🔖(helm) release chart 0.0.29

The script hardcoded #!/bin/bash, which does not exist on NixOS.
The script was also reformated with 2-space indentation.

.gitignore

@@ -89,3 +89,4 @@ docker/livekit/rootCA.pem
 
 # NixOS
 .devenv
+.pre-commit-config.yaml

.gitlint

@@ -22,6 +22,9 @@
 # See http://jorisroovers.github.io/gitlint/user_defined_rules for details
 extra-path=gitlint/
 
+# Use "search" semantics for regexes (gitlint's future default)
+regex-style-search=True
+
 # [title-max-length]
 # line-length=80
 

CHANGELOG.md

@@ -10,8 +10,40 @@ and this project adheres to
 
 ### Added
 
+### Changed
+
+- 🔖(helm) release chart 0.0.28
+
+### Fixed
+
+## [1.36.0] - 2026-10-20
+
+### Added
+
+- ⚡️(backend) add UPPER(email) index for case-insensitive user lookups
+- ✨(backend) add room soft-deletion to the external API
+- ✨(all) allow any authenticated user to start a recording
+- ✨(backend) authenticate external API calls with Menshen exchanged tokens
+- ✨(backend) audit Menshen calls and users created from introspected tokens
+
+### Fixed
+
+- 🔒️(frontend) upgrade libx11 to fix CVE-2026-88806
+- 🔒️(backend) throttle the start recording endpoint
+- 🐛(backend) put a timeout on every LiveKit API call
+- 🔒️(backend) upgrade aiohttp to 3.14.5 to fix CVE-2026-111064
+- ♿️(frontend) announce the microphone turning off on shortcut #1816
+- 🐛(release) use env bash in prepare-release script for NixOS
+
+## [1.35.0] - 2026-10-13
+
+### Added
+
 - ✨(frontend) let users pick the recording encoding
 - ✨(backend) introduce a token exchange endpoint for iframe embeds
+- ⚡️(backend) send recording notification emails from a Celery task
+- ✨(backend) allow static feature flags without an analytics backend #1809
+- ⚡️(backend) add an opt-in psycopg connection pool
 
 ### Changed
 
@@ -20,6 +52,7 @@ and this project adheres to
 - ♻️️️(backend) use a dedicated auth scheme for LiveKit token auth
 - ♻️(all) stop relying on cookies for the lobby flow
 - ♿️(frontend) show a visible focus outline on menu items #1797
+- ⬆️(backend) upgrade pylint to 4.1.3
 
 ### Fixed
 
@@ -43,6 +76,11 @@ and this project adheres to
 - ✨(backend) expose `allow_unregistered_rooms` in the frontend configuration
 - ✅(frontend) add vitest so the frontend can carry unit tests
 - ♿️(frontend) make participant pagination readable and keyboard reachable #1775
+- ✨(backend) add structured audit logging facility
+- ✨(backend) audit external API token and room operations
+- 🔒️(backend) audit writes and bulk actions made in the Django admin
+- ✨(backend) audit recordings, transcripts and summaries
+- ✨(backend) audit transit code issuance and exchange
 
 ### Changed
 

UPGRADE.md

@@ -16,6 +16,21 @@ the following command inside your docker container:
 
 ## [Unreleased]
 
+### Purging deleted rooms
+
+Deleting a room now only soft deletes it: it is hidden but keeps its slug and PIN code. The `purge_inactive_rooms` command also permanently deletes soft-deleted rooms. See [the room purge documentation](docs/features/room-purge.md).
+
+- Inactive soft-deleted rooms are purged along with the other inactive rooms: if `ROOM_INACTIVITY_DELETION_DAYS` is already set, nothing else is needed.
+- The new `ROOM_DELETED_RETENTION_DAYS` setting purges soft-deleted rooms that many days after their deletion, whether they are inactive or not. It is unset by default.
+- As for inactive rooms, a deleted room holding a saved recording its users may still access is kept until that recording expires.
+
+### Recording permission
+
+We've introduced the ability for any authenticated participant to start a recording or transcription, but this behavior remains configurable.
+You can keep recording and transcription restricted to room admins and owners by setting `RECORDING_AUTHENTICATED_PARTICIPANTS_ENABLED` to `false`.
+
+## [v1.34.0]
+
 ### Marketing / Brevo integration now uses `django-lasuite`
 
 The in-house marketing service (`core.services.marketing`) has been removed and

bin/prepare-release.sh

@@ -1,6 +1,6 @@
-#!/bin/bash
+#!/usr/bin/env bash
 
-set -e  # Exit on error
+set -e # Exit on error
 
 # Colors for output
 RED='\033[0;31m'
@@ -10,60 +10,59 @@ NC='\033[0m' # No Color
 
 # Function to print colored output
 print_info() {
-    echo -e "${GREEN}[INFO]${NC} $1"
+  echo -e "${GREEN}[INFO]${NC} $1"
 }
 
 print_error() {
-    echo -e "${RED}[ERROR]${NC} $1"
+  echo -e "${RED}[ERROR]${NC} $1"
 }
 
 print_warning() {
-    echo -e "${YELLOW}[WARNING]${NC} $1"
+  echo -e "${YELLOW}[WARNING]${NC} $1"
 }
 
-
 # Function to update npm package version
 update_npm_version() {
-    local component=$1
-    print_info "Updating $component version..."
-    cd "src/$component"
-    npm version "$VERSION" --no-git-tag-version
-    cd -
+  local component=$1
+  print_info "Updating $component version..."
+  cd "src/$component"
+  npm version "$VERSION" --no-git-tag-version
+  cd -
 }
 
 # Function to update Python project version in pyproject.toml
 update_python_version() {
-    local component=$1
-    print_info "Updating $component version..."
-    cd "src/$component"
+  local component=$1
+  print_info "Updating $component version..."
+  cd "src/$component"
 
-    if [ ! -f "pyproject.toml" ]; then
-        print_error "pyproject.toml not found in src/$component!"
-        exit 1
-    fi
+  if [ ! -f "pyproject.toml" ]; then
+    print_error "pyproject.toml not found in src/$component!"
+    exit 1
+  fi
 
-    if grep -q '^version = "' pyproject.toml; then
-        sed -i.bak "s/^version = \".*\"/version = \"$VERSION\"/" pyproject.toml
-        rm pyproject.toml.bak
-        print_info "Updated pyproject.toml version to $VERSION"
-    else
-        print_error "Could not find version line in pyproject.toml"
-        exit 1
-    fi
+  if grep -q '^version = "' pyproject.toml; then
+    sed -i.bak "s/^version = \".*\"/version = \"$VERSION\"/" pyproject.toml
+    rm pyproject.toml.bak
+    print_info "Updated pyproject.toml version to $VERSION"
+  else
+    print_error "Could not find version line in pyproject.toml"
+    exit 1
+  fi
 
-    cd -
+  cd -
 }
 
 # Check if we're in a git repository
-if ! git rev-parse --git-dir > /dev/null 2>&1; then
-    print_error "Not a git repository. Please run this script from the root of your project."
-    exit 1
+if ! git rev-parse --git-dir >/dev/null 2>&1; then
+  print_error "Not a git repository. Please run this script from the root of your project."
+  exit 1
 fi
 
 # Check if working directory is clean
 if ! git diff-index --quiet HEAD --; then
-    print_error "Working directory is not clean. Please commit or stash your changes first."
-    exit 1
+  print_error "Working directory is not clean. Please commit or stash your changes first."
+  exit 1
 fi
 
 # Ask user for release version number
@@ -72,8 +71,8 @@ read -r -p "Enter release version number (e.g., 1.2.3): " VERSION
 
 # Validate version format (basic semver check)
 if ! [[ $VERSION =~ ^[0-9]+\.[0-9]+\.[0-9]+$ ]]; then
-    print_error "Invalid version format. Please use semantic versioning (e.g., 1.2.3)"
-    exit 1
+  print_error "Invalid version format. Please use semantic versioning (e.g., 1.2.3)"
+  exit 1
 fi
 
 print_info "Release version: $VERSION"
@@ -81,8 +80,8 @@ print_info "Release version: $VERSION"
 # Check if branch already exists
 BRANCH_NAME="release/$VERSION"
 if git show-ref --verify --quiet "refs/heads/$BRANCH_NAME"; then
-    print_error "Branch $BRANCH_NAME already exists!"
-    exit 1
+  print_error "Branch $BRANCH_NAME already exists!"
+  exit 1
 fi
 
 # Create and checkout new branch
@@ -129,8 +128,8 @@ cd -
 print_info "Updating CHANGELOG..."
 
 if [ ! -f "CHANGELOG.md" ]; then
-    print_error "CHANGELOG.md not found in project root!"
-    exit 1
+  print_error "CHANGELOG.md not found in project root!"
+  exit 1
 fi
 
 # Get current date in YYYY-MM-DD format
@@ -138,23 +137,21 @@ CURRENT_DATE=$(date +%Y-%m-%d)
 
 # Replace [Unreleased] with [version number] - YYYY-MM-DD
 if grep -q '\[Unreleased\]' CHANGELOG.md; then
-    sed -i.bak "s/\[Unreleased\]/[$VERSION] - $CURRENT_DATE/" CHANGELOG.md
+  sed -i.bak "s/\[Unreleased\]/[$VERSION] - $CURRENT_DATE/" CHANGELOG.md
 
-    # Add new [Unreleased] section after the header
-    # This adds it after the line containing "Semantic Versioning"
-    sed -i.bak "/Semantic Versioning/a\\
+  # Add new [Unreleased] section after the header
+  # This adds it after the line containing "Semantic Versioning"
+  sed -i.bak "/Semantic Versioning/a\\
 \\
 ## [Unreleased]
 " CHANGELOG.md
 
-    rm CHANGELOG.md.bak
-    print_info "Updated CHANGELOG.md"
+  rm CHANGELOG.md.bak
+  print_info "Updated CHANGELOG.md"
 else
-    print_warning "Could not find [Unreleased] section in CHANGELOG.md"
+  print_warning "Could not find [Unreleased] section in CHANGELOG.md"
 fi
 
-
-
 # Summary
 echo ""
 print_info "Release preparation complete!"
@@ -178,4 +175,4 @@ print_warning "Next steps:"
 echo "  1. Review the changes: git status"
 echo "  2. Commit the changes: git add . && git commit -m 'Release $VERSION'"
 echo "  3. Push the branch: git push origin $BRANCH_NAME"
-echo ""
+echo ""

compose.yml

@@ -5,17 +5,17 @@ services:
     env_file:
       - env.d/development/postgresql
     ports:
-      - "15432:5432"
+      - "127.0.0.1:15432:5432"
 
   redis:
     image: redis:5
     ports:
-      - "6379:6379"
+      - "127.0.0.1:6379:6379"
 
   mailcatcher:
     image: sj26/mailcatcher:latest
     ports:
-      - "1081:1080"
+      - "127.0.0.1:1081:1080"
 
   garage:
     user: ${DOCKER_USER:-1000}
@@ -71,7 +71,7 @@ services:
       - env.d/development/common
       - env.d/development/postgresql
     ports:
-      - "8071:8000"
+      - "127.0.0.1:8071:8000"
     volumes:
       - ./src/backend:/app
       - ./data/static:/data/static
@@ -137,7 +137,7 @@ services:
   nginx:
     image: nginx:1.25
     ports:
-      - "8083:8083"
+      - "127.0.0.1:8083:8083"
     volumes:
       - ./docker/files/etc/nginx/conf.d:/etc/nginx/conf.d:ro
     depends_on:
@@ -159,7 +159,7 @@ services:
         VITE_APP_TITLE: "LaSuite Meet"
     image: meet:frontend-development
     ports:
-      - "3000:8080"
+      - "127.0.0.1:3000:8080"
 
   dockerize:
     image: jwilder/dockerize
@@ -185,7 +185,7 @@ services:
   kc_postgresql:
     image: postgres:14.3
     ports:
-      - "5433:5432"
+      - "127.0.0.1:5433:5432"
     env_file:
       - env.d/development/kc_postgresql
 
@@ -213,7 +213,7 @@ services:
       KC_DB_SCHEMA: public
       PROXY_ADDRESS_FORWARDING: 'true'
     ports:
-      - "8080:8080"
+      - "127.0.0.1:8080:8080"
     depends_on:
       - kc_postgresql
 
@@ -222,10 +222,10 @@ services:
     entrypoint: /livekit-server --dev --bind 0.0.0.0 --config ./config.yaml
     ports:
       - "7880:7880"
-      - "7881:7881"
-      - "7882:7882/udp"
-      - "3478:3478/udp"
-      - "30000-30100:30000-30100/udp"
+      - "127.0.0.1:7881:7881"
+      - "127.0.0.1:7882:7882/udp"
+      - "127.0.0.1:3478:3478/udp"
+      - "127.0.0.1:30000-30100:30000-30100/udp"
     volumes:
       - ./docker/livekit/config/livekit-server.yaml:/config.yaml
     depends_on:
@@ -283,7 +283,7 @@ services:
     env_file:
       - env.d/development/summary
     ports:
-      - "8001:8000"
+      - "127.0.0.1:8001:8000"
     volumes:
       - ./src/summary:/app
     depends_on:

devenv.lock

@@ -18,12 +18,50 @@
         "url": "https://github.com/cachix/devenv"
       }
     },
+    "flake-compat": {
+      "flake": false,
+      "locked": {
+        "lastModified": 1767039857,
+        "narHash": "sha256-vNpUSpF5Nuw8xvDLj2KCwwksIbjua2LZCqhV1LNRDns=",
+        "owner": "NixOS",
+        "repo": "flake-compat",
+        "rev": "5edf11c44bc78a0d334f6334cdaf7d60d732daab",
+        "type": "github"
+      },
+      "original": {
+        "owner": "NixOS",
+        "repo": "flake-compat",
+        "type": "github"
+      }
+    },
+    "git-hooks": {
+      "inputs": {
+        "flake-compat": "flake-compat",
+        "nixpkgs": [
+          "nixpkgs"
+        ]
+      },
+      "locked": {
+        "lastModified": 1791909798,
+        "narHash": "sha256-VAhpCOmrun/KXimYfR8NM88bciKCui7CqHHhThSzgag=",
+        "ref": "refs/heads/master",
+        "rev": "1ba1dbfe28738c9a71c266be6efa5b89e75491a9",
+        "shallow": true,
+        "type": "git",
+        "url": "https://github.com/cachix/git-hooks.nix"
+      },
+      "original": {
+        "shallow": true,
+        "type": "git",
+        "url": "https://github.com/cachix/git-hooks.nix"
+      }
+    },
     "nixpkgs": {
       "locked": {
-        "lastModified": 1789542786,
-        "narHash": "sha256-ajQuqcxnj6RYnwCjA/9FTCnrdR2+BDzstE8UembXf60=",
+        "lastModified": 1792295010,
+        "narHash": "sha256-F7meJtbqGttmUoMmYjRRgkVs42sn7bh7vvRvLPlUN98=",
         "ref": "nixos-26.05",
-        "rev": "4c7870105e7f1fdf9c48688c8d7efc21abf0688a",
+        "rev": "8ce73368d1efd4d657e9064d29b144a52046b4e8",
         "shallow": true,
         "type": "git",
         "url": "https://github.com/NixOS/nixpkgs"
@@ -38,6 +76,7 @@
     "root": {
       "inputs": {
         "devenv": "devenv",
+        "git-hooks": "git-hooks",
         "nixpkgs": "nixpkgs"
       }
     }

devenv.nix

@@ -101,6 +101,8 @@ in
     languages.typescript.enable = false;
     languages.nix.enable = true;
 
+    git-hooks.hooks.gitlint.enable = true;
+
     packages =
       with pkgs;
       [

devenv.yaml

@@ -3,3 +3,8 @@ inputs:
     url: git+https://github.com/NixOS/nixpkgs?ref=nixos-26.05&shallow=1
   devenv:
     url: git+https://github.com/cachix/devenv?ref=refs/tags/v2.1.2&dir=src/modules
+  git-hooks:
+    url: git+https://github.com/cachix/git-hooks.nix?shallow=1
+    inputs:
+      nixpkgs:
+        follows: nixpkgs

docker/compose.d/compose.bureautix.yml

@@ -45,4 +45,4 @@ services:
   # The local proxy listens on 8080 and collides with Keycloak's published admin port.
   keycloak:
     ports: !override
-      - "8081:8080"
+      - "127.0.0.1:8081:8080"

docker/dinum-frontend/Dockerfile

@@ -58,7 +58,8 @@ FROM nginxinc/nginx-unprivileged:1.30.4-alpine3.24 AS frontend-production
 
 USER root
 RUN apk upgrade --no-cache libexpat && \
-    apk add --no-cache --upgrade 'pcre2>=10.49-r0' 'tiff>=4.7.2-r0' && \
+    apk add --no-cache --upgrade 'pcre2>=10.49-r0' 'tiff>=4.7.2-r0' \
+        'libx11>=1.8.14-r0' && \
     apk del curl
 USER nginx
 

docker/files/usr/local/etc/gunicorn/meet.py

@@ -14,4 +14,7 @@ accesslog = "-"
 # Using '-' for the error log file makes gunicorn log errors to stderr
 errorlog = "-"
 loglevel = "info"
-access_log_format = '%(h)s %(l)s %(u)s %(t)s "%(r)s" %(s)s %(b)s "%(f)s" "%(a)s" %(M)s'
+access_log_format = (
+    '%(h)s %(l)s %(u)s %(t)s "%(r)s" %(s)s %(b)s "%(f)s" "%(a)s" %(M)s'
+    " rid=%({x-request-id}o)s"
+)

