),
+                content_type="application/json",
+            )
+            logger.info(
+                "Uploaded speaker meeting metadata",
+            )
+        except S3Error:
+            logger.exception(
+                "Failed to upload meeting metadata",
+            )
+
+    async def aclose(self):
+        """Close all sessions and cleanup resources."""
+        logger.info("Closing all VAD monitoring sessions…")
+
+        await utils.aio.cancel_and_wait(*self._tasks)
+
+        await asyncio.gather(
+            *[self._close_session(session) for session in self._sessions.values()],
+            return_exceptions=True,
+        )
+
+        self.ctx.room.off("participant_disconnected", self.on_participant_disconnected)
+        self.ctx.room.off("participant_name_changed", self.on_participant_name_changed)
+
+        logger.info("All VAD sessions closed")
+        self.save()
+
+    async def on_participant_entrypoint(
+        self, ctx: JobContext, participant: rtc.RemoteParticipant
+    ):
+        """Handle new participant by starting a VAD monitoring session."""
+        if participant.identity in self._sessions:
+            logger.debug("Session already exists for %s", participant.identity)
+            return
+
+        self.events.append(
+            MetadataEvent(
+                participant_id=participant.identity,
+                type="participant_connected",
+                timestamp=datetime.now(timezone.utc),
+            )
+        )
+
+        self.participants[participant.identity] = participant.name
+
+        logger.info("New participant connected: %s", participant.identity)
+        try:
+            session = await self._start_session(participant)
+            self._sessions[participant.identity] = session
+        except Exception:
+            logger.exception("Failed to start session for %s", participant.identity)
+
+    def on_participant_disconnected(self, participant: rtc.RemoteParticipant):
+        """Handle participant disconnection by closing VAD monitoring."""
+        self.events.append(
+            MetadataEvent(
+                participant_id=participant.identity,
+                type="participant_disconnected",
+                timestamp=datetime.now(timezone.utc),
+            )
+        )
+
+        session = self._sessions.pop(participant.identity, None)
+        if session is None:
+            logger.debug("No session found for %s", participant.identity)
+            return
+
+        logger.info("Participant disconnected: %s", participant.identity)
+        task = asyncio.create_task(self._close_session(session))
+        self._tasks.add(task)
+
+        def on_close_done(_):
+            self._tasks.discard(task)
+            logger.info(
+                "VAD session closed for %s (remaining sessions: %d)",
+                participant.identity,
+                len(self._sessions),
+            )
+
+        task.add_done_callback(on_close_done)
+
+    def on_participant_name_changed(self, participant: rtc.RemoteParticipant):
+        """Update stored participant name when it changes."""
+        logger.info("Participant's name changed: %s", participant.identity)
+        self.participants[participant.identity] = participant.name
+
+    async def _start_session(self, participant: rtc.RemoteParticipant) -> AgentSession:
+        """Create and start VAD monitoring session for participant."""
+        if participant.identity in self._sessions:
+            return self._sessions[participant.identity]
+
+        # Create session with VAD only - no STT, LLM, or TTS
+        session = AgentSession(
+            vad=self.ctx.proc.userdata["vad"],
+            turn_detection="vad",
+            user_away_timeout=30.0,
+        )
+
+        # Set up room IO to receive audio from this specific participant
+        room_io = RoomIO(
+            agent_session=session,
+            room=self.ctx.room,
+            participant=participant,
+            input_options=RoomInputOptions(
+                audio_enabled=True,
+                text_enabled=False,
+            ),
+            output_options=RoomOutputOptions(
+                audio_enabled=False,
+                transcription_enabled=False,
+            ),
+        )
+
+        await room_io.start()
+        await session.start(
+            agent=VADAgent(
+                participant_identity=participant.identity, events=self.events
+            )
+        )
+
+        return session
+
+    async def _close_session(self, session: AgentSession) -> None:
+        """Close and cleanup VAD monitoring session."""
+        try:
+            await session.drain()
+            await session.aclose()
+        except Exception:
+            logger.exception("Error closing session")
+
+
+async def handle_job_request(job_req: JobRequest) -> None:
+    """Accept or reject the job request based on agent presence in the room."""
+    room_name = job_req.room.name
+    recording_id = job_req.job.metadata
+    agent_identity = f"{AGENT_NAME}-{room_name}"
+
+    async with api.LiveKitAPI() as lk:
+        try:
+            resp = await lk.room.list_participants(
+                list=api.ListParticipantsRequest(room=room_name)
+            )
+            already_present = any(
+                p.kind == rtc.ParticipantKind.PARTICIPANT_KIND_AGENT
+                and p.identity == agent_identity
+                for p in resp.participants
+            )
+            if already_present:
+                logger.info("Agent already in the room '%s' — reject", room_name)
+                await job_req.reject()
+            else:
+                logger.info(
+                    "Accept job for '%s' — identity=%s", room_name, agent_identity
+                )
+                await job_req.accept(identity=agent_identity, metadata=recording_id)
+        except Exception:
+            logger.exception("Error treating the job for '%s'", room_name)
+            await job_req.reject()
+
+
+@server.rtc_session(agent_name=AGENT_NAME, on_request=handle_job_request)
+async def entrypoint(ctx: JobContext):
+    """Initialize and run the metadata collector."""
+    logger.info("Starting metadata agent in room: %s", ctx.room.name)
+    recording_id = ctx.job.metadata
+    metadata_collector = MetadataCollector(ctx, recording_id)
+    metadata_collector.start()
+
+    ctx.add_participant_entrypoint(metadata_collector.on_participant_entrypoint)
+
+    await ctx.connect(auto_subscribe=AutoSubscribe.AUDIO_ONLY)
+
+    async def cleanup():
+        logger.info("Shutting down metadata collector…")
+        await metadata_collector.aclose()
+
+    ctx.add_shutdown_callback(cleanup)
+
+
+if __name__ == "__main__":
+    cli.run_app(server)
@@ -1,22 +1,26 @@

 [project]
 name = "agents"
-version = "1.11.0"
+version = "1.15.0"
 requires-python = ">=3.12"
 dependencies = [
-    "livekit-agents==1.3.10",
-    "livekit-plugins-deepgram==1.3.10",
-    "livekit-plugins-silero==1.3.10",
+    "livekit-agents==1.4.5",
+    "livekit-plugins-deepgram==1.4.5",
+    "livekit-plugins-silero==1.4.5",
    "livekit-plugins-kyutai-lasuite==0.0.6",
-    "python-dotenv==1.2.1",
-    "protobuf==6.33.5"
+    "python-dotenv==1.2.2",
+    "protobuf==6.33.5",
+    "minio==7.2.15"
 ]

 [project.optional-dependencies]
 dev = [
-    "ruff==0.14.4",
+    "ruff==0.15.6",
 ]

+[tool.setuptools]
+py-modules = ["multi_user_transcriber", "metadata_collector", "exceptions"]
+
 [build-system]
 requires = ["setuptools>=61.0"]
 build-backend = "setuptools.build_meta"
@@ -0,0 +1 @@
+"""Meet core add-ons module."""
@@ -0,0 +1,344 @@
+"""Authentication session management for add-ons using temporary cache-based sessions."""
+
+import hashlib
+import hmac
+import secrets
+from datetime import datetime, timedelta, timezone
+from enum import Enum
+from logging import getLogger
+
+from django.conf import settings
+from django.core.cache import cache
+from django.core.exceptions import ImproperlyConfigured
+
+from core.models import User
+from core.services.jwt_token import JwtTokenService
+
+logger = getLogger(__name__)
+
+_PUBLIC_SESSION_FIELDS = frozenset(
+    {"state", "access_token", "token_type", "expires_in", "scope"}
+)
+
+
+class SessionDataError(Exception):
+    """Raised when session data is invalid or malformed."""
+
+
+class CSRFTokenError(Exception):
+    """Raised when CSRF token verification fails."""
+
+
+class TransitTokenError(Exception):
+    """Raised when a transit token is invalid or expired."""
+
+
+class SessionExpiredError(Exception):
+    """Raised when a session has expired."""
+
+
+class SessionNotFoundError(Exception):
+    """Raised when a session is not found."""
+
+
+class SuspiciousSessionError(Exception):
+    """Raised when session state indicates a possible attack or bug."""
+
+
+class SessionState(str, Enum):
+    """Add-on authentication session lifecycle states."""
+
+    PENDING = "pending"
+    AUTHENTICATED = "authenticated"
+
+
+class TransitTokenState(str, Enum):
+    """Transit token lifecycle states; CONSUMED is retained to detect replay."""
+
+    PENDING = "pending"
+    CONSUMED = "consumed"
+
+
+class TokenExchangeService:
+    """Manage temporary authentication sessions for add-on JWT token exchange."""
+
+    def __init__(self):
+        """Build the underlying JWT service and validate required settings."""
+
+        if not settings.ADDONS_CSRF_SECRET:
+            raise ImproperlyConfigured("CSRF Secret is required.")
+
+        if not settings.ADDONS_TOKEN_SCOPE:
+            raise ImproperlyConfigured("Token scope must be defined.")
+
+        self._token_service = JwtTokenService(
+            secret_key=settings.ADDONS_TOKEN_SECRET_KEY,
+            algorithm=settings.ADDONS_TOKEN_ALG,
+            issuer=settings.ADDONS_TOKEN_ISSUER,
+            audience=settings.ADDONS_TOKEN_AUDIENCE,
+            expiration_seconds=settings.ADDONS_TOKEN_TTL,
+            token_type=settings.ADDONS_TOKEN_TYPE,
+        )
+
+    @staticmethod
+    def _cache_key(prefix: str, token: str) -> str:
+        """Build a namespaced cache key: ``addons_{prefix}_{token}``."""
+        return f"addons_{prefix}_{token}"
+
+    @staticmethod
+    def _derive_csrf_token(session_id: str) -> str:
+        """Derive the CSRF token as HMAC-SHA256(session_id) under ADDONS_CSRF_SECRET."""
+        return hmac.new(
+            settings.ADDONS_CSRF_SECRET.encode("utf-8"),
+            session_id.encode("utf-8"),
+            hashlib.sha256,
+        ).hexdigest()
+
+    @staticmethod
+    def _validate_session_not_expired(session_data: dict) -> int:
+        """Return remaining seconds until expiry, or raise if missing/malformed/expired."""
+        expires_at_str = session_data.get("expires_at")
+        if expires_at_str is None:
+            raise SessionDataError("Invalid session data: missing expiration.")
+
+        try:
+            expires_at = datetime.fromisoformat(expires_at_str)
+        except ValueError as e:
+            raise SessionDataError("Invalid session data: malformed expiration.") from e
+
+        remaining_seconds = int(
+            (expires_at - datetime.now(timezone.utc)).total_seconds()
+        )
+
+        if remaining_seconds <= 0:
+            raise SessionExpiredError("Session expired.")
+
+        return remaining_seconds
+
+    def _generate_session_id(self) -> str:
+        """Generate a high-entropy URL-safe session_id."""
+        return secrets.token_urlsafe(settings.ADDONS_RANDOM_TOKEN_BYTE_LENGTH)
+
+    def _generate_transit_token(self) -> str:
+        """Generate a high-entropy URL-safe transit token."""
+        return secrets.token_urlsafe(settings.ADDONS_RANDOM_TOKEN_BYTE_LENGTH)
+
+    def init_session(self) -> tuple[str, str, str]:
+        """Create a new pending session and its transit binding.
+
+        Returns:
+            (transit_token, session_id, csrf_token)
+        """
+        session_id = self._generate_session_id()
+        transit_token = self._generate_transit_token()
+        csrf_token = self._derive_csrf_token(session_id)
+
+        expires_at = (
+            datetime.now(timezone.utc) + timedelta(seconds=settings.ADDONS_SESSION_TTL)
+        ).isoformat()
+
+        session_data = {
+            "state": SessionState.PENDING,
+            "expires_at": expires_at,
+            "transit_token": transit_token,
+        }
+
+        cache.set(
+            self._cache_key(settings.ADDONS_CACHE_PREFIX_SESSION, session_id),
+            session_data,
+            settings.ADDONS_SESSION_TTL,
+        )
+
+        transit_token_data = {
+            "session_id": session_id,
+            "state": TransitTokenState.PENDING,
+        }
+
+        cache.set(
+            self._cache_key(settings.ADDONS_CACHE_PREFIX_TRANSIT, transit_token),
+            transit_token_data,
+            settings.ADDONS_TRANSIT_TOKEN_TTL,
+        )
+
+        return transit_token, session_id, csrf_token
+
+    def verify_csrf(self, session_id: str, submitted_csrf: str) -> None:
+        """Constant-time verify submitted_csrf against HMAC(session_id). Raise on mismatch."""
+        expected_csrf = self._derive_csrf_token(session_id)
+        if not hmac.compare_digest(expected_csrf, submitted_csrf):
+            raise CSRFTokenError("Invalid CSRF token.")
+
+    def consume_transit_token(self, transit_token: str) -> str:
+        """Mark transit token consumed and return its session_id.
+
+        A replay (second consume) evicts the session as a security cleanup and raises.
+
+        Raises:
+            TransitTokenError: If token is unknown, expired, or already consumed.
+        """
+        cache_key = self._cache_key(settings.ADDONS_CACHE_PREFIX_TRANSIT, transit_token)
+
+        transit_token_data = cache.get(cache_key)
+
+        if transit_token_data is None:
+            # Indistinguishable from here: either the token was never issued (attacker
+            # probing or client bug) or it was issued but expired before consumption.
+            logger.warning(
+                "Transit token not found in cache (unknown or expired).",
+            )
+            raise TransitTokenError("Invalid or expired transit token.")
+
+        state = transit_token_data.get("state", None)
+        session_id = transit_token_data.get("session_id", None)
+
+        if not session_id:
+            logger.warning("Transit token data missing session_id.")
+            raise TransitTokenError("Invalid transit token.")
+
+        if state == TransitTokenState.CONSUMED:
+            logger.warning(
+                "Replay on session %s",
+                session_id,
+            )
+
+            # Security cleanup: a replay attempt means the transit token leaked
+            # (or an attacker is probing). Evict the session so the authenticated
+            # tokens — if they exist — can no longer be polled.
+            cache.delete(
+                self._cache_key(settings.ADDONS_CACHE_PREFIX_SESSION, session_id)
+            )
+
+            raise TransitTokenError("Transit token already consumed.")
+
+        new_transit_token_data = {
+            "state": TransitTokenState.CONSUMED,
+            "session_id": session_id,
+        }
+
+        cache.set(
+            cache_key,
+            new_transit_token_data,
+            settings.ADDONS_SESSION_TTL,
+        )
+
+        return session_id
+
+    @staticmethod
+    def is_session_pending(session_data: dict) -> bool:
+        """Return True if the public session dict is still in the pending state."""
+        return session_data.get("state") == SessionState.PENDING
+
+    def _get_session_data(self, session_id: str) -> dict:
+        """Fetch raw session data from cache, or raise SessionNotFoundError."""
+
+        if not session_id:
+            raise SessionNotFoundError("Session not found.")
+
+        data = cache.get(
+            self._cache_key(settings.ADDONS_CACHE_PREFIX_SESSION, session_id)
+        )
+        if data is None:
+            raise SessionNotFoundError("Session not found.")
+        return data
+
+    def get_session(self, session_id: str) -> dict:
+        """Return the public session view; evict the session on authenticated read.
+
+        Raises:
+            SessionNotFoundError: If session is not found.
+            SessionDataError: If session data is missing the state field.
+        """
+
+        # raises if session is not found
+        session_data = self._get_session_data(session_id)
+
+        if "state" not in session_data:
+            raise SessionDataError("Invalid session data: missing state field.")
+
+        # One-time read: clear both bindings for authenticated sessions
+        if session_data["state"] == SessionState.AUTHENTICATED:
+            cache.delete(
+                self._cache_key(settings.ADDONS_CACHE_PREFIX_SESSION, session_id)
+            )
+
+        # Return public fields only
+        return {k: v for k, v in session_data.items() if k in _PUBLIC_SESSION_FIELDS}
+
+    def _validate_transit_token_state(self, session_data: dict) -> None:
+        """Assert the session's transit token exists in cache and is in CONSUMED state.
+
+        Raises:
+            SessionDataError: session_data is missing the transit_token field.
+            SuspiciousSessionError: transit entry is missing, or still pending (flow skipped).
+        """
+
+        transit_token = session_data.get("transit_token", None)
+        if transit_token is None:
+            raise SessionDataError("Invalid session data: missing transit_token field.")
+
+        transit_token_data = cache.get(
+            self._cache_key(settings.ADDONS_CACHE_PREFIX_TRANSIT, transit_token)
+        )
+
+        if transit_token_data is None:
+            logger.warning("Transit token missing when setting access token.")
+            raise SuspiciousSessionError("Transit token not found.")
+
+        if transit_token_data.get("state") != TransitTokenState.CONSUMED:
+            logger.warning("Access token requested without completing transit flow.")
+            raise SuspiciousSessionError("Transit token not consumed.")
+
+    def set_access_token(self, user: User, session_id: str) -> None:
+        """Authenticate a pending session by minting a JWT and storing it on the session.
+
+        Non-pending sessions are evicted as a security cleanup before raising.
+
+        Raises:
+            SessionNotFoundError: If session doesn't exist.
+            SessionDataError: If session data is malformed.
+            SessionExpiredError: If session has expired.
+            SuspiciousSessionError: If session is not pending or transit wasn't consumed.
+        """
+
+        # raises if session is not found
+        session_data = self._get_session_data(session_id)
+
+        if session_data.get("state") != SessionState.PENDING:
+            logger.warning(
+                "Session's state is not pending. Suspicious.",
+            )
+            # Security cleanup: evict the session so any cached tokens cannot be polled.
+            cache.delete(
+                self._cache_key(settings.ADDONS_CACHE_PREFIX_SESSION, session_id)
+            )
+            raise SuspiciousSessionError("Session is not in pending state.")
+
+        # raises if transit_token is invalid
+        try:
+            self._validate_transit_token_state(session_data)
+        except SuspiciousSessionError:
+            # Security cleanup: evict the session.
+            cache.delete(
+                self._cache_key(settings.ADDONS_CACHE_PREFIX_SESSION, session_id)
+            )
+            raise
+
+        # raises if session is expired
+        remaining_seconds = self._validate_session_not_expired(session_data)
+
+        response = self._token_service.generate_jwt(user, settings.ADDONS_TOKEN_SCOPE)
+
+        new_data = {
+            "access_token": response["access_token"],
+            "token_type": response["token_type"],
+            "expires_in": response["expires_in"],
+            "scope": response["scope"],
+            "expires_at": session_data["expires_at"],
+            "state": SessionState.AUTHENTICATED,
+        }
+
+        cache.set(
+            self._cache_key(settings.ADDONS_CACHE_PREFIX_SESSION, session_id),
+            new_data,
+            remaining_seconds,
+        )
@@ -0,0 +1,229 @@
+"""Add-ons API endpoints"""
+
+from logging import getLogger
+
+from django.conf import settings
+from django.core.exceptions import SuspiciousOperation
+
+from rest_framework import decorators, viewsets
+from rest_framework import (
+    response as drf_response,
+)
+from rest_framework import status as drf_status
+
+from core.addons.service import (
+    CSRFTokenError,
+    SessionDataError,
+    SessionExpiredError,
+    SessionNotFoundError,
+    SuspiciousSessionError,
+    TokenExchangeService,
+    TransitTokenError,
+)
+from core.api.feature_flag import FeatureFlag
+from core.api.permissions import IsAuthenticated
+
+logger = getLogger(__name__)
+
+
+class SessionViewSet(viewsets.ViewSet):
+    """ViewSet for managing add-on authentication sessions via token exchange.
+
+    Implements a three-step flow that lets a third-party add-on (running in an
+    embedded iframe) obtain an access token without exposing it to client-side
+    JavaScript:
+
+    1. /init: the add-on opens a session and receives a short-lived transit
+       token (used to bootstrap the OAuth-style exchange in a dialog) and a
+       CSRF token. The opaque session id is stored in an HttpOnly, Secure,
+       SameSite=None cookie so it can accompany cross-origin polls.
+    2. /poll: the add-on polls until the session transitions from pending to
+       authenticated. On the terminal read, the session payload (access
+       token, token type, expiry, etc.) is returned, the session is evicted
+       server-side, and the session cookie is cleared so the tokens can be
+       retrieved exactly once.
+    3. /exchange: called from the post-login callback page on our own domain,
+       after the user has authenticated in a dialog opened by the addon. The
+       transit token (carried client-side via postMessage + sessionStorage)
+       is redeemed here for the authenticated user's access token, which is
+       stored server-side against the session. Requires an authenticated
+       user — that user is whose access token gets bound to the session.
+
+    /init and /poll authenticate the caller through the session cookie +
+    CSRF token pair alone — no user login is required, since the whole point
+    of the flow is to bootstrap one. /exchange, by contrast, requires an
+    authenticated user and does not use the addonsSid cookie.
+    """
+
+    throttle_classes = []
+
+    @decorators.action(
+        detail=False,
+        methods=["POST"],
+        url_path="init",
+        authentication_classes=[],
+        permission_classes=[],
+    )
+    @FeatureFlag.require("addons")
+    def init(self, request):
+        """Open a new add-on authentication session.
+
+        Creates a fresh session server-side and returns the credentials the
+        add-on needs to drive the rest of the flow.
+        """
+
+        transit_token, session_id, csrf_token = TokenExchangeService().init_session()
+
+        response = drf_response.Response(
+            {"transit_token": transit_token, "csrf_token": csrf_token},
+            status=drf_status.HTTP_201_CREATED,
+        )
+
+        # SameSite=None allows the cookie to be sent on cross-origin requests,
+        # which is required because the /poll endpoint is called from an iframe
+        # embedded in a third-party site. Secure=True is mandatory when SameSite=None.
+        # HttpOnly prevents JS access, so the cookie can only be read by the server.
+        response.set_cookie(
+            key=settings.ADDONS_SESSION_ID_COOKIE,
+            value=session_id,
+            max_age=settings.ADDONS_SESSION_TTL,
+            httponly=True,
+            secure=True,
+            samesite="None",
+        )
+
+        return response
+
+    @decorators.action(
+        detail=False,
+        methods=["POST"],
+        url_path="poll",
+        authentication_classes=[],
+        permission_classes=[],
+    )
+    @FeatureFlag.require("addons")
+    def poll(self, request):
+        """Poll a session for its current state and, if terminal, consume it.
+
+        Authenticates the caller using the addonsSid cookie (set by
+        /init) together with the X-CSRFToken header, which must match
+        the CSRF token issued for that session. The session id alone is not
+        sufficient — both must be presented and must correspond.
+
+        Behavior depends on the session's current state:
+
+        - **Pending**: the token exchange has not yet completed. Returns
+          202 Accepted with `{"state": "pending"}`. The cookie is preserved
+          so the add-on can keep polling.
+        - **Authenticated** (or any other terminal state): returns 200 OK
+          with the session payload (access token, token type, expiry, etc.)
+          and clears the `addonsSid` cookie. The session is also evicted
+          server-side on this terminal read, so the tokens can be retrieved
+          exactly once.
+
+        A CSRF mismatch is treated as a `SuspiciousOperation` rather than a
+        normal 4xx, so it is logged by Django's security middleware and
+        surfaced as a 400 without leaking which check failed.
+        """
+
+        session_id = request.COOKIES.get(settings.ADDONS_SESSION_ID_COOKIE)
+        submitted_csrf = request.headers.get("X-CSRFToken")
+
+        if not session_id:
+            return drf_response.Response(
+                {"detail": "Missing credentials."},
+                status=drf_status.HTTP_401_UNAUTHORIZED,
+            )
+
+        if not submitted_csrf:
+            return drf_response.Response(
+                {"detail": "Missing CSRF token."},
+                status=drf_status.HTTP_400_BAD_REQUEST,
+            )
+
+        service = TokenExchangeService()
+
+        try:
+            service.verify_csrf(session_id, submitted_csrf)
+        except CSRFTokenError as e:
+            raise SuspiciousOperation(str(e)) from e
+
+        try:
+            session = service.get_session(session_id)
+        except SessionNotFoundError:
+            return drf_response.Response(
+                {"detail": "Session not found."},
+                status=drf_status.HTTP_404_NOT_FOUND,
+            )
+        except SessionDataError:
+            return drf_response.Response(
+                {"detail": "Invalid or expired session."},
+                status=drf_status.HTTP_400_BAD_REQUEST,
+            )
+
+        if service.is_session_pending(session):
+            return drf_response.Response(
+                {"state": "pending"}, status=drf_status.HTTP_202_ACCEPTED
+            )
+
+        response = drf_response.Response(session, status=drf_status.HTTP_200_OK)
+        response.delete_cookie(
+            key=settings.ADDONS_SESSION_ID_COOKIE,
+            samesite="None",
+        )
+
+        return response
+
+    @decorators.action(
+        detail=False,
+        methods=["POST"],
+        url_path="exchange",
+        permission_classes=[IsAuthenticated],
+    )
+    @FeatureFlag.require("addons")
+    def exchange(self, request):
+        """Redeem a transit token for an access token bound to the current user.
+
+        Called from the post-OIDC callback page on our own domain. The transit
+        token was issued by /init, passed to the authentication dialog via
+        postMessage, stashed in sessionStorage, and read back by this page
+        after login completes.
+
+        The authenticated user (request.user) is whose access token gets stored
+        against the session. On success, the addon's next /poll will transition
+        from pending to authenticated and receive the token payload.
+
+        Transit tokens are single-use: a replayed token is rejected with 400.
+        """
+
+        transit_token = request.data.get("transit_token")
+        if not transit_token:
+            return drf_response.Response(
+                {"detail": "Missing transit_token."},
+                status=drf_status.HTTP_400_BAD_REQUEST,
+            )
+
+        service = TokenExchangeService()
+
+        try:
+            session_id = service.consume_transit_token(transit_token)
+        except TransitTokenError:
+            return drf_response.Response(
+                {"detail": "Invalid or expired transit token."},
+                status=drf_status.HTTP_400_BAD_REQUEST,
+            )
+
+        try:
+            service.set_access_token(request.user, session_id)
+        except SessionNotFoundError:
+            return drf_response.Response(
+                {"detail": "Session not found."},
+                status=drf_status.HTTP_404_NOT_FOUND,
+            )
+        except (SessionDataError, SessionExpiredError, SuspiciousSessionError):
+            return drf_response.Response(
+                {"detail": "Invalid or expired session."},
+                status=drf_status.HTTP_400_BAD_REQUEST,
+            )
+
+        return drf_response.Response({"status": "ok"}, status=drf_status.HTTP_200_OK)
@@ -14,6 +14,8 @@ class FeatureFlag:
        "storage_event": "RECORDING_STORAGE_EVENT_ENABLE",
        "subtitle": "ROOM_SUBTITLE_ENABLED",
        "file_upload": "FILE_UPLOAD_ENABLED",
+        "addons": "ADDONS_ENABLED",
+        "application": "APPLICATION_ENABLED",
    }