docs/features/audit-logging.md

@@ -0,0 +1,495 @@
+# Audit logging
+
+La Suite Meet keeps an **audit log**: a record of the notable things that happen in the product, such as a room created
+through the external API, a recording started, a sign-in, or a change made in the Django admin. Every entry answers the
+same questions: *who* did *what*, *to what*, *on whose behalf*, *from where*, and *did it work?*
+
+It is written for:
+
+- **operators and security teams** investigating an incident or watching for abuse
+- **data protection officers**, who need to know who accessed or changed what
+- **developers** adding a new audited action (see [For developers](#for-developers-emitting-events))
+
+Each event is a single line of JSON written to standard output, kept apart from the application logs.
+Events follow the [Elastic Common Schema](https://www.elastic.co/docs/reference/ecs)
+(ECS) 9.5.0, which most SIEMs understand out of the box.
+
+Personal data is kept to a minimum. A person is identified by their account id, their OIDC `sub` and the domain of their
+email address. Secrets, transit codes and the messages of unexpected exceptions are never recorded.
+
+## What an event looks like
+
+Events are written on the dedicated `audit` logger, one per line. Pretty-printed, one looks like this:
+
+```json
+{
+  "@timestamp": "2026-09-15T08:41:12.345+00:00",
+  "ecs": {"version": "9.5.0"},
+  "data_stream": {"type": "logs", "dataset": "meet.audit", "namespace": "default"},
+  "service": {"name": "meet", "environment": "production", "version": "1.34.0", "node": {"name": "meet-backend-6d8f7b9c4-x2x7q"}},
+  "event": {
+    "kind": "event",
+    "id": "0b3f6a0e-5d1c-4f43-9a8e-2b7c1d0e4f5a",
+    "action": "room.create",
+    "category": ["api"],
+    "type": ["creation"],
+    "outcome": "success",
+    "dataset": "meet.audit"
+  },
+  "client": {"ip": "1.2.3.4"},
+  "source": {"ip": "1.2.3.4"},
+  "http": {"request": {"id": "6f1c0d0e-2a8b-4c1d-9e7f-0a1b2c3d4e5f", "method": "POST"}, "response": {"status_code": 201}},
+  "url": {"path": "/external-api/v1.0/rooms/"},
+  "user_agent": {"original": "calendar-app/2.3"},
+  "user": {"id": "beecd833-4be4-4675-b139-a196b07144a9", "domain": "gouv.fr"},
+  "organization": {"id": "calendar-app"},
+  "entity": {
+    "target": {
+      "id": "9ae54744-ae64-44f4-b094-71e137556b66",
+      "sub_type": "room",
+      "name": "Daily standup",
+      "raw": {"slug": "daily-standup", "access_level": "trusted"}
+    }
+  },
+  "lasuite": {
+    "actor": {"type": "application", "sub": "0edebfa3-1355-4891-ae63-daf9fd37ac04"},
+    "auth": {"method": "application_jwt"},
+    "application": {"client_id": "calendar-app"},
+    "outcome": "success"
+  },
+  "log": {"level": "info", "logger": "audit"}
+}
+```
+
+Read it as: *the application `calendar-app`, acting on behalf of a user from `gouv.fr`, created the room "Daily standup"
+from `1.2.3.4`, and it worked.*
+
+When an action is refused, the event keeps the name of the action that was attempted, here still `room.create`. Only
+the fields describing the outcome change:
+
+```json
+{
+  "event": {"action": "room.create", "outcome": "failure", "type": ["creation", "denied"], "reason": "permission_denied"},
+  "lasuite": {"outcome": "denied"},
+  "http": {"response": {"status_code": 403}},
+  "error": {"message": "..."},
+  "log": {"level": "warning", "logger": "audit"}
+}
+```
+
+## Key concepts
+
+These words are used throughout this page and in the code (`core/audit/`). The *In the event* column says where to
+find each one in the JSON above.
+
+### The record
+
+| Term | Meaning | In the event |
+|---|---|---|
+| **Audit Event** | One immutable record that a notable action was attempted, by whom, on what, and with what outcome. Written as a single JSON line on the Audit Log. | The whole document, identified by `event.id` |
+| **Audit Log** | The stream of Audit Events. It is distinct from the application logs: a logger and a dataset of its own. | `data_stream.*`, `event.dataset` |
+| **Action** | The dotted, stable name of what was attempted, such as `room.create` or `application.token.issue`. It names the attempt, not its result: a refused `room.create` is still a `room.create`. Every Action belongs to the Catalogue. | `event.action` |
+| **Catalogue** | The closed list of Actions the code may emit, with their meaning and fields: see [Catalogue](#catalogue). Writes made through the Django admin are its one templated family, `admin.<target>.<verb>`. | — |
+| **Details** | The fields specific to one Action, such as the scopes granted with a token or the fields a room update changed. The Catalogue lists them. | `lasuite.details.*` |
+
+### Who acted
+
+| Term | Meaning | In the event |
+|---|---|---|
+| **Actor** | Who is behind an Action. It always has an Actor Type. When a person's account is involved, the event also carries the account id, its OIDC `sub` when it has one, and its email domain. | `lasuite.actor.*`, `user.*` |
+| **Actor Type** | What kind of Actor it is: `user`, `application`, `service`, `system` or `anonymous`. See [Actors](#actors). Device accounts are `user`s like any other account. | `lasuite.actor.type` |
+| **Auth Method** | How the Actor proved who it is for this request: `session`, `oidc`, `password`, `application_jwt`, `client_credentials`, `addons_jwt`, `user_access_jwt`, `transit_code`, `resource_server`, `menshen_token`, `livekit_token`, `shared_secret`, `none` when it did not authenticate, or `unknown`. | `lasuite.auth.method` |
+| **Application** | A registered third-party integration, identified by its client id, that calls the external API on behalf of users. | `lasuite.application.client_id` |
+| **Delegation** | An Application acting for one specific user, through the delegated token it obtained with `application.token.issue`. The event then names both: the Application as the Actor, and the user in `user.*`. | `lasuite.actor.type` = `application`, with `user.*` set |
+| **Provisional User** | An account an Application created from an email address before that person ever signed in. It has no OIDC `sub` yet, so its account id is what links its `user.provision` event to its later `user.login`. | `event.action` = `user.provision` |
+| **Machine User** | The identity of an internal service calling the backend with a shared secret: the LiveKit SIP bridge (`roomkit`), the summary service (`summary`), and the LiveKit server reporting that a recording ended (`livekit`). It is an Actor of type `service`, never an account. | `service.origin.name` |
+| **Tenant** | The organisation an event belongs to: the calling Application when there is one, otherwise the Actor's email domain. | `organization.id` |
+
+### What it was done to
+
+| Term | Meaning | In the event |
+|---|---|---|
+| **Target** | The resource the Action was attempted on: a room, a recording, an access grant, an application, a user or a transit code. Described by its type, its id and a few stable fields. See [Targets](#targets). | `entity.target.*` |
+| **User Target** | The person the Action was *about*, when there is one: a provisioned user, the user an access grants a role to, the account an admin edits, or the user a transit code is minted for. Not to be confused with `user.*`, the account whose authority was used. | `user.target.*` |
+
+### How it went
+
+| Term | Meaning | In the event |
+|---|---|---|
+| **Outcome** | Whether the Action succeeded (`success`), failed (`failure`), was refused (`denied`), or ended in a way the backend could not interpret (`unknown`). ECS has no `denied`: in `event.outcome`, a refusal is a `failure`. | `lasuite.outcome`, `event.outcome` |
+| **Reason** | Why an Action did not succeed, from a closed list: `authentication_failed`, `permission_denied`, `rate_limited`, `validation_error`, `not_found`, `conflict`, `internal_error`. | `event.reason` |
+| **Refusal** | An Action the backend would not let happen, such as a 401, 403 or 429. It is recorded under the Action that was attempted, with Outcome `denied`, never as an Action of its own. | `lasuite.outcome` = `denied` |
+
+### Where and when
+
+| Term | Meaning | In the event |
+|---|---|---|
+| **Source** | Where the request came from: the real client IP (never a proxy's), the HTTP method, the URL path and the user agent. Empty when no request is behind the event. | `client.ip`, `source.ip`, `http.request.method`, `url.path`, `user_agent.original` |
+| **Request Id** | The id shared by the Audit Events and the web server access log of one HTTP request, what other tools call a trace id. The backend generates it, unless the ingress is trusted to set it. | `http.request.id` |
+| **Emitter** | The backend instance that wrote the event: its name, environment, release and host (the pod, on Kubernetes). Never the caller. | `service.name`, `service.environment`, `service.version`, `service.node.name` |
+| **Peer Service** | Another service of the deployment taking part in the Action: the one that called the backend, or the one the backend called. | `service.origin.name`, `service.target.name` |
+
+### Where events go
+
+| Term | Meaning | In the event |
+|---|---|---|
+| **Sink** | Where Audit Events are written: the `audit` logger, whose handler writes to `AUDIT_LOG_STREAM`, standard output by default. A log shipper takes them from there. | `log.logger` = `audit` |
+| **Data Stream** | The data stream events are meant for, `logs-meet.audit-default` by default. It is what lets a shipper route audit events away from the application logs. | `data_stream.*` |
+
+### Embedded frontends
+
+| Term | Meaning | In the event |
+|---|---|---|
+| **Transit Code** | A single-use, short-lived code an Application mints for its delegated user and hands to an embedded frontend, which exchanges it for a User Access Token. Only its SHA-256 is ever logged. | `entity.target.sub_type` = `transit_code` |
+| **User Access Token** | The token an embedded frontend uses to call the API as the user, where session cookies are blocked (in an iframe, for example). Requests made with it are recorded as the Application acting for that user. | `lasuite.auth.method` = `user_access_jwt` |
+
+## Answering common questions
+
+These are the fields to filter on for the questions that come up most. They work the same whatever tool you search
+your logs with.
+
+**Who created, changed or deleted this room?**
+Filter on `entity.target.sub_type: room` with the room's id in `entity.target.id`, or its slug in
+`entity.target.raw.slug`. `event.action` says what happened, and `user.id` or `lasuite.application.client_id` who did
+it. Rooms are audited when they are handled through the external API (`room.*`) or the Django admin (`admin.room.*`).
+
+**What has this application done?**
+Filter on `lasuite.application.client_id`. To include the attempts made before its credentials were verified, such as a
+wrong secret or an inactive application, also search `lasuite.details.claimed_client_id`.
+
+**What did this person do, and what was done to their account?**
+`user.id` is the account whose authority an action used, and `user.target.id` the account an action was about: search
+both. To follow someone across the other La Suite products, use their OIDC `sub`, in `lasuite.actor.sub`.
+
+**Which requests were refused, and why?**
+Filter on `lasuite.outcome: denied` and group by `event.reason`. A burst of `authentication_failed` on `user.login` or
+`application.token.issue` from a single `source.ip` deserves a closer look.
+
+**What else happened during this request?**
+Take its `http.request.id`. The same id is sent back in the `X-Request-ID` response header, and appears on every audit
+event of the request and in the Gunicorn access log as `rid=`. The application logs do not carry it. A single request
+may produce several events: an application obtaining a token for someone who never signed in produces both
+`user.provision` and `application.token.issue`.
+
+## Fields reference
+
+Events follow the [Elastic Common Schema](https://www.elastic.co/docs/reference/ecs) 9.5.0. Only two namespaces hold
+what ECS does not define: `lasuite.*`, and `entity.target.raw.*` for the fields of a target.
+
+| Field | Meaning |
+|---|---|
+| `@timestamp` | When the event was emitted: ISO 8601, in UTC, with millisecond precision |
+| `data_stream.*`, `event.dataset` | `logs`, `<AUDIT_LOG_SERVICE_NAME>.audit` and `AUDIT_LOG_DATA_STREAM_NAMESPACE`: what sets the audit stream apart from the application logs |
+| `service.name`, `service.environment`, `service.version`, `service.node.name` | The Emitter: `AUDIT_LOG_SERVICE_NAME`, the current environment, the release and the host name (the pod, on Kubernetes). Never the caller |
+| `service.origin.name` | The internal service that called the backend, when the actor is a `service`: `roomkit`, `summary` or `livekit` |
+| `service.target.name` | The service the backend called, such as `summary` for `recording.transcript.request` |
+| `event.id` | Unique id of the event, so that a shipper retrying it cannot create a duplicate |
+| `event.action` | What was attempted, from the [Catalogue](#catalogue) |
+| `event.category`, `event.type` | The ECS classification (`api`, `authentication`, `iam`... and `creation`, `change`, `access`, `denied`, `user`...). Always a combination ECS expects, see [Classification](#classification) |
+| `event.outcome` | ECS `success` or `failure` (refusals included), or `unknown` when the result was reported in terms the backend does not recognise |
+| `event.reason` | Why it did not succeed: `authentication_failed`, `permission_denied`, `rate_limited`, `validation_error`, `not_found`, `conflict`, `internal_error` |
+| `lasuite.outcome` | `success`, `failure`, `denied` or `unknown`: the same as `event.outcome`, with refusals kept apart |
+| `lasuite.actor.type` | `user`, `application`, `service`, `system` or `anonymous`, see [Actors](#actors) |
+| `lasuite.actor.sub` | The OIDC `sub` of the account in `user.*`, when it has one: the identity it shares with the other La Suite products |
+| `lasuite.auth.method` | `session`, `application_jwt`, `addons_jwt`, `user_access_jwt`, `resource_server`, `menshen_token`, `livekit_token`, `shared_secret`, `client_credentials`, `transit_code`, `oidc`, `password`, `none`, or `unknown` for an authentication class that is not registered. Requests served outside DRF, such as the admin and logout, report `session` when signed in |
+| `lasuite.application.client_id` | The external application acting, if any. Only set once its credentials are verified. For a Menshen token, Menshen's own client id (see [Actors](#actors)) |
+| `user.id`, `user.domain` | The account whose authority the action used (see [Actors](#actors)): its primary key and email domain. The email address itself is never recorded |
+| `user.roles` | That account's privileges when the event happened: `superuser`, `staff` |
+| `user.target.id`, `user.target.domain` | The account the action was about: the target when it is a user, or the user an access grants a role to. `user.*` stays the actor |
+| `organization.id` | The Tenant: the application's client id when there is one, otherwise the user's email domain |
+| `entity.target.*` | The resource acted on, see [Targets](#targets) |
+| `lasuite.details` | Fields specific to the action, see the [Catalogue](#catalogue) |
+| `client.ip`, `source.ip` | The real client address, the same one DRF's throttles identify (see `NUM_PROXIES`) |
+| `http.request.method`, `url.path` | The request as received |
+| `user_agent.original` | The client's `User-Agent`, cut at 1024 characters |
+| `http.request.id` | The Request Id. Also sent back as the `X-Request-ID` response header and logged by Gunicorn as `rid=`. Generated by the backend unless `REQUEST_ID_TRUST_HEADER` is set |
+| `http.response.status_code` | The status of the response, for API calls and refusals |
+| `error.message` | A human-readable reason for a failure |
+| `error.type` | The class of an unhandled exception. Its message is left out, as it may contain personal data |
+| `log.level` | `info` for a success, `warning` for failures, refusals and unknown outcomes, `error` for internal errors |
+
+### Targets
+
+The resource an action was performed on is described with ECS `entity.target`, the field set ECS 9.3 introduced for
+"the targeted entity of an action taken". ECS still flags the `entity` fields as beta.
+
+| Field | Meaning |
+|---|---|
+| `entity.target.id` | Its primary key |
+| `entity.target.sub_type` | Its model: `room`, `recording`, `user`, `application`, `resourceaccess` or `transit_code` (identified by its SHA-256) |
+| `entity.target.type` | Its ECS entity type, when one fits: `user` for an account, `application` for an application |
+| `entity.target.name` | Its name, when its model registers one |
+| `entity.target.raw.*` | The other fields its model registers, such as a room's `slug` and `access_level`, or the OIDC `sub` of a user |
+
+### Actors
+
+`lasuite.actor.type` says *who* acted, and `user.*` *whose authority* the action used. They are not always the same: when
+an application acts for a user, the actor is the application, but `user.*` is that user.
+
+| `lasuite.actor.type` | Who | `user.*` |
+|---|---|---|
+| `user` | A person's account acting for itself: through a session, an OIDC or password login, an add-on token, or the LiveKit token of a known account | That account |
+| `application` | A client application acting on behalf of a user. Either a Meet application, through its client credentials, its delegated token or the user access token of its embedded frontend, or another La Suite application, through the resource server or a token exchanged with Menshen. `lasuite.application.client_id` names it | The delegating user |
+| `service` | An internal service of the deployment, named by `service.origin.name`: the LiveKit SIP bridge (`roomkit`), the summary service (`summary`), or the LiveKit server reporting on a recording (`livekit`) | Absent |
+| `system` | The backend itself, with no inbound request | Absent |
+| `anonymous` | A caller that did not authenticate, or failed to | Absent |
+
+The backend picks the actor type by applying these rules in order:
+
+1. A client id is known, usually from the token payload: `application`.
+2. There is neither a request nor an actor: `system`.
+3. The caller authenticated without an account, as a Machine User: `service`.
+4. The caller is an account: `user`.
+5. Anything else: `anonymous`.
+
+A La Suite application calling the external API with a token it exchanged through Menshen, La Suite's token exchange
+server, is recorded as an `application`, with `lasuite.auth.method` `menshen_token`. Menshen reports itself as the client
+the token was issued to, not the application that exchanged it, so `lasuite.application.client_id` and `organization.id`
+are Menshen's client id for every such call. The token is never recorded, nor its `jti`, which for an opaque token
+Menshen takes from the token itself, nor the email Menshen reports.
+
+### Classification
+
+`event.category` and `event.type` are only ever combined in the ways the ECS 9.5.0 `expected_event_types` allow:
+
+- Each action declares its category, `api` by default, and its types. A type its category does not expect fails at
+  import time, so a misclassified action can't ship.
+- A refusal adds the `denied` type only when the category expects it. An API call becomes `["creation", "denied"]`. A
+  failed login stays `["start"]`, and `event.outcome`, `event.reason` and `lasuite.outcome` show that it was refused.
+- A 401 is also filed under `authentication`, as in `["api", "authentication"]`, so that it counts as a failed
+  authentication.
+
+When an audited API action raises an exception DRF does not handle, the event is still recorded before the exception
+propagates: as a `failure` with reason `internal_error`, status code `500` and `error.type`.
+
+## Catalogue
+
+Action names are dotted and lower-case, in the form `<target>.<verb>`. They name what was *attempted*: whether it worked
+is told by `event.outcome`, `lasuite.outcome` and `event.reason`, never by the name.
+
+### Applications and delegation
+
+| `event.action` | Emitted when | Notable fields |
+|---|---|---|
+| `application.token.issue` | An application asks for a delegated token (`POST /external-api/v1.0/application/token/`), whether it gets one or is refused. It can be refused for bad credentials, an inactive application, an invalid or unauthorized email domain, an unknown user, or a provisioning conflict | On success: `user.*` is the delegated user, `entity.target` the application, and `lasuite.details` holds `scopes`, `user_provisioned` and `expires_in`. On refusal: `event.reason`, `http.response.status_code` and `lasuite.details.requested_domain`. Until its credentials are verified, the client id the caller submitted is only recorded as `lasuite.details.claimed_client_id`: it never sets `lasuite.application` or `organization` |
+| `user.provision` | An application creates a provisional user from an email address, or fails to. It is a `failure` with reason `conflict` when a concurrent request created the user first. Also emitted when a La Suite application calls the external API, through the resource server or with a Menshen token, for a `sub` no account has and `OIDC_CREATE_USER` lets the backend create one | `user.target` and `entity.target` are the user, the existing one on a conflict. `lasuite.auth.method` is `client_credentials`, `resource_server` or `menshen_token`. A provisional user has no `sub` yet: its id links this event to the winning one and to its later `user.login`. On a conflict over an email, `lasuite.details.requested_sub` is the `sub` no account was created for |
+| `transit_code.issue` | An application mints a single-use transit code for its delegated user | `entity.target` is the code, whose `id` is its SHA-256. `user.target` is the user it is minted for. `lasuite.details.expires_in` |
+| `transit_code.exchange` | An embedded frontend exchanges a transit code for a user access token | `event.category` is `authentication`, `lasuite.auth.method` is `transit_code`, and `entity.target` is the code's SHA-256. Once the code verifies, even if the exchange is then refused: `lasuite.actor.type` is `application` (the one that minted it), and `user.target` the user it was minted for. On success, `user.*` is that user too, with `lasuite.details.expires_in`. A code that does not verify is recorded as an `anonymous` failed authentication |
+
+### Rooms
+
+Rooms are audited on the external API only.
+
+| `event.action` | Emitted when | Notable fields |
+|---|---|---|
+| `room.create` | A room is created through the external API, or the attempt fails | `entity.target` is the room |
+| `room.update` | A room is updated through the external API, or the attempt fails | `entity.target` is the room, refusals included. `lasuite.details.updated_fields` and `previous_access_level` |
+| `room.delete` | A room is deleted through the external API: soft deleted, its LiveKit room closed. Or the attempt fails | `entity.target` is the room, refusals included |
+| `room.retrieve` | A room is read through the external API, or the attempt fails | `entity.target` is the room |
+| `room.list` | Rooms are listed through the external API, or the attempt fails | `lasuite.details.total` |
+
+### Recordings, transcripts and summaries
+
+| `event.action` | Emitted when | Notable fields |
+|---|---|---|
+| `recording.start` | A room owner or administrator starts a recording, or the attempt fails: a recording already in progress, a worker error | `entity.target` is the recording, or the room when none was created. `lasuite.details.collect_metadata` |
+| `recording.stop` | A room owner or administrator stops the recording in progress, or the attempt fails | `entity.target` is the recording, or the room when none is active |
+| `recording.end` | LiveKit reports that a recording ended (`egress_ended` webhook): `success` when its media file is available, `failure` when it was aborted or failed, `unknown` for a status the backend does not map | `service.origin.name` is `livekit`. `entity.target` is the recording as it was before the report was processed. `lasuite.details.worker_event` (`completed`, `limit reached`, `aborted`, `failed`) and `error_code` |
+| `recording.delete` | A recording is deleted, or the attempt fails | `entity.target` is the recording |
+| `recording.transcript.request` | The backend sends a recording to the summary service to be transcribed, or fails to | `lasuite.actor.type` is `system`, `service.target.name` is `summary`, and `entity.target` is the recording. `lasuite.details.summary_requested` (whether a summary of the transcript is to be made too) and `job_id` |
+| `recording.transcript.report` | The summary service reports on a transcript (`external-process-hook`), or a call to that hook is refused | `service.origin.name` is `summary`. `entity.target` is the recording, absent for an unknown job. `lasuite.details.job_id` and `status`. A failure the service reports is recorded as a `failure` |
+| `recording.summary.report` | The summary service reports on a summary | Same as `recording.transcript.report` |
+
+A recording's target says what was recorded:
+
+- `mode` is how the media was captured: `screen_recording` for a video, `transcript` for an audio track;
+- `requested_mode` is what the user asked for;
+- `is_transcribed` says whether it is sent to the summary service.
+
+`mode` and `requested_mode` differ for a transcript started with a screen capture: `mode` is then `screen_recording`,
+and `requested_mode` is `transcript`.
+
+Transcripts and summaries are not recordings, but what the summary service derives from one. They are audited under
+`recording.transcript.*` and `recording.summary.*`, with the recording as their target.
+
+### Sign-in and the admin
+
+| `event.action` | Emitted when | Notable fields |
+|---|---|---|
+| `user.login` | A user signs in, or a sign-in attempt fails: `denied`, with reason `authentication_failed` | `lasuite.auth.method` is `oidc`, `password` or `unknown`. On success, it is named after the login backend, also given in `lasuite.details.auth_backend`. On failure, it is named after the credentials submitted: a password, or the nonce of the OIDC callback |
+| `user.logout` | A user signs out | |
+| `admin.access` | A signed-in account without staff access reaches an admin page. Always denied, once per refused page | `event.category` is `web` and `event.type` is `access`. `event.reason`, and `http.response.status_code`: the redirect to the login page |
+| `admin.<target>.<verb>` | A write is made through the Django admin, see [Django admin](#django-admin) | |
+
+## Django admin
+
+The admin is the most sensitive part of the product, so every write made through it produces an audit event, alongside
+the `LogEntry` Django already writes. Nothing is replaced and there is no extra table: the admin history keeps working.
+
+The action name follows a template, `admin.<target>.<verb>`, where `<target>` is the model name and `<verb>` one of:
+
+| `<verb>` | Emitted when | Notable fields |
+|---|---|---|
+| `create` | An object is added | `lasuite.details.changed_fields`, `changes` |
+| `update` | An object is changed | `lasuite.details.changed_fields`, `changes` |
+| `delete` | An object is deleted: one event per object, once the deletion has run. A deletion that raises is a `failure` with reason `internal_error`, and in a bulk deletion every selected object is then reported as failed | `error.message` on failure |
+| `action` | A bulk action runs | `lasuite.details.admin_action`, `count` |
+
+This gives names such as `admin.room.update`, `admin.user.delete` or `admin.recording.action`. `event.category` is `iam`
+for anything that grants access to the product, and `configuration` otherwise. Writes on a user or a group put `user` or
+`group` first in `event.type`, as in `["user", "change"]`.
+
+### What changed
+
+- `lasuite.details.changed_fields` always lists the **names** of the fields a form changed, exactly the ones Django
+  reports in its own history.
+- `lasuite.details.changes` gives their **values**, as `{"from": ..., "to": ...}`, but only for the fields a model
+  explicitly allows in the `admin_values` it is registered with (see
+  [Registering models](#registering-models-and-authentication-methods)).
+- Anything that looks like a secret is refused, whatever the allow-list says. A password change is reported as a change
+  to `password`, never with its value.
+- A `JSONField` on the allow-list, such as a room's `configuration`, is recorded as JSON rather than as a string, and
+  both versions are kept whole.
+
+### Inlines
+
+Objects edited through an **inline** produce their own event, linked to the parent's by `http.request.id`. Granting a
+role on a room produces both `admin.room.update` and `admin.resourceaccess.create`, whose `user.target` is the account
+granted the role.
+
+### What is not covered
+
+- **Reads.** Opening a change list, a change form or the history page emits nothing. Django's own `LogEntry` remains
+  the record of who touched what.
+- **Custom actions that bypass the ORM hooks.** An action calling `queryset.update()` or `queryset.delete()` directly
+  is reported as a single `admin.<target>.action`, with its name and the number of objects, not one event per object.
+  `delete_selected` is the exception: Django reports its objects through `log_deletions`, so it emits one
+  `admin.<target>.delete` per object and no `action` event.
+
+### How it is wired
+
+The wiring lives in `core/audit/admin.py`. `AuditedAdminSite` adds auditing to every admin class when it is registered,
+including those Django declares itself, and is installed through `core.audit.apps.AuditedAdminConfig` in
+`INSTALLED_APPS`. A new `ModelAdmin` is therefore covered without doing anything. Registering its model (see
+[Registering models](#registering-models-and-authentication-methods)) only adds its category and its allowed values.
+
+## For developers: emitting events
+
+### Declaring an action
+
+Every action is declared once, in `core/auditing.py`, as an `audit.Action` constant. An action may carry its ECS
+category and types, which then apply to every event it emits:
+
+```python
+APPLICATION_TOKEN_ISSUE = audit.Action(
+    "application.token.issue",
+    category=EventCategory.AUTHENTICATION,
+    types=(EventType.START,),
+)
+ROOM_CREATE = audit.Action("room.create")
+```
+
+`core/auditing.py` imports nothing but the audit facility, so that any module can import it, authentication classes
+included. Models and authentication classes are registered apart, in `core/audit_registry.py`.
+
+### Auditing a DRF view
+
+A DRF view only declares the actions it audits: everything else is derived from the response. CRUD actions are mapped
+in `audit_actions`. An extra action names its own on its route, so that renaming its method cannot silently stop
+auditing it:
+
+```python
+from core import audit, auditing
+
+
+class RoomViewSet(audit.AuditViewMixin, viewsets.GenericViewSet):
+    audit_actions = {"create": auditing.ROOM_CREATE, "retrieve": auditing.ROOM_RETRIEVE}
+
+    def perform_create(self, serializer):
+        self.audit_target = serializer.save()
+
+    @action(detail=True, methods=["post"], audit_action=auditing.ROOM_INVITE)
+    def invite(self, request, pk=None): ...
+```
+
+`AuditViewMixin` fills in the rest:
+
+- It runs from DRF's `finalize_response` hook, which every response goes through, successful or not.
+- The ECS category and types come from the action, or default to `api` and the DRF action.
+- The outcome, reason and status code come from the response status: 401, 403 and 429 are `denied`, other errors are
+  `failure`, and a 401 is always filed under `authentication`.
+- The target is the object `get_object()` returned, unless the view assigns `audit_target`.
+- A view can also assign `audit_user_target`, `audit_actor` (`None` records no account) and `audit_details`, or override
+  `get_audit_fields()`.
+
+### Auditing from anywhere else
+
+Outside of `AuditViewMixin`, from a view or deeper in a service, call `audit.log`. A `category` or `types` given here
+wins over the action's:
+
+```python
+audit.log(auditing.USER_PROVISION, target=user)
+```
+
+Without `request=`, the event reads the context of the request being served, `audit.request_context()`, which
+`AuditLogMiddleware` captures when the request comes in. Outside a request, as in a Celery task, the context is empty
+and the actor is the system.
+
+> [!NOTE]
+> That context holds the Django request. DRF copies its user and auth onto it, but not its authenticator, so a call
+> made inside a DRF view without `request=` should pass `auth_method=`.
+
+### How fields are filled
+
+- **Request fields** are read from the request: the real client address, the path and the user agent.
+  `http.request.id` is the request id, settled by `AuditLogMiddleware` right after dockerflow assigns it, and echoed in
+  the `DOCKERFLOW_REQUEST_ID_HEADER_NAME` response header (`X-Request-ID` by default). The inbound id is only kept when
+  `REQUEST_ID_TRUST_HEADER` is set. Otherwise the backend generates one, so a client never picks it.
+- **The actor** is derived from `request.user`, `request.auth` and the DRF authenticator, as described in
+  [Actors](#actors). The authenticator's class is mapped to an auth method by `audit.register_auth_method` (see
+  [Configuration](#configuration)). Without a request, the actor is the system. You can override it with `actor=`,
+  `actor_type=`, `auth_method=` and `client_id=`. An explicit `actor_type=` keeps the account the request is signed in
+  as. `actor=None` records no account: for a caller failing to authenticate, an application acting before it is given
+  a delegated user, or the system.
+- **The target** is described by its model name, its primary key and the `fields` its model is registered with, see
+  [Targets](#targets). A model that is not registered is still identified. The account the action is about,
+  `user.target`, is found from the target, unless given as `user_target=`. Name a service the backend calls with
+  `target_service=`. Any other keyword argument lands under `lasuite.details`.
+
+### Emission never raises
+
+A broken configuration or value is reported on the application logger (and to Sentry), and the business operation goes
+on. A registered field that cannot be read is left out of the target, and the event is still emitted.
+
+## Configuration
+
+| Variable | Default | Meaning |
+|---|---|---|
+| `AUDIT_LOG_LEVEL` | `INFO` | Level of the `audit` logger |
+| `AUDIT_LOG_STREAM` | `ext://sys.stdout` | Where the handler writes |
+| `AUDIT_LOG_SERVICE_NAME` | `meet` | `service.name`, and the dataset `<name>.audit`, with any `-` turned into `_` |
+| `AUDIT_LOG_DATA_STREAM_NAMESPACE` | `default` | `data_stream.namespace`: events are routed to the data stream `logs-meet.audit-<namespace>`. It must not contain `-` |
+| `NUM_PROXIES` | `1` | DRF's number of trusted proxies appending to `X-Forwarded-For`, shared with the throttles. The client is the entry that many positions from the right; anything a client injects lands further left and is ignored. `1` matches the ingress-nginx defaults; use `2` behind a load balancer that also appends |
+| `REQUEST_ID_TRUST_HEADER` | `False` | Reuse the inbound request id as `http.request.id`, so that the ingress, Gunicorn and audit events share one id. Only set it when the ingress overwrites the header (`proxy_set_header X-Request-ID $request_id;` on ingress-nginx, which otherwise forwards the client's): otherwise a client could pick the id of someone else's request |
+| `DOCKERFLOW_REQUEST_ID_HEADER_NAME` | `X-Request-ID` | The header carrying that id. Read on the request only when `REQUEST_ID_TRUST_HEADER` is set, always echoed on the response |
+
+### Registering models and authentication methods
+
+The project describes itself to the audit facility in code, in `core/audit_registry.py`. Once the audit app is ready,
+it imports the `audit_registry` module of every installed app.
+
+**`audit.register(Model, ...)`** tells the audit log how to handle a model:
+
+- `fields`: the fields describing it as a target;
+- `admin_values`: the fields whose before and after values may be recorded for admin writes;
+- `category`: the ECS category of its admin writes;
+- `entity_type`: its ECS entity type, when one of the allowed values fits (`application`, `user`...);
+- `user_target`: the attribute holding the account an event on it is about, such as `user` for an access.
+
+A proxy model falls back to its concrete model. Registering a model twice raises `AlreadyRegistered`, and an entity type
+ECS does not allow raises `ValueError`.
+
+**`audit.register_auth_method(klass, name)`** sets the `lasuite.auth.method` of a DRF authentication class or of a login
+backend. A DRF class inherits the name of its closest registered base, and DRF's own classes are built in. A login
+backend must be registered itself, because custom backends often subclass `ModelBackend` just for its permission
+checks. `ModelBackend` is built in as `password`.

docs/features/recording.md

@@ -3,7 +3,7 @@
 
 La Suite Meet offers a room recording feature that is currently in beta, with ongoing improvements planned. 
 