    @classmethod
@@ -232,11 +232,14 @@ class RecordingOptions(BaseModel):
            When `None`, falls back to the application default.
        original_mode: The original recording mode before any override.
            Must be one of the valid RecordingModeChoices values when provided.
+        collect_metadata: Whether to collect additional metadata during recording.
+            When `None`, no metadata are collected.

    """

    language: str | None = None
    transcribe: bool | None = None
+    collect_metadata: bool | None = None
    original_mode: Literal["screen_recording", "transcript"] | None = None

    model_config = {"extra": "forbid"}
@@ -303,6 +306,9 @@ class MuteParticipantSerializer(BaseParticipantsManagementSerializer):
    )


+TrackSource = Literal["SCREEN_SHARE", "SCREEN_SHARE_AUDIO", "CAMERA", "MICROPHONE"]
+
+
 class ParticipantPermission(BaseModel):
    """Mirror the LiveKit ParticipantPermission protobuf.

@@ -313,9 +319,7 @@ class ParticipantPermission(BaseModel):
    can_subscribe: bool | None = None
    can_publish: bool | None = None
    can_publish_data: bool | None = None
-    can_publish_sources: list[int] = Field(
-        default_factory=list
-    )  # TrackSource enum values
+    can_publish_sources: list[TrackSource] = Field(default_factory=list)
    hidden: bool | None = None
    recorder: bool | None = None
    can_update_metadata: bool | None = None
@@ -366,14 +370,6 @@ class UpdateParticipantSerializer(BaseParticipantsManagementSerializer):
                f"Setting the following participant permissions is not allowed: "
                f"{', '.join(suspicious_fields)}."
            )
-        if permission.can_subscribe_metrics is not None:
-            raise serializers.ValidationError(
-                {
-                    "permission": {
-                        "can_subscribe_metrics": "This permission is not implemented."
-                    }
-                }
-            )

        return permission

@@ -533,3 +529,15 @@ class CreateFileSerializer(ListFileSerializer):

    def update(self, instance, validated_data):
        raise NotImplementedError("Update method can not be used.")
+
+
+class RaiseHandSerializer(BaseValidationOnlySerializer):
+    """Serializer for raising or lowering a participant's hand in a room."""
+
+    raised = serializers.BooleanField()
+
+
+class RenameParticipantSerializer(BaseValidationOnlySerializer):
+    """Serializer for renaming a participant in a room."""
+
+    name = serializers.CharField(min_length=1, max_length=255, allow_blank=False)
@@ -10,6 +10,7 @@ from django.core.files.storage import default_storage
 from django.db.models import Q
 from django.http import Http404
 from django.shortcuts import get_object_or_404
+from django.utils import timezone
 from django.utils.text import slugify
 from django.utils.translation import gettext_lazy as _

@@ -44,6 +45,10 @@ from core.recording.event.exceptions import (
 )
 from core.recording.event.notification import notification_service
 from core.recording.event.parsers import get_parser
+from core.recording.services.metadata_collector import (
+    MetadataCollectorException,
+    MetadataCollectorService,
+)
 from core.recording.worker.exceptions import (
    RecordingStartError,
    RecordingStopError,
@@ -64,6 +69,7 @@ from core.services.lobby import (
    LobbyService,
 )
 from core.services.participants_management import (
+    ParticipantNotFoundException,
    ParticipantsManagement,
    ParticipantsManagementException,
 )
@@ -336,6 +342,14 @@ class RoomViewSet(
                status=drf_status.HTTP_500_INTERNAL_SERVER_ERROR,
            )

+        if settings.METADATA_COLLECTOR_ENABLED and (
+            recording.options.get("collect_metadata", False)
+        ):
+            try:
+                MetadataCollectorService().start(recording)
+            except MetadataCollectorException:
+                logger.warning("Failed to start MetadataCollectorService")
+
        return drf_response.Response(
            {"message": f"Recording successfully started for room {room.slug}"},
            status=drf_status.HTTP_201_CREATED,
@@ -598,6 +612,11 @@ class RoomViewSet(
                identity=str(serializer.validated_data["participant_identity"]),
                track_sid=serializer.validated_data["track_sid"],
            )
+        except ParticipantNotFoundException:
+            return drf_response.Response(
+                {"error": "Participant not found"},
+                status=drf_status.HTTP_404_NOT_FOUND,
+            )
        except ParticipantsManagementException:
            return drf_response.Response(
                {"error": "Failed to mute participant"},
@@ -636,6 +655,11 @@ class RoomViewSet(
                permission=permission.model_dump() if permission else None,
                name=serializer.validated_data.get("name"),
            )
+        except ParticipantNotFoundException:
+            return drf_response.Response(
+                {"error": "Participant not found"},
+                status=drf_status.HTTP_404_NOT_FOUND,
+            )
        except ParticipantsManagementException:
            return drf_response.Response(
                {"error": "Failed to update participant"},
@@ -668,6 +692,11 @@ class RoomViewSet(
                room_name=str(room.pk),
                identity=str(serializer.validated_data["participant_identity"]),
            )
+        except ParticipantNotFoundException:
+            return drf_response.Response(
+                {"error": "Participant not found"},
+                status=drf_status.HTTP_404_NOT_FOUND,
+            )
        except ParticipantsManagementException:
            return drf_response.Response(
                {"error": "Failed to remove participant"},
@@ -678,6 +707,92 @@ class RoomViewSet(
            {"status": "success"}, status=drf_status.HTTP_200_OK
        )

+    @decorators.action(
+        detail=True,
+        methods=["post"],
+        url_path="toggle-hand",
+        url_name="toggle-hand",
+        permission_classes=[permissions.HasLiveKitRoomAccess],
+        authentication_classes=[LiveKitTokenAuthentication],
+    )
+    def toggle_hand(self, request, pk=None):  # pylint: disable=unused-argument
+        """Raise or lower the current participant's hand in the room."""
+        room = self.get_object()
+
+        serializer = serializers.RaiseHandSerializer(data=request.data)
+        serializer.is_valid(raise_exception=True)
+
+        identity = request.auth.identity
+
+        # LiveKit uses the handRaisedAt participant attribute to signal hand state.
+        # An empty string means the hand is lowered; a non-empty ISO 8601 timestamp
+        # means the hand is raised. The timestamp is used by clients to determine
+        # the order in which participants raised their hands.
+        hand_raised_at = (
+            timezone.now().isoformat() if serializer.validated_data["raised"] else ""
+        )
+
+        try:
+            ParticipantsManagement().update(
+                room_name=str(room.pk),
+                identity=identity,
+                attributes={"handRaisedAt": hand_raised_at},
+            )
+        except ParticipantNotFoundException:
+            return drf_response.Response(
+                {"error": "Participant not found"},
+                status=drf_status.HTTP_404_NOT_FOUND,
+            )
+        except ParticipantsManagementException:
+            return drf_response.Response(
+                {"error": "Failed to update participant hand state"},
+                status=drf_status.HTTP_500_INTERNAL_SERVER_ERROR,
+            )
+
+        return drf_response.Response(
+            {"status": "success"},
+            status=drf_status.HTTP_200_OK,
+        )
+
+    @decorators.action(
+        detail=True,
+        methods=["post"],
+        url_path="rename",
+        url_name="rename",
+        permission_classes=[permissions.HasLiveKitRoomAccess],
+        authentication_classes=[LiveKitTokenAuthentication],
+    )
+    def rename(self, request, pk=None):  # pylint: disable=unused-argument
+        """Rename the current participant in the room."""
+        room = self.get_object()
+
+        serializer = serializers.RenameParticipantSerializer(data=request.data)
+        serializer.is_valid(raise_exception=True)
+
+        identity = request.auth.identity
+
+        try:
+            ParticipantsManagement().update(
+                room_name=str(room.pk),
+                identity=identity,
+                name=serializer.validated_data["name"],
+            )
+        except ParticipantNotFoundException:
+            return drf_response.Response(
+                {"error": "Participant not found"},
+                status=drf_status.HTTP_404_NOT_FOUND,
+            )
+        except ParticipantsManagementException:
+            return drf_response.Response(
+                {"error": "Failed to rename participant"},
+                status=drf_status.HTTP_500_INTERNAL_SERVER_ERROR,
+            )
+
+        return drf_response.Response(
+            {"status": "success"},
+            status=drf_status.HTTP_200_OK,
+        )
+

 class ResourceAccessViewSet(
    mixins.CreateModelMixin,
@@ -14,10 +14,19 @@ class LiveKitTokenAuthentication(authentication.BaseAuthentication):
    """Authenticate using LiveKit token and load the associated Django user."""

    def authenticate(self, request):
-        token = request.data.get("token")
-        if not token:
+        auth_header = request.headers.get("Authorization")
+
+        if not auth_header:
            return None  # No authentication attempted

+        parts = auth_header.split()
+        if len(parts) != 2 or parts[0].lower() != "bearer":
+            raise exceptions.AuthenticationFailed(
+                "Authorization header must be: Bearer <token>"
+            )
+
+        token = parts[1]
+
        try:
            verifier = TokenVerifier(
                api_key=settings.LIVEKIT_CONFIGURATION["api_key"],
@@ -23,7 +23,14 @@ class BaseJWTAuthentication(authentication.BaseAuthentication):
    """Base JWT authentication class."""

    def __init__(
-        self, secret_key, algorithm, issuer, audience, expiration_seconds, token_type
+        self,
+        secret_key,
+        algorithm,
+        issuer,
+        audience,
+        expiration_seconds,
+        token_type,
+        is_enabled,
    ):
        """Initialize the JWT authentication backend with the given token service configuration.

@@ -34,10 +41,17 @@ class BaseJWTAuthentication(authentication.BaseAuthentication):
            audience: Expected token audience identifier
            expiration_seconds: Token expiration time in seconds
            token_type: Token type (e.g. Bearer)
+            is_enabled: Whether this authentication backend is active
        """

        super().__init__()

+        self.is_enabled = is_enabled
+        self._token_service = None
+
+        if not self.is_enabled:
+            return
+
        self._token_service = jwt_token.JwtTokenService(
            secret_key=secret_key,
            algorithm=algorithm,
@@ -54,6 +68,9 @@ class BaseJWTAuthentication(authentication.BaseAuthentication):
            Tuple of (user, payload) if authentication successful, None otherwise
        """

+        if not self.is_enabled:
+            return None
+
        auth_header = authentication.get_authorization_header(request).split()

        if not auth_header or auth_header[0].lower() != b"bearer":
@@ -186,6 +203,7 @@ class ApplicationJWTAuthentication(BaseJWTAuthentication):
            audience=settings.APPLICATION_JWT_AUDIENCE,
            expiration_seconds=settings.APPLICATION_JWT_EXPIRATION_SECONDS,
            token_type=settings.APPLICATION_JWT_TOKEN_TYPE,
+            is_enabled=settings.APPLICATION_ENABLED,
        )

    def validate_payload(self, payload):
@@ -214,6 +232,26 @@ class ApplicationJWTAuthentication(BaseJWTAuthentication):
            raise exceptions.AuthenticationFailed("Invalid token type.")


+class AddonsJWTAuthentication(BaseJWTAuthentication):
+    """JWT authentication for addons API access.
+
+    Validates JWT tokens issued to addons.
+    """
+
+    def __init__(self):
+        """Initialize authentication backend with addons JWT settings from Django settings."""
+
+        super().__init__(
+            secret_key=settings.ADDONS_TOKEN_SECRET_KEY,
+            algorithm=settings.ADDONS_TOKEN_ALG,
+            issuer=settings.ADDONS_TOKEN_ISSUER,
+            audience=settings.ADDONS_TOKEN_AUDIENCE,
+            expiration_seconds=settings.ADDONS_TOKEN_TTL,
+            token_type=settings.ADDONS_TOKEN_TYPE,
+            is_enabled=settings.ADDONS_ENABLED,
+        )
+
+
 class ResourceServerBackend(LaSuiteBackend):
    """OIDC Resource Server backend for user creation and retrieval."""

@@ -20,6 +20,7 @@ from rest_framework import (
 )

 from core import api, models
+from core.api.feature_flag import FeatureFlag
 from core.services.jwt_token import JwtTokenService

 from . import authentication, permissions, serializers
@@ -36,6 +37,7 @@ class ApplicationViewSet(viewsets.ViewSet):
        url_path="token",
        url_name="token",
    )
+    @FeatureFlag.require("application")
    def generate_jwt_access_token(self, request, *args, **kwargs):
        """Generate JWT access token for application delegation.

@@ -173,6 +175,7 @@ class RoomViewSet(

    authentication_classes = [
        authentication.ApplicationJWTAuthentication,
+        authentication.AddonsJWTAuthentication,
        ResourceServerAuthentication,
    ]
    permission_classes = [
@@ -0,0 +1,91 @@
+"""Meeting metadata collection service."""
+
+from logging import getLogger
+
+from django.conf import settings
+
+from asgiref.sync import async_to_sync, sync_to_async
+from livekit.protocol.agent_dispatch import (
+    CreateAgentDispatchRequest,
+)
+
+from core import utils
+from core.models import Recording
+
+logger = getLogger(__name__)
+
+
+class MetadataCollectorException(Exception):
+    """Generic exception in the metadata collector."""
+
+
+class MetadataCollectorService:
+    """Service for dispatching and managing the metadata collector agent."""
+
+    @async_to_sync
+    async def start(self, recording: Recording):
+        """Explicitly dispatch the metadata collector agent to a room."""
+
+        lkapi = utils.create_livekit_client()
+        room_id = str(recording.room.id)
+
+        try:
+            response = await lkapi.agent_dispatch.create_dispatch(
+                CreateAgentDispatchRequest(
+                    agent_name=settings.METADATA_COLLECTOR_AGENT_NAME,
+                    room=room_id,
+                    metadata=str(recording.id),
+                )
+            )
+        except Exception as e:
+            logger.exception(
+                "Failed to create metadata collector agent for room %s", room_id
+            )
+            raise MetadataCollectorException(
+                "Failed to create metadata collector agent"
+            ) from e
+        finally:
+            await lkapi.aclose()
+
+        dispatch_id = getattr(response, "id", None)
+
+        if not dispatch_id:
+            logger.error("LiveKit response missing dispatch ID for room %s", room_id)
+            raise MetadataCollectorException(
+                f"LiveKit did not return a dispatch_id for room {room_id}"
+            )
+
+        recording.options["metadata_collector_dispatch_id"] = dispatch_id
+        await sync_to_async(recording.save)(update_fields=["options"])
+
+        return dispatch_id
+
+    @async_to_sync
+    async def stop(self, recording: Recording):
+        """Stop and delete the agent dispatch associated to the room."""
+
+        room_id = str(recording.room.id)
+        dispatch_id = recording.options.get("metadata_collector_dispatch_id")
+        lkapi = utils.create_livekit_client()
+
+        try:
+            if not dispatch_id:
+                logger.warning(
+                    "No metadata collector dispatch ID stored for room %s", room_id
+                )
+                return None
+
+            await lkapi.agent_dispatch.delete_dispatch(
+                dispatch_id=str(dispatch_id), room_name=room_id
+            )
+
+        except Exception as e:
+            logger.exception(
+                "Failed to stop metadata collector agent dispatch for room %s",
+                room_id,
+            )
+            raise MetadataCollectorException(
+                f"Failed to stop metadata collector agent for room {room_id}"
+            ) from e
+        finally:
+            await lkapi.aclose()
@@ -7,6 +7,7 @@ from logging import getLogger
 from livekit import api

 from core import models, utils
+from core.models import Recording

 logger = getLogger(__name__)

@@ -19,7 +20,7 @@ class RecordingEventsService:
    """Handles recording-related LiveKit webhook events."""

    @staticmethod
-    def handle_update(recording, egress_status):
+    def handle_update(recording: Recording, egress_status):
        """Handle egress status updates and sync recording state to room metadata."""

        room_name = str(recording.room.id)
@@ -40,7 +41,7 @@ class RecordingEventsService:
                logger.exception("Failed to update room's metadata: %s", e)

    @staticmethod
-    def handle_limit_reached(recording):
+    def handle_limit_reached(recording: Recording):
        """Stop recording and notify participants when limit is reached."""

        recording.status = models.RecordingStatusChoices.STOPPED
@@ -4,7 +4,7 @@ import smtplib
 from logging import getLogger

 from django.conf import settings
-from django.core.mail import send_mail
+from django.core.mail import EmailMultiAlternatives
 from django.template.loader import render_to_string
 from django.utils.translation import get_language, override
 from django.utils.translation import gettext_lazy as _
@@ -45,15 +45,18 @@ class InvitationService:
                )
            )  # Force translation

+            email = EmailMultiAlternatives(
+                subject=subject,
+                body=msg_plain,
+                from_email=settings.EMAIL_FROM,
+                to=[],
+                bcc=emails,
+            )
+
+            email.attach_alternative(msg_html, "text/html")
+
            try:
-                send_mail(
-                    subject,
-                    msg_plain,
-                    settings.EMAIL_FROM,
-                    emails,
-                    html_message=msg_html,
-                    fail_silently=False,
-                )
+                email.send()
            except smtplib.SMTPException as e:
-                logger.error("invitation to %s was not sent: %s", emails, e)
+                logger.error("invitations were not sent: %s", e)
                raise InvitationError("Could not send invitation") from e
@@ -12,6 +12,10 @@ from django.conf import settings
 from livekit import api

 from core import models, utils
+from core.recording.services.metadata_collector import (
+    MetadataCollectorException,
+    MetadataCollectorService,
+)
 from core.recording.services.recording_events import (
    RecordingEventsError,
    RecordingEventsService,
@@ -158,7 +162,7 @@ class LiveKitEventsService:
        """Handle 'egress_ended' event."""

        try:
-            recording = models.Recording.objects.get(
+            recording = models.Recording.objects.select_related("room").get(
                worker_id=data.egress_info.egress_id
            )
        except models.Recording.DoesNotExist as err:
@@ -174,6 +178,12 @@ class LiveKitEventsService:
        except utils.MetadataUpdateException as e:
            logger.exception("Failed to update room's metadata: %s", e)

+        if recording.options.get("metadata_collector_dispatch_id", None) is not None:
+            try:
+                MetadataCollectorService().stop(recording)
+            except MetadataCollectorException:
+                logger.warning("Failed to stop the MetadataCollectorService")
+
        if (
            data.egress_info.status == api.EgressStatus.EGRESS_LIMIT_REACHED
            and recording.status == models.RecordingStatusChoices.ACTIVE
@@ -27,6 +27,10 @@ class ParticipantsManagementException(Exception):
    """Exception raised when a participant management operations fail."""


+class ParticipantNotFoundException(ParticipantsManagementException):
+    """Raised when the target participant does not exist in the room."""
+
+
 class ParticipantsManagement:
    """Service for managing participants."""

@@ -47,6 +51,14 @@ class ParticipantsManagement:
            )

        except TwirpError as e:
+            if e.code == "not_found":
+                logger.warning(
+                    "Participant %s not found in room %s, skipping muting",
+                    identity,
+                    room_name,
+                )
+                raise ParticipantNotFoundException("Participant does not exist") from e
+
            logger.exception(
                "Unexpected error muting participant %s for room %s",
                identity,
@@ -80,6 +92,14 @@ class ParticipantsManagement:
                RoomParticipantIdentity(room=room_name, identity=identity)
            )
        except TwirpError as e:
+            if e.code == "not_found":
+                logger.warning(
+                    "Participant %s not found in room %s, skipping removing",
+                    identity,
+                    room_name,
+                )
+                raise ParticipantNotFoundException("Participant does not exist") from e
+
            logger.exception(
                "Unexpected error removing participant %s for room %s",
                identity,
@@ -117,6 +137,14 @@ class ParticipantsManagement:
            )

        except TwirpError as e:
+            if e.code == "not_found":
+                logger.warning(
+                    "Participant %s not found in room %s, skipping update",
+                    identity,
+                    room_name,
+                )
+                raise ParticipantNotFoundException("Participant does not exist") from e
+
            logger.exception(
                "Unexpected error updating participant %s for room %s",
                identity,
@@ -0,0 +1,601 @@
+"""
+Tests for add-ons API /sessions/init and /sessions/poll endpoints
+"""
+
+# pylint: disable=redefined-outer-name,unused-argument
+
+import re
+from unittest.mock import patch
+
+import pytest
+from rest_framework.test import APIClient
+
+from core.addons.service import (
+    SessionDataError,
+    SessionExpiredError,
+    SessionNotFoundError,
+    SuspiciousSessionError,
+    TokenExchangeService,
+)
+from core.factories import UserFactory
+
+pytestmark = pytest.mark.django_db
+
+
+# ================================
+# endpoint /addons/sessions/init/
+# ================================
+
+
+def test_init_feature_flag_disabled(client, settings):
+    """Should return 404 on POST when feature is disabled."""
+    settings.ADDONS_ENABLED = False
+
+    response = client.post("/api/v1.0/addons/sessions/init/")
+    assert response.status_code == 404
+
+
+def test_init_only_accepts_post():
+    """Should return 201 JSON with only transit_token and csrf_token."""
+
+    response = APIClient().post("/api/v1.0/addons/sessions/init/")
+
+    assert response.status_code == 201
+    assert response["Content-Type"] == "application/json"
+
+    response_data = response.json()
+    # session_id must only be delivered via cookie, not in the same channel as csrf_token.
+    assert set(response_data.keys()) == {"transit_token", "csrf_token"}
+
+    transit_token = response_data["transit_token"]
+
+    # URL-safe base64 alphabet: A-Z, a-z, 0-9, -, _
+    assert re.match(r"^[A-Za-z0-9_-]+$", transit_token)
+
+    csrf_token = response_data["csrf_token"]
+    # HMAC-SHA256 → 64-character hex string.
+    assert re.match(r"^[a-f0-9]{64}$", csrf_token)
+
+    assert csrf_token != transit_token
+
+
+def test_init_rejects_non_post_methods():
+    """Should return 405 Method Not Allowed on GET."""
+    response = APIClient().get("/api/v1.0/addons/sessions/init/")
+    assert response.status_code == 405
+
+
+def test_init_generates_unique_tokens_across_calls():
+    """Should generate a distinct transit_token and csrf_token for every call."""
+
+    api_client = APIClient()
+
+    tokens = set()
+    csrf_tokens = set()
+
+    for _ in range(5):
+        response = api_client.post("/api/v1.0/addons/sessions/init/")
+        tokens.add(response.json()["transit_token"])
+        csrf_tokens.add(response.json()["csrf_token"])
+
+    assert len(tokens) == 5
+    assert len(csrf_tokens) == 5
+
+
+def test_init_cookie_authorizes_subsequent_poll():
+    """Should issue a session cookie that, with the returned csrf_token, authorizes /poll."""
+    api_client = APIClient()
+
+    init_response = api_client.post("/api/v1.0/addons/sessions/init/")
+    assert init_response.status_code == 201
+
+    assert "addonsSid" in init_response.cookies
+
+    csrf_token = init_response.json()["csrf_token"]
+
+    poll_response = api_client.post(
+        "/api/v1.0/addons/sessions/poll/",
+        HTTP_X_CSRFTOKEN=csrf_token,
+    )
+
+    assert poll_response.status_code == 202
+    assert poll_response.json() == {"state": "pending"}
+
+
+def test_init_session_id_cookie_attributes(settings):
+    """Should set the session cookie with the security attributes required for iframe embedding."""
+    response = APIClient().post("/api/v1.0/addons/sessions/init/")
+
+    cookies = response.cookies
+    assert list(cookies) == ["addonsSid"]  # only this cookie
+
+    cookie = cookies["addonsSid"]
+    assert re.match(r"^[A-Za-z0-9_-]+$", cookie.value), "URL-safe base64 expected"
+    assert cookie["httponly"] is True, (
+        "HttpOnly required — cookie must not be JS-readable"
+    )
+    assert cookie["secure"] is True, (
+        "Secure required — cookie must not travel over HTTP"
+    )
+    assert cookie["samesite"] == "None", (
+        "SameSite=None required for cross-origin iframe"
+    )
+    assert cookie["max-age"] == settings.ADDONS_SESSION_TTL
+
+
+def test_init_session_id_cookie_respects_configured_name(settings):
+    """Should name the session cookie according to the ADDONS_SESSION_ID_COOKIE setting."""
+    api_client = APIClient()
+
+    settings.ADDONS_SESSION_ID_COOKIE = "mockSessionSid"
+
+    response = api_client.post("/api/v1.0/addons/sessions/init/")
+    assert "mockSessionSid" in response.cookies
+    assert response.cookies.get("mockSessionSid") is not None
+
+
+# =================================
+# endpoint /addons/sessions/poll/
+# =================================
+
+
+def test_poll_feature_flag_disabled(client, settings):
+    """Should return 404 on POST when feature is disabled."""
+    settings.ADDONS_ENABLED = False
+
+    response = client.post("/api/v1.0/addons/sessions/poll/")
+    assert response.status_code == 404
+
+
+def test_poll_rejects_missing_csrf_token():
+    """Should reject requests that carry the sessionSid cookie but omit the CSRF header."""
+    api_client = APIClient()
+
+    init_response = api_client.post("/api/v1.0/addons/sessions/init/")
+    assert init_response.status_code == 201
+
+    # X-CSRF-Token is deliberately omitted
+    poll_response = api_client.post("/api/v1.0/addons/sessions/poll/")
+
+    assert poll_response.status_code == 400
+    assert poll_response.json() == {"detail": "Missing CSRF token."}
+
+
+def test_poll_missing_cookie():
+    """Should return 401 when no sessionSid cookie is present."""
+    api_client = APIClient()
+
+    poll_response = api_client.post("/api/v1.0/addons/sessions/poll/")
+
+    assert poll_response.status_code == 401
+    assert poll_response.json() == {"detail": "Missing credentials."}
+
+
+def test_poll_rejects_invalid_csrf_token():
+    """Should reject requests carrying an invalid CSRF token."""
+    api_client = APIClient()
+
+    init_response = api_client.post("/api/v1.0/addons/sessions/init/")
+    assert init_response.status_code == 201
+
+    poll_response = api_client.post(
+        "/api/v1.0/addons/sessions/poll/",
+        HTTP_X_CSRFTOKEN="invalid-csrf-token",
+    )
+
+    # SuspiciousOperation translates to 400 via Django's exception middleware.
+    assert poll_response.status_code == 400
+
+
+@patch(
+    "core.addons.service.TokenExchangeService._get_session_data",
+    side_effect=SessionNotFoundError("Session not found."),
+)
+def test_poll_session_not_found(mock_get_session_data):
+    """Should return 404 when the session is not found."""
+    api_client = APIClient()
+
+    init_response = api_client.post("/api/v1.0/addons/sessions/init/")
+    assert init_response.status_code == 201
+
+    csrf_token = init_response.json()["csrf_token"]
+
+    poll_response = api_client.post(
+        "/api/v1.0/addons/sessions/poll/",
+        HTTP_X_CSRFTOKEN=csrf_token,
+    )
+
+    assert poll_response.status_code == 404
+    assert poll_response.json() == {"detail": "Session not found."}
+
+
+@patch(
+    "core.addons.service.TokenExchangeService._get_session_data",
+    side_effect=SessionDataError("Session corrupted."),
+)
+def test_poll_session_corrupted(mock_get_session_data):
+    """Should return 400 when the session is corrupted."""
+    api_client = APIClient()
+
+    init_response = api_client.post("/api/v1.0/addons/sessions/init/")
+    assert init_response.status_code == 201
+
+    csrf_token = init_response.json()["csrf_token"]
+
+    poll_response = api_client.post(
+        "/api/v1.0/addons/sessions/poll/",
+        HTTP_X_CSRFTOKEN=csrf_token,
+    )
+
+    assert poll_response.status_code == 400
+    assert poll_response.json() == {"detail": "Invalid or expired session."}
+
+
+def test_poll_session_authenticated():
+    """Should return tokens and tears down the polling channel when authenticated."""
+    api_client = APIClient()
+
+    init_response = api_client.post("/api/v1.0/addons/sessions/init/")
+    assert init_response.status_code == 201
+
+    session_id_cookie = init_response.cookies["addonsSid"]
+    csrf_token = init_response.json()["csrf_token"]
+    transit_token = init_response.json()["transit_token"]
+
+    # Simulate Authentication done in the opened dialog
+    service = TokenExchangeService()
+    service.consume_transit_token(transit_token)
+    service.set_access_token(UserFactory(), session_id_cookie.value)
+
+    poll_response = api_client.post(
+        "/api/v1.0/addons/sessions/poll/",
+        HTTP_X_CSRFTOKEN=csrf_token,
+    )
+
+    assert poll_response.status_code == 200
+    response_data = poll_response.json()
+    access_token = response_data.pop("access_token")
+    assert isinstance(access_token, str) and access_token  # non-empty string
+    assert response_data == {
+        "expires_in": 7200,
+        "scope": "rooms:create",
+        "state": "authenticated",
+        "token_type": "Bearer",
+    }
+
+    # Verify the server cleared the addonsSid cookie
+    cleared_cookie = poll_response.cookies["addonsSid"]
+    assert cleared_cookie.value == ""
+    assert cleared_cookie["max-age"] == 0
+
+    # Server cleared the addonsSid cookie; APIClient drops it → no credentials.
+    poll_response = api_client.post(
+        "/api/v1.0/addons/sessions/poll/",
+        HTTP_X_CSRFTOKEN=csrf_token,
+    )
+    assert poll_response.status_code == 401
+
+    # Replay the original addonsSid: session was evicted on terminal read.
+    api_client.cookies["addonsSid"] = session_id_cookie.value
+    poll_response = api_client.post(
+        "/api/v1.0/addons/sessions/poll/",
+        HTTP_X_CSRFTOKEN=csrf_token,
+    )
+    assert poll_response.status_code == 404
+    assert poll_response.json() == {"detail": "Session not found."}
+
+
+def test_poll_two_clients_do_not_interfere():
+    """Two clients poll independently; CSRF tokens are bound to their own session."""
+    client_a = APIClient()
+    client_b = APIClient()
+
+    init_a = client_a.post("/api/v1.0/addons/sessions/init/")
+    init_b = client_b.post("/api/v1.0/addons/sessions/init/")
+    assert init_a.status_code == 201
+    assert init_b.status_code == 201
+
+    csrf_a = init_a.json()["csrf_token"]
+    csrf_b = init_b.json()["csrf_token"]
+    poll_id_a = init_a.cookies["addonsSid"].value
+    poll_id_b = init_b.cookies["addonsSid"].value
+
+    # Sessions must be distinct.
+    assert csrf_a != csrf_b
+    assert poll_id_a != poll_id_b
+
+    # Each client polls its own session.
+    poll_a = client_a.post(
+        "/api/v1.0/addons/sessions/poll/",
+        HTTP_X_CSRFTOKEN=csrf_a,
+    )
+    poll_b = client_b.post(
+        "/api/v1.0/addons/sessions/poll/",
+        HTTP_X_CSRFTOKEN=csrf_b,
+    )
+    assert poll_a.status_code == 202
+    assert poll_b.status_code == 202
+
+    # Cross-use (A's cookie + B's CSRF) must be rejected.
+    cross_response = client_a.post(
+        "/api/v1.0/addons/sessions/poll/",
+        HTTP_X_CSRFTOKEN=csrf_b,
+    )
+    assert cross_response.status_code == 400
+
+    # A's session transitioning to authenticated must not affect B.
+    with patch(
+        "core.addons.service.TokenExchangeService._get_session_data",
+        return_value={
+            "state": "authenticated",
+            "expires_at": "foo",
+            "access_token": "mock-token",
+            "token_type": "Bearer",
+            "expires_in": 100,
+        },
+    ):
+        poll_a = client_a.post(
+            "/api/v1.0/addons/sessions/poll/",
+            HTTP_X_CSRFTOKEN=csrf_a,
+        )
+        assert poll_a.status_code == 200
+
+    poll_b = client_b.post(
+        "/api/v1.0/addons/sessions/poll/",
+        HTTP_X_CSRFTOKEN=csrf_b,
+    )
+    assert poll_b.status_code == 202
+
+
+def test_poll_csrf_attack_does_not_disrupt_legitimate_client():
+    """CSRF attack using the pollId cookie must fail without burning the session."""
+    legitimate = APIClient()
+
+    init_response = legitimate.post("/api/v1.0/addons/sessions/init/")
+    assert init_response.status_code == 201
+
+    csrf_token = init_response.json()["csrf_token"]
+    session_id_value = init_response.cookies["addonsSid"].value
+
+    # Attacker has the cookie (SameSite=None) but not the CSRF token.
+    attacker = APIClient()
+    attacker.cookies["addonsSid"] = session_id_value
+
+    # No CSRF header
+    attack_no_csrf = attacker.post("/api/v1.0/addons/sessions/poll/")
+    assert attack_no_csrf.status_code == 400
+    assert attack_no_csrf.json() == {"detail": "Missing CSRF token."}
+
+    # Fabricated CSRF token
+    attack_bad_csrf = attacker.post(
+        "/api/v1.0/addons/sessions/poll/",
+        HTTP_X_CSRFTOKEN="attacker-guessed-token",
+    )
+    assert attack_bad_csrf.status_code == 400
+
+    # Legitimate client's session is still usable.
+    legitimate_poll = legitimate.post(
+        "/api/v1.0/addons/sessions/poll/",
+        HTTP_X_CSRFTOKEN=csrf_token,
+    )
+    assert legitimate_poll.status_code == 202
+    assert legitimate_poll.json() == {"state": "pending"}
+
+
+# =====================================
+# endpoint /addons/sessions/exchange/
+# =====================================
+
+
+def test_exchange_feature_flag_disabled(settings):
+    """Should return 404 on POST when feature is disabled."""
+    settings.ADDONS_ENABLED = False
+
+    api_client = APIClient()
+    api_client.force_authenticate(user=UserFactory())
+
+    response = api_client.post("/api/v1.0/addons/sessions/exchange/")
+    assert response.status_code == 404
+
+
+def test_exchange_requires_authentication():
+    """Should return 401 when the caller is not authenticated."""
+    api_client = APIClient()
+
+    response = api_client.post(
+        "/api/v1.0/addons/sessions/exchange/",
+        {"transit_token": "irrelevant"},
+        format="json",
+    )
+
+    assert response.status_code == 401
+
+
+def test_exchange_rejects_missing_transit_token():
+    """Should return 400 when the request body has no transit_token."""
+    api_client = APIClient()
+    api_client.force_authenticate(user=UserFactory())
+
+    response = api_client.post(
+        "/api/v1.0/addons/sessions/exchange/",
+        {},
+        format="json",
+    )
+
+    assert response.status_code == 400
+    assert response.json() == {"detail": "Missing transit_token."}
+
+
+def test_exchange_rejects_empty_transit_token():
+    """Should return 400 when transit_token is present but empty."""
+    api_client = APIClient()
+    api_client.force_authenticate(user=UserFactory())
+
+    response = api_client.post(
+        "/api/v1.0/addons/sessions/exchange/",
+        {"transit_token": ""},
+        format="json",
+    )
+
+    assert response.status_code == 400
+    assert response.json() == {"detail": "Missing transit_token."}
+
+
+def test_exchange_rejects_invalid_transit_token():
+    """Should return 400 when the transit token is unknown or malformed."""
+    api_client = APIClient()
+    api_client.force_authenticate(user=UserFactory())
+
+    response = api_client.post(
+        "/api/v1.0/addons/sessions/exchange/",
+        {"transit_token": "not-a-real-transit-token"},
+        format="json",
+    )
+
+    assert response.status_code == 400
+    assert response.json() == {"detail": "Invalid or expired transit token."}
+
+
+def test_exchange_rejects_replayed_transit_token():
+    """Should return 400 when a transit token is reused after being consumed."""
+    init_client = APIClient()
+    init_response = init_client.post("/api/v1.0/addons/sessions/init/")
+    assert init_response.status_code == 201
+    transit_token = init_response.json()["transit_token"]
+
+    auth_client = APIClient()
+    auth_client.force_authenticate(user=UserFactory())
+
+    first = auth_client.post(
+        "/api/v1.0/addons/sessions/exchange/",
+        {"transit_token": transit_token},
+        format="json",
+    )
+    assert first.status_code == 200
+
+    second = auth_client.post(
+        "/api/v1.0/addons/sessions/exchange/",
+        {"transit_token": transit_token},
+        format="json",
+    )
+    assert second.status_code == 400
+    assert second.json() == {"detail": "Invalid or expired transit token."}
+
+
+def test_exchange_success_enables_poll_to_complete():
+    """Should bind tokens to the session so the polling completes."""
+    # 1. Taskpane opens a session.
+    taskpane = APIClient()
+    init_response = taskpane.post("/api/v1.0/addons/sessions/init/")
+    assert init_response.status_code == 201
+
+    transit_token = init_response.json()["transit_token"]
+    csrf_token = init_response.json()["csrf_token"]
+
+    # 2. Dialog completes OIDC; post-login page (authenticated, separate
+    # client — no addonsSid cookie) calls /exchange with the transit token.
+    dialog = APIClient()
+    dialog.force_authenticate(user=UserFactory())
+
+    exchange_response = dialog.post(
+        "/api/v1.0/addons/sessions/exchange/",
+        {"transit_token": transit_token},
+        format="json",
+    )
+    assert exchange_response.status_code == 200
+    assert exchange_response.json() == {"status": "ok"}
+
+    # 3. Taskpane's next poll transitions from pending → authenticated.
+    poll_response = taskpane.post(
+        "/api/v1.0/addons/sessions/poll/",
+        HTTP_X_CSRFTOKEN=csrf_token,
+    )
+    assert poll_response.status_code == 200
+    response_data = poll_response.json()
+    assert response_data["state"] == "authenticated"
+    assert response_data["token_type"] == "Bearer"
+    assert isinstance(response_data["access_token"], str)
+    assert response_data["access_token"]
+
+
+@patch(
+    "core.addons.service.TokenExchangeService.set_access_token",
+    side_effect=SessionNotFoundError("Session not found."),
+)
+def test_exchange_returns_when_session_missing(mock_set_access_token):
+    """Should return 404 when the session bound to the transit token is gone."""
+    init_response = APIClient().post("/api/v1.0/addons/sessions/init/")
+    transit_token = init_response.json()["transit_token"]
+
+    auth_client = APIClient()
+    auth_client.force_authenticate(user=UserFactory())
+
+    response = auth_client.post(
+        "/api/v1.0/addons/sessions/exchange/",
+        {"transit_token": transit_token},
+        format="json",
+    )
+
+    assert response.status_code == 404
+    assert response.json() == {"detail": "Session not found."}
+
+
+@pytest.mark.parametrize(
+    "service_error",
+    [SessionDataError, SessionExpiredError, SuspiciousSessionError],
+)
+def test_exchange_on_invalid_session(service_error):
+    """Should return 400 on malformed, expired, or suspicious sessions."""
+    init_response = APIClient().post("/api/v1.0/addons/sessions/init/")
+    transit_token = init_response.json()["transit_token"]
+
+    auth_client = APIClient()
+    auth_client.force_authenticate(user=UserFactory())
+
+    with patch(
+        "core.addons.service.TokenExchangeService.set_access_token",
+        side_effect=service_error("boom"),
+    ):
+        response = auth_client.post(
+            "/api/v1.0/addons/sessions/exchange/",
+            {"transit_token": transit_token},
+            format="json",
+        )
+
+    assert response.status_code == 400
+    assert response.json() == {"detail": "Invalid or expired session."}
+
+
+def test_exchange_rejects_non_post_methods():
+    """Should return 405 Method Not Allowed on non-POST verbs."""
+    api_client = APIClient()
+    api_client.force_authenticate(user=UserFactory())
+
+    for method in ("get", "put", "patch", "delete"):
+        response = getattr(api_client, method)("/api/v1.0/addons/sessions/exchange/")
+        assert response.status_code == 405, f"{method.upper()} should be rejected"
+
+
+def test_exchange_binds_to_authenticated_user():
+    """Should pass the authenticated user to set_access_token."""
+    init_response = APIClient().post("/api/v1.0/addons/sessions/init/")
+    transit_token = init_response.json()["transit_token"]
+
+    expected_user = UserFactory()
+    auth_client = APIClient()
+    auth_client.force_authenticate(user=expected_user)
+
+    with patch(
+        "core.addons.service.TokenExchangeService.set_access_token",
+        return_value=None,