-The feature allows users to record their room sessions. When a recording is complete, the room owner receives a notification with a link to download the recorded file. Recordings are automatically deleted after `RECORDING_EXPIRATION_DAYS`.
+The feature allows users to record their room sessions. When a recording is complete, the user who started it and the room's owners and administrators receive a notification with a link to download the recorded file. The transcript summary is sent to the user who started the recording. Recordings are automatically deleted after `RECORDING_EXPIRATION_DAYS`.
 
 It uses LiveKit Egress to record room sessions. For reference, see the [LiveKit Egress repository](https://github.com/livekit/egress) and the [official documentation](https://docs.livekit.io/home/egress/overview/).
 
@@ -89,6 +89,7 @@ sequenceDiagram
 | Option                                  | Type        | Default                                                                                                                                                            | Description                                                                                                                                                                                                                                                                                        |
 | --------------------------------------- | ----------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------ |----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|
 | **RECORDING_ENABLE**                    | Boolean     | `False`                                                                                                                                                            | Enable or disable the room recording feature.                                                                                                                                                                                                                                                      |
+| **RECORDING_AUTHENTICATED_PARTICIPANTS_ENABLED**| Boolean     | `True`                                                                                                                                                             | When enabled, any authenticated participant currently connected to a room with the `trusted` or `public` access level can start and stop recordings. When disabled, only room admins and owners can. On `restricted` rooms, only admins and owners can record.                                     |
 | **RECORDING_OUTPUT_FOLDER**             | String      | `"recordings"`                                                                                                                                                     | Folder/prefix where recordings are stored in the object storage.                                                                                                                                                                                                                                   |
 | **RECORDING_WORKER_CLASSES**            | Dict        | `{ "screen_recording": "core.recording.worker.services.VideoCompositeEgressService", "transcript": "core.recording.worker.services.AudioCompositeEgressService" }` | Maps recording types to their worker service classes.                                                                                                                                                                                                                                              |
 | **RECORDING_EXPIRATION_DAYS**           | Integer     | `None`                                                                                                                                                             | Number of days before recordings expire. Should match bucket lifecycle policy. Set to `None` for no expiration.                                                                                                                                                                                    |

docs/features/room-purge.md

@@ -1,6 +1,6 @@
 # Room purge
 
-Rooms pile up over time and most of them are only used once. The `purge_inactive_rooms` management command permanently deletes the rooms that have not been started for a configurable number of days. It is disabled by default.
+Rooms pile up over time and most of them are only used once. The `purge_inactive_rooms` management command permanently deletes the rooms that have not been started for a configurable number of days, and the rooms deleted by their owner for longer than a configurable retention period. It is disabled by default.
 
 ## How it works
 
@@ -12,16 +12,21 @@ A room is inactive when:
 
 Rooms that existed before this feature was deployed are considered started on the day of the release, so none of them can be purged before a full inactivity period has elapsed.
 
-The command is meant to run once a day. The Helm chart schedules it in `backend.cronjobs` (`purge-inactive-rooms`, 01:00); it does nothing until `ROOM_INACTIVITY_DELETION_DAYS` is set.
+Deleting a room through the API only soft deletes it: the room is hidden, its link tells visitors the meeting was deleted, and it keeps its slug and PIN code. A soft-deleted room is purged:
+
+- when it is inactive, as described above: a deleted room is never considered started again, so its inactivity period keeps running, or
+- when it was deleted more than `ROOM_DELETED_RETENTION_DAYS` days ago.
+
+The command is meant to run once a day. The Helm chart schedules it in `backend.cronjobs` (`purge-inactive-rooms`, 01:00); it does nothing until `ROOM_INACTIVITY_DELETION_DAYS` or `ROOM_DELETED_RETENTION_DAYS` is set.
 
 ```bash
-python manage.py purge_inactive_rooms            # delete the inactive rooms
+python manage.py purge_inactive_rooms            # delete the inactive and deleted rooms
 python manage.py purge_inactive_rooms --dry-run  # only list the rooms that would be deleted
 ```
 
 ## Rooms that are kept
 
-A recording can only be reached through its room. An inactive room is kept as long as it holds a saved recording its users may still access:
+A recording can only be reached through its room. A room is kept, past its inactivity or retention period, as long as it holds a saved recording its users may still access:
 
 - with `RECORDING_EXPIRATION_DAYS` set, a saved recording created less than that many days ago,
 - with `RECORDING_EXPIRATION_DAYS` unset, any saved recording.
@@ -33,7 +38,8 @@ The room is deleted from the database, along with its accesses, its telephony PI
 The recording **files in the bucket are left untouched**: the backend never deletes anything from the storage, it only drops the database entries pointing at it. Removing the files is the job of the bucket lifecycle policy, which should match `RECORDING_EXPIRATION_DAYS` (see the [recording documentation](recording.md)). When the two do not match, the purge leaves objects behind: they become unreachable, since serving a recording requires its database entry, but they keep costing storage.
 
 ⚠️ When a room is purged, all it's configuration and access rights are also deleted. Its slug becomes available again
-and can be reused when a meeting is created from that same URL.
+and can be reused when a meeting is created from that same URL. This also applies to a soft-deleted room: once purged, its link
+no longer tells visitors the meeting was deleted, and its PIN code can be given to another room.
 
 * With `ALLOW_UNREGISTERED_ROOMS=false`, only an authenticated user can navigate to a previously existing link after the room has been purged. Doing so recreates the room in the database with a fresh configuration, with that user associated with it and granted admin rights.
 

docs/installation/compose.md

@@ -113,12 +113,33 @@ DJANGO_EMAIL_FROM=<your email address>
 
 #DJANGO_EMAIL_USE_TLS=true # A flag to enable or disable TLS for email sending.
 #DJANGO_EMAIL_USE_SSL=true # A flag to enable or disable SSL for email sending.
+#DJANGO_EMAIL_TIMEOUT=30 # Seconds before a stalled SMTP connection times out.
 
 
 DJANGO_EMAIL_BRAND_NAME=<brand name used in email templates> # e.g. "La Suite Numérique"
 DJANGO_EMAIL_LOGO_IMG=<logo image to use in email templates.> # e.g. "https://meet.yourdomain.tld/assets/logo-suite-numerique.png" 
 ```
 
+### Feature flags without an analytics backend
+
+Some features, such as automatic meeting summaries (`summary-enabled`), are gated by a feature flag read from the analytics backend. You do not need an analytics backend to enable them: leave `ANALYTICS_BACKEND` unset and declare the flags in `env.d/common`. No data is sent anywhere.
+
+```env
+ANALYTICS_BACKEND_SETTINGS={"feature_flags": {"summary-enabled": True}}
+```
+
+You can also set it directly in `compose.yaml`:
+
+```yaml
+services:
+  backend:
+    environment:
+      ANALYTICS_BACKEND_SETTINGS: '{"feature_flags": {"summary-enabled": True}}'
+```
+
+> [!NOTE]
+> The value is a Python dictionary, not JSON: write `True`, not `true`. Set it on every container running the backend image.
+
 ## Step 3: Configure your firewall
 
 If you are using a firewall as it is usually recommended in a production environment you will need to allow the webservice traffic on ports 80 and 443 but also to allow UDP traffic for the WebRTC service.

docs/installation/kubernetes.md

@@ -318,12 +318,17 @@ These are the environmental options available on meet backend.
 | DJANGO_SECRET_KEY                               | Secret key used for Django security                                                                                                                          |                                                                                                                                                              |
 | DJANGO_SILENCED_SYSTEM_CHECKS                   | Silence Django system checks                                                                                                                                 | []                                                                                                                                                           |
 | DJANGO_ALLOW_UNSECURE_USER_LISTING              | Allow unsecure user listing                                                                                                                                  | false                                                                                                                                                        |
-| DB_ENGINE                                       | Database engine used                                                                                                                                         | django.db.backends.postgresql_psycopg2                                                                                                                       |
+| DB_ENGINE                                       | Database engine used                                                                                                                                         | django.db.backends.postgresql                                                                                                                                |
 | DB_NAME                                         | Name of the database                                                                                                                                         | meet                                                                                                                                                         |
 | DB_USER                                         | User used to connect to database                                                                                                                             | dinum                                                                                                                                                        |
 | DB_PASSWORD                                     | Password used to connect to the database                                                                                                                     | pass                                                                                                                                                         |
 | DB_HOST                                         | Hostname of the database                                                                                                                                     | localhost                                                                                                                                                    |
 | DB_PORT                                         | Port to connect to database                                                                                                                                  | 5432                                                                                                                                                         |
+| DB_PSYCOPG_POOL_ENABLED                         | Enable the psycopg connection pool                                                                                                                           | false                                                                                                                                                        |
+| DB_PSYCOPG_POOL_MIN_SIZE                        | Connections each pool keeps open                                                                                                                             | 1                                                                                                                                                            |
+| DB_PSYCOPG_POOL_MAX_SIZE                        | Maximum connections per pool                                                                                                                                 | 3                                                                                                                                                            |
+| DB_PSYCOPG_POOL_TIMEOUT                         | Seconds a request waits for a free pool connection before failing                                                                                            | 30                                                                                                                                                           |
+| DB_PSYCOPG_POOL_MAX_IDLE                        | Seconds an idle connection above the minimum stays open                                                                                                      | 600                                                                                                                                                          |
 | STORAGES_STATICFILES_BACKEND                    | Static file serving engine                                                                                                                                   | whitenoise.storage.CompressedManifestStaticFilesStorage                                                                                                      |
 | AWS_S3_ENDPOINT_URL                             | S3 host endpoint                                                                                                                                             |                                                                                                                                                              |
 | AWS_S3_ACCESS_KEY_ID                            | S3 access key                                                                                                                                                |                                                                                                                                                              |
@@ -335,6 +340,8 @@ These are the environmental options available on meet backend.
 | SESSION_COOKIE_AGE                              | Session cookie expiration in seconds                                                                                                                         | 43200 (12 hours)                                                                                                                                             |
 | ROOM_CREATION_THROTTLE_RATES                    | Room creation throttle rate per authenticated user | 50/minute                                                                                               | 50/minute                                                                                                                                                    |
 | ROOM_CREATION_DAILY_THROTTLE_RATES              | Daily room creation cap per authenticated user                                                                                                               | 1000/day                                                                                                                                                     |
+| START_RECORDING_THROTTLE_RATES                  | Recording start throttle rate per authenticated user                                                                                                         | 10/minute                                                                                                                                                    |
+| START_RECORDING_DAILY_THROTTLE_RATES            | Daily recording start cap per authenticated user                                                                                                             | 100/day                                                                                                                                                      |
 | REQUEST_ENTRY_THROTTLE_RATES                    | Entry request throttle rates                                                                                                                                 | 150/minute                                                                                                                                                   |
 | CREATION_CALLBACK_THROTTLE_RATES                | Creation callback throttle rates                                                                                                                             | 600/minute                                                                                                                                                   |
 | SPECTACULAR_SETTINGS_ENABLE_DJANGO_DEPLOY_CHECK | Enable Django deploy check                                                                                                                                   | false                                                                                                                                                        |
@@ -357,6 +364,7 @@ These are the environmental options available on meet backend.
 | DJANGO_EMAIL_PORT                               | Port to connect to the email server                                                                                                                          |                                                                                                                                                              |
 | DJANGO_EMAIL_USE_TLS                            | Enable TLS on email connection                                                                                                                               | false                                                                                                                                                        |
 | DJANGO_EMAIL_USE_SSL                            | Enable SSL on email connection                                                                                                                               | false                                                                                                                                                        |
+| DJANGO_EMAIL_TIMEOUT                            | Seconds before a stalled SMTP connection times out                                                                                                           | 30                                                                                                                                                           |
 | DJANGO_EMAIL_FROM                               | Email from account                                                                                                                                           | from@example.com                                                                                                                                             |
 | EMAIL_BRAND_NAME                                | Email branding name                                                                                                                                          |                                                                                                                                                              |
 | EMAIL_SUPPORT_EMAIL                             | Support email address                                                                                                                                        |                                                                                                                                                              |
@@ -402,12 +410,15 @@ These are the environmental options available on meet backend.
 | LIVEKIT_API_SECRET                              | LiveKit API secret                                                                                                                                           |                                                                                                                                                              |
 | LIVEKIT_API_URL                                 | LiveKit API URL                                                                                                                                              |                                                                                                                                                              |
 | LIVEKIT_VERIFY_SSL                              | Verify SSL for LiveKit connections                                                                                                                           | true                                                                                                                                                         |
+| LIVEKIT_API_TIMEOUT_SECONDS                     | Seconds before a call to the LiveKit API gives up                                                                                                            | 10                                                                                                                                                           |
 | LIVEKIT_FORCE_WSS_PROTOCOL                      | Enables WSS protocol conversion for legacy browser compatibility (Firefox <124, Chrome <125, Edge <125) where HTTPS URLs fail in WebSocket() constructor.    | false                                                                                                                                                        |
 | LIVEKIT_ENABLE_FIREFOX_PROXY_WORKAROUND         | Firefox-only connection warmup: pre-calls WebSocket endpoint (expecting 401) to initialize cache, resolving proxy/network connectivity issues.               | false                                                                                                                                                        |
 | RESOURCE_DEFAULT_ACCESS_LEVEL                   | Default resource access level for rooms                                                                                                                      | public                                                                                                                                                       |
 | ALLOW_UNREGISTERED_ROOMS                        | Allow usage of unregistered rooms                                                                                                                            | true                                                                                                                                                         |
 | ROOM_INACTIVITY_DELETION_DAYS                   | Days without being started after which a room is purged. Unset to never purge                                                                                |                                                                                                                                                              |
+| ROOM_DELETED_RETENTION_DAYS                     | Days after its deletion after which a room is purged. Unset to purge deleted rooms only once inactive                                                        |                                                                                                                                                              |
 | RECORDING_ENABLE                                | Record meeting option                                                                                                                                        | false                                                                                                                                                        |
+| RECORDING_AUTHENTICATED_PARTICIPANTS_ENABLED    | Let any authenticated participant connected to a trusted or public room start/stop recordings. Set to false to reserve recording to room admins/owners       | true                                                                                                                                                         |
 | RECORDING_OUTPUT_FOLDER                         | Folder to store meetings                                                                                                                                     | recordings                                                                                                                                                   |
 | RECORDING_WORKER_CLASSES                        | Worker classes for recording                                                                                                                                 | {"screen_recording": "core.recording.worker.services.VideoCompositeEgressService","transcript": "core.recording.worker.services.AudioCompositeEgressService"} |
 | RECORDING_EXPIRATION_DAYS                       | Recording expiration in days                                                                                                                                 |                                                                                                                                                              |
@@ -415,6 +426,8 @@ These are the environmental options available on meet backend.
 | SCREEN_RECORDING_BASE_URL                       | Screen recording base URL                                                                                                                                    |                                                                                                                                                              |
 | SUMMARY_SERVICE_ENDPOINT                        | Summary service endpoint                                                                                                                                     |                                                                                                                                                              |
 | SUMMARY_SERVICE_API_TOKEN                       | API token for summary service                                                                                                                                |                                                                                                                                                              |
+| ANALYTICS_BACKEND                               | Analytics backend class, e.g. `core.analytics.posthog.PostHogAnalytics`. Nothing is sent when unset                                                          |                                                                                                                                                              |
+| ANALYTICS_BACKEND_SETTINGS                      | Analytics backend settings. Without a backend, `{"feature_flags": {"summary-enabled": True}}` sets feature flags statically                                  | {}                                                                                                                                                           |
 | SIGNUP_NEW_USER_TO_MARKETING_EMAIL              | Signup users to marketing emails                                                                                                                             | false                                                                                                                                                        |
 | MARKETING_SERVICE_CLASS                         | Marketing service class                                                                                                                                      | core.services.marketing.BrevoMarketingService                                                                                                                |
 | BREVO_API_KEY                                   | Brevo API key for marketing emails                                                                                                                           |                                                                                                                                                              |

env.d/development/postgresql.dist

@@ -8,4 +8,5 @@ DB_HOST=postgresql
 DB_NAME=meet
 DB_USER=dinum
 DB_PASSWORD=pass
-DB_PORT=5432
+DB_PORT=5432
+DB_PSYCOPG_POOL_ENABLED=True

renovate.json

@@ -24,12 +24,6 @@
       "matchManagers": ["pep621"],
       "matchPackageNames": ["redis"]
     },
-    {
-      "groupName": "allowed pylint versions",
-      "matchManagers": ["pep621"],
-      "matchPackageNames": ["pylint"],
-      "allowedVersions": "<4.0.0"
-    },
     {
         "groupName": "allowed django versions",
         "matchManagers": ["pep621"],

src/agents/pyproject.toml

@@ -1,7 +1,7 @@
 
 [project]
 name = "agents"
-version = "1.34.0"
+version = "1.35.0"
 requires-python = ">=3.12"
 dependencies = [
     "livekit-agents==1.7.0",

src/agents/uv.lock

@@ -9,7 +9,7 @@ resolution-markers = [
 
 [[package]]
 name = "agents"
-version = "1.34.0"
+version = "1.35.0"
 source = { virtual = "." }
 dependencies = [
     { name = "boto3" },
@@ -65,7 +65,7 @@ wheels = [
 
 [[package]]
 name = "aiohttp"
-version = "3.14.3"
+version = "3.14.5"
 source = { registry = "https://pypi.org/simple" }
 dependencies = [
     { name = "aiohappyeyeballs" },
@@ -77,90 +77,132 @@ dependencies = [
     { name = "typing-extensions", marker = "python_full_version < '3.13'" },
     { name = "yarl" },
 ]
-sdist = { url = "https://files.pythonhosted.org/packages/58/d9/22ce5786ac0c1653ae8b6c23bded02c1686d11f0dbb45b31ce128e0df985/aiohttp-3.14.3.tar.gz", hash = "sha256:9491196535a88924a60afd5b5f434b5b203b6cc616250878dbdb223a8f7844bc", size = 7971213, upload-time = "2026-07-23T01:57:27.037Z" }
+sdist = { url = "https://files.pythonhosted.org/packages/6c/4c/bdccd81e9ee225b69c60e7766c9a5b05364f118f4d383713b89a682d772d/aiohttp-3.14.5.tar.gz", hash = "sha256:5558a7f5a05af9ecf744af91e5baefc436f93c9333e656c27ec253f9a6bbe178", size = 8078052, upload-time = "2026-10-11T01:05:12.408Z" }
 wheels = [