+    ) as mock_set:
+        response = auth_client.post(
+            "/api/v1.0/addons/sessions/exchange/",
+            {"transit_token": transit_token},
+            format="json",
+        )
+
+    assert response.status_code == 200
+    mock_set.assert_called_once()
+    called_user, _called_session_id = mock_set.call_args.args
+    assert called_user == expected_user
@@ -0,0 +1,586 @@
+"""
+Unit tests for TokenExchangeService.
+"""
+
+# pylint: disable=redefined-outer-name,unused-argument,protected-access
+
+from django.core.cache import cache
+from django.core.exceptions import ImproperlyConfigured
+
+import pytest
+
+from core.addons.service import (
+    _PUBLIC_SESSION_FIELDS,
+    CSRFTokenError,
+    SessionDataError,
+    SessionExpiredError,
+    SessionNotFoundError,
+    SessionState,
+    SuspiciousSessionError,
+    TokenExchangeService,
+    TransitTokenError,
+    TransitTokenState,
+)
+
+from ...factories import UserFactory
+
+pytestmark = pytest.mark.django_db
+
+
+@pytest.fixture
+def service():
+    """Fresh service instance per test."""
+    return TokenExchangeService()
+
+
+# ==============================
+# init
+# ==============================
+
+
+def test_init_service_improperly_configured_secret_token(settings):
+    """Should raise ImproperlyConfigured when ADDONS_TOKEN_SECRET_KEY is unset."""
+
+    settings.ADDONS_TOKEN_SECRET_KEY = None
+
+    with pytest.raises(ImproperlyConfigured, match="Secret key is required."):
+        TokenExchangeService()
+
+
+def test_init_service_improperly_configured_token_scope(settings):
+    """Should raise ImproperlyConfigured when ADDONS_TOKEN_SCOPE is empty."""
+
+    settings.ADDONS_TOKEN_SCOPE = None
+
+    with pytest.raises(ImproperlyConfigured, match="Token scope must be defined."):
+        TokenExchangeService()
+
+
+def test_init_service_raises_when_csrf_secret_missing(settings):
+    """Should raise ImproperlyConfigured when ADDONS_CSRF_SECRET is unset."""
+    settings.ADDONS_CSRF_SECRET = None
+
+    with pytest.raises(ImproperlyConfigured, match="CSRF Secret is required."):
+        TokenExchangeService()
+
+
+# ==============================
+# init_session
+# ==============================
+
+
+def test_init_session_returns_three_distinct_tokens(service):
+    """Should return (transit_token, session_id, csrf_token), all distinct and non-empty."""
+    transit_token, session_id, csrf_token = service.init_session()
+
+    assert transit_token
+    assert session_id
+    assert csrf_token
+    assert len({transit_token, session_id, csrf_token}) == 3
+
+
+def test_init_session_starts_in_pending_state(service):
+    """Should return a pending initialized session."""
+    transit_token, session_id, _ = service.init_session()
+
+    session_data = cache.get(f"addons_sid_{session_id}")
+
+    assert session_data["state"] == SessionState.PENDING
+    assert "access_token" not in session_data
+
+    transit_data = cache.get(f"addons_transit_{transit_token}")
+
+    # Transit token should be bind to the same session
+    assert transit_data.get("session_id") == session_id
+    assert transit_data.get("state") == TransitTokenState.PENDING
+
+
+def test_init_session_bind_transit_token_with_session(service):
+    """Should bind transit_token with the initialized session."""
+    transit_token, session_id, _ = service.init_session()
+
+    transit_data = cache.get(f"addons_transit_{transit_token}")
+
+    assert transit_data.get("session_id") == session_id
+    assert transit_data.get("state") == TransitTokenState.PENDING
+
+
+def test_init_session_creates_independent_cache_entries(service):
+    """Should write to distinct cache keys when called multiple times."""
+    transit_a, session_id_a, csrf_a = service.init_session()
+    transit_b, session_id_b, csrf_b = service.init_session()
+
+    assert transit_a != transit_b
+    assert session_id_a != session_id_b
+    assert csrf_a != csrf_b
+
+
+def test_init_session_csrf_token_is_derived_from_session_id(service, settings):
+    """Should derive the csrf_token as HMAC(session_id, ADDONS_CSRF_SECRET)."""
+    _, session_id, csrf_token = service.init_session()
+
+    # Same inputs, same output: derivation is pure.
+    assert csrf_token == service._derive_csrf_token(session_id)
+    assert csrf_token == service._derive_csrf_token(
+        session_id
+    )  # deterministic across calls
+
+    assert len(csrf_token) == 64
+    assert all(c in "0123456789abcdef" for c in csrf_token)
+
+    # CSRF token is bound to the secret: rotating it invalidates outstanding tokens.
+    settings.ADDONS_CSRF_SECRET = "another-secret-entirely"
+    assert csrf_token != service._derive_csrf_token(session_id)
+
+    # CSRF token is bound to the session_id: same secret, different session ≠ same token.
+    settings.ADDONS_CSRF_SECRET = "secret-key-padded-for-minimum-len!-addons"  # restore
+    _, other_session_id, _ = service.init_session()
+    assert service._derive_csrf_token(session_id) != service._derive_csrf_token(
+        other_session_id
+    )
+
+
+def test_init_session_tokens_have_sufficient_entropy(service):
+    """Should be long enough by default that collision is negligible."""
+    transit_token, session_id, csrf_token = service.init_session()
+
+    assert len(transit_token) >= 40
+    assert len(session_id) >= 40
+    assert len(csrf_token) == 64
+
+
+def test_init_session_respects_configured_ttls(service, settings):
+    """Should respect their respective TTL configured through settings."""
+
+    transit_token, session_id, _ = service.init_session()
+
+    session_a_ttl = cache.ttl(f"addons_sid_{session_id}")
+    transit_a_ttl = cache.ttl(f"addons_transit_{transit_token}")
+
+    # By default, transit token has a shorter TTL
+    assert transit_a_ttl < session_a_ttl
+
+    settings.ADDONS_SESSION_TTL = 3000
+    settings.ADDONS_TRANSIT_TOKEN_TTL = 60
+
+    transit_token_b, session_id_b, _ = service.init_session()
+
+    session_b_ttl = cache.ttl(f"addons_sid_{session_id_b}")
+    transit_b_ttl = cache.ttl(f"addons_transit_{transit_token_b}")
+
+    assert abs(session_b_ttl - 3000) <= 2
+    assert abs(transit_b_ttl - 60) <= 2
+
+
+# ==============================
+# verify_csrf
+# ==============================
+
+
+def test_verify_csrf_accepts_matching_token(service):
+    """Should verify against its session_id."""
+    _, session_id, csrf_token = service.init_session()
+
+    assert service.verify_csrf(session_id, csrf_token) is None
+
+
+def test_verify_csrf_is_deterministic_for_same_session(service):
+    """Should yield the same token when deriving CSRF twice."""
+    _, session_id, csrf_token = service.init_session()
+
+    # Verify once, then verify again, both must succeed because
+    # _derive_csrf_token is a pure function of session_id + secret.
+    # without raising exceptions;
+    assert service.verify_csrf(session_id, csrf_token) is None
+    assert service.verify_csrf(session_id, csrf_token) is None
+
+
+def test_verify_csrf_rejects_after_secret_rotation(service, settings):
+    """Should invalidate tokens issued under the old secret when ADDONS_CSRF_SECRET was rotated."""
+    _, session_id, csrf_token = service.init_session()
+
+    # Rotate the secret
+    settings.ADDONS_CSRF_SECRET = "different-secret-entirely"
+
+    with pytest.raises(CSRFTokenError, match="Invalid CSRF token."):
+        service.verify_csrf(session_id, csrf_token)
+
+
+def test_verify_csrf_rejects_foreign_token(service):
+    """Should reject against another csrf_token."""
+    _, session_id_a, _ = service.init_session()
+    _, _, csrf_b = service.init_session()
+
+    with pytest.raises(CSRFTokenError, match="Invalid CSRF token."):
+        service.verify_csrf(session_id_a, csrf_b)
+
+
+def test_verify_csrf_rejects_random_token(service):
+    """Should reject against a random csrf_token."""
+    _, session_id_a, _ = service.init_session()
+
+    with pytest.raises(CSRFTokenError, match="Invalid CSRF token."):
+        service.verify_csrf(session_id_a, "wrong-csrf-value")
+
+
+def test_verify_csrf_rejects_empty_token(service):
+    """Should reject against an empty csrf_token."""
+    _, session_id_a, _ = service.init_session()
+
+    with pytest.raises(CSRFTokenError, match="Invalid CSRF token."):
+        service.verify_csrf(session_id_a, "")
+
+
+def test_verify_csrf_is_case_sensitive(service):
+    """Should be case-sensitive (HMAC output is lowercase hex)."""
+    _, session_id, csrf_token = service.init_session()
+
+    with pytest.raises(CSRFTokenError, match="Invalid CSRF token."):
+        service.verify_csrf(session_id, csrf_token.upper())
+
+
+# ==============================
+# get_session
+# ==============================
+
+
+def test_get_session_raises_when_missing(service):
+    """Should raise SessionNotFoundError for an unknown session_id."""
+    with pytest.raises(SessionNotFoundError, match="Session not found."):
+        service.get_session("nonexistent-session-id")
+
+
+def test_get_session_authenticated_returns_token_then_evicts(service):
+    """Should return tokens once and evict session when authenticated."""
+
+    user = UserFactory()
+    transit_token_a, session_id_a, _ = service.init_session()
+    _, session_id_b, _ = service.init_session()
+
+    # Authenticate the session
+    service.consume_transit_token(transit_token_a)
+    service.set_access_token(user, session_id_a)
+
+    # First read: returns the token payload.
+    result = service.get_session(session_id_a)
+    assert result["state"] == SessionState.AUTHENTICATED
+    assert "access_token" in result
+
+    # Assert session_a is evicted from the cache
+    session_data_a = cache.get(f"addons_sid_{session_id_a}")
+    assert session_data_a is None
+
+    # Second read: binding was evicted.
+    with pytest.raises(SessionNotFoundError, match="Session not found."):
+        service.get_session(session_id_a)
+
+    # Assert session_b is untouched
+    session_data_b = cache.get(f"addons_sid_{session_id_b}")
+    assert session_data_b is not None
+    assert session_data_b.get("state") == SessionState.PENDING
+
+
+def test_get_session_pending_preserve_cache(service):
+    """Should keep session state in cache when the session is pending."""
+
+    _, session_id, _ = service.init_session()
+
+    # First read: returns the pending session.
+    result_1 = service.get_session(session_id)
+    assert result_1["state"] == SessionState.PENDING
+    assert "access_token" not in result_1
+
+    # Second read: returns the pending session.
+    result_2 = service.get_session(session_id)
+    assert result_2["state"] == SessionState.PENDING
+    assert "access_token" not in result_2
+
+
+def test_get_session_pending_only_exposes_public_fields(service):
+    """Should only return whitelisted public fields when session is pending."""
+    _, session_id, _ = service.init_session()
+
+    session = service.get_session(session_id)
+
+    assert set(session.keys()) <= _PUBLIC_SESSION_FIELDS
+    assert session["state"] == SessionState.PENDING
+
+    assert "expires_at" not in session
+    assert "transit_token" not in session
+
+
+def test_get_session_authenticated_only_exposes_public_fields(service):
+    """Should only return whitelisted public fields when session is authenticated."""
+
+    transit_token, session_id, _ = service.init_session()
+
+    # Authenticate the session
+    user = UserFactory()
+    service.consume_transit_token(transit_token)
+    service.set_access_token(user, session_id)
+
+    session = service.get_session(session_id)
+
+    assert session["state"] == SessionState.AUTHENTICATED
+    assert set(session.keys()) <= _PUBLIC_SESSION_FIELDS
+
+    assert "expires_at" not in session
+    assert "transit_token" not in session
+
+
+def test_get_session_empty_string(service):
+    """Should raise SessionNotFoundError if session is empty."""
+
+    with pytest.raises(SessionNotFoundError, match="Session not found."):
+        service.get_session("")
+
+
+def test_get_session_corrupted_session_data(service):
+    """Should raise SessionDataError if session's data is corrupted."""
+    session_id = "mock-corrupted-session-id"
+    cache.set(f"addons_sid_{session_id}", {"invalid": "invalid-value"})
+
+    with pytest.raises(
+        SessionDataError, match="Invalid session data: missing state field."
+    ):
+        service.get_session(session_id)
+
+
+# ==============================
+# consume_transit_token
+# ==============================
+
+
+def test_consume_transit_token_returns_session_id(service):
+    """Should return the session_id the transit token was bound to."""
+    _, session_id, _ = service.init_session()
+    transit_token = cache.get(f"addons_sid_{session_id}")["transit_token"]
+
+    returned_session_id = service.consume_transit_token(transit_token)
+
+    assert returned_session_id == session_id
+
+
+def test_consume_transit_token_replay_raises(service):
+    """Should raise on the second consume of the same transit token."""
+    transit_token, _, _ = service.init_session()
+
+    service.consume_transit_token(transit_token)
+
+    with pytest.raises(TransitTokenError, match="Transit token already consumed."):
+        service.consume_transit_token(transit_token)
+
+
+def test_consume_transit_token_replay_evicts_session(service):
+    """Should evict the session as security cleanup when a replay is detected."""
+    transit_token, session_id, _ = service.init_session()
+
+    service.consume_transit_token(transit_token)
+    assert service.get_session(session_id)
+
+    with pytest.raises(TransitTokenError):
+        service.consume_transit_token(transit_token)
+
+    # After replay, the session is gone.
+    with pytest.raises(SessionNotFoundError):
+        service.get_session(session_id)
+
+
+def test_consume_transit_token_raises_on_unknown_token(service):
+    """Should raise TransitTokenError when the transit token is unknown or expired."""
+
+    with pytest.raises(TransitTokenError, match="Invalid or expired transit token."):
+        service.consume_transit_token("nonexistent-transit-token")
+
+
+def test_consume_transit_token_replay_when_session_already_gone(service):
+    """Should still detect replay even if the session was evicted independently."""
+    transit_token, session_id, _ = service.init_session()
+    service.consume_transit_token(transit_token)
+
+    # Simulate session evicted independently
+    cache.delete(f"addons_sid_{session_id}")
+
+    with pytest.raises(TransitTokenError, match="Transit token already consumed."):
+        service.consume_transit_token(transit_token)
+
+
+def test_consume_transit_token_extends_ttl_for_replay_detection(service, settings):
+    """Should extend the consumed transit entry's TTL to session length."""
+    settings.ADDONS_SESSION_TTL = 3000
+    settings.ADDONS_TRANSIT_TOKEN_TTL = 60
+
+    transit_token, _, _ = service.init_session()
+
+    # Before consume: transit has the short TTL.
+    assert cache.ttl(f"addons_transit_{transit_token}") <= 60 + 1
+
+    service.consume_transit_token(transit_token)
+
+    # After consume: TTL is extended to session length.
+    assert cache.ttl(f"addons_transit_{transit_token}") > 60
+
+
+# ==============================
+# set_access_token
+# ==============================
+
+
+def test_set_access_token_writes_jwt_fields_to_session(service, settings):
+    """Should populate the session with JWT fields and flip state to authenticated."""
+    user = UserFactory()
+    transit_token, session_id, _ = service.init_session()
+    service.consume_transit_token(transit_token)
+
+    service.set_access_token(user, session_id)
+
+    session = service.get_session(session_id)
+    assert session["state"] == SessionState.AUTHENTICATED
+    assert session["access_token"]
+    assert session["token_type"] == settings.ADDONS_TOKEN_TYPE
+    assert session["expires_in"] == settings.ADDONS_TOKEN_TTL
+    assert session["scope"] == settings.ADDONS_TOKEN_SCOPE
+
+
+def test_set_access_token_preserves_remaining_ttl(service, settings):
+    """Should inherit the pending session's remaining TTL rather than resetting it."""
+    settings.ADDONS_SESSION_TTL = 3000
+
+    user = UserFactory()
+    transit_token, session_id, _ = service.init_session()
+    service.consume_transit_token(transit_token)
+
+    ttl_before = cache.ttl(f"addons_sid_{session_id}")
+    service.set_access_token(user, session_id)
+    ttl_after = cache.ttl(f"addons_sid_{session_id}")
+
+    # TTL must not jump back to full — allow small tolerance for execution time.
+    assert ttl_after <= ttl_before + 1
+    # And it shouldn't have somehow grown beyond the session length either.
+    assert ttl_after <= 3000
+
+
+def test_authenticating_one_session_leaves_others_pending(service):
+    """Should leave other pending sessions untouched when authenticating one."""
+    user = UserFactory()
+
+    transit_a, session_id_a, _ = service.init_session()
+    _, session_id_b, _ = service.init_session()
+
+    service.consume_transit_token(transit_a)
+    service.set_access_token(user, session_id_a)
+
+    session_b = service.get_session(session_id_b)
+    assert session_b["state"] == SessionState.PENDING
+    assert "access_token" not in session_b
+
+
+def test_set_access_token_raises_when_transit_entry_missing(service):
+    """Should raise when the transit cache entry is gone (TTL expired or evicted)."""
+    user = UserFactory()
+    transit_token, session_id, _ = service.init_session()
+
+    # Manually delete the transit entry, simulating expiry or eviction.
+    cache.delete(f"addons_transit_{transit_token}")
+
+    with pytest.raises(SuspiciousSessionError, match="Transit token not found."):
+        service.set_access_token(user, session_id)
+
+
+def test_set_access_token_raises_if_transit_token_not_consumed(service):
+    """Should refuse to authenticate a session whose transit token hasn't been consumed."""
+
+    user = UserFactory()
+    _, session_id, _ = service.init_session()
+
+    with pytest.raises(SuspiciousSessionError, match="Transit token not consumed."):
+        service.set_access_token(user, session_id)
+
+    assert cache.get(f"addons_sid_{session_id}") is None
+
+
+def test_set_access_token_raises_on_missing_transit_token_field(service):
+    """Should raise SessionDataError when session data is missing the transit_token field."""
+    user = UserFactory()
+    transit_token, session_id, _ = service.init_session()
+    service.consume_transit_token(transit_token)
+
+    corrupted = cache.get(f"addons_sid_{session_id}")
+    del corrupted["transit_token"]
+    cache.set(f"addons_sid_{session_id}", corrupted, 3600)
+
+    with pytest.raises(SessionDataError, match="missing transit_token field"):
+        service.set_access_token(user, session_id)
+
+
+def test_set_access_token_raises_if_double_authenticated(service):
+    """Should raise and wipe the session on double-auth while leaving the transit token intact."""
+    user = UserFactory()
+    transit_token, _, _ = service.init_session()
+
+    session_id = service.consume_transit_token(transit_token)
+    service.set_access_token(user, session_id)
+
+    with pytest.raises(
+        SuspiciousSessionError, match="Session is not in pending state."
+    ):
+        service.set_access_token(user, session_id)
+
+    # Nuke session data as a security cleanup
+    session_data = cache.get(f"addons_sid_{session_id}")
+    assert session_data is None
+
+    transit_data = cache.get(f"addons_transit_{transit_token}")
+    assert transit_data.get("state") == TransitTokenState.CONSUMED
+
+
+def test_set_access_token_raises_when_session_missing(service):
+    """Should raise SessionNotFoundError when called with an unknown session_id."""
+    user = UserFactory()
+
+    with pytest.raises(SessionNotFoundError, match="Session not found."):
+        service.set_access_token(user, "nonexistent-session-id")
+
+
+def test_set_access_token_rejects_malformed_expires_at(service):
+    """Should raise SessionDataError when the cached expires_at is not valid ISO 8601."""
+    user = UserFactory()
+    transit_token, _, _ = service.init_session()
+    session_id = service.consume_transit_token(transit_token)
+
+    # Corrupt the cached session directly.
+    corrupted = cache.get(f"addons_sid_{session_id}")
+    corrupted["expires_at"] = "not-an-iso-string"
+    cache.set(f"addons_sid_{session_id}", corrupted, 3600)
+
+    with pytest.raises(SessionDataError, match="malformed expiration"):
+        service.set_access_token(user, session_id)
+
+
+def test_set_access_token_rejects_missing_expires_at(service):
+    """Should raise SessionDataError when the cached session is missing the expires_at field."""
+    user = UserFactory()
+    transit_token, _, _ = service.init_session()
+    session_id = service.consume_transit_token(transit_token)
+
+    corrupted = cache.get(f"addons_sid_{session_id}")
+    del corrupted["expires_at"]
+    cache.set(f"addons_sid_{session_id}", corrupted, 3600)
+
+    with pytest.raises(SessionDataError, match="missing expiration"):
+        service.set_access_token(user, session_id)
+
+
+def test_set_access_token_raises_when_session_expired(service):
+    """Should raise SessionExpiredError when the cached session's expires_at is in the past."""
+    user = UserFactory()
+    transit_token, session_id, _ = service.init_session()
+    service.consume_transit_token(transit_token)
+
+    # Simulate expiry: rewrite expires_at into the past.
+    corrupted = cache.get(f"addons_sid_{session_id}")
+    corrupted["expires_at"] = "2020-01-01T00:00:00+00:00"
+    cache.set(f"addons_sid_{session_id}", corrupted, 3600)
+
+    with pytest.raises(SessionExpiredError, match="Session expired."):
+        service.set_access_token(user, session_id)
@@ -240,10 +240,9 @@ def test_api_rooms_invite_error(mock_invite_to_room):
    mock_invite_to_room.assert_called_once()