-    { url = "https://files.pythonhosted.org/packages/18/d4/eb96299230e20acf2efae207cb8d69051f1f68e357e5ea5e479bf6fb097a/aiohttp-3.14.3-cp312-cp312-macosx_10_13_universal2.whl", hash = "sha256:39aded8c7f3b935b54aab1d8d73c70ec0ee2d3ec3b943e0e86611bc150ba47f5", size = 754690, upload-time = "2026-07-23T01:53:47.332Z" },
-    { url = "https://files.pythonhosted.org/packages/88/11/e7a70a209eb9a067c0d3212b518a0134e3484f5178c7533878b6b514d469/aiohttp-3.14.3-cp312-cp312-macosx_10_13_x86_64.whl", hash = "sha256:5bcb6ff3fdab1258a192679ff1a05d44f59626430aa05cd1a9d2447423599228", size = 509484, upload-time = "2026-07-23T01:53:51.159Z" },
-    { url = "https://files.pythonhosted.org/packages/30/07/4bbc222cc8dbe31d4c3e8a5baad2286e4d42026ac0c570027b89afce6344/aiohttp-3.14.3-cp312-cp312-macosx_11_0_arm64.whl", hash = "sha256:617105e2c3018ee38d0c8ce5ee3c84f621a6d8b9f723202aacaff28449ca91ee", size = 511949, upload-time = "2026-07-23T01:53:55.083Z" },
-    { url = "https://files.pythonhosted.org/packages/54/b9/42e74c46b7b7c794b995bbc1f573fb48950c38b19d8600c62a6804ee2d67/aiohttp-3.14.3-cp312-cp312-manylinux2014_aarch64.manylinux_2_17_aarch64.manylinux_2_28_aarch64.whl", hash = "sha256:f631fe87a6f30df5fbe6d79640b25e4cffb38c31c7fb6f10871517b84b0f8c1a", size = 1765282, upload-time = "2026-07-23T01:53:59.662Z" },
-    { url = "https://files.pythonhosted.org/packages/6b/ed/62bc4d74363ad346d518e0720363a949f63e2e23439a79eb5813d4d29bb3/aiohttp-3.14.3-cp312-cp312-manylinux2014_armv7l.manylinux_2_17_armv7l.manylinux_2_31_armv7l.whl", hash = "sha256:a94dbaae5ae27bd849c93570669bff91e0510f33a80805738e3de72a7be0447b", size = 1741511, upload-time = "2026-07-23T01:54:04.063Z" },
-    { url = "https://files.pythonhosted.org/packages/d0/9f/181e8a8bc79e47d13c7fc4540bd7a3b729d9505609c61f392a8dd2fbfe55/aiohttp-3.14.3-cp312-cp312-manylinux2014_ppc64le.manylinux_2_17_ppc64le.manylinux_2_28_ppc64le.whl", hash = "sha256:8f2f1c4c032c7cedd7d8da6f54c97b70266c6570c3108d3fdffee7188bb70529", size = 1810680, upload-time = "2026-07-23T01:54:09.882Z" },
-    { url = "https://files.pythonhosted.org/packages/5c/9a/dec94d6ad694552fe3424e3f1928d7a606a5d9d9433a04e7ecdd9d38ae7f/aiohttp-3.14.3-cp312-cp312-manylinux2014_s390x.manylinux_2_17_s390x.manylinux_2_28_s390x.whl", hash = "sha256:ea05e1f97ceea523942d9b2a7d7c0359d781d683d6b043f5943a602b14da4787", size = 1905646, upload-time = "2026-07-23T01:54:13.475Z" },
-    { url = "https://files.pythonhosted.org/packages/52/b7/7cd31f29d6055bd711ae6e669367fba6f5ae9de463910a793e30556a8db7/aiohttp-3.14.3-cp312-cp312-manylinux2014_x86_64.manylinux_2_17_x86_64.manylinux_2_28_x86_64.whl", hash = "sha256:543906c127fb1d929b95076db19b83fa2d46751006ff1e23b093aa5ac4d8db42", size = 1792122, upload-time = "2026-07-23T01:54:15.752Z" },
-    { url = "https://files.pythonhosted.org/packages/66/73/10b1ef93afa61f4963c746257b70ced619cf31a4798671de5fdb2608501d/aiohttp-3.14.3-cp312-cp312-manylinux_2_31_riscv64.manylinux_2_39_riscv64.whl", hash = "sha256:0a5ff2dfbb9ce645fa5b8ef3e02c6c0b9cc3f6030ff863d0c51fffc50cb5541b", size = 1591127, upload-time = "2026-07-23T01:54:19.489Z" },
-    { url = "https://files.pythonhosted.org/packages/49/ed/3b203fa6de1b338c14acdc06bf6ca9b043b7944f005966958c2ced932cde/aiohttp-3.14.3-cp312-cp312-musllinux_1_2_aarch64.whl", hash = "sha256:041badb8f84396357c4d3ad26de6afd7a32b112f43d3c63045c0c8278cfd2043", size = 1725210, upload-time = "2026-07-23T01:54:24.129Z" },
-    { url = "https://files.pythonhosted.org/packages/28/b7/1c2aab8c706436dcc28598452488ac9cd7c409da815237c28c27d58993e6/aiohttp-3.14.3-cp312-cp312-musllinux_1_2_armv7l.whl", hash = "sha256:530125ee1163c4219af35dc3aa1206e541e7b31b6efc1a3f93b70a136f65d427", size = 1764848, upload-time = "2026-07-23T01:54:27.973Z" },
-    { url = "https://files.pythonhosted.org/packages/54/50/94c28f08b131c4bf10984ea2c7a536c9920608bb2d6e7f95642c30cc87b7/aiohttp-3.14.3-cp312-cp312-musllinux_1_2_ppc64le.whl", hash = "sha256:c8653fd547c93a61aadc612007790f5555cdd18946fa48cf45e26d8ea4ea473d", size = 1777102, upload-time = "2026-07-23T01:54:31.775Z" },
-    { url = "https://files.pythonhosted.org/packages/13/d4/e7d09ba7d345fb2d74440fd2fa033c5e079fac05552927705986f41a364f/aiohttp-3.14.3-cp312-cp312-musllinux_1_2_riscv64.whl", hash = "sha256:89176250f686cb9853c0fb7ead90e639e915b84a6f43eedc2a4e7ec21f1037f0", size = 1580205, upload-time = "2026-07-23T01:54:34.518Z" },
-    { url = "https://files.pythonhosted.org/packages/a3/84/072a91d68e1e1eb587985b54baab94221277f877e8ef274fc213a0ceae28/aiohttp-3.14.3-cp312-cp312-musllinux_1_2_s390x.whl", hash = "sha256:3a26434dafe408229ff3403458ca58de24fb51936504decac49ce6755f77e59d", size = 1797219, upload-time = "2026-07-23T01:54:36.995Z" },
-    { url = "https://files.pythonhosted.org/packages/e0/eb/aad34e897e668424d6e995da5dff8a4a09af93363d3392488772957a63aa/aiohttp-3.14.3-cp312-cp312-musllinux_1_2_x86_64.whl", hash = "sha256:d1558173930a5a8d3069cee5c92fc91c87c4dbcb099debbb3622053717145a19", size = 1768629, upload-time = "2026-07-23T01:54:40.103Z" },
-    { url = "https://files.pythonhosted.org/packages/b6/2b/6bb88ddba0fecd9122aa3ebcad25996cf6c083a4a7040dbb3a4f97972af6/aiohttp-3.14.3-cp312-cp312-win32.whl", hash = "sha256:16100ad3ab8d649fdfbee87602d9d2dcdca9df0b9eda8a1b5fdc0d41f96da559", size = 451481, upload-time = "2026-07-23T01:54:42.547Z" },
-    { url = "https://files.pythonhosted.org/packages/76/9b/f2f8f108da17ecef2cc3efc424e8b7ad3782b1a8360f7b8eae8ced84f6ea/aiohttp-3.14.3-cp312-cp312-win_amd64.whl", hash = "sha256:33a2d7c28d33797a2e99923dffa63f83d908a19b6bf26cfe80fa790aa5e1a75a", size = 476845, upload-time = "2026-07-23T01:54:44.853Z" },
-    { url = "https://files.pythonhosted.org/packages/3e/44/28dac80a8941b604f4da10ce21097614ca1bf905ce93dca28d8d7de9c1e7/aiohttp-3.14.3-cp312-cp312-win_arm64.whl", hash = "sha256:362a3fd481769cac1a824514bcd86fda51c65e8fe6e051099e008fddde6db17c", size = 448050, upload-time = "2026-07-23T01:54:47.087Z" },
-    { url = "https://files.pythonhosted.org/packages/57/be/5afd201cc0ab139029aadb75392efe85a293403d9dd3a3226161c21ce00c/aiohttp-3.14.3-cp313-cp313-android_21_arm64_v8a.whl", hash = "sha256:2e9878ae68e4a5f1c0abe4dd497dbc3d51946f5837b56759e2a02e78fa90ef86", size = 506269, upload-time = "2026-07-23T01:54:49.075Z" },
-    { url = "https://files.pythonhosted.org/packages/22/09/dec8189d62b45ade009f6792a2264b942a90cb88aeaf181239933cd72c3c/aiohttp-3.14.3-cp313-cp313-android_21_x86_64.whl", hash = "sha256:f3d2669fe7dec7fc359ecdb5984b29b50d85d5d00f8c1cb61de4f4a24ee42627", size = 515166, upload-time = "2026-07-23T01:54:51.894Z" },
-    { url = "https://files.pythonhosted.org/packages/28/24/2854869d29ed8a8b19d74f9ec6629515f7e04d02dd329d9d179201e58e47/aiohttp-3.14.3-cp313-cp313-ios_13_0_arm64_iphoneos.whl", hash = "sha256:cc7cb243a68167172f48c1fd43cee91ec4b1d40cefd190edd43369d1a6bc9c82", size = 486263, upload-time = "2026-07-23T01:54:54.223Z" },
-    { url = "https://files.pythonhosted.org/packages/d4/dd/57187c8be2a35aea65eaee3bd2c3dcbbcf0204f5106c89637e3610380cd1/aiohttp-3.14.3-cp313-cp313-ios_13_0_arm64_iphonesimulator.whl", hash = "sha256:78253b573e6ffab5028924fc98bc281aae05445969982a10864bc360dea2016c", size = 492299, upload-time = "2026-07-23T01:54:56.236Z" },
-    { url = "https://files.pythonhosted.org/packages/b9/11/06ae6ed8f0d414edf4068861e233d8fe23ee699bfd4b3ceb8663db948a62/aiohttp-3.14.3-cp313-cp313-ios_13_0_x86_64_iphonesimulator.whl", hash = "sha256:7041d52c3a7fa20c9e8c182b534704abb19502c8bdcbde7ab23bfda6f642394f", size = 502235, upload-time = "2026-07-23T01:54:58.377Z" },
-    { url = "https://files.pythonhosted.org/packages/7e/a3/559639c34a345d2cf7c52dff6838119f2eaf29eb508227b5b83f573af813/aiohttp-3.14.3-cp313-cp313-macosx_10_13_universal2.whl", hash = "sha256:ac74facc01463f138b0da5580329cfcc82818dea5656e83ddcd11268fc12ff80", size = 750883, upload-time = "2026-07-23T01:55:00.65Z" },
-    { url = "https://files.pythonhosted.org/packages/91/cd/41e131f13afd1e7b0172a9d9eda085ef90eb8439f41f0d279db81ed3ae60/aiohttp-3.14.3-cp313-cp313-macosx_10_13_x86_64.whl", hash = "sha256:d6218d92e450824e9b4881f44e8c09f1853b490f9a64130801024a4793b1b3b0", size = 508473, upload-time = "2026-07-23T01:55:02.945Z" },
-    { url = "https://files.pythonhosted.org/packages/bc/6b/e7f13410d391c6e55b4c007a8de024355389d7d459e3d64c42b2d33617e5/aiohttp-3.14.3-cp313-cp313-macosx_11_0_arm64.whl", hash = "sha256:11fb37ef075669eee52ab1928fbf6e1741fada40409fa309ebde9607a962aebf", size = 509190, upload-time = "2026-07-23T01:55:05.173Z" },
-    { url = "https://files.pythonhosted.org/packages/97/21/6464573e53d69672cc1eada3e5c5cb2d2efa82701e8305a0f2047a576967/aiohttp-3.14.3-cp313-cp313-manylinux2014_aarch64.manylinux_2_17_aarch64.manylinux_2_28_aarch64.whl", hash = "sha256:55bdcc472aafe2de4a253045cc128007a64f1e0264fb675791e132ea5edaa3bd", size = 1761478, upload-time = "2026-07-23T01:55:07.383Z" },
-    { url = "https://files.pythonhosted.org/packages/1a/81/d217043a4c17fbce360905e3b2bdd20139ebc9a2de836d035d179c4da006/aiohttp-3.14.3-cp313-cp313-manylinux2014_armv7l.manylinux_2_17_armv7l.manylinux_2_31_armv7l.whl", hash = "sha256:c39846c3aad97a8530c89d7a3869a8f8e9e3762c6ac0504481e5c80948f7e807", size = 1735092, upload-time = "2026-07-23T01:55:09.803Z" },
-    { url = "https://files.pythonhosted.org/packages/a1/66/e13a02d0eeb1a9a502402a977abb4e4abff9fe4051c26f80558c57a7c975/aiohttp-3.14.3-cp313-cp313-manylinux2014_ppc64le.manylinux_2_17_ppc64le.manylinux_2_28_ppc64le.whl", hash = "sha256:5895ef58c4620afe02fa16044f023dc4dafec08158f9d08874a46a7dbc0341b8", size = 1800546, upload-time = "2026-07-23T01:55:12.012Z" },
-    { url = "https://files.pythonhosted.org/packages/26/5e/57d42fca1d18cb5acc1cad945d017fabc5d6ae71d8a08ad66be8dc3ee544/aiohttp-3.14.3-cp313-cp313-manylinux2014_s390x.manylinux_2_17_s390x.manylinux_2_28_s390x.whl", hash = "sha256:fa9467a8113aa69d3d7c55a70ef0b7c636010a40993f3df9d9d0d73b3eb7ef24", size = 1895250, upload-time = "2026-07-23T01:55:14.357Z" },
-    { url = "https://files.pythonhosted.org/packages/ca/1c/7da8d08e74d56f00070822f9638ff3f1c563f8ad87d1efa996c87bfc8644/aiohttp-3.14.3-cp313-cp313-manylinux2014_x86_64.manylinux_2_17_x86_64.manylinux_2_28_x86_64.whl", hash = "sha256:d7d2deec16eeedf55f2c7cf75b521ea3856a5177e123844f8fd0f114ce252cb5", size = 1789289, upload-time = "2026-07-23T01:55:16.668Z" },
-    { url = "https://files.pythonhosted.org/packages/cd/0f/cf16bcf56896981c1a0319f5d5db9337994b5165730c48a8fa07e9b34be6/aiohttp-3.14.3-cp313-cp313-manylinux_2_31_riscv64.manylinux_2_39_riscv64.whl", hash = "sha256:dd54d0e8717de95939766febac482ac0474d8ac3b048115f9f2b1d23a16e7db4", size = 1586706, upload-time = "2026-07-23T01:55:18.913Z" },
-    { url = "https://files.pythonhosted.org/packages/fe/6f/76eac12a7f2480e1e304f842efdb07db33256b0d9165b866b6ef0806c202/aiohttp-3.14.3-cp313-cp313-musllinux_1_2_aarch64.whl", hash = "sha256:df82f3787c940c94986b34222d59c9e38843fba85139f36e85255a82ad5355a9", size = 1724652, upload-time = "2026-07-23T01:55:21.296Z" },
-    { url = "https://files.pythonhosted.org/packages/39/b6/19c8c592baeeb94b75f966547d40c02ac7590902306ec5863d5c027cf506/aiohttp-3.14.3-cp313-cp313-musllinux_1_2_armv7l.whl", hash = "sha256:42a67efc36300d052fb4508a53e8b6901b9284b599ae63945c377569c5fcc1e1", size = 1756239, upload-time = "2026-07-23T01:55:23.705Z" },
-    { url = "https://files.pythonhosted.org/packages/dc/c9/4e9383150296f97f873b680c4de8fb2cd88608fb9f48c79edcb111611abc/aiohttp-3.14.3-cp313-cp313-musllinux_1_2_ppc64le.whl", hash = "sha256:7a75aa63cbf9b21cfaf60dc2657e19df2c2867d91707d653fee171ffeedd1371", size = 1769161, upload-time = "2026-07-23T01:55:26.082Z" },
-    { url = "https://files.pythonhosted.org/packages/aa/1e/147bdc6cc5de5f3ab011be8bf5d6e786633249f22c20bae06f85e45f5387/aiohttp-3.14.3-cp313-cp313-musllinux_1_2_riscv64.whl", hash = "sha256:e92eb8acc45eb6a9f4935071a77edf5b85cc6f8dfad5cd99e97653c26593cdde", size = 1578759, upload-time = "2026-07-23T01:55:28.846Z" },
-    { url = "https://files.pythonhosted.org/packages/fd/31/78388a9d6040ece2e11df62ea229a822cf5e52d238374b220ae9975b2623/aiohttp-3.14.3-cp313-cp313-musllinux_1_2_s390x.whl", hash = "sha256:b014a6ed7cf912e787149fdc529166d3ceabac23f26efeea3158c9aba2354e7e", size = 1792025, upload-time = "2026-07-23T01:55:31.457Z" },
-    { url = "https://files.pythonhosted.org/packages/03/51/a3d29fdf2c25d796746af8ad6fe56a45d6256c38b0a8a2ed752e1160b3a2/aiohttp-3.14.3-cp313-cp313-musllinux_1_2_x86_64.whl", hash = "sha256:3d4f72af88ac2474bb5bca640030320e3d38a0163a1d7533500e87be458eef71", size = 1768477, upload-time = "2026-07-23T01:55:33.87Z" },
-    { url = "https://files.pythonhosted.org/packages/29/a6/442e18b5afeade534d877a2dc3c3e392aff8d49787890b0cf84790410267/aiohttp-3.14.3-cp313-cp313-win32.whl", hash = "sha256:5f08ec777f35ee70720233b8b9811d3bb5d728137f30ac91b7457709c3261ac0", size = 451069, upload-time = "2026-07-23T01:55:36.121Z" },
-    { url = "https://files.pythonhosted.org/packages/9d/69/3d876ac02659f271cf7f6769f14a8e3de5b6e888ed8b5a7e998086a4cec8/aiohttp-3.14.3-cp313-cp313-win_amd64.whl", hash = "sha256:dff9461ec275f22135650d5ba4b4931a11f3958df7dfbb8db630000d4dee0883", size = 476518, upload-time = "2026-07-23T01:55:38.303Z" },
-    { url = "https://files.pythonhosted.org/packages/b2/0e/50d6e6471cd31edce8b282bdec59375a3a69124d8a989a0b1313355cae52/aiohttp-3.14.3-cp313-cp313-win_arm64.whl", hash = "sha256:ddcac3c6b382e81f1dd0499199d4136b877beb4cb5ef770bbbfba56c4b8f55d2", size = 447676, upload-time = "2026-07-23T01:55:40.451Z" },
-    { url = "https://files.pythonhosted.org/packages/c8/20/887fdcf832326571b370ffc347b3e70abe101096f3720126aac161b1d872/aiohttp-3.14.3-cp314-cp314-android_24_arm64_v8a.whl", hash = "sha256:49f7325beb0f85ef4aef5f48f490269575f83e6e2acad00a1d80b807eb027062", size = 509067, upload-time = "2026-07-23T01:55:42.618Z" },
-    { url = "https://files.pythonhosted.org/packages/ad/a3/92cec936f78cc4bf0fa5554ebe593b73459d94e3c62303e1902a4cccb6f7/aiohttp-3.14.3-cp314-cp314-android_24_x86_64.whl", hash = "sha256:e3be98a7c30b8c25d573dafba7171d66dfb05ee6a9070fc46535464ff97700a6", size = 514774, upload-time = "2026-07-23T01:55:44.937Z" },
-    { url = "https://files.pythonhosted.org/packages/29/ba/2a0c38df3fc557620b6a5acd98364af050053b6285b4dc7ee74100c63c18/aiohttp-3.14.3-cp314-cp314-ios_13_0_arm64_iphoneos.whl", hash = "sha256:614c61d478b83953e261d02bb2df750f17227cd33ef8002945bf5aebbde21919", size = 488134, upload-time = "2026-07-23T01:55:47.135Z" },
-    { url = "https://files.pythonhosted.org/packages/48/d6/d51b7d4bf309af3693940d8ffd2b9ed0b682434ef85959b7c9c137f60cf8/aiohttp-3.14.3-cp314-cp314-ios_13_0_arm64_iphonesimulator.whl", hash = "sha256:1caa7b0d05f3e3a36f87788c59e970a7ee1cefcfcbb924a9f138c4a6551c9cb7", size = 494201, upload-time = "2026-07-23T01:55:49.451Z" },
-    { url = "https://files.pythonhosted.org/packages/3f/5a/8f624384e5f1efabb5229b94157eb966b021e97bdb188c62860c2ae243c2/aiohttp-3.14.3-cp314-cp314-ios_13_0_x86_64_iphonesimulator.whl", hash = "sha256:dfa68deb2a443bdaa3ea5297b0699c1464f08aef3812b486d1348eee61b07dc0", size = 502766, upload-time = "2026-07-23T01:55:51.656Z" },
-    { url = "https://files.pythonhosted.org/packages/a6/26/4ff0164370deec18fb19254ee4ab10b7a73304ac0c860b13f5f84663759b/aiohttp-3.14.3-cp314-cp314-macosx_10_15_universal2.whl", hash = "sha256:e72ee89e28d907a18f46959b4eb0bb06701cc7f8cf4366e00029e2ccfaaf5924", size = 756557, upload-time = "2026-07-23T01:55:53.964Z" },
-    { url = "https://files.pythonhosted.org/packages/97/a3/7056b86dc0d9ec709ea9777eae3b0161428f943372f8b98c01c11593b682/aiohttp-3.14.3-cp314-cp314-macosx_10_15_x86_64.whl", hash = "sha256:ad4c8b7488d745d2ca4838ebd8ae5ba9b56341d30b1da43640e4ce87f9f49646", size = 510168, upload-time = "2026-07-23T01:55:56.22Z" },
-    { url = "https://files.pythonhosted.org/packages/85/ed/0357a015892fd68058bf2d39d3fd1958e459b997a7db30aaa6aaa434ae96/aiohttp-3.14.3-cp314-cp314-macosx_11_0_arm64.whl", hash = "sha256:db332af25642007330fca8be5c4d194caf2bea7a7fc84415aff3497af5dfee6b", size = 512957, upload-time = "2026-07-23T01:55:58.437Z" },
-    { url = "https://files.pythonhosted.org/packages/47/d1/8aba53f15ccb2238405f5e9d30e2a8ca44f93878c26e7165ade00d374b1c/aiohttp-3.14.3-cp314-cp314-manylinux2014_aarch64.manylinux_2_17_aarch64.manylinux_2_28_aarch64.whl", hash = "sha256:25bd2708db6bdf6a6630dd37bdcdfcb47c4434d22ac69c64665b802910140b30", size = 1750149, upload-time = "2026-07-23T01:56:00.856Z" },
-    { url = "https://files.pythonhosted.org/packages/49/bd/40c3fee327529284375c6701cbb0fa4600cc2e8432af1378f897e2ef7d3a/aiohttp-3.14.3-cp314-cp314-manylinux2014_armv7l.manylinux_2_17_armv7l.manylinux_2_31_armv7l.whl", hash = "sha256:cef89a58e628c4efcac3275c2d68083f82426dcdc89c1492a6f654f9f7ea6ab9", size = 1707685, upload-time = "2026-07-23T01:56:03.371Z" },
-    { url = "https://files.pythonhosted.org/packages/2a/a3/ca0cc6724cca8114b05694abd916060758c79894c3aa5b012cdadc1bc28e/aiohttp-3.14.3-cp314-cp314-manylinux2014_ppc64le.manylinux_2_17_ppc64le.manylinux_2_28_ppc64le.whl", hash = "sha256:c23ec8ee9d5ab2f5421f9c7fffce208435607af27fd46d4a44e031954352838f", size = 1803911, upload-time = "2026-07-23T01:56:05.817Z" },
-    { url = "https://files.pythonhosted.org/packages/95/b5/85b099c299c3ffd38ad9b3e43694c8a346934e4a30c88c4fd5a841234f77/aiohttp-3.14.3-cp314-cp314-manylinux2014_s390x.manylinux_2_17_s390x.manylinux_2_28_s390x.whl", hash = "sha256:e2667f0bbe7eb6c74eae5e9691441ad186e5845ca3cff63230fc09c4e7514f5d", size = 1876929, upload-time = "2026-07-23T01:56:08.413Z" },
-    { url = "https://files.pythonhosted.org/packages/d5/b7/1da684a04175473fa4cddbf9a2f572e79514c3fd27a74597f43057d4f3da/aiohttp-3.14.3-cp314-cp314-manylinux2014_x86_64.manylinux_2_17_x86_64.manylinux_2_28_x86_64.whl", hash = "sha256:18cb43369747b2ae007bd2655fb8e63a099c2ff1d207962943636dac989b3147", size = 1761112, upload-time = "2026-07-23T01:56:10.918Z" },
-    { url = "https://files.pythonhosted.org/packages/d1/16/bc4b55e3e5cb175fd69c53c90d60d2f47797cb343da5106e23863dc4dba4/aiohttp-3.14.3-cp314-cp314-manylinux_2_31_riscv64.manylinux_2_39_riscv64.whl", hash = "sha256:d77640cc618c1d99fc4f8589c0f24a730adfa54eb1e57ef7bf0c8dfb78da898c", size = 1583500, upload-time = "2026-07-23T01:56:13.613Z" },
-    { url = "https://files.pythonhosted.org/packages/2a/e8/13a9d957a1ee40837f46aa30f0f4c657e673ad86a2e6362a9f9be20d26d9/aiohttp-3.14.3-cp314-cp314-musllinux_1_2_aarch64.whl", hash = "sha256:53e5179d8abb5710f8e83ba207c41c8d1261fcffd4616500e15ca2b7a33be10a", size = 1713940, upload-time = "2026-07-23T01:56:15.969Z" },
-    { url = "https://files.pythonhosted.org/packages/38/05/d33c680c1bcf1c7e130f9cbfc1fc02fe8bb0c4af2a94a53dd5fb56131e5c/aiohttp-3.14.3-cp314-cp314-musllinux_1_2_armv7l.whl", hash = "sha256:cd817772b2fcf2b8c0905795318485f9ec16eae60b29feb7f4c77085311637f0", size = 1724413, upload-time = "2026-07-23T01:56:18.591Z" },
-    { url = "https://files.pythonhosted.org/packages/85/1d/af798d306f7a74b6a632dbcabcf62a4c91391b7582d2a8c6d7712e2cc54e/aiohttp-3.14.3-cp314-cp314-musllinux_1_2_ppc64le.whl", hash = "sha256:4e3ac92d90e92773b2362d506068e9a948192bd553e743c5b2429e28527c8661", size = 1770748, upload-time = "2026-07-23T01:56:21.074Z" },
-    { url = "https://files.pythonhosted.org/packages/a8/92/ad720d472556a995049206867765e9410969684f86ee09423ff9969044c1/aiohttp-3.14.3-cp314-cp314-musllinux_1_2_riscv64.whl", hash = "sha256:3f42e9b78301f11c8f861746175d8b9c1ccef713fcad9eab396e2f6db8ed4a22", size = 1577564, upload-time = "2026-07-23T01:56:23.475Z" },
-    { url = "https://files.pythonhosted.org/packages/60/ad/0ed7586cbef7a884e23a752fa2bb987a122e6a5dd50dab109258d0a95193/aiohttp-3.14.3-cp314-cp314-musllinux_1_2_s390x.whl", hash = "sha256:9d9edccfe496b476db5f398d97b865e9a6752bcf8aec4eef8390ce20fb64bb41", size = 1782080, upload-time = "2026-07-23T01:56:25.994Z" },
-    { url = "https://files.pythonhosted.org/packages/97/ea/dbaed0d73e8a69aad653b045dab451c67c2454bb731a37b45a86593e9422/aiohttp-3.14.3-cp314-cp314-musllinux_1_2_x86_64.whl", hash = "sha256:1c5ec8fb1bcc31a8466f74aaf26c345d5c386fa4bd08a3f0eb9c7a4a3fe8b5bf", size = 1745813, upload-time = "2026-07-23T01:56:28.604Z" },
-    { url = "https://files.pythonhosted.org/packages/81/1b/6893d4bc57e434fc93a6c9217c637d967a0b651d989f6e3265179375754a/aiohttp-3.14.3-cp314-cp314-win32.whl", hash = "sha256:38901a84da3ce22249f6e860bf8f90d141bcab7da090cc398f8bb58c0e44b7da", size = 455872, upload-time = "2026-07-23T01:56:31.031Z" },
-    { url = "https://files.pythonhosted.org/packages/f5/8b/c7baa1ba1eda4db6989baefe5de6d99834921b84ebd7918624febcb9f290/aiohttp-3.14.3-cp314-cp314-win_amd64.whl", hash = "sha256:8b3b60de05f3dcb6f6a00f818bb2ec781cee4de0645f59ccaf99b1d1823b6100", size = 481030, upload-time = "2026-07-23T01:56:33.365Z" },
-    { url = "https://files.pythonhosted.org/packages/22/8c/c29d067df825a2df88ca432db848aa2fe8199598359cc06c12b09320cac9/aiohttp-3.14.3-cp314-cp314-win_arm64.whl", hash = "sha256:1576145bdceeb92382d899751e12743a3a5b8e460a841e3e50543859e54864dc", size = 453669, upload-time = "2026-07-23T01:56:35.731Z" },
-    { url = "https://files.pythonhosted.org/packages/6a/a4/9c033beb355d39b6147980597ec9645e4729243f686ee4dc73945de72030/aiohttp-3.14.3-cp314-cp314t-macosx_10_15_universal2.whl", hash = "sha256:8800c996b01c2772a783e3e46f3e1abd5823029adca0df54231960de9bfefa5b", size = 791403, upload-time = "2026-07-23T01:56:37.972Z" },
-    { url = "https://files.pythonhosted.org/packages/80/ca/87c32a0a7704583cfc49660bd817889bae5b830bf53b5dcb4e92145ac2da/aiohttp-3.14.3-cp314-cp314t-macosx_10_15_x86_64.whl", hash = "sha256:ebe8e504f058fe91223351cecd2d9d6946c9d241bb0250d898ffbdf584cc72b0", size = 526413, upload-time = "2026-07-23T01:56:40.523Z" },
-    { url = "https://files.pythonhosted.org/packages/9e/d8/8ec0e471248c500acdce2be3f46db8fb62b5eb60efef072529cc85ee1d26/aiohttp-3.14.3-cp314-cp314t-macosx_11_0_arm64.whl", hash = "sha256:30402d03a7c0ff52bce290b57e564e9079fd9d0cb545c8aba73f86a103162d2e", size = 532135, upload-time = "2026-07-23T01:56:42.876Z" },
-    { url = "https://files.pythonhosted.org/packages/fe/45/f8919fd936e8b79fcd9bda7b6d8e62613462a713f4f17987fd7c34399142/aiohttp-3.14.3-cp314-cp314t-manylinux2014_aarch64.manylinux_2_17_aarch64.manylinux_2_28_aarch64.whl", hash = "sha256:9fc7b5bfec6573f3ae844f457fdde5adeb713f8b8e4a81ad64fc207b49383716", size = 1922742, upload-time = "2026-07-23T01:56:45.528Z" },
-    { url = "https://files.pythonhosted.org/packages/f6/ec/9ca76b28a27525b0cc53e20842e0228b022f301ce1f436b7d814b4aaf2df/aiohttp-3.14.3-cp314-cp314t-manylinux2014_armv7l.manylinux_2_17_armv7l.manylinux_2_31_armv7l.whl", hash = "sha256:8a5fd34f7f7410d1730d5c2ba873cacb2eed3fede366feb268a70ba22581ed8f", size = 1787371, upload-time = "2026-07-23T01:56:48.045Z" },
-    { url = "https://files.pythonhosted.org/packages/b1/04/6acdbf17315f7b55f1937e3387acb89a3cddeb4995689553d064af8e92ab/aiohttp-3.14.3-cp314-cp314t-manylinux2014_ppc64le.manylinux_2_17_ppc64le.manylinux_2_28_ppc64le.whl", hash = "sha256:270d3dace9ca2f10f0da5d8ebe519b7a310fc6112ed916e32df5866df0888553", size = 1912623, upload-time = "2026-07-23T01:56:50.605Z" },
-    { url = "https://files.pythonhosted.org/packages/86/e6/438b0c79ca6f45eb9fd9817dd4c01a91919a38c0de5ee9e05e2b4dc0ece7/aiohttp-3.14.3-cp314-cp314t-manylinux2014_s390x.manylinux_2_17_s390x.manylinux_2_28_s390x.whl", hash = "sha256:3ae5b3a59436d089b5395d910121a390feed4d00578eb95a0fd1a329fe963100", size = 2005515, upload-time = "2026-07-23T01:56:53.153Z" },
-    { url = "https://files.pythonhosted.org/packages/bb/6b/62cbd6577758699525f5c712d1ddef57d9875fbab0ae8d5f5a202fd598f8/aiohttp-3.14.3-cp314-cp314t-manylinux2014_x86_64.manylinux_2_17_x86_64.manylinux_2_28_x86_64.whl", hash = "sha256:2498f0fe69ead802f9675beca44a7c21c62fdaa4ec5145ea1c3ad6edbee29f85", size = 1879906, upload-time = "2026-07-23T01:56:55.818Z" },
-    { url = "https://files.pythonhosted.org/packages/00/95/18bcbf830a21dc3aae24d8f6b6feaf3db1d2090242d00a7868db2ffb0b67/aiohttp-3.14.3-cp314-cp314t-manylinux_2_31_riscv64.manylinux_2_39_riscv64.whl", hash = "sha256:a0dc483c00da8b673abbb367eb6f8d8f4bcec30eb58529ea13cb42e7fd2dfa33", size = 1675849, upload-time = "2026-07-23T01:56:58.861Z" },
-    { url = "https://files.pythonhosted.org/packages/a9/19/47f4968659c5e23606c3790c80fc624e691c153d036148449ee84d31b287/aiohttp-3.14.3-cp314-cp314t-musllinux_1_2_aarch64.whl", hash = "sha256:c7d3a97c678d34fc5b59da671ee9cd630096ddc643e7b5a30d54a2a6f3574d3f", size = 1843496, upload-time = "2026-07-23T01:57:01.591Z" },
-    { url = "https://files.pythonhosted.org/packages/64/af/38c33c4dd82fddcb4e56c4653b6f1072a8edbc6b7fa15809f14932c41e2d/aiohttp-3.14.3-cp314-cp314t-musllinux_1_2_armv7l.whl", hash = "sha256:f8fb78a83c9e5f741ca3a68cfb455c1f5bb83b4e7249a3848b3cd78d0a8563b0", size = 1827746, upload-time = "2026-07-23T01:57:05.131Z" },
-    { url = "https://files.pythonhosted.org/packages/a1/9d/0537cda4885ac8f5b7053d164dd06312f4c483a4edcb8ee5b8aaf2a989bf/aiohttp-3.14.3-cp314-cp314t-musllinux_1_2_ppc64le.whl", hash = "sha256:74ab5b6a9fb13e873e5a90946588baecaf488745e1db1a4a5c433f971f035098", size = 1853810, upload-time = "2026-07-23T01:57:08.043Z" },
-    { url = "https://files.pythonhosted.org/packages/19/fe/26f9c5e6458385aa86497836b0dea6fb2f027827d63f37c7856cce9286ee/aiohttp-3.14.3-cp314-cp314t-musllinux_1_2_riscv64.whl", hash = "sha256:bd52f811e65f6fb634b1047159657c98f52b407f8efec907bcfc09da9a4c0a25", size = 1668895, upload-time = "2026-07-23T01:57:10.837Z" },
-    { url = "https://files.pythonhosted.org/packages/ec/4c/618b1db9b9ba079b8875d2cdf78e7c4a3bf72903bd5850fee7dd9544600a/aiohttp-3.14.3-cp314-cp314t-musllinux_1_2_s390x.whl", hash = "sha256:f0f177d1b195b9e06376cfd7d308d8a1b920909a609d03ac82a8c73bbb16d3b9", size = 1883833, upload-time = "2026-07-23T01:57:13.672Z" },
-    { url = "https://files.pythonhosted.org/packages/94/c6/bd959bd1e4771f9fd944e9e436224c48c77b018b73b519b5aad346335bcc/aiohttp-3.14.3-cp314-cp314t-musllinux_1_2_x86_64.whl", hash = "sha256:498c6c623134f8e09a3c4e60bcd607a0b4590dd7dbf08dd40851b27cbb520ccb", size = 1844251, upload-time = "2026-07-23T01:57:16.593Z" },
-    { url = "https://files.pythonhosted.org/packages/5e/19/08d41839658bdd44a0ed2480f3891705ecb487ce28c0dde62c9040c997e0/aiohttp-3.14.3-cp314-cp314t-win32.whl", hash = "sha256:b304db572b4368edd8dda8a2274f73156fe15558fca4a917cb8a09fc47af5963", size = 474180, upload-time = "2026-07-23T01:57:19.306Z" },
-    { url = "https://files.pythonhosted.org/packages/99/5d/3cd6ef0a2b2851f7ab913b5b079334781bd50ff56a323e4454063377a080/aiohttp-3.14.3-cp314-cp314t-win_amd64.whl", hash = "sha256:b20032766aedf6261c7a566585a40867d092ac03a0d81592d5370ef9b054f99b", size = 500528, upload-time = "2026-07-23T01:57:21.762Z" },
-    { url = "https://files.pythonhosted.org/packages/a4/37/cfd1ed540a4d318da025590d96b728e63713c09e9377950fc655dadeb856/aiohttp-3.14.3-cp314-cp314t-win_arm64.whl", hash = "sha256:2e1161602f45a54de2ce0905243a95f58cb42dcd378402f3697f5e0b21e9d2e7", size = 469280, upload-time = "2026-07-23T01:57:24.241Z" },
+    { url = "https://files.pythonhosted.org/packages/d5/94/6ba86efddcb616c811b40e6a0dfdd862738f647e4e3860a961075d5e9ed8/aiohttp-3.14.5-cp312-cp312-macosx_10_13_universal2.whl", hash = "sha256:df37b620684e19b5e25724412518ccafc3b1a49cdac706fdbd2f983fad943450", size = 817499, upload-time = "2026-10-11T01:00:18.901Z" },
+    { url = "https://files.pythonhosted.org/packages/5e/e1/7bca6d84dabd228aa8eb4b7f9feac2586aaa9be5505d7d65bf287a615c43/aiohttp-3.14.5-cp312-cp312-macosx_10_13_x86_64.whl", hash = "sha256:ef60869969180ec2464f1349aff07138ae35ca2200f0946cb3552e49e8f301a8", size = 549467, upload-time = "2026-10-11T01:00:20.854Z" },
+    { url = "https://files.pythonhosted.org/packages/64/91/11b89f45ca486252dd67dd5f3231fec04bf5518da39a95cb3997619f17fb/aiohttp-3.14.5-cp312-cp312-macosx_11_0_arm64.whl", hash = "sha256:d079c0a0135c36e7beb6f1c88087c8f108dc5891cdd0b5eafa778421bda70ed2", size = 548067, upload-time = "2026-10-11T01:00:22.659Z" },
+    { url = "https://files.pythonhosted.org/packages/22/ff/c6615806c14aab34f82b9424ccde8ce6e417315fd57ce1c5b4d4747888e1/aiohttp-3.14.5-cp312-cp312-manylinux2014_aarch64.manylinux_2_17_aarch64.manylinux_2_28_aarch64.whl", hash = "sha256:abfda5cb094a829f7bc25216a32f7db2e85cc65bd59910f8e7b40b3d9b224764", size = 1896245, upload-time = "2026-10-11T01:00:24.638Z" },
+    { url = "https://files.pythonhosted.org/packages/39/b2/25a8c971ae6a92c8394d77e42422d7f38989e05cf41a5ceb92d73d67ab7e/aiohttp-3.14.5-cp312-cp312-manylinux2014_armv7l.manylinux_2_17_armv7l.manylinux_2_31_armv7l.whl", hash = "sha256:9cc882cf8619109583c906b4d4a85d6a111a98afa34b7a450d1e08118d016820", size = 1872180, upload-time = "2026-10-11T01:00:26.838Z" },
+    { url = "https://files.pythonhosted.org/packages/2f/d5/99f93ea36cc5205e47c1e5a803e087f2ad21b5430b5db2e942cb6e988a37/aiohttp-3.14.5-cp312-cp312-manylinux2014_ppc64le.manylinux_2_17_ppc64le.manylinux_2_28_ppc64le.whl", hash = "sha256:7457580535e019e1247ea35d6a02bf081ad30c26d0cbc210c93f6c3ab67a0835", size = 1937261, upload-time = "2026-10-11T01:00:28.74Z" },
+    { url = "https://files.pythonhosted.org/packages/40/a6/9ac9c9e6695040bd73d2584a1b59a9388f6433c76d5294a7bf591e21ffe5/aiohttp-3.14.5-cp312-cp312-manylinux2014_s390x.manylinux_2_17_s390x.manylinux_2_28_s390x.whl", hash = "sha256:c5ed596aedb9c42afd3fe0aae3117725378ac73d2cc5ddc735056fbdb96c5d02", size = 2064994, upload-time = "2026-10-11T01:00:30.623Z" },
+    { url = "https://files.pythonhosted.org/packages/da/e4/aa172eb534b7f02f1f8ff1c3213347eaf3cf218db91a727c6863c22f1035/aiohttp-3.14.5-cp312-cp312-manylinux2014_x86_64.manylinux_2_17_x86_64.manylinux_2_28_x86_64.whl", hash = "sha256:20f085697d7e911f1f73c43ed03fafbed1e7121797e2eb5428efa80398060584", size = 1919630, upload-time = "2026-10-11T01:00:32.548Z" },
+    { url = "https://files.pythonhosted.org/packages/06/7d/4eedafc5bababa8932636c141e346806966eade12c0b7e5946d43bf8218b/aiohttp-3.14.5-cp312-cp312-manylinux_2_31_riscv64.manylinux_2_39_riscv64.whl", hash = "sha256:74b0a9c8270f9b0a11410e124ff8d4f18bfc1f1837440ec84da5ae7b50927b5d", size = 1710016, upload-time = "2026-10-11T01:00:34.471Z" },
+    { url = "https://files.pythonhosted.org/packages/b2/94/eee018537ba19da0ceb2ac79cab83faed4ac49568e08376e2799043f2538/aiohttp-3.14.5-cp312-cp312-musllinux_1_2_aarch64.whl", hash = "sha256:19e2ba471507c34f8252402ab50f5ab512398b9ea8c8f1cb26beb3f75793ba30", size = 1858112, upload-time = "2026-10-11T01:00:36.581Z" },
+    { url = "https://files.pythonhosted.org/packages/68/76/354653a306547238f3427283905972d796ba7c292ba9977abec9f2b6f260/aiohttp-3.14.5-cp312-cp312-musllinux_1_2_armv7l.whl", hash = "sha256:d418ce2af40c6bb685b3f663e9e8de27cb0a22431d8e88a167348d7f01878073", size = 1896371, upload-time = "2026-10-11T01:00:38.478Z" },
+    { url = "https://files.pythonhosted.org/packages/f2/ec/63e8c7136b570e356345ad3174e3820fdc973ea10712cb6c649bf875755a/aiohttp-3.14.5-cp312-cp312-musllinux_1_2_ppc64le.whl", hash = "sha256:70cb4008ac2ed1e0ca9e824deb4b53d3aa0d939109698ebf1e723a84337bd794", size = 1905836, upload-time = "2026-10-11T01:00:40.527Z" },
+    { url = "https://files.pythonhosted.org/packages/57/d8/11365bda144b127928cd42533d0eff78a55613c9e28f81941bd6630ea887/aiohttp-3.14.5-cp312-cp312-musllinux_1_2_riscv64.whl", hash = "sha256:a23fe35d776bc03cb495938b9594450d047e3bc08c5255315a82323e9cb7d2dd", size = 1696534, upload-time = "2026-10-11T01:00:42.686Z" },
+    { url = "https://files.pythonhosted.org/packages/2f/3d/82df0461b18e00b2998f205c03e0d3010222478c43640aceb8e03dcd7e8f/aiohttp-3.14.5-cp312-cp312-musllinux_1_2_s390x.whl", hash = "sha256:3e0eb43bed3c6801a6cee315195377789e90b2a72c2277a475b578535312488d", size = 1933970, upload-time = "2026-10-11T01:00:44.71Z" },
+    { url = "https://files.pythonhosted.org/packages/03/ad/6ddfe0aacd931c17b53533336d97e9d11a98b96d6ae815a9da0b19f82ccf/aiohttp-3.14.5-cp312-cp312-musllinux_1_2_x86_64.whl", hash = "sha256:3be7dd397d64ca3e1869626fa9318aaebb54b7bf93bc72d7a205448d83e4f748", size = 1899501, upload-time = "2026-10-11T01:00:46.629Z" },
+    { url = "https://files.pythonhosted.org/packages/9e/8e/189bdd9ae4793059bb09f6dc880f211a6c6c7859cebcbf33912dbfab7dd7/aiohttp-3.14.5-cp312-cp312-win32.whl", hash = "sha256:eb324e2009fb54db30a071dad7caf6998ee2879c4704007efb244514dad1fec1", size = 480370, upload-time = "2026-10-11T01:00:48.468Z" },
+    { url = "https://files.pythonhosted.org/packages/ae/ce/1f08114679d49655b30a6e0a29858375c94b82c1de1a0bd0a20c2fee8b02/aiohttp-3.14.5-cp312-cp312-win_amd64.whl", hash = "sha256:2cc38a4f2b516bef1714e690df87a0e043faf1a7693c82d860091684453d5111", size = 506141, upload-time = "2026-10-11T01:00:50.272Z" },
+    { url = "https://files.pythonhosted.org/packages/79/d4/c7b4f60b16a1b7e43249fa9031ae05e7e8c341ba4b7d1866f914dafeaa0e/aiohttp-3.14.5-cp312-cp312-win_arm64.whl", hash = "sha256:a63afd1f757de949028387e65a7127b61ad0f775432dbb0e62816ae619fe69ac", size = 488108, upload-time = "2026-10-11T01:00:52.321Z" },
+    { url = "https://files.pythonhosted.org/packages/d3/e1/2841e020ebb7aefae5513586193e011e06313d9a6bdbd296622afbbce204/aiohttp-3.14.5-cp313-cp313-android_24_arm64_v8a.whl", hash = "sha256:9ad7e6aa38c20da1be697874349c4c273c8a03b7887169665081706398d0439a", size = 538932, upload-time = "2026-10-11T01:00:54.3Z" },
+    { url = "https://files.pythonhosted.org/packages/f7/a6/7fb8ea8fe96bcc7b7c7a36d10f021d99d01a8dc8a4b3f0ddacecfad9a80e/aiohttp-3.14.5-cp313-cp313-android_24_x86_64.whl", hash = "sha256:f59c7673465908cbe506117176156c127f29f917677afceada34957179221d91", size = 553329, upload-time = "2026-10-11T01:00:56.442Z" },
+    { url = "https://files.pythonhosted.org/packages/de/64/d056e3c27647dc25af1a592cf356245382ea7c808171b9dac7677afedfc8/aiohttp-3.14.5-cp313-cp313-ios_13_0_arm64_iphoneos.whl", hash = "sha256:1b5416552740edf07234cc9437d0706f2acb67b93c198670b1a68e1b2b587dec", size = 521367, upload-time = "2026-10-11T01:00:58.345Z" },
+    { url = "https://files.pythonhosted.org/packages/3e/e4/95226147e11d4db916fd1d495dcf85af8e3816e38333e42718241196e848/aiohttp-3.14.5-cp313-cp313-ios_13_0_arm64_iphonesimulator.whl", hash = "sha256:43351bdb5e4c3cb7d1772368e988534e869a74db7778079a83782c11c69535c7", size = 528322, upload-time = "2026-10-11T01:01:00.211Z" },
+    { url = "https://files.pythonhosted.org/packages/17/cd/1d3c9192cafdb51cad62b2d3ded96cff9cc8af51893210aadd448a325389/aiohttp-3.14.5-cp313-cp313-ios_13_0_x86_64_iphonesimulator.whl", hash = "sha256:c8c4478bef6d57fcfda15dae461ea3c9f06aa7b257c58df3f2300174ccbb185a", size = 539874, upload-time = "2026-10-11T01:01:02.06Z" },
+    { url = "https://files.pythonhosted.org/packages/f6/0c/dfa33aecc7d4d1dc75e05248f5eac5a0edf4d09e7b44d93ab62529b0c1db/aiohttp-3.14.5-cp313-cp313-macosx_10_13_universal2.whl", hash = "sha256:c2c30484dd1417ef98b51021ffa2cc0d7f3c78918adaaaab7e70817335ab3e02", size = 813836, upload-time = "2026-10-11T01:01:04.01Z" },
+    { url = "https://files.pythonhosted.org/packages/33/17/4a63738052d20567d55529d6daa1b9480d906fd52930fbcf6d3fbed618f0/aiohttp-3.14.5-cp313-cp313-macosx_10_13_x86_64.whl", hash = "sha256:dab9ac5a67c8d1f070c00fa8fccb7cbd1b8dcc1a8d6b42f37540df9b3d4cc603", size = 548070, upload-time = "2026-10-11T01:01:06.035Z" },
+    { url = "https://files.pythonhosted.org/packages/15/e5/b57e58695a757fd4c02497c033fced96a69c631b13866c43d336530c9670/aiohttp-3.14.5-cp313-cp313-macosx_11_0_arm64.whl", hash = "sha256:e1cc2bfaee8c214f06080a7c7d5772419b8a1108e8e5349236189811823fb02a", size = 545786, upload-time = "2026-10-11T01:01:07.817Z" },
+    { url = "https://files.pythonhosted.org/packages/9a/68/8c2c67a3aedf46e00f3c42f04fbc6983de80d4ed5786151e33681ba45883/aiohttp-3.14.5-cp313-cp313-manylinux2014_aarch64.manylinux_2_17_aarch64.manylinux_2_28_aarch64.whl", hash = "sha256:74efb69332b85675b1eabd760a8cfc2e2cf42c60607c66f88014c1bdfb40942d", size = 1886492, upload-time = "2026-10-11T01:01:09.834Z" },
+    { url = "https://files.pythonhosted.org/packages/ab/4b/74aab5e8d28c62e8f795b4fe8f38cf5586fd264a9a27bd2141ef6490333d/aiohttp-3.14.5-cp313-cp313-manylinux2014_armv7l.manylinux_2_17_armv7l.manylinux_2_31_armv7l.whl", hash = "sha256:42b5e616946dbaf505e2bff18c9af2cd4ef9e7ef300ee58a6e951a5b7cf147ae", size = 1870057, upload-time = "2026-10-11T01:01:12.045Z" },
+    { url = "https://files.pythonhosted.org/packages/a8/f7/eafc3b1988302b1815d9fd4a21071be5c360d616c0a430d02fd92dc97688/aiohttp-3.14.5-cp313-cp313-manylinux2014_ppc64le.manylinux_2_17_ppc64le.manylinux_2_28_ppc64le.whl", hash = "sha256:f9033b43f511f27547c557dcaba0177649e10a3725336ccd2cce0fdc1dc4850d", size = 1925119, upload-time = "2026-10-11T01:01:14.09Z" },
+    { url = "https://files.pythonhosted.org/packages/a1/04/78d8f294f74dd570f3898ff20402349fce524176045df98ba727d6846a68/aiohttp-3.14.5-cp313-cp313-manylinux2014_s390x.manylinux_2_17_s390x.manylinux_2_28_s390x.whl", hash = "sha256:15a310d3c71398e3d7bfc93a1a73fbe664315cd9e9016b8efc1cff85eeab7155", size = 2053137, upload-time = "2026-10-11T01:01:16.344Z" },
+    { url = "https://files.pythonhosted.org/packages/32/51/395d225ef36f5a50d8e548dcd3141bfdbcd31fb6eed859022c573d2c4d66/aiohttp-3.14.5-cp313-cp313-manylinux2014_x86_64.manylinux_2_17_x86_64.manylinux_2_28_x86_64.whl", hash = "sha256:1ffa3a523a36d8628f98c06492ae16a31a23d14c0b4ec721757b477319f656d6", size = 1911038, upload-time = "2026-10-11T01:01:18.653Z" },
+    { url = "https://files.pythonhosted.org/packages/ff/a4/2aec1aa06d82e8a244843b5dae31d78061e5e76744270a86dd0ee051c889/aiohttp-3.14.5-cp313-cp313-manylinux_2_31_riscv64.manylinux_2_39_riscv64.whl", hash = "sha256:5fb6a6e919bfb703227bc1ce6579281b84b1a2ba57deb9794dfdbec7dcd1e40c", size = 1702205, upload-time = "2026-10-11T01:01:20.904Z" },
+    { url = "https://files.pythonhosted.org/packages/16/27/6051bfde7b6f418f70edd60d655fa426abb3355fa0981764739d87ecf160/aiohttp-3.14.5-cp313-cp313-musllinux_1_2_aarch64.whl", hash = "sha256:43e1b7994a8b038125f722bff07492ef501110722c2727c408995d9fb864c421", size = 1848588, upload-time = "2026-10-11T01:01:22.918Z" },
+    { url = "https://files.pythonhosted.org/packages/9e/44/55efc06fc26c4e6e1c095f231b4c222bf2d86d64a8eebbc24b2bb5958ea8/aiohttp-3.14.5-cp313-cp313-musllinux_1_2_armv7l.whl", hash = "sha256:5f3e96071686755d9cd3600c3880183eb94b012178e92746d68101800f0ed8a3", size = 1887540, upload-time = "2026-10-11T01:01:25.278Z" },
+    { url = "https://files.pythonhosted.org/packages/48/dc/1502bfdc2a65760d386ac6a00090b0addaa8a3c9c60b3f8127fad3a9afb2/aiohttp-3.14.5-cp313-cp313-musllinux_1_2_ppc64le.whl", hash = "sha256:cd88b01f3d37b7a2a34f91d98f14720206f1ea3d540843fab2d649dd5fb91fec", size = 1895030, upload-time = "2026-10-11T01:01:27.316Z" },
+    { url = "https://files.pythonhosted.org/packages/93/7e/44174bb6288264418c9eec07a5e35180969c0d5a796c7af544db3cb8a33a/aiohttp-3.14.5-cp313-cp313-musllinux_1_2_riscv64.whl", hash = "sha256:f2ed8b64dc0c651c0f5a9c926777719770021251b8f336d97c4b80b660836ce1", size = 1693244, upload-time = "2026-10-11T01:01:29.39Z" },
+    { url = "https://files.pythonhosted.org/packages/47/dd/b507d64e50db23888582fff08eda13998b12f9dea70c072edaac19218380/aiohttp-3.14.5-cp313-cp313-musllinux_1_2_s390x.whl", hash = "sha256:a9918e58faf62ba2c7147927d06057aec78f42475aff5048047ec47e7265a600", size = 1926308, upload-time = "2026-10-11T01:01:31.634Z" },
+    { url = "https://files.pythonhosted.org/packages/98/4b/5b51b4f63e3f2793151f4aea49c48fe1e00baeb7cec9c7a206de499f8de0/aiohttp-3.14.5-cp313-cp313-musllinux_1_2_x86_64.whl", hash = "sha256:42f320d4a5b00b9af0bddcfec5407dc6f2d9816f006b2f79ebbaa31f16895df3", size = 1888406, upload-time = "2026-10-11T01:01:33.715Z" },
+    { url = "https://files.pythonhosted.org/packages/ff/13/d5e818a5eaba9f822016727299f41c0e1075799f82a6433ec508a93ab867/aiohttp-3.14.5-cp313-cp313-win32.whl", hash = "sha256:3ae800a20947e2c2e53088047d021e6bf7d51560cc49f6a0737a1f79d2e3a13c", size = 479970, upload-time = "2026-10-11T01:01:35.677Z" },
+    { url = "https://files.pythonhosted.org/packages/8d/d0/8eca2c65aa467320990d78fb2005f38ed3588944280c39ff9deb6423fef1/aiohttp-3.14.5-cp313-cp313-win_amd64.whl", hash = "sha256:d05e94cdfe0d15d0206f970722d2554780ce562787b21b218b275447f8751319", size = 505985, upload-time = "2026-10-11T01:01:37.574Z" },
+    { url = "https://files.pythonhosted.org/packages/7a/f8/4cdd65305d2fca14b886bea9ed2abb1fe726287872524e56e3d26692b47d/aiohttp-3.14.5-cp313-cp313-win_arm64.whl", hash = "sha256:f001b571ead90ca1770f1e616db255351a1703317f20374c361ef22f12c06d09", size = 487629, upload-time = "2026-10-11T01:01:39.477Z" },
+    { url = "https://files.pythonhosted.org/packages/43/be/3184a1d34a8be665569eadb7e9e764b4629e4f3413e241cb2e4d6fecf3b3/aiohttp-3.14.5-cp314-cp314-android_24_arm64_v8a.whl", hash = "sha256:939042d5cda21d41a6f512e7cc8b8e33a2aebff863352251da495fbd91b673b5", size = 540673, upload-time = "2026-10-11T01:01:41.354Z" },
+    { url = "https://files.pythonhosted.org/packages/60/2a/d35f3ba4cf157b072e3b674bf9983047ca5ea5173c995d32d877e1191d36/aiohttp-3.14.5-cp314-cp314-android_24_x86_64.whl", hash = "sha256:6da32b5ff3fd78d244e37300463434c7145162bfd2b6e9e915ab164da37f7343", size = 554087, upload-time = "2026-10-11T01:01:43.719Z" },
+    { url = "https://files.pythonhosted.org/packages/fc/d2/61a33880ca4eaca95a9c60ca3f6beed15555af1028652dfaac601627787b/aiohttp-3.14.5-cp314-cp314-ios_13_0_arm64_iphoneos.whl", hash = "sha256:1b438b73c38111818d0c9d6a5c2bfed8584c8e503a49ef085d70e874ec846738", size = 522613, upload-time = "2026-10-11T01:01:46.154Z" },
+    { url = "https://files.pythonhosted.org/packages/31/1d/de579b299d2225dc2c6fd99d579d91f16c02a913fb5af9a3cf2fe9bd88ba/aiohttp-3.14.5-cp314-cp314-ios_13_0_arm64_iphonesimulator.whl", hash = "sha256:755933b107ea7a6a9ac916f635a70595a5b1a32fac10a8ff0b9f2ab88555550c", size = 529682, upload-time = "2026-10-11T01:01:48.477Z" },
+    { url = "https://files.pythonhosted.org/packages/f4/4a/ddb923564e15e053b6e060b0036e1694dcadcb13aa476c5a87dcad20e336/aiohttp-3.14.5-cp314-cp314-ios_13_0_x86_64_iphonesimulator.whl", hash = "sha256:b3cc509327c7b27f6f4727a8830f4004f6df7766e179f2f4b8e54e65c0bec5d3", size = 540120, upload-time = "2026-10-11T01:01:50.474Z" },
+    { url = "https://files.pythonhosted.org/packages/3d/36/a640fbecaa53727a5900b892bdbe17b5f3e8cc88903e22864fe41b654def/aiohttp-3.14.5-cp314-cp314-macosx_10_15_universal2.whl", hash = "sha256:7bd8ac754ebd6733a3e2a0dd1674c4d8ab086196803fd8dcd776f07b4e2607d9", size = 818795, upload-time = "2026-10-11T01:01:52.665Z" },
+    { url = "https://files.pythonhosted.org/packages/ef/b6/d52ca608859e271b5fa7944074802dc45f60e52c318a4ddc34edbf73586e/aiohttp-3.14.5-cp314-cp314-macosx_10_15_x86_64.whl", hash = "sha256:e724a7b6091f0b1ac064f9d1b15ff9ec52e6033a86cdae649e5f086e32a3c0db", size = 549667, upload-time = "2026-10-11T01:01:54.65Z" },
+    { url = "https://files.pythonhosted.org/packages/ce/b5/05b8ac39a76ff4bca89f42a4c2471560c71f894ff6e4bc16158c951874e3/aiohttp-3.14.5-cp314-cp314-macosx_11_0_arm64.whl", hash = "sha256:c32e26310cc10e547f53cd13d39a369034f69dcb7d749d5cb0e5f67bc196b6ba", size = 548922, upload-time = "2026-10-11T01:01:56.547Z" },
+    { url = "https://files.pythonhosted.org/packages/19/b0/5aa186d56ce2334dabe29b70bd99dc8ae926ee44184c0de64a53d415a4f3/aiohttp-3.14.5-cp314-cp314-manylinux2014_aarch64.manylinux_2_17_aarch64.manylinux_2_28_aarch64.whl", hash = "sha256:1eb8167961ec4dfcc8cb9dd50bd0ee72519f7ef496be95203e49e27b01618382", size = 1882422, upload-time = "2026-10-11T01:01:59.258Z" },
+    { url = "https://files.pythonhosted.org/packages/db/f7/7d5c91bb9620db300c8ddb05337a9014301acb626223faff3abcb8ea47d7/aiohttp-3.14.5-cp314-cp314-manylinux2014_armv7l.manylinux_2_17_armv7l.manylinux_2_31_armv7l.whl", hash = "sha256:c1d60eafd9c7e8e74abd03a5b00df44e7febfe6d9b89b559c0a6551eef0699d4", size = 1843621, upload-time = "2026-10-11T01:02:01.417Z" },
+    { url = "https://files.pythonhosted.org/packages/30/0a/b208953b96d8f24b75f6da704f508e6c5cf3022f52b60c61933df082e89c/aiohttp-3.14.5-cp314-cp314-manylinux2014_ppc64le.manylinux_2_17_ppc64le.manylinux_2_28_ppc64le.whl", hash = "sha256:137351bf20bbed9a65e839f4a4452ac377389bdb2f2857d2acffef38f5e9f2d1", size = 1927915, upload-time = "2026-10-11T01:02:03.697Z" },
+    { url = "https://files.pythonhosted.org/packages/f6/79/90ebcccb55e2d1e11a1fed581d83bb966e38fb35fb4b2577fdc980f8707a/aiohttp-3.14.5-cp314-cp314-manylinux2014_s390x.manylinux_2_17_s390x.manylinux_2_28_s390x.whl", hash = "sha256:fba47bc2c3d7303c3d027c6cf4d07626c37b1314ac81f5820c31032e0ca1f677", size = 2036339, upload-time = "2026-10-11T01:02:06.046Z" },
+    { url = "https://files.pythonhosted.org/packages/a6/66/55a8904b3a129fafdf94f9cc0a2e4ca09a3c914650be52355db7ad0bbdb6/aiohttp-3.14.5-cp314-cp314-manylinux2014_x86_64.manylinux_2_17_x86_64.manylinux_2_28_x86_64.whl", hash = "sha256:94684b879ac1d71e4238850c99b62dc1b28d9086b156a2555f082010b85a865c", size = 1888041, upload-time = "2026-10-11T01:02:08.384Z" },
+    { url = "https://files.pythonhosted.org/packages/0b/b8/96b25da7329a52e42c812b1e8b076386039ec4fc312afa043d173d8147fc/aiohttp-3.14.5-cp314-cp314-manylinux_2_31_riscv64.manylinux_2_39_riscv64.whl", hash = "sha256:56572c42e3ecd636de8d2c3dd54cf5fc939cb5c32eb56297f176a0d366fac622", size = 1703849, upload-time = "2026-10-11T01:02:10.903Z" },
+    { url = "https://files.pythonhosted.org/packages/1b/43/fbf976e3ae4c038d6f5c84945ab2150298c2d71201674d4e53d158063e75/aiohttp-3.14.5-cp314-cp314-musllinux_1_2_aarch64.whl", hash = "sha256:a95529a92a446db351675f4aab518feaf5e99842f63f5dd17160c2b74f382db3", size = 1849703, upload-time = "2026-10-11T01:02:13.15Z" },
+    { url = "https://files.pythonhosted.org/packages/8b/7d/218e912f4c1d89bde7ac551409be57ad2f6121638e56942d395a7cb1fa58/aiohttp-3.14.5-cp314-cp314-musllinux_1_2_armv7l.whl", hash = "sha256:3edbece0379b8b4aaa67619b8aa2399bb66fce372cd5911098a434ea77220aa0", size = 1852695, upload-time = "2026-10-11T01:02:15.295Z" },
+    { url = "https://files.pythonhosted.org/packages/5a/42/252a1b9287e3b6e393a1c3bd1776f36af30f5f25f071bbf2b0cb7eba9116/aiohttp-3.14.5-cp314-cp314-musllinux_1_2_ppc64le.whl", hash = "sha256:56d9828f204331a5ca8850fcfe2bcce95a149f1f223f60cc7216e5524978e480", size = 1893493, upload-time = "2026-10-11T01:02:17.93Z" },
+    { url = "https://files.pythonhosted.org/packages/78/97/71cae83d5100556fad1521684f7cd1e3e578432644f850245ed3bd969310/aiohttp-3.14.5-cp314-cp314-musllinux_1_2_riscv64.whl", hash = "sha256:20064a177a070d789ee64a50b01a9161d3468e989baacfc6c714aa685c4b332f", size = 1693468, upload-time = "2026-10-11T01:02:20.666Z" },
+    { url = "https://files.pythonhosted.org/packages/1f/69/73d88e97a8b5f0ca7a946d0011c0de99fb188b1687c7948ecd0553dc5bf0/aiohttp-3.14.5-cp314-cp314-musllinux_1_2_s390x.whl", hash = "sha256:81c2b3dfd56c62bee6108e4852d5970b4cf9086390b6983f52b666e878c1f115", size = 1915398, upload-time = "2026-10-11T01:02:23.011Z" },
+    { url = "https://files.pythonhosted.org/packages/05/f0/881644bcb15d4b258daea9b720a0af9dc4330496cc8d6ade9090cdd0cffc/aiohttp-3.14.5-cp314-cp314-musllinux_1_2_x86_64.whl", hash = "sha256:09ec102b4b8c9a920275733bbc11fdbb615efe6f9231a06007c0218d336fb77a", size = 1871470, upload-time = "2026-10-11T01:02:25.278Z" },
+    { url = "https://files.pythonhosted.org/packages/7f/de/19d9ebbcce5aedaa3242d8a99ff8816a60bdb7629fb0084bf4a45bfd1f62/aiohttp-3.14.5-cp314-cp314-win32.whl", hash = "sha256:9c428eb2bd8817588d16a0ab898aa4eb5d141f896aa2b394cc79a4cf61d9a8e2", size = 485517, upload-time = "2026-10-11T01:02:27.579Z" },
+    { url = "https://files.pythonhosted.org/packages/a9/74/8cdaf0e58c2588371670d5a9a8215bbb971d36940b6e5d051967dd05c07d/aiohttp-3.14.5-cp314-cp314-win_amd64.whl", hash = "sha256:6f967dde489ca6a8c02d093ab245d2cbf50ccb5c36adf0188b17b0ca39d24b67", size = 511755, upload-time = "2026-10-11T01:02:29.685Z" },
+    { url = "https://files.pythonhosted.org/packages/1a/6b/e0100e25502430a531c7cf1482a378d0b65bf728ab60c01ee270e56bc469/aiohttp-3.14.5-cp314-cp314-win_arm64.whl", hash = "sha256:1d2d981b53dd09a319e3570ef8cc3bbc3ef86f5a7abef0f6b2bff3867db3a9e7", size = 495151, upload-time = "2026-10-11T01:02:32.163Z" },
+    { url = "https://files.pythonhosted.org/packages/9d/c2/ca2ead7b655688c53c03aeeb6e96e6851c9ff08d6be7b13802f53a6ae8fd/aiohttp-3.14.5-cp314-cp314t-macosx_10_15_universal2.whl", hash = "sha256:9ce66feae6ac65327379460380549bf1b8df8e17c4e25df2a2bcf168272e3bed", size = 855396, upload-time = "2026-10-11T01:02:34.443Z" },
+    { url = "https://files.pythonhosted.org/packages/a7/70/22206fea409255a240c926ce11de48de354ae2bb90ca44f709c05497585d/aiohttp-3.14.5-cp314-cp314t-macosx_10_15_x86_64.whl", hash = "sha256:27c2322e03f66101acb09869ce1cf1efc04994ee95e1735b69827bf8c8b9d781", size = 567734, upload-time = "2026-10-11T01:02:36.644Z" },
+    { url = "https://files.pythonhosted.org/packages/ce/e5/79a36c118308b56f8667d67e05d2fb6dc638ab45985704cdb199631bedaa/aiohttp-3.14.5-cp314-cp314t-macosx_11_0_arm64.whl", hash = "sha256:ff75a7537413a86e7cafe98e0e1d6e3dc4b15c6349896e7d5c6b881bfdb6d550", size = 567379, upload-time = "2026-10-11T01:02:38.757Z" },