-@mock.patch("core.services.invitation.send_mail")
-def test_api_rooms_invite_success(mock_send_mail, settings):
+@mock.patch("core.services.invitation.EmailMultiAlternatives")
+def test_api_rooms_invite_success(mock_email_class, settings):
    """Test privileged users should successfully send invitation emails."""
-
    settings.EMAIL_BRAND_NAME = "ACME"
    settings.EMAIL_LOGO_IMG = "https://acme.com/logo"
    settings.EMAIL_APP_BASE_URL = "https://acme.com"
@@ -255,7 +254,6 @@ def test_api_rooms_invite_success(mock_send_mail, settings):
    user = UserFactory()

    room.accesses.create(user=user, role=random.choice(["administrator", "owner"]))
-
    client.force_login(user)

    data = {"emails": ["fabien@yopmail.com", "gerald@yopmail.com"]}
@@ -269,26 +267,38 @@ def test_api_rooms_invite_success(mock_send_mail, settings):
    assert response.status_code == 200
    assert response.json() == {"status": "success", "message": "invitations sent"}

-    mock_send_mail.assert_called_once()
+    mock_email_class.assert_called_once()

-    subject, body, sender, recipients = mock_send_mail.call_args[0]
+    # Check constructor arguments
+    call_kwargs = mock_email_class.call_args[1]  # EmailMultiAlternatives(**kwargs)

-    assert (
-        subject == f"Video call in progress: {user.email} is waiting for you to connect"
+    assert call_kwargs["subject"] == (
+        f"Video call in progress: {user.email} is waiting for you to connect"
+    )
+    assert call_kwargs["from_email"] == "notifications@acme.com"
+    assert call_kwargs["to"] == []
+    assert sorted(call_kwargs["bcc"]) == sorted(
+        ["fabien@yopmail.com", "gerald@yopmail.com"]
    )

-    # Verify email contains expected content
+    # Check plain text body
+    plain_body = call_kwargs["body"]
    required_content = [
-        "ACME",  # Brand name
-        "https://acme.com/logo",  # Logo URL
-        f"https://acme.com/{room.slug}",  # Room url
-        f"acme.com/{room.slug}",  # Room link
+        "ACME",
+        "https://acme.com/logo",
+        f"https://acme.com/{room.slug}",
+        f"acme.com/{room.slug}",
    ]
-
    for content in required_content:
-        assert content in body
+        assert content in plain_body

-    assert sender == "notifications@acme.com"
+    # Check HTML alternative was attached
+    mock_instance = mock_email_class.return_value
+    mock_instance.attach_alternative.assert_called_once()
+    html_body, mimetype = mock_instance.attach_alternative.call_args[0]
+    assert mimetype == "text/html"
+    for content in required_content:
+        assert content in html_body

-    # Verify all owners received the email (order-independent comparison)
-    assert sorted(recipients) == sorted(["fabien@yopmail.com", "gerald@yopmail.com"])
+    # Check send was called
+    mock_instance.send.assert_called_once()
@@ -91,7 +91,7 @@ def test_mute_participant_unexpected_twirp_error(mock_livekit_client):
    client = APIClient()

    mock_livekit_client.room.mute_published_track.side_effect = TwirpError(
-        msg="Internal server error", code=500, status=500
+        msg="Internal server error", code="unknown", status=500
    )

    room = RoomFactory()
@@ -130,10 +130,11 @@ def test_update_participant_success(mock_livekit_client):
            "can_publish": True,
            "can_publish_data": True,
            "can_publish_sources": [
-                1,
-                2,
-            ],  # [TrackSource.CAMERA, TrackSource.MICROPHONE]
+                "CAMERA",
+                "MICROPHONE",
+            ],
            "can_update_metadata": True,
+            "can_subscribe_metrics": True,
        },
        "name": "John Doe",
    }
@@ -155,8 +156,14 @@ def test_update_participant_success(mock_livekit_client):
        {"can_subscribe": True},
        {"can_publish": True},
        {"can_publish_data": True},
-        {"can_publish_sources": [1, 2]},
+        {
+            "can_publish_sources": [
+                "CAMERA",
+                "MICROPHONE",
+            ]
+        },
        {"can_update_metadata": True},
+        {"can_subscribe_metrics": False},
    ],
 )
 def test_update_participant_permission_fields_are_optional(
@@ -264,35 +271,6 @@ def test_update_participant_suspicious_permission_multiple(mock_suspicious):
    )


-@pytest.mark.parametrize("value", (False, True))
-def test_update_participant_unimplemented_can_subscribe_metrics(value):
-    """Test update participant raises 400 when can_subscribe_metrics is set."""
-    client = APIClient()
-    room = RoomFactory()
-    user = UserFactory()
-    UserResourceAccessFactory(
-        resource=room, user=user, role=random.choice(["administrator", "owner"])
-    )
-    client.force_authenticate(user=user)
-
-    payload = {
-        "participant_identity": str(uuid4()),
-        "permission": {
-            "can_subscribe": True,
-            "can_publish": True,
-            "can_publish_data": True,
-            "can_update_metadata": False,
-            "can_subscribe_metrics": value,
-        },
-    }
-
-    url = reverse("rooms-update-participant", kwargs={"pk": room.id})
-    response = client.post(url, payload, format="json")
-
-    assert response.status_code == status.HTTP_400_BAD_REQUEST
-    assert "can_subscribe_metrics" in str(response.data)
-
-
 def test_update_participant_forbidden_without_access():
    """Test update participant returns 403 when user lacks room privileges."""
    client = APIClient()
@@ -409,7 +387,7 @@ def test_update_participant_unexpected_twirp_error(mock_livekit_client):
    client = APIClient()

    mock_livekit_client.room.update_participant.side_effect = TwirpError(
-        msg="Internal server error", code=500, status=500
+        msg="Internal server error", code="unknown", status=500
    )

    room = RoomFactory()
@@ -548,7 +526,7 @@ def test_remove_participant_unexpected_twirp_error(mock_livekit_client):
    client = APIClient()

    mock_livekit_client.room.remove_participant.side_effect = TwirpError(
-        msg="Internal server error", code=500, status=500
+        msg="Internal server error", code="unknown", status=500
    )

    room = RoomFactory()
@@ -567,3 +545,55 @@ def test_remove_participant_unexpected_twirp_error(mock_livekit_client):
    assert response.data == {"error": "Failed to remove participant"}

    mock_livekit_client.aclose.assert_called_once()
+
+
+def test_update_participant_not_found(mock_livekit_client):
+    """Test update participant returns 404 when the participant no longer exists in the room."""
+    client = APIClient()
+
+    mock_livekit_client.room.update_participant.side_effect = TwirpError(
+        msg="participant does not exist", code="not_found", status=404
+    )
+
+    room = RoomFactory()
+    user = UserFactory()
+    UserResourceAccessFactory(
+        resource=room, user=user, role=random.choice(["administrator", "owner"])
+    )
+    client.force_authenticate(user=user)
+
+    payload = {"participant_identity": str(uuid4()), "name": "Test User"}
+
+    url = reverse("rooms-update-participant", kwargs={"pk": room.id})
+    response = client.post(url, payload, format="json")
+
+    assert response.status_code == status.HTTP_404_NOT_FOUND
+    assert response.data == {"error": "Participant not found"}
+
+    mock_livekit_client.aclose.assert_called_once()
+
+
+def test_remove_participant_not_found(mock_livekit_client):
+    """Test remove participant returns 404 when the participant no longer exists in the room."""
+    client = APIClient()
+
+    mock_livekit_client.room.remove_participant.side_effect = TwirpError(
+        msg="participant does not exist", code="not_found", status=404
+    )
+
+    room = RoomFactory()
+    user = UserFactory()
+    UserResourceAccessFactory(
+        resource=room, user=user, role=random.choice(["administrator", "owner"])
+    )
+    client.force_authenticate(user=user)
+
+    payload = {"participant_identity": str(uuid4())}
+
+    url = reverse("rooms-remove-participant", kwargs={"pk": room.id})
+    response = client.post(url, payload, format="json")
+
+    assert response.status_code == status.HTTP_404_NOT_FOUND
+    assert response.data == {"error": "Participant not found"}
+
+    mock_livekit_client.aclose.assert_called_once()
@@ -0,0 +1,574 @@
+"""
+Test rooms API endpoints: toggle hand and rename participant.
+"""
+
+# pylint: disable=redefined-outer-name,unused-argument,protected-access
+
+from unittest import mock
+from uuid import uuid4
+
+from django.contrib.auth.models import AnonymousUser
+from django.urls import reverse
+
+import pytest
+from freezegun import freeze_time
+from livekit.api import TwirpError
+from rest_framework import status
+from rest_framework.test import APIClient
+
+from core import utils
+from core.factories import RoomFactory, UserFactory
+
+pytestmark = pytest.mark.django_db
+
+
+@pytest.fixture
+def mock_livekit_client():
+    """Mock LiveKit API client."""
+    with mock.patch("core.utils.create_livekit_client") as mock_create:
+        mock_client = mock.AsyncMock()
+        mock_create.return_value = mock_client
+        yield mock_client
+
+
+@pytest.fixture
+def room():
+    """Create a room."""
+    return RoomFactory()
+
+
+@pytest.fixture
+def user():
+    """Create a user."""
+    return UserFactory()
+
+
+@pytest.fixture
+def token(room, user):
+    """Generate a real LiveKit JWT for the user in the room."""
+    return utils.generate_token(room=str(room.id), user=user)
+
+
+@pytest.fixture
+def anonymous_token(room):
+    """Generate a real LiveKit JWT for an anonymous user in the room."""
+    return utils.generate_token(
+        room=str(room.id),
+        user=AnonymousUser(),
+        participant_id="anon-participant-id",
+    )
+
+
+# ---
+# toggle-hand
+# ---
+
+
+def test_toggle_hand_raise_success(mock_livekit_client, room, token):
+    """Test successfully raising a participant's hand."""
+    client = APIClient()
+    url = reverse("rooms-toggle-hand", kwargs={"pk": room.id})
+    response = client.post(
+        url, {"raised": True}, format="json", HTTP_AUTHORIZATION=f"Bearer {token}"
+    )
+
+    assert response.status_code == status.HTTP_200_OK
+    assert response.data == {"status": "success"}
+
+    mock_livekit_client.room.update_participant.assert_called_once()
+    mock_livekit_client.aclose.assert_called_once()
+
+
+def test_toggle_hand_lower_success(mock_livekit_client, room, token):
+    """Test successfully lowering a participant's hand."""
+    client = APIClient()
+    url = reverse("rooms-toggle-hand", kwargs={"pk": room.id})
+    response = client.post(
+        url, {"raised": False}, format="json", HTTP_AUTHORIZATION=f"Bearer {token}"
+    )
+
+    assert response.status_code == status.HTTP_200_OK
+    assert response.data == {"status": "success"}
+
+    call_kwargs = mock_livekit_client.room.update_participant.call_args
+    assert call_kwargs[0][0].attributes["handRaisedAt"] == ""
+
+    mock_livekit_client.aclose.assert_called_once()
+
+
+def test_toggle_hand_raise_sets_timestamp(mock_livekit_client, room, token):
+    """Test that raising a hand sets a non-empty ISO timestamp as the attribute."""
+    client = APIClient()
+    url = reverse("rooms-toggle-hand", kwargs={"pk": room.id})
+    response = client.post(
+        url, {"raised": True}, format="json", HTTP_AUTHORIZATION=f"Bearer {token}"
+    )
+
+    assert response.status_code == status.HTTP_200_OK
+
+    call_kwargs = mock_livekit_client.room.update_participant.call_args
+    assert call_kwargs[0][0].attributes["handRaisedAt"] != ""
+
+
+def test_toggle_hand_identity_derived_from_token(
+    mock_livekit_client, room, token, user
+):
+    """Test that the participant identity is derived from the token, not supplied by the client."""
+    client = APIClient()
+    url = reverse("rooms-toggle-hand", kwargs={"pk": room.id})
+    client.post(
+        url, {"raised": True}, format="json", HTTP_AUTHORIZATION=f"Bearer {token}"
+    )
+
+    call_kwargs = mock_livekit_client.room.update_participant.call_args
+    assert call_kwargs[0][0].identity == str(user.sub)
+
+
+def test_toggle_hand_missing_raised_field(room, token):
+    """Test toggle hand with missing raised field returns 400."""
+    client = APIClient()
+    url = reverse("rooms-toggle-hand", kwargs={"pk": room.id})
+    response = client.post(url, {}, format="json", HTTP_AUTHORIZATION=f"Bearer {token}")
+
+    assert response.status_code == status.HTTP_400_BAD_REQUEST
+    assert "raised" in response.data
+
+
+def test_toggle_hand_invalid_raised_field(room, token):
+    """Test toggle hand with non-boolean raised field returns 400."""
+    client = APIClient()
+    url = reverse("rooms-toggle-hand", kwargs={"pk": room.id})
+    response = client.post(
+        url,
+        {"raised": "not-a-boolean"},
+        format="json",
+        HTTP_AUTHORIZATION=f"Bearer {token}",
+    )
+
+    assert response.status_code == status.HTTP_400_BAD_REQUEST
+
+
+def test_toggle_hand_forbidden_without_token(room):
+    """Test toggle hand returns 403 when no LiveKit token is provided."""
+    client = APIClient()
+    url = reverse("rooms-toggle-hand", kwargs={"pk": room.id})
+    response = client.post(url, {"raised": True}, format="json")
+
+    assert response.status_code == status.HTTP_403_FORBIDDEN
+
+
+def test_toggle_hand_forbidden_token_for_wrong_room(user):
+    """Test toggle hand returns 403 when the token is scoped to a different room."""
+    wrong_room = RoomFactory()
+    target_room = RoomFactory()
+    wrong_token = utils.generate_token(room=str(wrong_room.id), user=user)
+
+    client = APIClient()
+    url = reverse("rooms-toggle-hand", kwargs={"pk": target_room.id})
+    response = client.post(
+        url, {"raised": True}, format="json", HTTP_AUTHORIZATION=f"Bearer {wrong_token}"
+    )
+
+    assert response.status_code == status.HTTP_403_FORBIDDEN
+
+
+def test_toggle_hand_unexpected_twirp_error(mock_livekit_client, room, token):
+    """Test toggle hand when LiveKit API raises TwirpError."""
+    mock_livekit_client.room.update_participant.side_effect = TwirpError(
+        msg="Internal server error", code="unknown", status=500
+    )
+
+    client = APIClient()
+    url = reverse("rooms-toggle-hand", kwargs={"pk": room.id})
+    response = client.post(
+        url, {"raised": True}, format="json", HTTP_AUTHORIZATION=f"Bearer {token}"
+    )
+
+    assert response.status_code == status.HTTP_500_INTERNAL_SERVER_ERROR
+    assert response.data == {"error": "Failed to update participant hand state"}
+
+    mock_livekit_client.aclose.assert_called_once()
+
+
+def test_toggle_hand_raise_success_anonymous(
+    mock_livekit_client, room, anonymous_token
+):
+    """Test successfully raising hand as an anonymous participant."""
+    client = APIClient()
+    url = reverse("rooms-toggle-hand", kwargs={"pk": room.id})
+    response = client.post(
+        url,
+        {"raised": True},
+        format="json",
+        HTTP_AUTHORIZATION=f"Bearer {anonymous_token}",
+    )
+
+    assert response.status_code == status.HTTP_200_OK
+    assert response.data == {"status": "success"}
+
+    mock_livekit_client.room.update_participant.assert_called_once()
+    mock_livekit_client.aclose.assert_called_once()
+
+
+def test_toggle_hand_lower_success_anonymous(
+    mock_livekit_client, room, anonymous_token
+):
+    """Test successfully lowering hand as an anonymous participant."""
+    client = APIClient()
+    url = reverse("rooms-toggle-hand", kwargs={"pk": room.id})
+    response = client.post(
+        url,
+        {"raised": False},
+        format="json",
+        HTTP_AUTHORIZATION=f"Bearer {anonymous_token}",
+    )
+
+    assert response.status_code == status.HTTP_200_OK
+    assert response.data == {"status": "success"}
+
+    call_kwargs = mock_livekit_client.room.update_participant.call_args
+    assert call_kwargs[0][0].attributes["handRaisedAt"] == ""
+
+
+def test_toggle_hand_identity_derived_from_token_anonymous(
+    mock_livekit_client, room, anonymous_token
+):
+    """Test that identity is derived from participant_id for anonymous users."""
+    client = APIClient()
+    url = reverse("rooms-toggle-hand", kwargs={"pk": room.id})
+    client.post(
+        url,
+        {"raised": True},
+        format="json",
+        HTTP_AUTHORIZATION=f"Bearer {anonymous_token}",
+    )
+
+    call_kwargs = mock_livekit_client.room.update_participant.call_args
+    assert call_kwargs[0][0].identity == "anon-participant-id"
+
+
+# ---
+# rename
+# ---
+
+
+def test_rename_participant_success(mock_livekit_client, room, token):
+    """Test successfully renaming a participant."""
+    client = APIClient()
+    url = reverse("rooms-rename", kwargs={"pk": room.id})
+    response = client.post(
+        url, {"name": "John Doe"}, format="json", HTTP_AUTHORIZATION=f"Bearer {token}"
+    )
+
+    assert response.status_code == status.HTTP_200_OK
+    assert response.data == {"status": "success"}
+
+    mock_livekit_client.room.update_participant.assert_called_once()
+    mock_livekit_client.aclose.assert_called_once()
+
+
+def test_rename_participant_sets_correct_name(mock_livekit_client, room, token):
+    """Test that rename passes the correct name to LiveKit."""
+    client = APIClient()
+    url = reverse("rooms-rename", kwargs={"pk": room.id})
+    client.post(
+        url, {"name": "Jane Doe"}, format="json", HTTP_AUTHORIZATION=f"Bearer {token}"
+    )
+
+    call_kwargs = mock_livekit_client.room.update_participant.call_args
+    assert call_kwargs[0][0].name == "Jane Doe"
+
+
+def test_rename_participant_uses_identity_from_token(
+    mock_livekit_client, room, token, user
+):
+    """Test that rename derives participant identity from the LiveKit token, not the request."""
+    client = APIClient()
+    url = reverse("rooms-rename", kwargs={"pk": room.id})
+    client.post(
+        url, {"name": "John Doe"}, format="json", HTTP_AUTHORIZATION=f"Bearer {token}"
+    )
+
+    call_kwargs = mock_livekit_client.room.update_participant.call_args
+    assert call_kwargs[0][0].identity == str(user.sub)
+
+
+def test_rename_participant_empty_name(room, token):
+    """Test rename with an empty name returns 400."""
+    client = APIClient()
+    url = reverse("rooms-rename", kwargs={"pk": room.id})
+    response = client.post(
+        url, {"name": ""}, format="json", HTTP_AUTHORIZATION=f"Bearer {token}"
+    )
+
+    assert response.status_code == status.HTTP_400_BAD_REQUEST
+    assert "name" in response.data
+
+
+def test_rename_participant_missing_name(room, token):
+    """Test rename with missing name field returns 400."""
+    client = APIClient()
+    url = reverse("rooms-rename", kwargs={"pk": room.id})
+    response = client.post(url, {}, format="json", HTTP_AUTHORIZATION=f"Bearer {token}")
+
+    assert response.status_code == status.HTTP_400_BAD_REQUEST
+    assert "name" in response.data
+
+
+def test_rename_participant_name_too_long(room, token):
+    """Test rename with a name exceeding 255 characters returns 400."""
+    client = APIClient()
+    url = reverse("rooms-rename", kwargs={"pk": room.id})
+    response = client.post(
+        url, {"name": "a" * 256}, format="json", HTTP_AUTHORIZATION=f"Bearer {token}"
+    )
+
+    assert response.status_code == status.HTTP_400_BAD_REQUEST
+    assert "name" in response.data
+
+
+def test_rename_participant_forbidden_without_token(room):
+    """Test rename returns 403 when no LiveKit token is provided."""
+    client = APIClient()
+    url = reverse("rooms-rename", kwargs={"pk": room.id})
+    response = client.post(url, {"name": "John Doe"}, format="json")
+
+    assert response.status_code == status.HTTP_403_FORBIDDEN
+
+
+def test_rename_participant_forbidden_token_for_wrong_room(user):
+    """Test rename returns 403 when the token is scoped to a different room."""
+    wrong_room = RoomFactory()
+    target_room = RoomFactory()
+    wrong_token = utils.generate_token(room=str(wrong_room.id), user=user)
+
+    client = APIClient()
+    url = reverse("rooms-rename", kwargs={"pk": target_room.id})
+    response = client.post(
+        url,
+        {"name": "John Doe"},
+        format="json",
+        HTTP_AUTHORIZATION=f"Bearer {wrong_token}",
+    )
+
+    assert response.status_code == status.HTTP_403_FORBIDDEN
+
+
+def test_rename_participant_unexpected_twirp_error(mock_livekit_client, room, token):
+    """Test rename when LiveKit API raises TwirpError."""
+    mock_livekit_client.room.update_participant.side_effect = TwirpError(
+        msg="Internal server error", code="unknown", status=500
+    )
+
+    client = APIClient()
+    url = reverse("rooms-rename", kwargs={"pk": room.id})
+    response = client.post(
+        url, {"name": "John Doe"}, format="json", HTTP_AUTHORIZATION=f"Bearer {token}"
+    )
+
+    assert response.status_code == status.HTTP_500_INTERNAL_SERVER_ERROR
+    assert response.data == {"error": "Failed to rename participant"}
+
+    mock_livekit_client.aclose.assert_called_once()
+
+
+def test_rename_participant_success_anonymous(
+    mock_livekit_client, room, anonymous_token
+):
+    """Test successfully renaming an anonymous participant."""
+    client = APIClient()
+    url = reverse("rooms-rename", kwargs={"pk": room.id})
+    response = client.post(
+        url,
+        {"name": "Guest User"},
+        format="json",
+        HTTP_AUTHORIZATION=f"Bearer {anonymous_token}",
+    )
+
+    assert response.status_code == status.HTTP_200_OK
+    assert response.data == {"status": "success"}
+
+    mock_livekit_client.room.update_participant.assert_called_once()
+    mock_livekit_client.aclose.assert_called_once()
+
+
+def test_rename_participant_uses_identity_from_token_anonymous(
+    mock_livekit_client, room, anonymous_token
+):
+    """Test that rename derives identity from participant_id for anonymous users."""
+    client = APIClient()
+    url = reverse("rooms-rename", kwargs={"pk": room.id})
+    client.post(
+        url,
+        {"name": "Guest User"},
+        format="json",
+        HTTP_AUTHORIZATION=f"Bearer {anonymous_token}",
+    )
+
+    call_kwargs = mock_livekit_client.room.update_participant.call_args
+    assert call_kwargs[0][0].identity == "anon-participant-id"
+
+
+def test_rename_participant_sets_correct_name_anonymous(
+    mock_livekit_client, room, anonymous_token
+):
+    """Test that rename passes the correct name to LiveKit for anonymous users."""
+    client = APIClient()
+    url = reverse("rooms-rename", kwargs={"pk": room.id})
+    client.post(
+        url,
+        {"name": "Guest User"},
+        format="json",
+        HTTP_AUTHORIZATION=f"Bearer {anonymous_token}",
+    )
+
+    call_kwargs = mock_livekit_client.room.update_participant.call_args
+    assert call_kwargs[0][0].name == "Guest User"
+
+
+def test_rename_participant_forbidden_anonymous_token_for_wrong_room(anonymous_token):
+    """Test rename returns 403 when anonymous token is scoped to a different room."""
+    target_room = RoomFactory()
+
+    client = APIClient()
+    url = reverse("rooms-rename", kwargs={"pk": target_room.id})
+    response = client.post(
+        url,
+        {"name": "Guest User"},
+        format="json",
+        HTTP_AUTHORIZATION=f"Bearer {anonymous_token}",
+    )
+
+    assert response.status_code == status.HTTP_403_FORBIDDEN
+
+
+# ---
+# expired / malformed / missing room — shared cases
+# ---
+
+
+@pytest.fixture
+@freeze_time("2023-01-15 12:00:00")
+def expired_token(room, user):
+    """Generate a LiveKit JWT frozen in the past, guaranteed to be expired."""
+    return utils.generate_token(room=str(room.id), user=user)
+
+
+def test_toggle_hand_expired_token(room, expired_token):
+    """Test toggle hand returns 403 when the LiveKit token is expired."""
+    client = APIClient()
+    url = reverse("rooms-toggle-hand", kwargs={"pk": room.id})
+    response = client.post(
+        url,
+        {"raised": True},
+        format="json",
+        HTTP_AUTHORIZATION=f"Bearer {expired_token}",
+    )
+
+    assert response.status_code == status.HTTP_403_FORBIDDEN
+
+
+def test_rename_participant_expired_token(room, expired_token):
+    """Test rename returns 403 when the LiveKit token is expired."""
+    client = APIClient()
+    url = reverse("rooms-rename", kwargs={"pk": room.id})
+    response = client.post(
+        url,
+        {"name": "John Doe"},
+        format="json",
+        HTTP_AUTHORIZATION=f"Bearer {expired_token}",
+    )
+
+    assert response.status_code == status.HTTP_403_FORBIDDEN
+
+
+def test_toggle_hand_malformed_token(room):
+    """Test toggle hand returns 403 when the LiveKit token is malformed."""
+    client = APIClient()
+    url = reverse("rooms-toggle-hand", kwargs={"pk": room.id})
+    response = client.post(
+        url,
+        {"raised": True},
+        format="json",
+        HTTP_AUTHORIZATION="Bearer this-is-not-a-valid-jwt",
+    )
+
+    assert response.status_code == status.HTTP_403_FORBIDDEN
+
+
+def test_toggle_hand_room_not_found(user):
+    """Test toggle hand returns 404 when the room does not exist."""
+    non_existent_room_id = uuid4()
+    token = utils.generate_token(room=str(non_existent_room_id), user=user)
+
+    client = APIClient()
+    url = reverse("rooms-toggle-hand", kwargs={"pk": non_existent_room_id})
+    response = client.post(
+        url, {"raised": True}, format="json", HTTP_AUTHORIZATION=f"Bearer {token}"
+    )
+
+    assert response.status_code == status.HTTP_404_NOT_FOUND
+
+
+def test_toggle_hand_participant_not_found(mock_livekit_client, room, token):
+    """Test toggle hand returns 404 when the participant no longer exists in the room."""
+    mock_livekit_client.room.update_participant.side_effect = TwirpError(
+        msg="participant does not exist", code="not_found", status=404
+    )
+
+    client = APIClient()
+    url = reverse("rooms-toggle-hand", kwargs={"pk": room.id})
+    response = client.post(
+        url, {"raised": True}, format="json", HTTP_AUTHORIZATION=f"Bearer {token}"
+    )
+
+    assert response.status_code == status.HTTP_404_NOT_FOUND
+    assert response.data == {"error": "Participant not found"}
+
+    mock_livekit_client.aclose.assert_called_once()
+
+
+def test_rename_participant_malformed_token(room):
+    """Test rename returns 403 when the LiveKit token is malformed."""
+    client = APIClient()
+    url = reverse("rooms-rename", kwargs={"pk": room.id})
+    response = client.post(
+        url,
+        {"name": "John Doe"},
+        format="json",
+        HTTP_AUTHORIZATION="Bearer this-is-not-a-valid-jwt",
+    )
+
+    assert response.status_code == status.HTTP_403_FORBIDDEN
+
+
+def test_rename_participant_room_not_found(user):
+    """Test rename returns 404 when the room does not exist."""
+    non_existent_room_id = uuid4()
+    token = utils.generate_token(room=str(non_existent_room_id), user=user)
+
+    client = APIClient()
+    url = reverse("rooms-rename", kwargs={"pk": non_existent_room_id})
+    response = client.post(
+        url, {"name": "John Doe"}, format="json", HTTP_AUTHORIZATION=f"Bearer {token}"
+    )
+
+    assert response.status_code == status.HTTP_404_NOT_FOUND
+
+
+def test_rename_participant_not_found(mock_livekit_client, room, token):
+    """Test rename returns 404 when the participant no longer exists in the room."""
+    mock_livekit_client.room.update_participant.side_effect = TwirpError(
+        msg="participant does not exist", code="not_found", status=404
+    )
+
+    client = APIClient()
+    url = reverse("rooms-rename", kwargs={"pk": room.id})
+    response = client.post(
+        url, {"name": "John Doe"}, format="json", HTTP_AUTHORIZATION=f"Bearer {token}"
+    )
+
+    assert response.status_code == status.HTTP_404_NOT_FOUND
+    assert response.data == {"error": "Participant not found"}
+
+    mock_livekit_client.aclose.assert_called_once()
@@ -277,6 +277,7 @@ def test_start_recording_options_transcribe_valid_true(
 ):
    """Should accept transcribe with any valid pydantic true values."""
    settings.RECORDING_ENABLE = True
+    settings.METADATA_COLLECTOR_ENABLED = False
    room = RoomFactory()
    user = UserFactory()
    room.accesses.create(user=user, role="owner")
@@ -487,6 +488,93 @@ def test_start_recording_options_original_mode_omitted(
    assert recording.options == {}


+def test_start_recording_calls_metadata_collector_start(
+    settings, mock_worker_service_factory, mock_worker_manager
+):
+    """Should call MetadataCollectorService.start when conditions are met."""
+    settings.RECORDING_ENABLE = True
+    settings.METADATA_COLLECTOR_ENABLED = True
+
+    room = RoomFactory()
+    user = UserFactory()
+    room.accesses.create(user=user, role="owner")
+
+    client = APIClient()
+    client.force_login(user)
+
+    with mock.patch(
+        "core.api.viewsets.MetadataCollectorService"
+    ) as mock_collector_class:
+        mock_collector = mock.Mock()
+        mock_collector_class.return_value = mock_collector
+
+        response = client.post(
+            f"/api/v1.0/rooms/{room.id}/start-recording/",
+            {
+                "mode": "screen_recording",
+                "options": {"transcribe": True, "collect_metadata": True},
+            },
+            format="json",
+        )
+
+    assert response.status_code == 201
+
+    recording = Recording.objects.get(room=room)
+    mock_collector.start.assert_called_once_with(recording)
+
+
+@pytest.mark.parametrize(
+    "metadata_enabled,options",
+    [
+        # Metadata collector disabled, regardless of transcribe option
+        (False, {"transcribe": True}),
+        (False, {"transcribe": False}),
+        (False, None),
+        # Metadata collector enabled, but transcribe is False or missing
+        (True, {"transcribe": False}),
+        (True, None),
+        # Metadata collector enabled, transcribe True, but collect_metadata explicitly False
+        (True, {"transcribe": True, "collect_metadata": False}),
+    ],
+)
+def test_start_recording_does_not_call_metadata_collector_start_when_conditions_not_met(
+    settings,
+    mock_worker_service_factory,
+    mock_worker_manager,
+    metadata_enabled,
+    options,
+):
+    """Should not call MetadataCollectorService.start when conditions are not met."""
+    settings.RECORDING_ENABLE = True
+    settings.METADATA_COLLECTOR_ENABLED = metadata_enabled
+
+    room = RoomFactory()
+    user = UserFactory()
+    room.accesses.create(user=user, role="owner")
+
+    client = APIClient()
+    client.force_login(user)
+
+    payload = {"mode": "screen_recording"}
+    if options is not None:
+        payload["options"] = options
+
+    with mock.patch(
+        "core.api.viewsets.MetadataCollectorService"
+    ) as mock_collector_class:
+        mock_collector = mock.Mock()
+        mock_collector_class.return_value = mock_collector
+
+        response = client.post(
+            f"/api/v1.0/rooms/{room.id}/start-recording/",
+            payload,
+            format="json",
+        )
+
+    assert response.status_code == 201
+    mock_collector.start.assert_not_called()
+
+
@pytest.mark.parametrize("value", ["invalid_mode", "foo", 123, "SCREEN_RECORDING"])
 def test_start_recording_options_original_mode_invalid(settings, value):
    """Should reject invalid recording mode values for original_mode."""
@@ -108,7 +108,9 @@ def test_start_subtitle_invalid_token():
    client.force_login(user)

    response = client.post(
-        f"/api/v1.0/rooms/{room.id}/start-subtitle/", {"token": "invalid-token"}
+        f"/api/v1.0/rooms/{room.id}/start-subtitle/",
+        {},
+        HTTP_AUTHORIZATION="Bearer invalid-token",
    )

    assert response.status_code == 403
@@ -125,7 +127,8 @@ def test_start_subtitle_disabled_by_default(mock_livekit_token):

    response = client.post(
        f"/api/v1.0/rooms/{room.id}/start-subtitle/",
-        {"token": mock_livekit_token},
+        {},
+        HTTP_AUTHORIZATION=f"Bearer {mock_livekit_token}",
    )

    assert response.status_code == 404
@@ -144,7 +147,8 @@ def test_start_subtitle_valid_token(

    response = client.post(
        f"/api/v1.0/rooms/{room.id}/start-subtitle/",
-        {"token": mock_livekit_token},
+        {},
+        HTTP_AUTHORIZATION=f"Bearer {mock_livekit_token}",
    )

    assert response.status_code == 200
@@ -168,12 +172,13 @@ def test_start_subtitle_twirp_error(
    client = APIClient()

    mock_livekit_client.agent_dispatch.create_dispatch.side_effect = TwirpError(
-        msg="Internal server error", code=500, status=500
+        msg="Internal server error", code="unknown", status=500
    )

    response = client.post(
        f"/api/v1.0/rooms/{room.id}/start-subtitle/",
-        {"token": mock_livekit_token},
+        {},
+        HTTP_AUTHORIZATION=f"Bearer {mock_livekit_token}",
    )

    assert response.status_code == 500
@@ -192,7 +197,8 @@ def test_start_subtitle_wrong_room(settings, mock_livekit_token):

    response = client.post(
        f"/api/v1.0/rooms/{room.id}/start-subtitle/",
-        {"token": mock_livekit_token},
+        {},
+        HTTP_AUTHORIZATION=f"Bearer {mock_livekit_token}",
    )

    assert response.status_code == 403
@@ -205,14 +211,15 @@ def test_start_subtitle_wrong_signature(settings, mock_livekit_token):
    """Test that tokens signed with incorrect signature are rejected."""

    settings.ROOM_SUBTITLE_ENABLED = True
-    settings.LIVEKIT_CONFIGURATION["api_secret"] = "wrong-secret"
+    settings.LIVEKIT_CONFIGURATION["api_secret"] = "wrong-secret-padded-to-32-bytes!!"

    room = RoomFactory()
    client = APIClient()

    response = client.post(
        f"/api/v1.0/rooms/{room.id}/start-subtitle/",
-        {"token": mock_livekit_token},
+        {},
+        HTTP_AUTHORIZATION=f"Bearer {mock_livekit_token}",
    )

    assert response.status_code == 403
@@ -47,7 +47,7 @@ def mock_livekit_config(settings):
    """Mock LiveKit configuration."""
    settings.LIVEKIT_CONFIGURATION = {
        "api_key": "test_api_key",
-        "api_secret": "test_api_secret",
+        "api_secret": "test_api_secret_padded_to_32bytes!",
        "url": "https://test-livekit.example.com/",
    }
    return settings.LIVEKIT_CONFIGURATION
@@ -0,0 +1,541 @@
+"""
+Tests for JWT token service.
+"""
+
+# pylint: disable=W0212,W0621
+
+import uuid
+from unittest import mock
+
+from django.core.exceptions import ImproperlyConfigured
+
+import jwt as pyjwt
+import pytest
+from freezegun import freeze_time
+
+from core.services.jwt_token import (
+    JwtTokenService,
+    TokenDecodeError,
+    TokenExpiredError,
+    TokenInvalidError,
+)
+
+# -- Fixtures --
+
+
+@pytest.fixture
+def jwt_service():
+    """Create a JWT token service for testing."""
+    return JwtTokenService(
+        secret_key="test-secret-padded-to-32-bytes!!",
+        algorithm="HS256",
+        issuer="test-issuer",
+        audience="test-audience",
+        expiration_seconds=3600,
+        token_type="Bearer",
+    )
+
+
+@pytest.fixture
+def mock_user():
+    """Create a mock user with a string ID."""
+    user = mock.Mock()
+    user.id = "test-user-id"
+    return user
+
+
+# -- __init__ / Configuration --
+
+
+def test_init_missing_secret_key():
+    """Missing secret key should raise ImproperlyConfigured."""
+    with pytest.raises(ImproperlyConfigured, match="Secret key is required"):
+        JwtTokenService(
+            secret_key="",
+            algorithm="HS256",
+            issuer="issuer",
+            audience="audience",
+            expiration_seconds=3600,
+            token_type="Bearer",
+        )
+
+
+def test_init_none_secret_key():
+    """None secret key should raise ImproperlyConfigured."""
+    with pytest.raises(ImproperlyConfigured, match="Secret key is required"):
+        JwtTokenService(
+            secret_key=None,
+            algorithm="HS256",
+            issuer="issuer",
+            audience="audience",
+            expiration_seconds=3600,
+            token_type="Bearer",
+        )
+
+
+def test_init_missing_algorithm():
+    """Missing algorithm should raise ImproperlyConfigured."""
+    with pytest.raises(ImproperlyConfigured, match="Algorithm is required"):
+        JwtTokenService(
+            secret_key="test-secret-padded-to-32-bytes!!",
+            algorithm="",
+            issuer="issuer",
+            audience="audience",
+            expiration_seconds=3600,
+            token_type="Bearer",
+        )
+
+
+def test_init_none_algorithm():
+    """None algorithm should raise ImproperlyConfigured."""
+    with pytest.raises(ImproperlyConfigured, match="Algorithm is required"):
+        JwtTokenService(
+            secret_key="test-secret-padded-to-32-bytes!!",
+            algorithm=None,
+            issuer="issuer",
+            audience="audience",
+            expiration_seconds=3600,
+            token_type="Bearer",
+        )
+
+
+def test_init_missing_token_type():
+    """Missing token type should raise ImproperlyConfigured."""
+    with pytest.raises(ImproperlyConfigured, match="Token's type is required"):
+        JwtTokenService(
+            secret_key="test-secret-padded-to-32-bytes!!",
+            algorithm="HS256",
+            issuer="issuer",
+            audience="audience",
+            expiration_seconds=3600,
+            token_type="",
+        )
+
+
+def test_init_none_token_type():
+    """None token type should raise ImproperlyConfigured."""
+    with pytest.raises(ImproperlyConfigured, match="Token's type is required"):
+        JwtTokenService(
+            secret_key="test-secret-padded-to-32-bytes!!",
+            algorithm="HS256",
+            issuer="issuer",
+            audience="audience",
+            expiration_seconds=3600,
+            token_type=None,
+        )
+
+
+def test_init_none_expiration_seconds():
+    """None expiration seconds should raise ImproperlyConfigured."""
+    with pytest.raises(ImproperlyConfigured, match="Expiration's seconds is required"):
+        JwtTokenService(
+            secret_key="test-secret-padded-to-32-bytes!!",
+            algorithm="HS256",
+            issuer="issuer",
+            audience="audience",
+            expiration_seconds=None,
+            token_type="Bearer",
+        )
+
+
+def test_init_zero_expiration_seconds_is_accepted():
+    """expiration_seconds=0 is falsy but should be accepted — token expires immediately."""
+    service = JwtTokenService(
+        secret_key="test-secret-padded-to-32-bytes!!",
+        algorithm="HS256",
+        issuer="issuer",
+        audience="audience",
+        expiration_seconds=0,
+        token_type="Bearer",
+    )
+    assert service._expiration_seconds == 0
+
+
+def test_init_stores_config_correctly():
+    """All config values should be stored correctly on the instance."""
+    service = JwtTokenService(
+        secret_key="test-secret-padded-to-32-bytes!!",
+        algorithm="HS256",
+        issuer="my-issuer",
+        audience="my-audience",
+        expiration_seconds=1800,
+        token_type="Bearer",
+    )
+    assert service._key == "test-secret-padded-to-32-bytes!!"
+    assert service._algorithm == "HS256"
+    assert service._issuer == "my-issuer"
+    assert service._audience == "my-audience"
+    assert service._expiration_seconds == 1800
+    assert service._token_type == "Bearer"
+
+
+# -- generate_jwt / Return shape --
+
+
+@freeze_time("2023-01-15 12:00:00")
+def test_generate_jwt_always_returns_required_keys(jwt_service, mock_user):
+    """Response always contains access_token, token_type, and expires_in."""
+    result = jwt_service.generate_jwt(mock_user, scope="read")
+
+    assert "access_token" in result
+    assert "token_type" in result
+    assert "expires_in" in result
+    assert result["token_type"] == "Bearer"
+    assert result["expires_in"] == 3600
+    assert isinstance(result["access_token"], str)
+
+
+@freeze_time("2023-01-15 12:00:00")
+def test_generate_jwt_scope_present_when_provided(jwt_service, mock_user):
+    """scope key should be present in response when scope is provided."""
+    result = jwt_service.generate_jwt(mock_user, scope="read write")
+
+    assert result["scope"] == "read write"
+
+
+@freeze_time("2023-01-15 12:00:00")
+def test_generate_jwt_scope_absent_when_empty(jwt_service, mock_user):
+    """scope key should be absent from response when scope is empty."""
+    result = jwt_service.generate_jwt(mock_user, scope="")
+
+    assert "scope" not in result
+
+
+@freeze_time("2023-01-15 12:00:00")
+def test_generate_jwt_scope_absent_when_none(jwt_service, mock_user):
+    """scope key should be absent from response when scope is None."""
+    result = jwt_service.generate_jwt(mock_user, scope=None)
+
+    assert "scope" not in result
+
+
+# -- generate_jwt / Payload correctness --
+
+
+@freeze_time("2023-01-15 12:00:00")
+def test_generate_jwt_payload_contains_required_claims(jwt_service, mock_user):
+    """Payload should always contain iat, exp, and user_id."""
+    result = jwt_service.generate_jwt(mock_user, scope="read")
+    payload = jwt_service.decode_jwt(result["access_token"])
+
+    assert payload["iat"] == 1673784000
+    assert payload["exp"] == 1673787600
+    assert payload["user_id"] == "test-user-id"
+
+
+@freeze_time("2023-01-15 12:00:00")
+def test_generate_jwt_exp_is_now_plus_expiration_seconds(mock_user):
+    """exp should equal iat + expiration_seconds exactly."""
+    service = JwtTokenService(
+        secret_key="test-secret-padded-to-32-bytes!!",
+        algorithm="HS256",
+        issuer="issuer",
+        audience="audience",
+        expiration_seconds=900,
+        token_type="Bearer",
+    )
+    result = service.generate_jwt(mock_user, scope="read")
+    payload = service.decode_jwt(result["access_token"])
+
+    assert payload["exp"] - payload["iat"] == 900
+
+
+@freeze_time("2023-01-15 12:00:00")
+def test_generate_jwt_iss_included_when_set(jwt_service, mock_user):
+    """iss should be present in payload when issuer is non-empty."""
+    result = jwt_service.generate_jwt(mock_user, scope="read")
+    payload = jwt_service.decode_jwt(result["access_token"])
+
+    assert payload["iss"] == "test-issuer"
+
+
+@freeze_time("2023-01-15 12:00:00")
+def test_generate_jwt_aud_included_when_set(jwt_service, mock_user):
+    """aud should be present in payload when audience is non-empty."""
+    result = jwt_service.generate_jwt(mock_user, scope="read")
+    payload = jwt_service.decode_jwt(result["access_token"])
+
+    assert payload["aud"] == "test-audience"
+
+
+@freeze_time("2023-01-15 12:00:00")
+def test_generate_jwt_iss_absent_when_empty(mock_user):
+    """iss should be absent from payload when issuer is empty string."""
+
+    service = JwtTokenService(
+        secret_key="test-secret-padded-to-32-bytes!!",
+        algorithm="HS256",
+        issuer="",
+        audience="",
+        expiration_seconds=3600,
+        token_type="Bearer",
+    )
+    result = service.generate_jwt(mock_user, scope="read")
+    payload = pyjwt.decode(
+        result["access_token"],
+        "test-secret-padded-to-32-bytes!!",
+        algorithms=["HS256"],
+        options={"verify_aud": False},
+    )
+
+    assert "iss" not in payload
+    assert "aud" not in payload
+
+
+@freeze_time("2023-01-15 12:00:00")
+def test_generate_jwt_iss_absent_when_none(mock_user):
+    """iss should be absent from payload when issuer is None."""
+
+    service = JwtTokenService(
+        secret_key="test-secret-padded-to-32-bytes!!",
+        algorithm="HS256",
+        issuer=None,
+        audience=None,
+        expiration_seconds=3600,
+        token_type="Bearer",
+    )
+    result = service.generate_jwt(mock_user, scope="read")
+    payload = pyjwt.decode(
+        result["access_token"],
+        "test-secret-padded-to-32-bytes!!",
+        algorithms=["HS256"],
+        options={"verify_aud": False},
+    )
+
+    assert "iss" not in payload
+    assert "aud" not in payload
+
+
+@freeze_time("2023-01-15 12:00:00")
+def test_generate_jwt_scope_absent_from_payload_when_empty(jwt_service, mock_user):
+    """scope should be absent from payload when not provided."""
+
+    result = jwt_service.generate_jwt(mock_user, scope="")
+    payload = pyjwt.decode(
+        result["access_token"],
+        "test-secret-padded-to-32-bytes!!",
+        algorithms=["HS256"],
+        issuer="test-issuer",
+        audience="test-audience",
+    )
+
+    assert "scope" not in payload
+
+
+# -- generate_jwt / extra_payload handling --
+
+
+@freeze_time("2023-01-15 12:00:00")
+def test_generate_jwt_extra_payload_none_does_not_crash(jwt_service, mock_user):
+    """extra_payload=None should not crash and produce a valid token."""
+    result = jwt_service.generate_jwt(mock_user, scope="read", extra_payload=None)
+    payload = jwt_service.decode_jwt(result["access_token"])
+
+    assert payload["user_id"] == "test-user-id"
+
+
+@freeze_time("2023-01-15 12:00:00")
+def test_generate_jwt_extra_payload_non_colliding_keys_preserved(
+    jwt_service, mock_user
+):
+    """Non-colliding extra_payload keys should appear in decoded token."""
+    result = jwt_service.generate_jwt(
+        mock_user,
+        scope="read",
+        extra_payload={"client_id": "my-app", "delegated": True},
+    )
+    payload = jwt_service.decode_jwt(result["access_token"])
+
+    assert payload["client_id"] == "my-app"
+    assert payload["delegated"] is True
+
+
+@freeze_time("2023-01-15 12:00:00")
+def test_generate_jwt_extra_payload_colliding_iat_overwritten(jwt_service, mock_user):
+    """iat in extra_payload should be overwritten by the service."""
+    result = jwt_service.generate_jwt(mock_user, scope="read", extra_payload={"iat": 0})
+    payload = jwt_service.decode_jwt(result["access_token"])
+
+    assert payload["iat"] == 1673784000
+
+
+@freeze_time("2023-01-15 12:00:00")
+def test_generate_jwt_extra_payload_colliding_exp_overwritten(jwt_service, mock_user):
+    """exp in extra_payload should be overwritten by the service."""
+    result = jwt_service.generate_jwt(
+        mock_user, scope="read", extra_payload={"exp": 9999999999}
+    )
+    payload = jwt_service.decode_jwt(result["access_token"])
+
+    assert payload["exp"] == 1673787600
+
+
+@freeze_time("2023-01-15 12:00:00")
+def test_generate_jwt_extra_payload_colliding_user_id_overwritten(
+    jwt_service, mock_user
+):
+    """user_id in extra_payload should be overwritten by the service."""
+    result = jwt_service.generate_jwt(
+        mock_user, scope="read", extra_payload={"user_id": "hacked"}
+    )
+    payload = jwt_service.decode_jwt(result["access_token"])
+
+    assert payload["user_id"] == "test-user-id"
+
+
+@freeze_time("2023-01-15 12:00:00")
+def test_generate_jwt_extra_payload_not_mutated(jwt_service, mock_user):
+    """generate_jwt should not mutate the original extra_payload dict."""
+    extra = {"client_id": "my-app"}
+    jwt_service.generate_jwt(mock_user, scope="read", extra_payload=extra)
+
+    assert extra == {"client_id": "my-app"}
+
+
+# -- generate_jwt / user.id casting --
+
+
+@freeze_time("2023-01-15 12:00:00")
+def test_generate_jwt_user_id_cast_from_uuid(jwt_service):
+    """user.id as UUID should be cast to str in payload."""
+    user = mock.Mock()
+    user.id = uuid.UUID("12345678-1234-5678-1234-567812345678")
+    result = jwt_service.generate_jwt(user, scope="read")
+    payload = jwt_service.decode_jwt(result["access_token"])
+
+    assert payload["user_id"] == "12345678-1234-5678-1234-567812345678"
+
+
+# -- decode_jwt / Happy path --
+
+
+def test_decode_jwt_roundtrip(jwt_service, mock_user):
+    """Valid token should decode to correct payload."""
+    with freeze_time("2023-01-15 12:00:00"):
+        result = jwt_service.generate_jwt(
+            mock_user, scope="read", extra_payload={"client_id": "my-app"}
+        )
+
+    with freeze_time("2023-01-15 12:30:00"):
+        payload = jwt_service.decode_jwt(result["access_token"])
+
+    assert payload["user_id"] == "test-user-id"
+    assert payload["scope"] == "read"
+    assert payload["client_id"] == "my-app"
+    assert payload["iss"] == "test-issuer"
+    assert payload["aud"] == "test-audience"
+
+
+# -- decode_jwt / Error mapping --
+
+
+def test_decode_jwt_expired_raises_token_expired_error(jwt_service, mock_user):
+    """Expired token should raise TokenExpiredError."""
+    with freeze_time("2023-01-15 12:00:00"):
+        result = jwt_service.generate_jwt(mock_user, scope="read")
+
+    with freeze_time("2099-01-01 00:00:00"):
+        with pytest.raises(TokenExpiredError):
+            jwt_service.decode_jwt(result["access_token"])
+
+
+def test_decode_jwt_wrong_issuer_raises_token_invalid_error(mock_user):
+    """Token with wrong issuer should raise TokenInvalidError."""
+    service_a = JwtTokenService(
+        secret_key="test-secret-padded-to-32-bytes!!",
+        algorithm="HS256",
+        issuer="issuer-a",
+        audience="audience",
+        expiration_seconds=3600,
+        token_type="Bearer",
+    )
+    service_b = JwtTokenService(
+        secret_key="test-secret-padded-to-32-bytes!!",
+        algorithm="HS256",
+        issuer="issuer-b",
+        audience="audience",
+        expiration_seconds=3600,
+        token_type="Bearer",
+    )
+    result = service_a.generate_jwt(mock_user, scope="read")
+
+    with pytest.raises(TokenInvalidError):
+        service_b.decode_jwt(result["access_token"])
+
+
+def test_decode_jwt_wrong_audience_raises_token_invalid_error(mock_user):
+    """Token with wrong audience should raise TokenInvalidError."""
+    service_a = JwtTokenService(
+        secret_key="test-secret-padded-to-32-bytes!!",
+        algorithm="HS256",
+        issuer="issuer",
+        audience="audience-a",
+        expiration_seconds=3600,
+        token_type="Bearer",
+    )
+    service_b = JwtTokenService(
+        secret_key="test-secret-padded-to-32-bytes!!",
+        algorithm="HS256",
+        issuer="issuer",
+        audience="audience-b",
+        expiration_seconds=3600,
+        token_type="Bearer",
+    )
+    result = service_a.generate_jwt(mock_user, scope="read")
+
+    with pytest.raises(TokenInvalidError):
+        service_b.decode_jwt(result["access_token"])
+
+
+def test_decode_jwt_tampered_signature_raises_token_decode_error(
+    jwt_service, mock_user
+):
+    """Token with tampered signature should raise TokenDecodeError."""
+    result = jwt_service.generate_jwt(mock_user, scope="read")
+    header, payload, _ = result["access_token"].split(".")
+    tampered_token = f"{header}.{payload}.invalidsignature"
+
+    with pytest.raises(TokenDecodeError):
+        jwt_service.decode_jwt(tampered_token)
+
+
+def test_decode_jwt_garbage_string_raises_token_decode_error(jwt_service):
+    """Garbage string should raise TokenDecodeError."""
+    with pytest.raises(TokenDecodeError):
+        jwt_service.decode_jwt("this.is.not.a.valid.token")
+
+
+def test_decode_jwt_empty_string_raises_token_decode_error(jwt_service):
+    """Empty string should raise TokenDecodeError."""
+    with pytest.raises(TokenDecodeError):
+        jwt_service.decode_jwt("")
+
+
+def test_decode_jwt_none_raises_token_decode_error(jwt_service):
+    """None should raise TokenDecodeError."""
+    with pytest.raises(TokenDecodeError):
+        jwt_service.decode_jwt(None)
+
+
+def test_algorithm_mismatch_raises_token_decode_error(mock_user):
+    """Token encoded with HS256 decoded expecting RS256 should raise TokenDecodeError."""
+    service_hs256 = JwtTokenService(
+        secret_key="test-secret-padded-to-32-bytes!!",
+        algorithm="HS256",
+        issuer="issuer",
+        audience="audience",
+        expiration_seconds=3600,
+        token_type="Bearer",
+    )
+    service_rs256 = JwtTokenService(
+        secret_key="test-secret-padded-to-32-bytes!!",
+        algorithm="RS256",
+        issuer="issuer",
+        audience="audience",
+        expiration_seconds=3600,
+        token_type="Bearer",
+    )
+    result = service_hs256.generate_jwt(mock_user, scope="read")
+
+    with pytest.raises(TokenDecodeError):
+        service_rs256.decode_jwt(result["access_token"])
@@ -269,6 +269,63 @@ def test_handle_egress_ended_recording_not_limit_reached(
    assert recording.status == "stopped"