+    { url = "https://files.pythonhosted.org/packages/63/a3/2ebec7dece3b1f02c30d2e484647f6f7b13952b1bb40a4cb285b849e8432/aiohttp-3.14.5-cp314-cp314t-manylinux2014_aarch64.manylinux_2_17_aarch64.manylinux_2_28_aarch64.whl", hash = "sha256:9c061aa954daaf57d2a4b8374f9fca621ef0e1b603584431c220c22458c59b6d", size = 2050686, upload-time = "2026-10-11T01:02:41.169Z" },
+    { url = "https://files.pythonhosted.org/packages/3a/d2/7e4d093db2f4450482652e7ef19a9e19919028f5135aa52bc4078c3beb80/aiohttp-3.14.5-cp314-cp314t-manylinux2014_armv7l.manylinux_2_17_armv7l.manylinux_2_31_armv7l.whl", hash = "sha256:1612fa5857b37bf32e5c1eaeefb96e3b01e9c70679eec81f0934e8a600080863", size = 1915077, upload-time = "2026-10-11T01:02:43.563Z" },
+    { url = "https://files.pythonhosted.org/packages/a6/88/bd40d09958442a0a1df67da81de496361d6e2afc04f9db2950d835da750b/aiohttp-3.14.5-cp314-cp314t-manylinux2014_ppc64le.manylinux_2_17_ppc64le.manylinux_2_28_ppc64le.whl", hash = "sha256:adbeee7d6fd4cf5fe0aece2fb3edc4243615d3180430ba8149d01a90670cac99", size = 2027204, upload-time = "2026-10-11T01:02:46.185Z" },
+    { url = "https://files.pythonhosted.org/packages/63/eb/3a601c1f8d3103c1a60ea981f20924855da9f575d2007fc38f8898b792fb/aiohttp-3.14.5-cp314-cp314t-manylinux2014_s390x.manylinux_2_17_s390x.manylinux_2_28_s390x.whl", hash = "sha256:b2966998927d7bed9db12c0a4647b0c7b179755878fc9c357fe1ffd3e3b0c1a5", size = 2149520, upload-time = "2026-10-11T01:02:48.812Z" },
+    { url = "https://files.pythonhosted.org/packages/22/d0/4e41bfe1b1ce1cb6f6d2e59fa7a88ef5cf92c402b2d07e9018778ba9edbc/aiohttp-3.14.5-cp314-cp314t-manylinux2014_x86_64.manylinux_2_17_x86_64.manylinux_2_28_x86_64.whl", hash = "sha256:8e317e0fb6b16212c881d2205a7d87414c29acd69320b3aa6dce9d9c7b86fe4f", size = 2002039, upload-time = "2026-10-11T01:02:51.293Z" },
+    { url = "https://files.pythonhosted.org/packages/6f/5e/72067019545c502b881b031153c437752ecef48d7d213bc0218ccebb4bfb/aiohttp-3.14.5-cp314-cp314t-manylinux_2_31_riscv64.manylinux_2_39_riscv64.whl", hash = "sha256:50343c1757b4b6f6708eeaf24534b32f19dfb99fb1b762c00420867a62fc81e0", size = 1786164, upload-time = "2026-10-11T01:02:53.533Z" },
+    { url = "https://files.pythonhosted.org/packages/d9/fe/7741efd6119bfb7a00827fe6f7b84b4409de58d888ae21adc5a9a6824992/aiohttp-3.14.5-cp314-cp314t-musllinux_1_2_aarch64.whl", hash = "sha256:083673c7a94c3ea035caaa5ca04288bdb44887abfe1f5ba23294e6a4b03efd2d", size = 1970689, upload-time = "2026-10-11T01:02:55.888Z" },
+    { url = "https://files.pythonhosted.org/packages/43/e7/342a13bf67f34d269bf2f7e870ecd72b99c832cc6f0a271a9210c0ebfb84/aiohttp-3.14.5-cp314-cp314t-musllinux_1_2_armv7l.whl", hash = "sha256:2528cb4c6b92008c76ac9ac6298624069bb2db91ff4929905512d1d84485f658", size = 1951967, upload-time = "2026-10-11T01:02:58.467Z" },
+    { url = "https://files.pythonhosted.org/packages/e7/d4/fdb3b27340617e5e64df18a70fa89097778652ea5c7c7e2f79def76999c3/aiohttp-3.14.5-cp314-cp314t-musllinux_1_2_ppc64le.whl", hash = "sha256:b1b8ece1e71132d2afba4dbc0c3d62c766e25165990b25db1196c04969eb3d84", size = 1968511, upload-time = "2026-10-11T01:03:00.883Z" },
+    { url = "https://files.pythonhosted.org/packages/83/b2/e8f88298de78d1a951f36f9f966d38ec6ed1d4721303ba02064a545e8aa6/aiohttp-3.14.5-cp314-cp314t-musllinux_1_2_riscv64.whl", hash = "sha256:fce9523df31cea6284f3e2c479876750d7687cf671d7b25d32b19effc0e86441", size = 1778497, upload-time = "2026-10-11T01:03:03.206Z" },
+    { url = "https://files.pythonhosted.org/packages/22/68/9ccdb93d664345c546be7f34480b921774d8c0d98f47e70d7e03b115d475/aiohttp-3.14.5-cp314-cp314t-musllinux_1_2_s390x.whl", hash = "sha256:09e0eb18c7e0c8777e2f9149de63799195b9b3ca1b5c81ba6f32f2c6b8628210", size = 1999676, upload-time = "2026-10-11T01:03:05.829Z" },
+    { url = "https://files.pythonhosted.org/packages/57/4a/a33cfa6dcb00e94194ae4fe710432ca4ed111e016356b4ba4d2f4c3a124c/aiohttp-3.14.5-cp314-cp314t-musllinux_1_2_x86_64.whl", hash = "sha256:6774814fd5c338e72ee0da5cbb9432816df450e69c019f72b5d29bdec2a1792d", size = 1963437, upload-time = "2026-10-11T01:03:08.196Z" },
+    { url = "https://files.pythonhosted.org/packages/f4/20/eacbecfea3b5c3dcbfc9b023e3a5460f43e5dda16d06a2877ebe7184c3f3/aiohttp-3.14.5-cp314-cp314t-win32.whl", hash = "sha256:33f706574e32c6e694f352a856e05caf18f7f2c871b3e87b41c55ea452b409ab", size = 503973, upload-time = "2026-10-11T01:03:10.481Z" },
+    { url = "https://files.pythonhosted.org/packages/ff/78/18eec294f6c8c5dc845dcf6d730a0147d8d0f17e86138a7bdb85e43a30fa/aiohttp-3.14.5-cp314-cp314t-win_amd64.whl", hash = "sha256:5ba14a839fbe87cf7c12a6b5661c05f324a296eb8363141edb3944ba63d4c9d3", size = 531190, upload-time = "2026-10-11T01:03:12.716Z" },
+    { url = "https://files.pythonhosted.org/packages/9d/39/e53f8169acc85271ebd12b5b32ad7f1541b35639ccbe0f49034c64785d10/aiohttp-3.14.5-cp314-cp314t-win_arm64.whl", hash = "sha256:1061b364556e8172e8d46b0b183adeeb73e8c42d30ebc745591e1bd89acad52e", size = 510360, upload-time = "2026-10-11T01:03:15.08Z" },
+    { url = "https://files.pythonhosted.org/packages/f3/1c/06d89f58b2db3ee92dd377217659d587e06f973e57bf0a97a0d8a4586c0c/aiohttp-3.14.5-cp315-cp315-android_24_arm64_v8a.whl", hash = "sha256:788ecaa9c10533b786ce5ba70c4f2df78ad41819fd00a6c99d92b66f9a32e1da", size = 540674, upload-time = "2026-10-11T01:03:17.483Z" },
+    { url = "https://files.pythonhosted.org/packages/18/39/5e822e038f496f0540ada91e27099d48f9e7f919b6c6deb4cf6db36cc706/aiohttp-3.14.5-cp315-cp315-android_24_x86_64.whl", hash = "sha256:5c76f1802bab718a68ac3cce447160605c734551f95c67ae90fa1132b215cb29", size = 554183, upload-time = "2026-10-11T01:03:19.71Z" },
+    { url = "https://files.pythonhosted.org/packages/9b/ff/0cf2619d902b5b160762422a7e5e02091295766a7fe4fcf5b9a655e386c1/aiohttp-3.14.5-cp315-cp315-ios_13_0_arm64_iphoneos.whl", hash = "sha256:a6d02b4c38de03d9c7617813433e6a0fb6b522797974177d69d9dad431900833", size = 523160, upload-time = "2026-10-11T01:03:22.193Z" },
+    { url = "https://files.pythonhosted.org/packages/86/99/3553abfc53a40849dbaacc3f54c730ec58410809ffa2d05885ae56108f2d/aiohttp-3.14.5-cp315-cp315-ios_13_0_arm64_iphonesimulator.whl", hash = "sha256:20726f9782d5c2744c1c66255842d1d163bb3edcf768b8de25216bf47f7b6ccf", size = 530311, upload-time = "2026-10-11T01:03:24.435Z" },
+    { url = "https://files.pythonhosted.org/packages/fe/a4/5d25f73754bc1e8f983ba704e86d641aea290c967f195f2aeebdaed2bd84/aiohttp-3.14.5-cp315-cp315-ios_13_0_x86_64_iphonesimulator.whl", hash = "sha256:248d779ad720b49d4fb355720e60c9e5f444f95887bc16974fea48fc56c41789", size = 540274, upload-time = "2026-10-11T01:03:26.698Z" },
+    { url = "https://files.pythonhosted.org/packages/29/a4/07eda5db2e3ee017d9590f36c12a94ec6f1f50516e8df78672373dfc7185/aiohttp-3.14.5-cp315-cp315-macosx_10_15_universal2.whl", hash = "sha256:0a8ea271867e360ac985ae607f4a23ad9a38414b9aca1d49ec98839ae660e49f", size = 819239, upload-time = "2026-10-11T01:03:29.481Z" },
+    { url = "https://files.pythonhosted.org/packages/cb/aa/a8723dd987a696dd48d4cf2f0088e589ce77caebff0b96f2a78c20424380/aiohttp-3.14.5-cp315-cp315-macosx_10_15_x86_64.whl", hash = "sha256:823c910f046f23f4c713b8d99a2242dc65f591cb45ee86418fa11762a3c2963c", size = 549832, upload-time = "2026-10-11T01:03:32.02Z" },
+    { url = "https://files.pythonhosted.org/packages/29/5c/969a1b72692055fd2a419590c41847ec9144fefb97b75ff1cde5b6372891/aiohttp-3.14.5-cp315-cp315-macosx_11_0_arm64.whl", hash = "sha256:9b42db919715e91eb76acf3bc492a9a7ccd8bd9adc6745c1412b689735269f14", size = 549234, upload-time = "2026-10-11T01:03:34.469Z" },
+    { url = "https://files.pythonhosted.org/packages/38/05/8e3e07fd8a0d33d06955ff4e54a1cb92f4bce347ff55e441dc3e25a7b5e5/aiohttp-3.14.5-cp315-cp315-manylinux2014_aarch64.manylinux_2_17_aarch64.manylinux_2_28_aarch64.whl", hash = "sha256:d3112585250b199296c26ca6e0131640b6a8d01bab8b232d2eb3763ed469de11", size = 1891314, upload-time = "2026-10-11T01:03:36.899Z" },
+    { url = "https://files.pythonhosted.org/packages/b6/b3/05a79ce2e25f024e93de30c94f39dc6aa6e2bc1e9c531a5c4b18dc61b7a4/aiohttp-3.14.5-cp315-cp315-manylinux2014_armv7l.manylinux_2_17_armv7l.manylinux_2_31_armv7l.whl", hash = "sha256:c147451b4a58e7050f7f7394e6c467867c84161560001f9ad4fb2d1446743946", size = 1884372, upload-time = "2026-10-11T01:03:39.334Z" },
+    { url = "https://files.pythonhosted.org/packages/94/52/0fd8af0717db109eea258191b326b5cb5847fb88928bfa6c862fd78b9ad3/aiohttp-3.14.5-cp315-cp315-manylinux2014_ppc64le.manylinux_2_17_ppc64le.manylinux_2_28_ppc64le.whl", hash = "sha256:bf163cc701f3d4ac43ba7d97771bf5fd955220ef5500ef3ee847bc0ecfbf4ec1", size = 1930957, upload-time = "2026-10-11T01:03:42.172Z" },
+    { url = "https://files.pythonhosted.org/packages/4e/b3/fa78733da88812bf9fb193913fb0ce1548f8b6912047633fdf88a758ff8c/aiohttp-3.14.5-cp315-cp315-manylinux2014_s390x.manylinux_2_17_s390x.manylinux_2_28_s390x.whl", hash = "sha256:f8d40ce41991e9d56fab4f5dc4a51fe59bc3b5c77c27f4b148963064d00232e8", size = 2038886, upload-time = "2026-10-11T01:03:44.646Z" },
+    { url = "https://files.pythonhosted.org/packages/cf/f5/2fcc5e30053a938286f17d0edf3f0850b8061b984256fa7c26850b9c8809/aiohttp-3.14.5-cp315-cp315-manylinux2014_x86_64.manylinux_2_17_x86_64.manylinux_2_28_x86_64.whl", hash = "sha256:276a4fc00b1d9ae492b802763a789c5b86328b989c5ea169f2faa447d6a11c7c", size = 1894470, upload-time = "2026-10-11T01:03:47.304Z" },
+    { url = "https://files.pythonhosted.org/packages/62/2a/f87feb42abe8e6a7c03814dbcb711540849a1e90aa392055f3183c643610/aiohttp-3.14.5-cp315-cp315-manylinux_2_31_riscv64.manylinux_2_39_riscv64.whl", hash = "sha256:50983e3be33d8c0942ab88cec3905b10602f64c469b20153c48c5d4e558dd016", size = 1716273, upload-time = "2026-10-11T01:03:50.121Z" },
+    { url = "https://files.pythonhosted.org/packages/81/b2/adf1f960dd977722ed1347d33da512a1624807114f57a3b91f5cc828e081/aiohttp-3.14.5-cp315-cp315-musllinux_1_2_aarch64.whl", hash = "sha256:16c8abd5bca220a47efe667d26f8460124c81810787e79ee87b242677563d9dd", size = 1857513, upload-time = "2026-10-11T01:03:52.959Z" },
+    { url = "https://files.pythonhosted.org/packages/d7/fd/ef8d910e641de4160026a513ace5888b7f92826bbc3fd90ced05d55a828e/aiohttp-3.14.5-cp315-cp315-musllinux_1_2_armv7l.whl", hash = "sha256:0790ec66fa4013e83c53b9025a45d454723da1a2fce28b3208c9b32d08af162f", size = 1887704, upload-time = "2026-10-11T01:03:55.641Z" },
+    { url = "https://files.pythonhosted.org/packages/7e/db/6c9142f941cba8d35be8e1fae6ea2bd390e754fc14076b8147aee1a4592f/aiohttp-3.14.5-cp315-cp315-musllinux_1_2_ppc64le.whl", hash = "sha256:cb11a971a3aea10f9b8373be628f1df932964fc6c6b174516d318a48c3ac4412", size = 1895684, upload-time = "2026-10-11T01:03:58.18Z" },
+    { url = "https://files.pythonhosted.org/packages/e6/7c/6a6bd9a72e576d376c668333b00c51c6147aba4fb863ed6c94996d497eca/aiohttp-3.14.5-cp315-cp315-musllinux_1_2_riscv64.whl", hash = "sha256:932ce7e694bbc29b2bf6f64f2343c27d148d4997c771d01bdade4639b6749ff4", size = 1706299, upload-time = "2026-10-11T01:04:00.8Z" },
+    { url = "https://files.pythonhosted.org/packages/69/ec/d2cc494242f8c4d3d1cd70baf591742818a74386dc3b84af3195c5c4fced/aiohttp-3.14.5-cp315-cp315-musllinux_1_2_s390x.whl", hash = "sha256:a7d470cf7b206e6359fc77b1b860632fde400d5a2ed59cd0181b93a686bc81ee", size = 1916645, upload-time = "2026-10-11T01:04:03.892Z" },
+    { url = "https://files.pythonhosted.org/packages/a3/6e/e852c53647e815db09a1b6b5ab634f54bd736412397e11940feef4d2c89a/aiohttp-3.14.5-cp315-cp315-musllinux_1_2_x86_64.whl", hash = "sha256:6e1d8637cf73eebc92eba2e11d4cfff98a3b562f2505bd75bba766d908926e8d", size = 1875408, upload-time = "2026-10-11T01:04:06.922Z" },
+    { url = "https://files.pythonhosted.org/packages/fe/f6/72ab6ef20c332399be593bac543d2c24a6d241e39d3540ce9f95a63e4bd2/aiohttp-3.14.5-cp315-cp315-win32.whl", hash = "sha256:fbdc5ec49f9ca3cd24955cf3520b10a4d4c901ba2572094c84274e9e7eb30534", size = 485590, upload-time = "2026-10-11T01:04:09.626Z" },
+    { url = "https://files.pythonhosted.org/packages/06/eb/e9de75b8c6d2170c42c08ff303abf857ea8a6d9d9b6e99b5aba40f15e962/aiohttp-3.14.5-cp315-cp315-win_amd64.whl", hash = "sha256:a9d3983bd6ab7aa1cfd573544ae98df9b6cb6912a5185a198263e024a636861d", size = 511740, upload-time = "2026-10-11T01:04:12.277Z" },
+    { url = "https://files.pythonhosted.org/packages/fc/25/455f3c2785eb0d50748cffd0abd07500815f419a9495b14610b7622d8d2d/aiohttp-3.14.5-cp315-cp315-win_arm64.whl", hash = "sha256:e29347c142cf6e99e0dff5e2995ead1d50fa3b51bf37a7c726a7ccfe5419745a", size = 495171, upload-time = "2026-10-11T01:04:14.667Z" },
+    { url = "https://files.pythonhosted.org/packages/e7/6c/497f0a98782eebfcf0f02a7fbdef5428148bd426027140cbad494cf842b5/aiohttp-3.14.5-cp315-cp315t-macosx_10_15_universal2.whl", hash = "sha256:9bf1d5dcc15204d9ec8b8ea4c18fd66e6b80e5de1f4ecbafb3a2f2740f8039d4", size = 855638, upload-time = "2026-10-11T01:04:17.154Z" },
+    { url = "https://files.pythonhosted.org/packages/9a/c5/55c0cef2572af9b1ee81608f7c0a1bf74e6c9151a73b04915d933f192335/aiohttp-3.14.5-cp315-cp315t-macosx_10_15_x86_64.whl", hash = "sha256:14f04769cfefe4734016a856a83af36133cd17779cef9ae817f812b8ba9d6d51", size = 567455, upload-time = "2026-10-11T01:04:19.702Z" },
+    { url = "https://files.pythonhosted.org/packages/4d/47/e1a0e39f4a2b881f6071225afaf94a6547001b5aefc1566734d73c685934/aiohttp-3.14.5-cp315-cp315t-macosx_11_0_arm64.whl", hash = "sha256:6e4251c0ba4624a68a2c11471a1ac54c3306876c21f0ae86de085cc9241c8905", size = 567836, upload-time = "2026-10-11T01:04:22.235Z" },
+    { url = "https://files.pythonhosted.org/packages/c3/1d/817d85836f52b687160064a326e62e037dc42f1ad5b6b5188a70e5c134b5/aiohttp-3.14.5-cp315-cp315t-manylinux2014_aarch64.manylinux_2_17_aarch64.manylinux_2_28_aarch64.whl", hash = "sha256:e4f5cf4dc72a71c4cfa9751b4950be22f733626670230d46e7d606592aa22d59", size = 2051409, upload-time = "2026-10-11T01:04:24.821Z" },
+    { url = "https://files.pythonhosted.org/packages/f7/25/e8ea6fc212a9aabce982917346ce8ecab0929c74b60232a056dd11c99da0/aiohttp-3.14.5-cp315-cp315t-manylinux2014_armv7l.manylinux_2_17_armv7l.manylinux_2_31_armv7l.whl", hash = "sha256:dbf53ae2601b7fd5a93c3944deea3a78d40f495226d582c35ef7a433425ce2b2", size = 1936493, upload-time = "2026-10-11T01:04:27.456Z" },
+    { url = "https://files.pythonhosted.org/packages/24/33/de0517f71f1a19feea4aff78a2ec4ec2d98634129ec30ead78fce2f8f81b/aiohttp-3.14.5-cp315-cp315t-manylinux2014_ppc64le.manylinux_2_17_ppc64le.manylinux_2_28_ppc64le.whl", hash = "sha256:657291433bf4dd3142f3abac495764cd47d0c7c92087751e6666c6447e65fcef", size = 2021405, upload-time = "2026-10-11T01:04:30.276Z" },
+    { url = "https://files.pythonhosted.org/packages/c4/11/ddaf2e7930543e9f0cad3a1c54e1af0c1bd2fae3973d568c4263d3b010e9/aiohttp-3.14.5-cp315-cp315t-manylinux2014_s390x.manylinux_2_17_s390x.manylinux_2_28_s390x.whl", hash = "sha256:3e51a27980c3788e6e6b3325d694fdd4898087fa8a86b2763af77b39353da41e", size = 2142017, upload-time = "2026-10-11T01:04:33.022Z" },
+    { url = "https://files.pythonhosted.org/packages/1d/7b/58784353c06de8adc20f426daad3d85dd86fd55331c713a3f4b638c94573/aiohttp-3.14.5-cp315-cp315t-manylinux2014_x86_64.manylinux_2_17_x86_64.manylinux_2_28_x86_64.whl", hash = "sha256:82c7583cd3dfdc7dcc927835b4f6c7faae7ecc1ba3ca5879321621ae2e6f8e84", size = 2002482, upload-time = "2026-10-11T01:04:35.94Z" },
+    { url = "https://files.pythonhosted.org/packages/b9/f0/417d9535caa9e165ffe6a53e2347a78107e7c87dcb0e10aca315c3af0344/aiohttp-3.14.5-cp315-cp315t-manylinux_2_31_riscv64.manylinux_2_39_riscv64.whl", hash = "sha256:6fdcd6af7e2e51d1ba1b4bea16e97b074bcb7b5dd0246a9d8201341bb28085a0", size = 1791774, upload-time = "2026-10-11T01:04:38.733Z" },
+    { url = "https://files.pythonhosted.org/packages/98/01/25e49c2e8a01b9f0e19ca0a8448ad50aa2bdf96c8cd41e92bd45af044784/aiohttp-3.14.5-cp315-cp315t-musllinux_1_2_aarch64.whl", hash = "sha256:c8859a013ae0de1074660992139a1a440df3e6b219b86cf0d3f11c2692bb4fe3", size = 1970358, upload-time = "2026-10-11T01:04:41.66Z" },
+    { url = "https://files.pythonhosted.org/packages/2d/fc/c132fd3465b6c7e4ce0193154f602c3e6c46b680e4da7eb3bd0d8a40d1c7/aiohttp-3.14.5-cp315-cp315t-musllinux_1_2_armv7l.whl", hash = "sha256:8966ecac808dd5f473c9c4cefd10cd3ffda71c18a4d3493b7c7d2ae1803bf2cc", size = 1969192, upload-time = "2026-10-11T01:04:44.66Z" },
+    { url = "https://files.pythonhosted.org/packages/95/4e/d58b45e7dba4eb607eca11fc0a4aa77ae0f39c11afa804635a61ce18cff4/aiohttp-3.14.5-cp315-cp315t-musllinux_1_2_ppc64le.whl", hash = "sha256:3093b72c215bda16ce961a6d073f6e71d46e022962a9d5d457c5d4d421c78b57", size = 1963618, upload-time = "2026-10-11T01:04:47.505Z" },
+    { url = "https://files.pythonhosted.org/packages/a2/d9/f6ac50946efb3490428ef52b56e62c1c6b7f9c6ff3ec6083535526c83e60/aiohttp-3.14.5-cp315-cp315t-musllinux_1_2_riscv64.whl", hash = "sha256:149fb56caf7acb67073126f675d0958d9c4b3125fcd3f6d4877df98aa8a97ce9", size = 1784817, upload-time = "2026-10-11T01:04:50.287Z" },
+    { url = "https://files.pythonhosted.org/packages/d0/2f/f255eb63da788cd8a452fe350869c03266ccad7d884925f6963c87808f24/aiohttp-3.14.5-cp315-cp315t-musllinux_1_2_s390x.whl", hash = "sha256:293d3ae7c6a0ed176a42e59a1b5fde825ead65c835360f734148e96729f928d2", size = 1995956, upload-time = "2026-10-11T01:04:53.213Z" },
+    { url = "https://files.pythonhosted.org/packages/d9/9b/241aa3393eaafda0034470add1625f82a4c252901108723b283a9b0b32ca/aiohttp-3.14.5-cp315-cp315t-musllinux_1_2_x86_64.whl", hash = "sha256:3f2dcc00191fd563e9075181a14ec31d7dd63223ced7582cc70a15a499de0c79", size = 1967794, upload-time = "2026-10-11T01:04:55.958Z" },
+    { url = "https://files.pythonhosted.org/packages/5f/7f/a68e689288c9e4bfcf8d0979f2b12b774bf01861985420df6150eba5448e/aiohttp-3.14.5-cp315-cp315t-win32.whl", hash = "sha256:7779cd97e61ebe583ec2f1c5616cdd038aa08a4453b1848c67842176d054948e", size = 503876, upload-time = "2026-10-11T01:04:58.978Z" },
+    { url = "https://files.pythonhosted.org/packages/a4/78/49b0299da6d54de19fc6fdc6889d50233ac47d192a461624f4fc010fde83/aiohttp-3.14.5-cp315-cp315t-win_amd64.whl", hash = "sha256:0e6f16f5e49c4b8267988c05ab07760d7064cea57d077c3d068d04b0fbb992cb", size = 530957, upload-time = "2026-10-11T01:05:02.23Z" },
+    { url = "https://files.pythonhosted.org/packages/21/d4/b0afc936aeb6d2f93157e3408b069ec5d7934429ae7d023de5e0953b1887/aiohttp-3.14.5-cp315-cp315t-win_arm64.whl", hash = "sha256:1aead151c3abbac6b32942e452020cb66d7efc099d253cc6c20f748e926c858b", size = 510408, upload-time = "2026-10-11T01:05:05.362Z" },
+    { url = "https://files.pythonhosted.org/packages/68/30/173960c42b05a6c59f7558e4b12a4b0d9ba376cf6aa9bde7f9e08a30ca8d/aiohttp-3.14.5-py3-none-any.whl", hash = "sha256:efc21a454892828368b11c2c780de0ff8bc991f73f6b99c6b66e56205470929b", size = 279517, upload-time = "2026-10-11T01:05:08.523Z" },
 ]
 
 [[package]]

src/backend/.pylintrc

@@ -31,10 +31,6 @@ persistent=yes
 # Specify a configuration file.
 #rcfile=
 
-# When enabled, pylint would attempt to guess common misconfiguration and emit
-# user-friendly hints instead of false-positive error messages
-suggestion-mode=yes
-
 # Allow loading of arbitrary C extensions. Extensions are imported into the
 # active Python interpreter and may run arbitrary code.
 unsafe-load-any-extension=no

src/backend/core/admin.py

@@ -286,9 +286,16 @@ class RoomAdmin(admin.ModelAdmin):
         "get_owner",
         "created_at",
         "last_started_at",
+        "deleted_at",
+    ]
+    list_filter = ["access_level", "created_at", "last_started_at", "deleted_at"]
+    readonly_fields = [
+        "id",
+        "created_at",
+        "updated_at",
+        "last_started_at",
+        "deleted_at",
     ]
-    list_filter = ["access_level", "created_at", "last_started_at"]
-    readonly_fields = ["id", "created_at", "updated_at", "last_started_at"]
 
     def get_queryset(self, request):
         """Optimize queries by prefetching related access and user data to avoid N+1 queries."""

src/backend/core/analytics/__init__.py

@@ -39,7 +39,7 @@ def get_analytics() -> AnalyticsBackend:
     options = getattr(settings, "ANALYTICS_BACKEND_SETTINGS", {}) or {}
 
     if not dotted_path:
-        return NoOpAnalytics()
+        return NoOpAnalytics(**options)
 
     backend_class = import_string(dotted_path)
     return backend_class(**options)

src/backend/core/analytics/base.py

@@ -53,7 +53,23 @@ class AnalyticsBackend(ABC):
 
 
 class NoOpAnalytics(AnalyticsBackend):
-    """Default backend: silently discards everything."""
+    """
+    Default backend: discards events and serves static feature flags.
+
+    Feature flags can be declared without any analytics provider, e.g.:
+
+        ANALYTICS_BACKEND_SETTINGS = {"feature_flags": {"summary-enabled": True}}
+    """
+
+    def __init__(
+        self,
+        *,
+        feature_flags: Mapping[str, bool | str | None] | None = None,
+        **_kwargs: Any,
+    ) -> None:
+        # Other settings are ignored, so that settings meant for another
+        # backend never break an instance running without one.
+        self._feature_flags = dict(feature_flags or {})
 
     def identify(self, user: User, properties=None) -> None:
         """No-op: discards identify calls."""
@@ -63,3 +79,10 @@ class NoOpAnalytics(AnalyticsBackend):
 
     def shutdown(self) -> None:
         """No-op: nothing to flush."""
+
+    def get_user_feature_flags(
+        self,
+        user: User,
+    ) -> Mapping[UserFeatureFlag, bool | str | None]:
+        """Return the feature flags declared in settings, for any user."""
+        return self._feature_flags

src/backend/core/analytics/events.py

@@ -9,6 +9,7 @@ class AnalyticsEvent(StrEnum):
     # Rooms
     ROOM_CREATED = "room_created"
     ROOM_UPDATED = "room_updated"
+    ROOM_DELETED = "room_deleted"
 
     # Roomkit (meeting-room SIP devices)
     ROOMKIT_JOINED = "roomkit_joined"

src/backend/core/api/__init__.py

@@ -55,6 +55,9 @@ def get_frontend_configuration(request):
                 "default_resolution": settings.RECORDING_ENCODING_DEFAULT_RESOLUTION,
                 "default_profile": settings.RECORDING_ENCODING_DEFAULT_PROFILE,
             },
+            "authenticated_participants_enabled": (
+                settings.RECORDING_AUTHENTICATED_PARTICIPANTS_ENABLED
+            ),
         },
         "background_image": {
             "upload_is_enabled": settings.FILE_UPLOAD_ENABLED,

src/backend/core/api/exceptions.py

@@ -0,0 +1,30 @@
+"""Exceptions and guards shared by the API endpoints."""
+
+from django.utils.translation import gettext_lazy as _
+
+from rest_framework import exceptions, status
+
+from core import models
+
+
+class RoomSoftDeleted(exceptions.APIException):
+    """Raised when the requested room has been soft deleted."""
+
+    status_code = status.HTTP_410_GONE
+    default_detail = _("This room has been deleted.")
+    default_code = "room_deleted"
+
+
+def ensure_room_not_deleted(resource):
+    """Raise a 410 Gone if the resource is a soft-deleted room.
+
+    Accepts a room or its parent resource, as referenced by accesses. Call it
+    after permissions are checked, to avoid revealing room.
+    """
+    if isinstance(resource, models.Room):
+        room = resource
+    else:
+        room = getattr(resource, "room", None)
+
+    if room is not None and room.is_deleted:
+        raise RoomSoftDeleted()

src/backend/core/api/locks.py

@@ -0,0 +1,17 @@
+"""Row locks guarding the API write paths."""
+
+import contextlib
+
+from django.db import transaction
+
+from core import models
+from core.api.exceptions import ensure_room_not_deleted
+
+
+@contextlib.contextmanager
+def room_locked_for_update(room):
+    """Lock a room's row for the duration of a write."""
+    with transaction.atomic():
+        locked_room = models.Room.all_objects.select_for_update().get(pk=room.pk)
+        ensure_room_not_deleted(locked_room)
+        yield locked_room

src/backend/core/api/permissions.py

@@ -187,29 +187,29 @@ class IsPresentInMeeting(permissions.BasePermission):
             return False
 
 
-class CanManageLobby(permissions.BasePermission):
-    """Grant lobby management (list/accept/deny waiting participants).
+class ParticipantCapability(permissions.BasePermission):
+    """Base permission for in-meeting capabilities opened up to participants.
 
-    - Room admins/owners can always manage the lobby.
-    - When the room access level is TRUSTED, any authenticated user who is
-      currently connected to the meeting can manage the lobby. Presence is
-      verified cache-first (Redis), falling back to the LiveKit API.
+    - Room admins/owners always hold the capability.