+@mock.patch("core.services.livekit_events.MetadataCollectorService")
+@mock.patch("core.utils.update_room_metadata")
+def test_handle_egress_ended_calls_metadata_collector_stop_when_conditions_are_met(
+    mock_update_room_metadata, mock_collector_class, service, settings
+):
+    """Should call MetadataCollectorService.stop when it exists."""
+    settings.METADATA_COLLECTOR_ENABLED = True
+
+    recording = RecordingFactory(
+        worker_id="worker-1",
+        status="active",
+        options={"metadata_collector_dispatch_id": "dispatch-123"},
+    )
+    mock_data = mock.MagicMock()
+    mock_data.egress_info.egress_id = recording.worker_id
+    mock_data.egress_info.status = EgressStatus.EGRESS_COMPLETE
+
+    mock_collector = mock.Mock()
+    mock_collector_class.return_value = mock_collector
+
+    service._handle_egress_ended(mock_data)
+
+    mock_collector.stop.assert_called_once_with(recording)
+
+
+@pytest.mark.parametrize(
+    "metadata_enabled,options",
+    [
+        (True, {}),
+        (False, {}),
+    ],
+)
+@mock.patch("core.services.livekit_events.MetadataCollectorService")
+@mock.patch("core.utils.update_room_metadata")
+def test_handle_egress_ended_does_not_call_metadata_collector_stop_when_conditions_not_met(
+    _, mock_collector_class, metadata_enabled, options, service, settings
+):  # pylint: disable=too-many-arguments,too-many-positional-arguments
+    """Should not call MetadataCollectorService.stop when it does not exist."""
+    settings.METADATA_COLLECTOR_ENABLED = metadata_enabled
+
+    recording = RecordingFactory(
+        worker_id="worker-1",
+        status="active",
+        options=options,
+    )
+    mock_data = mock.MagicMock()
+    mock_data.egress_info.egress_id = recording.worker_id
+    mock_data.egress_info.status = EgressStatus.EGRESS_COMPLETE
+
+    mock_collector = mock.Mock()
+    mock_collector_class.return_value = mock_collector
+
+    service._handle_egress_ended(mock_data)
+
+    mock_collector.stop.assert_not_called()
+
+
@mock.patch.object(LobbyService, "clear_room_cache")
@mock.patch.object(TelephonyService, "delete_dispatch_rule")
 def test_handle_room_finished_clears_cache_and_deletes_dispatch_rule(
@@ -72,7 +72,7 @@ def test_create_dispatch_rule_api_failure(mock_client_factory):

    mock_api = create_mock_livekit_client()
    mock_api.sip.create_sip_dispatch_rule = mock.AsyncMock(
-        side_effect=TwirpError(msg="Internal server error", code=500, status=500)
+        side_effect=TwirpError(msg="Internal server error", code="unknown", status=500)
    )
    mock_client_factory.return_value = mock_api

@@ -177,7 +177,7 @@ def test_list_dispatch_rules_ids_api_failure(mock_client_factory):

    mock_api = create_mock_livekit_client()
    mock_api.sip.list_sip_dispatch_rule = mock.AsyncMock(
-        side_effect=TwirpError(msg="Internal server error", code=500, status=500)
+        side_effect=TwirpError(msg="Internal server error", code="unknown", status=500)
    )
    mock_client_factory.return_value = mock_api

@@ -270,7 +270,7 @@ def test_delete_dispatch_rule_partial_failure(mock_client_factory, mock_list_rul
        if call_count == 0:
            call_count += 1
            return None
-        raise TwirpError(msg="Deletion failed", code=500, status=500)
+        raise TwirpError(msg="Deletion failed", code="unknown", status=500)

    mock_api.sip.delete_sip_dispatch_rule = mock.AsyncMock(
        side_effect=delete_side_effect
@@ -294,7 +294,7 @@ def test_delete_dispatch_rule_api_failure(mock_client_factory, mock_list_rules):
    mock_list_rules.return_value = ["rule-1"]
    mock_api = create_mock_livekit_client()
    mock_api.sip.delete_sip_dispatch_rule = mock.AsyncMock(
-        side_effect=TwirpError(msg="Internal server error", code=500, status=500)
+        side_effect=TwirpError(msg="Internal server error", code="unknown", status=500)
    )
    mock_client_factory.return_value = mock_api

@@ -22,6 +22,28 @@ from core.models import ApplicationScope, RoleChoices, Room, RoomAccessLevel, Us
 pytestmark = pytest.mark.django_db


+def generate_addons_test_token(user, scopes, **overrides):
+    """Generate a valid JWT token signed with the addons secret for testing."""
+    now = datetime.now(timezone.utc)
+    scope_string = " ".join(scopes)
+
+    payload = {
+        "iss": settings.ADDONS_TOKEN_ISSUER,
+        "aud": settings.ADDONS_TOKEN_AUDIENCE,
+        "iat": now,
+        "exp": now + timedelta(seconds=settings.ADDONS_TOKEN_TTL),
+        "scope": scope_string,
+        "user_id": str(user.id),
+    }
+    payload.update(overrides)
+
+    return jwt.encode(
+        payload,
+        settings.ADDONS_TOKEN_SECRET_KEY,
+        algorithm=settings.ADDONS_TOKEN_ALG,
+    )
+
+
 def generate_test_token(user, scopes):
    """Generate a valid JWT token for testing."""
    now = datetime.now(timezone.utc)
@@ -123,6 +145,25 @@ def test_api_rooms_list_with_expired_token(settings):
    assert "expired" in str(response.data).lower()


+@mock.patch.object(ResourceServerAuthentication, "authenticate", return_value=None)
+def test_api_rooms_list_with_application_disabled(mock_rs_authenticate, settings):
+    """Listing rooms should return 401 when application is disabled."""
+
+    settings.APPLICATION_ENABLED = False
+
+    user = UserFactory()
+
+    # Generate expired token
+    token = generate_test_token(user, [ApplicationScope.ROOMS_LIST])
+
+    client = APIClient()
+    client.credentials(HTTP_AUTHORIZATION=f"Bearer {token}")
+    response = client.get("/external-api/v1.0/rooms/")
+
+    assert response.status_code == 401
+    mock_rs_authenticate.assert_called_once()
+
+
@responses.activate
 def test_api_rooms_list_with_invalid_rs_token(settings):
    """Listing rooms with invalid resource server token should return 400."""
@@ -713,7 +754,7 @@ def test_api_rooms_token_invalid_signature(mock_rs_authenticate, settings):
    }
    token = jwt.encode(
        payload,
-        "invalid-private-key",
+        "invalid-private-key-padded-to-32b!",
        algorithm=settings.APPLICATION_JWT_ALG,
    )

@@ -931,6 +972,11 @@ def test_api_rooms_token_inactive_application(settings):
    assert "application is disabled." in str(response.data).lower()


+# ==============================
+# Resource Server
+# ==============================
+
+
@responses.activate
 def test_resource_server_creates_user_on_first_authentication(settings):
    """New user should be created during first authentication.
@@ -1106,6 +1152,64 @@ def test_resource_server_authentication_successful(settings):
    assert expected_ids == results_id


+@responses.activate
+def test_resource_server_authentication_successful_when_application_disabled(settings):
+    """Resource server should keep working when the application auth backend is disabled."""
+
+    settings.APPLICATION_ENABLED = False
+
+    user = UserFactory(sub="very-specific-sub")
+    other_user = UserFactory()
+
+    RoomFactory(access_level=RoomAccessLevel.PUBLIC)
+    RoomFactory(access_level=RoomAccessLevel.TRUSTED)
+    RoomFactory(access_level=RoomAccessLevel.RESTRICTED)
+    room_user_accesses = RoomFactory(
+        access_level=RoomAccessLevel.RESTRICTED, users=[user]
+    )
+    RoomFactory(access_level=RoomAccessLevel.RESTRICTED, users=[other_user])
+
+    assert (
+        settings.OIDC_RS_BACKEND_CLASS
+        == "core.external_api.authentication.ResourceServerBackend"
+    )
+
+    settings.OIDC_RS_CLIENT_ID = "some_client_id"
+    settings.OIDC_RS_CLIENT_SECRET = "some_client_secret"
+    settings.OIDC_RS_SCOPES_PREFIX = "lasuite_meet"
+
+    settings.OIDC_OP_URL = "https://oidc.example.com"
+    settings.OIDC_VERIFY_SSL = False
+    settings.OIDC_TIMEOUT = 5
+    settings.OIDC_PROXY = None
+    settings.OIDC_OP_JWKS_ENDPOINT = "https://oidc.example.com/jwks"
+    settings.OIDC_OP_INTROSPECTION_ENDPOINT = "https://oidc.example.com/introspect"
+
+    responses.add(
+        responses.POST,
+        "https://oidc.example.com/introspect",
+        json={
+            "iss": "https://oidc.example.com",
+            "aud": "some_client_id",  # settings.OIDC_RS_CLIENT_ID
+            "sub": "very-specific-sub",
+            "client_id": "some_service_provider",
+            "scope": "openid lasuite_meet lasuite_meet:rooms:list lasuite_meet:rooms:retrieve",
+            "active": True,
+        },
+    )
+
+    client = APIClient()
+    client.credentials(HTTP_AUTHORIZATION="Bearer some_token")
+    response = client.get("/external-api/v1.0/rooms/")
+
+    assert response.status_code == 200
+    results = response.json()["results"]
+    assert len(results) == 1
+    expected_ids = {str(room_user_accesses.id)}
+    results_id = {result["id"] for result in results}
+    assert expected_ids == results_id
+
+
@responses.activate
 def test_resource_server_denies_access_with_insufficient_scopes(settings):
    """Requests should be denied when the token lacks required scopes.
@@ -1147,3 +1251,245 @@ def test_resource_server_denies_access_with_insufficient_scopes(settings):
    response = client.get("/external-api/v1.0/rooms/")

    assert response.status_code == 403
+
+
+# ==============================
+# Addons
+# ==============================
+
+
+def test_api_rooms_list_with_valid_addons_token():
+    """Listing rooms with a valid addons token should succeed."""
+    user = UserFactory()
+    room = RoomFactory(users=[(user, RoleChoices.OWNER)])
+
+    token = generate_addons_test_token(user, [ApplicationScope.ROOMS_LIST])
+
+    client = APIClient()
+    client.credentials(HTTP_AUTHORIZATION=f"Bearer {token}")
+    response = client.get("/external-api/v1.0/rooms/")
+
+    assert response.status_code == 200
+    assert response.data["count"] == 1
+    assert response.data["results"][0]["id"] == str(room.id)
+
+
+def test_api_rooms_retrieve_with_valid_addons_token():
+    """Retrieving a room with a valid addons token should succeed."""
+    user = UserFactory()
+    room = RoomFactory(users=[(user, RoleChoices.OWNER)])
+
+    token = generate_addons_test_token(user, [ApplicationScope.ROOMS_RETRIEVE])
+
+    client = APIClient()
+    client.credentials(HTTP_AUTHORIZATION=f"Bearer {token}")
+    response = client.get(f"/external-api/v1.0/rooms/{room.id}/")
+
+    assert response.status_code == 200
+    assert response.data["id"] == str(room.id)
+
+
+def test_api_rooms_create_with_valid_addons_token():
+    """Creating a room with a valid addons token should succeed."""
+    user = UserFactory()
+
+    token = generate_addons_test_token(user, [ApplicationScope.ROOMS_CREATE])
+
+    client = APIClient()
+    client.credentials(HTTP_AUTHORIZATION=f"Bearer {token}")
+    response = client.post("/external-api/v1.0/rooms/", {}, format="json")
+
+    assert response.status_code == 201
+    room = Room.objects.get(id=response.data["id"])
+    assert room.get_role(user) == RoleChoices.OWNER
+
+
+def test_api_rooms_addons_token_inactive_user():
+    """Addons token for an inactive user should return 401."""
+    user = UserFactory(is_active=False)
+    RoomFactory(users=[(user, RoleChoices.OWNER)])
+
+    token = generate_addons_test_token(user, [ApplicationScope.ROOMS_LIST])
+
+    client = APIClient()
+    client.credentials(HTTP_AUTHORIZATION=f"Bearer {token}")
+    response = client.get("/external-api/v1.0/rooms/")
+
+    assert response.status_code == 401
+    assert "user account is disabled" in str(response.data).lower()
+
+
+def test_api_rooms_addons_token_expired(settings):
+    """Listing rooms with an expired addons token should return 401."""
+    settings.ADDONS_TOKEN_TTL = 0
+
+    user = UserFactory()
+    token = generate_addons_test_token(user, [ApplicationScope.ROOMS_LIST])
+
+    client = APIClient()
+    client.credentials(HTTP_AUTHORIZATION=f"Bearer {token}")
+    response = client.get("/external-api/v1.0/rooms/")
+
+    assert response.status_code == 401
+    assert "expired" in str(response.data).lower()
+
+
+def test_api_rooms_addons_token_missing_user_id(settings):
+    """Addons token without user_id should be rejected."""
+
+    # Re-encode without user_id
+    now = datetime.now(timezone.utc)
+    payload = {
+        "iss": settings.ADDONS_TOKEN_ISSUER,
+        "aud": settings.ADDONS_TOKEN_AUDIENCE,
+        "iat": now,
+        "exp": now + timedelta(hours=1),
+        "scope": "rooms:list",
+        # no user_id
+    }
+    token = jwt.encode(
+        payload,
+        settings.ADDONS_TOKEN_SECRET_KEY,
+        algorithm=settings.ADDONS_TOKEN_ALG,
+    )
+
+    client = APIClient()
+    client.credentials(HTTP_AUTHORIZATION=f"Bearer {token}")
+    response = client.get("/external-api/v1.0/rooms/")
+
+    assert response.status_code == 401
+    assert "invalid token claims." in str(response.data).lower()
+
+
+def test_api_rooms_addons_token_invalid_audience(settings):
+    """Addons token with an invalid audience should be rejected."""
+    user = UserFactory()
+
+    now = datetime.now(timezone.utc)
+    payload = {
+        "iss": settings.ADDONS_TOKEN_ISSUER,
+        "aud": "invalid-audience",
+        "iat": now,
+        "exp": now + timedelta(hours=1),
+        "user_id": str(user.id),
+        "scope": "rooms:list",
+    }
+    token = jwt.encode(
+        payload,
+        settings.ADDONS_TOKEN_SECRET_KEY,
+        algorithm=settings.ADDONS_TOKEN_ALG,
+    )
+
+    client = APIClient()
+    client.credentials(HTTP_AUTHORIZATION=f"Bearer {token}")
+    response = client.get("/external-api/v1.0/rooms/")
+
+    assert response.status_code == 401
+    assert "invalid token." in str(response.data).lower()
+
+
+def test_api_rooms_addons_token_unknown_user(settings):
+    """Addons token for an unknown user should be rejected."""
+    now = datetime.now(timezone.utc)
+    payload = {
+        "iss": settings.ADDONS_TOKEN_ISSUER,
+        "aud": settings.ADDONS_TOKEN_AUDIENCE,
+        "iat": now,
+        "exp": now + timedelta(hours=1),
+        "user_id": str(uuid.uuid4()),
+        "scope": "rooms:list",
+    }
+    token = jwt.encode(
+        payload,
+        settings.ADDONS_TOKEN_SECRET_KEY,
+        algorithm=settings.ADDONS_TOKEN_ALG,
+    )
+
+    client = APIClient()
+    client.credentials(HTTP_AUTHORIZATION=f"Bearer {token}")
+    response = client.get("/external-api/v1.0/rooms/")
+
+    assert response.status_code == 401
+    assert "user not found." in str(response.data).lower()
+
+
+def test_api_rooms_addons_token_missing_scope():
+    """Addons token without required scope should return 403."""
+    user = UserFactory()
+
+    token = generate_addons_test_token(user, [ApplicationScope.ROOMS_CREATE])
+
+    client = APIClient()
+    client.credentials(HTTP_AUTHORIZATION=f"Bearer {token}")
+    response = client.get("/external-api/v1.0/rooms/")
+
+    assert response.status_code == 403
+    assert (
+        "insufficient permissions. required scope: rooms:list"
+        in str(response.data).lower()
+    )
+
+
+@mock.patch.object(ResourceServerAuthentication, "authenticate", return_value=None)
+def test_api_rooms_addons_token_invalid_signature(mock_rs_authenticate, settings):
+    """Addons token signed with a wrong key should defer to the next authentication."""
+    user = UserFactory()
+
+    now = datetime.now(timezone.utc)
+    payload = {
+        "iss": settings.ADDONS_TOKEN_ISSUER,
+        "aud": settings.ADDONS_TOKEN_AUDIENCE,
+        "iat": now,
+        "exp": now + timedelta(hours=1),
+        "user_id": str(user.id),
+        "scope": "rooms:list",
+    }
+    token = jwt.encode(
+        payload,
+        "invalid-private-key-padded-to-32b!",
+        algorithm=settings.ADDONS_TOKEN_ALG,
+    )
+
+    client = APIClient()
+    client.credentials(HTTP_AUTHORIZATION=f"Bearer {token}")
+    response = client.get("/external-api/v1.0/rooms/")
+
+    mock_rs_authenticate.assert_called()
+    assert response.status_code == 401
+
+
+@mock.patch.object(ResourceServerAuthentication, "authenticate", return_value=None)
+def test_api_rooms_addons_disabled_defers_to_next_backend(
+    mock_rs_authenticate, settings
+):
+    """When ADDONS_ENABLED is False, a valid addons token should defer to the next backend."""
+    settings.ADDONS_ENABLED = False
+
+    user = UserFactory()
+    token = generate_addons_test_token(user, [ApplicationScope.ROOMS_LIST])
+
+    client = APIClient()
+    client.credentials(HTTP_AUTHORIZATION=f"Bearer {token}")
+    response = client.get("/external-api/v1.0/rooms/")
+
+    mock_rs_authenticate.assert_called()
+    assert response.status_code == 401
+
+
+def test_api_rooms_addons_disabled_does_not_break_application_auth(settings):
+    """Disabling addons auth should not affect ApplicationJWTAuthentication."""
+    settings.ADDONS_ENABLED = False
+
+    user = UserFactory()
+    room = RoomFactory(users=[(user, RoleChoices.OWNER)])
+
+    # Use the existing application token helper — that backend should still work
+    token = generate_test_token(user, [ApplicationScope.ROOMS_LIST])
+
+    client = APIClient()
+    client.credentials(HTTP_AUTHORIZATION=f"Bearer {token}")
+    response = client.get("/external-api/v1.0/rooms/")
+
+    assert response.status_code == 200
+    assert response.data["count"] == 1
+    assert response.data["results"][0]["id"] == str(room.id)
@@ -19,6 +19,35 @@ from core.models import ApplicationScope, User
 pytestmark = pytest.mark.django_db


+def test_api_applications_generate_token_application_disabled(settings):
+    """When APPLICATION_ENABLED is False, the endpoint should return 404."""
+    settings.APPLICATION_ENABLED = False
+
+    user = UserFactory(email="user@example.com")
+    application = ApplicationFactory(
+        is_active=True,
+        scopes=[ApplicationScope.ROOMS_LIST],
+    )
+
+    plain_secret = "test-secret-123"
+    application.client_secret = plain_secret
+    application.save()
+
+    client = APIClient()
+    response = client.post(
+        "/external-api/v1.0/application/token/",
+        {
+            "client_id": application.client_id,
+            "client_secret": plain_secret,
+            "grant_type": "client_credentials",
+            "scope": user.email,
+        },
+        format="json",
+    )
+
+    assert response.status_code == 404
+
+
 def test_api_applications_generate_token_success(settings):
    """Valid credentials should return a JWT token."""
    UserFactory(email="User.Family@example.com")
@@ -4,8 +4,9 @@ from django.conf import settings
 from django.urls import include, path

 from lasuite.oidc_login.urls import urlpatterns as oidc_urls
-from rest_framework.routers import DefaultRouter
+from rest_framework.routers import DefaultRouter, SimpleRouter

+from core.addons import viewsets as addons_viewsets
 from core.api import get_frontend_configuration, viewsets
 from core.external_api import viewsets as external_viewsets

@@ -18,15 +19,19 @@ router.register("files", viewsets.FileViewSet, basename="files")
 router.register(
    "resource-accesses", viewsets.ResourceAccessViewSet, basename="resource_accesses"
 )
+router.register(
+    "addons/sessions",
+    addons_viewsets.SessionViewSet,
+    basename="addons_sessions",
+)

 # - External API
-external_router = DefaultRouter()
+external_router = SimpleRouter()
 external_router.register(
    "application",
    external_viewsets.ApplicationViewSet,
    basename="external_application",
 )
-
 external_router.register(
    "rooms",
    external_viewsets.RoomViewSet,
@@ -96,7 +96,7 @@ def generate_token(
        room=room,
        room_join=True,
        room_admin=is_admin_or_owner,
-        can_update_own_metadata=True,
+        can_update_own_metadata=False,
        can_publish=bool(sources),
        can_publish_sources=sources,
        can_subscribe=True,
@@ -8,7 +8,7 @@ msgid ""
 msgstr ""
 "Project-Id-Version: PACKAGE VERSION\n"
 "Report-Msgid-Bugs-To: \n"
-"POT-Creation-Date: 2026-03-12 13:46+0000\n"
+"POT-Creation-Date: 2026-04-21 14:09+0000\n"
 "PO-Revision-Date: YEAR-MO-DA HO:MI+ZONE\n"
 "Last-Translator: FULL NAME <EMAIL@ADDRESS>\n"
 "Language-Team: LANGUAGE <LL@li.org>\n"
@@ -94,11 +94,11 @@ msgstr ""
 "Sie müssen Administrator oder Eigentümer eines Raums sein, um Zugriffe "
 "hinzuzufügen."

-#: core/api/serializers.py:516
+#: core/api/serializers.py:509
 msgid "This file extension is not allowed."
 msgstr "Diese Dateiendung ist nicht erlaubt."

-#: core/api/serializers.py:533
+#: core/api/viewsets.py:1090
 msgid "You have reached the maximum number of files for this type."
 msgstr "Sie haben die maximale Anzahl an Dateien dieses Typs erreicht."

@@ -8,7 +8,7 @@ msgid ""
 msgstr ""
 "Project-Id-Version: PACKAGE VERSION\n"
 "Report-Msgid-Bugs-To: \n"
-"POT-Creation-Date: 2026-03-12 13:46+0000\n"
+"POT-Creation-Date: 2026-04-21 14:09+0000\n"
 "PO-Revision-Date: YEAR-MO-DA HO:MI+ZONE\n"
 "Last-Translator: FULL NAME <EMAIL@ADDRESS>\n"
 "Language-Team: LANGUAGE <LL@li.org>\n"
@@ -92,11 +92,11 @@ msgstr "Creator is me"
 msgid "You must be administrator or owner of a room to add accesses to it."
 msgstr "You must be administrator or owner of a room to add accesses to it."

-#: core/api/serializers.py:516
+#: core/api/serializers.py:509
 msgid "This file extension is not allowed."
 msgstr "This file extension is not allowed."

-#: core/api/serializers.py:533
+#: core/api/viewsets.py:1090
 msgid "You have reached the maximum number of files for this type."
 msgstr "You have reached the maximum number of files for this type."

@@ -8,7 +8,7 @@ msgid ""
 msgstr ""
 "Project-Id-Version: PACKAGE VERSION\n"
 "Report-Msgid-Bugs-To: \n"
-"POT-Creation-Date: 2026-03-12 13:46+0000\n"
+"POT-Creation-Date: 2026-04-21 14:09+0000\n"
 "PO-Revision-Date: YEAR-MO-DA HO:MI+ZONE\n"
 "Last-Translator: antoine.lebaud@mail.numerique.gouv.fr\n"
 "Language-Team: LANGUAGE <LL@li.org>\n"
@@ -95,11 +95,11 @@ msgstr ""
 "Vous devez être administrateur ou propriétaire d'une salle pour y ajouter "
 "des accès."

-#: core/api/serializers.py:516
+#: core/api/serializers.py:509
 msgid "This file extension is not allowed."
 msgstr "Cette extension n'est pas autorisée"

-#: core/api/serializers.py:533
+#: core/api/viewsets.py:1090
 msgid "You have reached the maximum number of files for this type."
 msgstr "Vous avez atteint le nombre maximum de fichiers de ce type"

@@ -8,7 +8,7 @@ msgid ""
 msgstr ""
 "Project-Id-Version: PACKAGE VERSION\n"
 "Report-Msgid-Bugs-To: \n"
-"POT-Creation-Date: 2026-03-12 13:46+0000\n"
+"POT-Creation-Date: 2026-04-21 14:09+0000\n"
 "PO-Revision-Date: YEAR-MO-DA HO:MI+ZONE\n"
 "Last-Translator: FULL NAME <EMAIL@ADDRESS>\n"
 "Language-Team: LANGUAGE <LL@li.org>\n"
@@ -93,11 +93,11 @@ msgid "You must be administrator or owner of a room to add accesses to it."
 msgstr ""
 "Je moet beheerder of eigenaar van een ruimte zijn om toegang toe te voegen."

-#: core/api/serializers.py:516
+#: core/api/serializers.py:509
 msgid "This file extension is not allowed."
 msgstr "Deze bestandsextensie is niet toegestaan."

-#: core/api/serializers.py:533
+#: core/api/viewsets.py:1090
 msgid "You have reached the maximum number of files for this type."
 msgstr "Het maximale aantal bestanden voor dit type is bereikt."

@@ -452,7 +452,11 @@ class Base(Configuration):
    CELERY_BROKER_TRANSPORT_OPTIONS = values.DictValue({}, environ_prefix=None)

    # Session
-    SESSION_ENGINE = "django.contrib.sessions.backends.cache"
+    SESSION_ENGINE = values.Value(
+        default="django.contrib.sessions.backends.cache",
+        environ_name="SESSION_ENGINE",
+        environ_prefix=None,
+    )
    SESSION_CACHE_ALIAS = "default"
    SESSION_COOKIE_AGE = values.PositiveIntegerValue(
        default=60 * 60 * 12, environ_name="SESSION_COOKIE_AGE", environ_prefix=None
@@ -804,7 +808,20 @@ class Base(Configuration):
        environ_prefix=None,
    )

+    # Metadata collector settings
+    METADATA_COLLECTOR_ENABLED = values.BooleanValue(
+        False, environ_name="METADATA_COLLECTOR_ENABLED", environ_prefix=None
+    )
+    METADATA_COLLECTOR_AGENT_NAME = values.Value(
+        "metadata-collector",
+        environ_name="METADATA_COLLECTOR_AGENT_NAME",
+        environ_prefix=None,
+    )
+
    # External Applications
+    APPLICATION_ENABLED = values.BooleanValue(
+        False, environ_name="APPLICATION_ENABLED", environ_prefix=None
+    )
    APPLICATION_CLIENT_ID_LENGTH = values.PositiveIntegerValue(
        40,
        environ_name="APPLICATION_CLIENT_ID_LENGTH",
@@ -857,6 +874,88 @@ class Base(Configuration):
        environ_prefix=None,
    )

+    # Addons
+    ADDONS_ENABLED = values.BooleanValue(
+        False,
+        environ_name="ADDONS_ENABLED",
+        environ_prefix=None,
+    )
+    ADDONS_SESSION_TTL = values.PositiveIntegerValue(
+        3600,
+        environ_name="ADDONS_SESSION_TTL",
+        environ_prefix=None,
+    )
+    ADDONS_TRANSIT_TOKEN_TTL = values.PositiveIntegerValue(
+        120,
+        environ_name="ADDONS_TRANSIT_TOKEN_TTL",
+        environ_prefix=None,
+    )
+    ADDONS_CSRF_SECRET = SecretFileValue(
+        None,
+        environ_name="ADDONS_CSRF_SECRET",
+        environ_prefix=None,
+    )
+    ADDONS_CACHE_PREFIX_SESSION = values.Value(
+        "sid",
+        environ_name="ADDONS_CACHE_PREFIX_SESSION",
+        environ_prefix=None,
+    )
+    ADDONS_CACHE_PREFIX_TRANSIT = values.Value(
+        "transit",
+        environ_name="ADDONS_CACHE_PREFIX_TRANSIT",
+        environ_prefix=None,
+    )
+    ADDONS_TOKEN_AUDIENCE = values.Value(
+        "addons",
+        environ_name="ADDONS_TOKEN_AUDIENCE",
+        environ_prefix=None,
+    )
+    ADDONS_TOKEN_ISSUER = values.Value(
+        "lasuite-meet",
+        environ_name="ADDONS_TOKEN_ISSUER",
+        environ_prefix=None,
+    )
+    ADDONS_TOKEN_TTL = values.PositiveIntegerValue(
+        7200,
+        environ_name="ADDONS_TOKEN_TTL",
+        environ_prefix=None,
+    )
+    ADDONS_TOKEN_ALG = values.Value(
+        "HS256",
+        environ_name="ADDONS_TOKEN_ALG",
+        environ_prefix=None,
+    )
+    ADDONS_TOKEN_TYPE = values.Value(
+        "Bearer",
+        environ_name="ADDONS_TOKEN_TYPE",
+        environ_prefix=None,
+    )
+    ADDONS_TOKEN_SECRET_KEY = SecretFileValue(
+        None,
+        environ_name="ADDONS_TOKEN_SECRET_KEY",
+        environ_prefix=None,
+    )
+    ADDONS_TOKEN_SCOPE = values.Value(
+        "rooms:create",
+        environ_name="ADDONS_TOKEN_SCOPE",
+        environ_prefix=None,
+    )
+    ADDONS_RANDOM_TOKEN_BYTE_LENGTH = values.PositiveIntegerValue(
+        60,
+        environ_name="ADDONS_RANDOM_TOKEN_BYTE_LENGTH",
+        environ_prefix=None,
+    )
+    ADDONS_SESSION_ID_COOKIE = values.Value(
+        "addonsSid",
+        environ_name="ADDONS_SESSION_ID_COOKIE",
+        environ_prefix=None,
+    )
+    ADDONS_PENDING_SESSION_KEY = values.Value(
+        "addons_sid",
+        environ_name="ADDONS_PENDING_SESSION_KEY",
+        environ_prefix=None,
+    )
+
    # pylint: disable=invalid-name
    @property
    def ENVIRONMENT(self):
@@ -977,12 +1076,23 @@ class Test(Base):
    USE_SWAGGER = True
    EXTERNAL_API_ENABLED = True

-    APPLICATION_JWT_SECRET_KEY = "devKey"  # noqa:S105
+    LIVEKIT_CONFIGURATION = {
+        "api_key": "devkey-padded-for-minimum-len!-livekit",
+        "api_secret": "secret-key-padded-for-minimum-len!-livekit",
+        "url": "http://127.0.0.1.nip.io:7880",
+    }
+
+    APPLICATION_ENABLED = True
+    APPLICATION_JWT_SECRET_KEY = "secret-key-padded-for-minimum-len!-application"  # noqa:S105
    APPLICATION_JWT_AUDIENCE = "Test inc."

    CELERY_TASK_ALWAYS_EAGER = True
    FILE_UPLOAD_ENABLED = True

+    ADDONS_ENABLED = True
+    ADDONS_CSRF_SECRET = "secret-key-padded-for-minimum-len!-addons"  # noqa:S105
+    ADDONS_TOKEN_SECRET_KEY = "secret-key-padded-for-minimum-len!-addons"  # noqa:S105
+
    def __init__(self):
        # pylint: disable=invalid-name
        self.INSTALLED_APPS += ["drf_spectacular_sidecar"]
@@ -7,7 +7,7 @@ build-backend = "uv_build"

 [project]
 name = "meet"
-version = "1.11.0"
+version = "1.15.0"
 authors = [{ "name" = "DINUM", "email" = "dev@mail.numerique.gouv.fr" }]
 classifiers = [
    "Development Status :: 5 - Production/Stable",
@@ -24,43 +24,43 @@ keywords = ["Django", "Contacts", "Templates", "RBAC"]
 license = "MIT"
 requires-python = ">=3.13"
 dependencies = [
-    "boto3==1.42.49",
+    "boto3==1.42.68",
    "Brotli==1.2.0",
    "brevo-python==1.2.0",
    "celery[redis]==5.6.2",
-    "dj-database-url==3.1.0",
+    "dj-database-url==3.1.2",
    "django-configurations==2.5.1",
    "django-cors-headers==4.9.0",
    "django-countries==8.2.0",
    "django-filter==25.2",
-    "django-lasuite[all]==0.0.24",
+    "django-lasuite[all]==0.0.26",
    "django-parler==2.3",
    "redis==5.2.1",
    "django-redis==6.0.0",
    "django-storages[s3]==1.14.6",
    "django-timezone-field>=5.1",
    "django-pydantic-field==0.5.4",
-    "django==5.2.12",
+    "django==5.2.13",
    "djangorestframework==3.16.1",
    "drf_spectacular==0.29.0",
-    "dockerflow==2026.1.26",
+    "dockerflow==2026.3.4",
    "easy_thumbnails==2.10.1",
    "factory_boy==3.3.3",
    "gunicorn==25.1.0",
    "jsonschema==4.26.0",
    "markdown==3.10.2",
    "nested-multipart-parser==1.6.0",
-    "psycopg[binary]==3.3.2",
-    "pydantic==2.12.4",
-    "PyJWT==2.12.0",
+    "psycopg[binary]==3.3.3",
+    "pydantic==2.12.5",
+    "PyJWT==2.12.1",
    "python-frontmatter==1.1.0",
    "python-magic==0.4.27",
-    "requests==2.32.5",
-    "sentry-sdk==2.53.0",
-    "whitenoise==6.11.0",
+    "requests==2.33.0",
+    "sentry-sdk==2.54.0",
+    "whitenoise==6.12.0",
    "mozilla-django-oidc==5.0.2",
    "livekit-api==1.1.0",
-    "aiohttp==3.13.3",
+    "aiohttp==3.13.4",
 ]

 [project.urls]
@@ -72,24 +72,29 @@ dependencies = [
 [dependency-groups]
 dev = [
    "django-extensions==4.1",
-    "drf-spectacular-sidecar==2026.1.1",
+    "drf-spectacular-sidecar==2026.3.1",
    "freezegun==1.5.5",
    "ipdb==0.13.13",
-    "ipython==9.10.0",
-    "pyfakefs==6.1.1",
+    "ipython==9.11.0",
+    "pyfakefs==6.1.5",
    "pylint-django==2.7.0",
    "pylint<4.0.0",
    "pytest-cov==7.0.0",
    "pytest-django==4.12.0",
-    "pytest==9.0.2",
+    "pytest==9.0.3",
    "pytest-icdiff==0.9",
    "pytest-xdist==3.8.0",
-    "responses==0.25.8",
-    "ruff==0.15.1",
+    "responses==0.26.0",
+    "ruff==0.15.6",
    "types-requests==2.32.4.20260107",
 ]

 [tool.uv.build-backend]
+module-name = [
+    "core",
+    "demo",
+    "meet"
+]
 module-root = ""
 source-exclude = [
    "**/tests/**",
--- a/Show More
+++ b/Show More