+    -  When the room access level is TRUSTED or PUBLIC, any
+      session-authenticated user who is currently connected to the meeting
+      holds it too.
 
     Access level is always read fresh from the DB; only presence is cached,
-    so changing the room to RESTRICTED takes effect immediately.
+    so changing the room access level takes effect immediately.
     """
 
-    message = "You are not allowed to manage this room's lobby."
+    message = "You are not allowed to perform this action."
+    enabled_setting = None
 
-    # pylint: disable=too-many-return-statements
-    def has_object_permission(self, request, view, obj):  # noqa: PLR0911
-        """Check privileges first, then the trusted-room presence path."""
+    def has_object_permission(self, request, view, obj):
+        """Check privileges first, then the participant presence path."""
         user = request.user
 
         if not user or not user.is_authenticated:
             return False
 
-        # Product choice: lobby management is reserved for session-authenticated
+        # Product choice: these capabilities are reserved for session-authenticated
         # users with a real account, not holders of a LiveKit room token.
         if request.auth and hasattr(request.auth, "video"):
             return False
@@ -217,16 +217,31 @@ class CanManageLobby(permissions.BasePermission):
         if obj.is_administrator_or_owner(user):
             return True
 
-        if obj.access_level != RoomAccessLevel.TRUSTED:
+        is_open_room = obj.access_level in (
+            RoomAccessLevel.TRUSTED,
+            RoomAccessLevel.PUBLIC,
+        )
+        is_enabled = not self.enabled_setting or getattr(settings, self.enabled_setting)
+        if not (is_open_room and is_enabled):
             return False
 
-        self.message = "You must be connected to the meeting to manage its lobby."
-
         try:
             return ParticipantsManagement().check_if_in_meeting_cached(
                 room_name=str(obj.pk), identity=str(user.sub)
             )
-        except ParticipantNotFoundException:
-            return False
-        except ParticipantsManagementException:
+        except (ParticipantNotFoundException, ParticipantsManagementException):
             return False
+
+
+class CanManageLobby(ParticipantCapability):
+    """Grant lobby management (list/accept/deny waiting participants).
+
+    Public rooms have no lobby: the endpoints short-circuit there, so opening
+    them to participants exposes nothing.
+    """
+
+
+class CanManageRecording(ParticipantCapability):
+    """Grant starting/stopping a room recording (screen recording or transcript)."""
+
+    enabled_setting = "RECORDING_AUTHENTICATED_PARTICIPANTS_ENABLED"

src/backend/core/api/serializers.py

@@ -26,6 +26,7 @@ from rest_framework.exceptions import PermissionDenied
 from timezone_field.rest_framework import TimeZoneSerializerField
 
 from core import models, utils
+from core.api.exceptions import ensure_room_not_deleted
 
 logger = logging.getLogger(__name__)
 
@@ -114,6 +115,7 @@ class ResourceAccessSerializerMixin:
                 _("You must be administrator or owner of a room to add accesses to it.")
             )
 
+        ensure_room_not_deleted(resource)
         return resource
 
 

src/backend/core/api/throttling.py

@@ -47,6 +47,18 @@ class RoomCreationDailyUserRateThrottle(RoomCreationUserRateThrottle):
     scope = "room_creation_daily"
 
 
+class StartRecordingUserRateThrottle(MonitoredUserRateThrottle):
+    """Throttle recording starts per authenticated user."""
+
+    scope = "start_recording"
+
+
+class StartRecordingDailyUserRateThrottle(StartRecordingUserRateThrottle):
+    """Cap recording starts per authenticated user over a day."""
+
+    scope = "start_recording_daily"
+
+
 class RequestEntryAuthenticatedUserRateThrottle(MonitoredUserRateThrottle):
     """Throttle authenticated user requesting room entry"""
 

src/backend/core/api/viewsets.py

@@ -40,9 +40,11 @@ from rest_framework import (
 )
 from rest_framework.settings import api_settings
 
-from core import analytics, enums, models, utils
+from core import analytics, audit, auditing, enums, models, utils
 from core.api import throttling
+from core.api.exceptions import ensure_room_not_deleted
 from core.api.filters import ListFileFilter
+from core.api.locks import room_locked_for_update
 from core.enums import MEDIA_STORAGE_URL_PATTERN
 from core.recording.enums import FileExtension
 from core.recording.event.authentication import RecordingProcessWebhookAuthentication
@@ -77,7 +79,7 @@ from core.services.participants_management import (
     ParticipantsManagementException,
 )
 from core.services.room_creation import RoomCreation
-from core.services.room_management import RoomManagement
+from core.services.room_management import RoomManagement, RoomManagementException
 from core.services.room_roles import (
     RoomRoleError,
     RoomRoleService,
@@ -125,7 +127,10 @@ class Pagination(pagination.PageNumberPagination):
 
 
 class UserViewSet(
-    mixins.UpdateModelMixin, viewsets.GenericViewSet, mixins.ListModelMixin
+    audit.AuditViewMixin,
+    mixins.UpdateModelMixin,
+    viewsets.GenericViewSet,
+    mixins.ListModelMixin,
 ):
     """User ViewSet"""
 
@@ -133,6 +138,9 @@ class UserViewSet(
     queryset = models.User.objects.all()
     serializer_class = serializers.UserSerializer
 
+    audit_client_id = None
+    audit_code_refused = False
+
     def get_queryset(self):
         """
         Limit listed users by querying the email field with a trigram similarity
@@ -174,6 +182,7 @@ class UserViewSet(
         url_path="exchange-access-token",
         permission_classes=[],
         throttle_classes=[throttling.ExchangeAccessTokenAnonRateThrottle],
+        audit_action=auditing.TRANSIT_CODE_EXCHANGE,
     )
     @FeatureFlag.require("user_access_token")
     def exchange_access_token(self, request):
@@ -191,44 +200,38 @@ class UserViewSet(
         any URL. Role-based permissions apply unchanged.
         """
         if request.user and request.user.is_authenticated:
-            logger.warning(
-                "Transit code exchange refused: request is already "
-                "session-authenticated (user_id=%s)",
-                request.user.id,
-            )
             raise drf_exceptions.PermissionDenied("Already authenticated.")
 
         serializer = serializers.TransitCodeSerializer(data=request.data)
         serializer.is_valid(raise_exception=True)
 
-        code_data = TransitCodeService().consume_code(serializer.validated_data["code"])
+        code = serializer.validated_data["code"]
+        self.audit_target = auditing.transit_code_target(code)
+
+        code_data = TransitCodeService().consume_code(code)
 
         if code_data is None:
-            logger.warning("Invalid, expired or already used transit code")
+            self.audit_code_refused = True
             raise drf_exceptions.PermissionDenied(
                 "Invalid, expired or already used transit code."
             )
 
+        client_id = code_data.get("client_id")
+        self.audit_client_id = client_id
+
         # Re-check the user at exchange time so that a deactivation after
         # the transit code was minted is taken into account.
-        user_id = code_data["user_id"]
-        try:
-            user = models.User.objects.get(id=user_id, is_active=True)
-        except models.User.DoesNotExist as e:
+        user = models.User.objects.filter(id=code_data["user_id"]).first()
+        self.audit_user_target = user
+
+        if user is None or not user.is_active:
             raise drf_exceptions.PermissionDenied(
                 "This account can no longer access the application."
-            ) from e
+            )
 
-        client_id = code_data.get("client_id")
         if not models.Application.has_active_scope(
             client_id, models.ApplicationScope.USERS_SESSION
         ):
-            logger.warning(
-                "Transit code exchange refused: application '%s' no longer "
-                "holds the '%s' grant",
-                client_id,
-                models.ApplicationScope.USERS_SESSION,
-            )
             raise drf_exceptions.PermissionDenied(
                 "This application can no longer create user sessions."
             )
@@ -251,17 +254,31 @@ class UserViewSet(
             },
         )
 
-        # Log for auditing
-        logger.info(
-            "User access token issued from transit code: user_id=%s, client_id=%s",
-            user_id,
-            client_id,
-        )
+        self.audit_actor = user
+        self.audit_details = {"expires_in": settings.USER_ACCESS_TOKEN_TTL}
 
         return drf_response.Response(data)
 
+    def get_audit_fields(self, status_code, error=None):
+        """Report an exchange as an authentication with its transit code.
 
-class RoomViewSet(
+        The caller is anonymous until the code is consumed, then the
+        application that minted it, a refusal included, acting for its user
+        once the exchange succeeds. A code that does not verify is a failed
+        authentication, though answered with a 403. A request already signed
+        in is reported as it is.
+        """
+        fields = super().get_audit_fields(status_code, error)
+        if self.action != "exchange_access_token" or self.request.user.is_authenticated:
+            return fields
+        fields |= {"auth_method": "transit_code", "client_id": self.audit_client_id}
+        if self.audit_code_refused:
+            fields["reason"] = audit.Reason.AUTHENTICATION_FAILED
+        return fields
+
+
+class RoomViewSet(  # pylint: disable=too-many-public-methods
+    audit.AuditViewMixin,
     mixins.CreateModelMixin,
     mixins.DestroyModelMixin,
     mixins.UpdateModelMixin,
@@ -287,10 +304,9 @@ class RoomViewSet(
             filter_kwargs = {"pk": self.kwargs["pk"]}
         except ValueError:
             filter_kwargs = {"slug": slugify(self.kwargs["pk"])}
-        queryset = self.filter_queryset(self.get_queryset())
-        obj = get_object_or_404(queryset, **filter_kwargs)
-        # May raise a permission denied
+        obj = get_object_or_404(models.Room.all_objects, **filter_kwargs)
         self.check_object_permissions(self.request, obj)
+        ensure_room_not_deleted(obj)
         return obj
 
     def retrieve(self, request, *args, **kwargs):
@@ -342,6 +358,27 @@ class RoomViewSet(
         serializer = self.get_serializer(queryset, many=True)
         return drf_response.Response(serializer.data)
 
+    def perform_destroy(self, instance):
+        """Soft delete the room and close its LiveKit room.
+
+        The room and its recordings are kept in database for traceability.
+        """
+        try:
+            RoomManagement.soft_delete(instance)
+        except RoomManagementException as e:
+            raise drf_exceptions.APIException(
+                "Could not delete the room, please try again."
+            ) from e
+
+        analytics.capture(
+            self.request.user,
+            analytics.AnalyticsEvent.ROOM_DELETED,
+            {
+                "room_id": str(instance.pk),
+                "access_level": instance.access_level,
+            },
+        )
+
     def perform_create(self, serializer):
         """Set the current user as owner of the newly created room.
 
@@ -384,12 +421,20 @@ class RoomViewSet(
         )
 
     def perform_update(self, serializer):
-        """Persist the room update, then sync metadata to LiveKit."""
+        """Persist the room update under a row lock, then sync metadata to LiveKit.
 
-        old_configuration = serializer.instance.configuration
-        old_access_level = serializer.instance.access_level
+        The lock is what keeps a concurrent soft delete from being undone: the
+        full-row write of `save()` would otherwise carry back the `deleted_at`
+        read before the deletion committed.
+        """
 
-        room = serializer.save()
+        with room_locked_for_update(serializer.instance) as locked_room:
+            serializer.instance = locked_room
+
+            old_configuration = locked_room.configuration
+            old_access_level = locked_room.access_level
+
+            room = serializer.save()
 
         if (
             room.configuration == old_configuration
@@ -404,7 +449,12 @@ class RoomViewSet(
         methods=["post"],
         url_path="start-recording",
         permission_classes=[
-            permissions.HasPrivilegesOnRoom,
+            permissions.CanManageRecording,
+        ],
+        audit_action=auditing.RECORDING_START,
+        throttle_classes=[
+            throttling.StartRecordingUserRateThrottle,
+            throttling.StartRecordingDailyUserRateThrottle,
         ],
     )
     @FeatureFlag.require("recording")
@@ -437,11 +487,12 @@ class RoomViewSet(
                     mode=mode,
                     options=options_data,
                 )
-                models.RecordingAccess.objects.create(
-                    user=self.request.user,
-                    role=models.RoleChoices.OWNER,
-                    recording=recording,
-                )
+                recording.grant_initial_accesses(starter=self.request.user)
+
+            self.audit_target = recording
+            self.audit_details = {
+                "collect_metadata": bool(recording.options.get("collect_metadata")),
+            }
 
         except (DjangoValidationError, IntegrityError):
             # DjangoValidationError covers the Python-level check (full_clean);
@@ -485,8 +536,9 @@ class RoomViewSet(
         methods=["post"],
         url_path="stop-recording",
         permission_classes=[
-            permissions.HasPrivilegesOnRoom,
+            permissions.CanManageRecording,
         ],
+        audit_action=auditing.RECORDING_STOP,
     )
     @FeatureFlag.require("recording")
     def stop_room_recording(self, request, pk=None):  # pylint: disable=unused-argument
@@ -503,6 +555,8 @@ class RoomViewSet(
                 "No active recording found for this room."
             ) from e
 
+        self.audit_target = recording
+
         worker_service = get_worker_service(mode=recording.mode)
         worker_manager = WorkerServiceMediator(worker_service=worker_service)
 
@@ -1039,8 +1093,16 @@ class ResourceAccessViewSet(
 
         return queryset
 
+    def get_object(self):
+        """Accesses to a soft-deleted room can be read but no longer modified."""
+        access = super().get_object()
+        if self.request.method not in drf_permissions.SAFE_METHODS:
+            ensure_room_not_deleted(access.resource)
+        return access
+
 
 class RecordingViewSet(
+    audit.AuditViewMixin,
     mixins.DestroyModelMixin,
     mixins.ListModelMixin,
     mixins.RetrieveModelMixin,
@@ -1055,6 +1117,23 @@ class RecordingViewSet(
     queryset = models.Recording.objects.all()
     serializer_class = serializers.RecordingSerializer
 
+    audit_actions = {"destroy": auditing.RECORDING_DELETE}
+    # What the summary service reports on, once its event is validated
+    audit_process_type = None
+
+    def get_audit_action(self):
+        """Audit a summary apart from the transcript it is made from."""
+        if self.audit_process_type == "summary":
+            return auditing.RECORDING_SUMMARY_REPORT
+        return super().get_audit_action()
+
+    def get_audit_fields(self, status_code, error=None):
+        """Report a failure of the summary service as one, though it is acknowledged."""
+        fields = super().get_audit_fields(status_code, error)
+        if status_code < 400 and (self.audit_details or {}).get("status") == "failure":
+            fields["outcome"] = audit.Outcome.FAILURE
+        return fields
+
     def get_queryset(self):
         """Restrict recordings to the user's ones."""
         user = self.request.user
@@ -1070,6 +1149,7 @@ class RecordingViewSet(
         url_path="external-process-hook",
         authentication_classes=[RecordingProcessWebhookAuthentication],
         serializer_class=serializers.ExternalProcessEventSerializer,
+        audit_action=auditing.RECORDING_TRANSCRIPT_REPORT,
     )
     def on_external_process_event_received(self, request, pk=None):  # pylint: disable=unused-argument
         """Handle incoming external process events for recordings."""
@@ -1083,12 +1163,16 @@ class RecordingViewSet(
 
         validated_data = serializer.validated_data
         job_id = validated_data["job_id"]
+        self.audit_process_type = validated_data.get("type")
+        self.audit_details = {"job_id": job_id, "status": validated_data.get("status")}
         try:
             recording = models.Recording.objects.get(external_process_id=job_id)
         except models.Recording.DoesNotExist as e:
             logger.warning("No recording found for job_id %s: %s", job_id, e)
             return ok_response
 
+        self.audit_target = recording
+
         if validated_data.get("type") == "transcript":
             if validated_data.get("status") == "success":
                 logger.info(

src/backend/core/audit/__init__.py

@@ -0,0 +1,34 @@
+"""Structured audit logging."""
+
+from .actions import Action
+from .actor import email_domain
+from .drf import AuditViewMixin
+from .emitter import AUDIT_LOGGER_NAME, log
+from .enums import ActorType, EventCategory, EventType, Outcome, Reason
+from .formatter import AuditJsonFormatter
+from .registry import AlreadyRegistered, register, register_auth_method
+from .request import request_context
+from .signals import LOGIN_ACTION, LOGOUT_ACTION, connect_auth_signals
+from .utils import exception_type
+
+__all__ = [
+    "AUDIT_LOGGER_NAME",
+    "LOGIN_ACTION",
+    "LOGOUT_ACTION",
+    "Action",
+    "ActorType",
+    "AlreadyRegistered",
+    "AuditJsonFormatter",
+    "AuditViewMixin",
+    "EventCategory",
+    "EventType",
+    "Outcome",
+    "Reason",
+    "connect_auth_signals",
+    "email_domain",
+    "exception_type",
+    "log",
+    "register",
+    "register_auth_method",
+    "request_context",
+]

src/backend/core/audit/actions.py

@@ -0,0 +1,30 @@
+"""Specs of the actions audit events are emitted for."""
+
+from dataclasses import dataclass
+
+from .ecs import DEFAULT_CATEGORY, check_classification
+from .enums import EventCategory, EventType
+
+
+@dataclass(frozen=True)
+class Action:
+    """An audited action: its dotted name and its ECS classification.
+
+    ``category`` and ``types`` are the defaults of every event of the action:
+    a ``category`` or ``types`` given to ``log`` wins over them. Without a
+    category, the action is an API call.
+    """
+
+    name: str
+    category: EventCategory | None = None
+    types: tuple[EventType, ...] = ()
+
+    def __post_init__(self):
+        """Validate the classification against ECS, so a bad one fails at import."""
+        if self.category is not None:
+            object.__setattr__(self, "category", EventCategory(self.category))
+        object.__setattr__(self, "types", tuple(EventType(t) for t in self.types))
+        check_classification([self.category or DEFAULT_CATEGORY], self.types)
+
+    def __str__(self) -> str:
+        return self.name

src/backend/core/audit/actor.py

@@ -0,0 +1,187 @@
+"""Resolve who is acting: actor type, identifiers, auth method and tenant.
+
+Personal data is kept to a minimum on purpose: a person is identified by its
+primary key, its OIDC ``sub`` when it has one and the domain of its email
+address. The address itself is never recorded.
+"""
+
+from collections.abc import Mapping
+from enum import Enum
+from typing import Any
+
+from django.contrib.auth import get_user_model
+
+from lasuite.tools.email import get_domain_from_email
+
+from .enums import ActorType
+from .registry import auth_methods, dotted_path
+
+AUTH_METHOD_NONE = "none"
+AUTH_METHOD_SESSION = "session"
+AUTH_METHOD_UNKNOWN = "unknown"
+
+USER_ROLE_FLAGS = (("is_superuser", "superuser"), ("is_staff", "staff"))
+
+
+class _ActorDefault(Enum):
+    """Sentinel telling an omitted ``actor`` apart from ``None``(no account)."""
+
+    FROM_REQUEST = "from_request"
+
+
+FROM_REQUEST = _ActorDefault.FROM_REQUEST
+
+DEFAULT_AUTH_METHODS = {
+    "rest_framework.authentication.SessionAuthentication": AUTH_METHOD_SESSION,
+    "rest_framework.authentication.BasicAuthentication": "basic",
+    "rest_framework.authentication.TokenAuthentication": "token",
+    "django.contrib.auth.backends.ModelBackend": "password",
+}
+
+
+def _auth_methods() -> dict[str, str]:
+    return {**DEFAULT_AUTH_METHODS, **auth_methods()}
+
+
+def auth_method_for(authenticator) -> str:
+    """Return the auth method name for a DRF authenticator instance."""
+    if authenticator is None:
+        return AUTH_METHOD_NONE
+    methods = _auth_methods()
+    for klass in type(authenticator).__mro__:
+        name = methods.get(dotted_path(klass))
+        if name:
+            return name
+    return AUTH_METHOD_UNKNOWN
+
+
+def auth_method_for_backend(backend: str | None) -> str:
+    """Return the auth method name for the dotted path of a login backend."""
+    return _auth_methods().get(backend or "", AUTH_METHOD_UNKNOWN)
+
+
+def request_auth_method(request) -> str:
+    """Return how ``request`` was authenticated.
+
+    A DRF request names its authenticator. A plain Django request, as served
+    by the admin or the logout view, can only be authenticated by its session.
+    """
+    if hasattr(request, "successful_authenticator"):
+        return auth_method_for(request.successful_authenticator)
+    if _is_authenticated(getattr(request, "user", None)):
+        return AUTH_METHOD_SESSION
+    return AUTH_METHOD_NONE
+
+
+def email_domain(email) -> str | None:
+    """Return the lower-cased domain part of an email address, if any.
+
+    It is parsed as for ``Application.can_delegate_email``, so an audited
+    domain is the one a delegation was checked against.
+    """
+    domain = get_domain_from_email(str(email)) if email else None
+    return domain.lower() if domain else None
+
+
+def client_id_from_auth(auth) -> str | None:
+    """Extract an application client id from a token payload."""
+    if isinstance(auth, Mapping):
+        value = auth.get("client_id")
+        return str(value) if value else None
+    return None
+
+
+def _is_authenticated(user) -> bool:
+    return bool(user is not None and getattr(user, "is_authenticated", False))
+
+
+def _is_account(user) -> bool:
+    """Tell whether ``user`` is a user account.
+
+    It stays one once deleted, when Django clears its primary key.
+    """
+    return isinstance(user, get_user_model())
+
+
+def _is_service(user) -> bool:
+    """Tell whether ``user`` authenticated without an account, as a machine user."""
+    return _is_authenticated(user) and not _is_account(user)
+
+
+def _default_actor_type(request, user, client_id) -> ActorType:
+    if client_id:
+        return ActorType.APPLICATION
+    if request is None and user is None:
+        return ActorType.SYSTEM
+    if _is_service(user):
+        return ActorType.SERVICE
+    if _is_account(user):
+        return ActorType.USER
+    return ActorType.ANONYMOUS
+
+
+def describe_user(user) -> dict[str, Any]:
+    """Return the ECS fields identifying a person: id and email domain.
+
+    The id is missing for accounts that were deleted.
+    """
+    return {
+        "id": str(user.pk) if user.pk is not None else None,
+        "domain": email_domain(getattr(user, "email", None)),
+    }
+
+
+def user_sub(user) -> str | None:
+    """Return the OIDC sub of an account, missing for one that never signed in."""
+    return getattr(user, "sub", None) or None
+
+
+def user_roles(user) -> list[str] | None:
+    """Return the privileges of an account at the time of the event, if any."""
+    roles = [role for flag, role in USER_ROLE_FLAGS if getattr(user, flag, False)]
+    return roles or None
+
+
+def describe_actor(
+    request,
+    *,
+    actor: Any = FROM_REQUEST,
+    actor_type: ActorType | str | None = None,
+    client_id: str | None = None,
+    auth_method: str | None = None,
+) -> dict[str, Any]:
+    """Return the fields describing the actor.
+
+    That is the ECS ``user`` and ``organization`` fields, the name of the
+    service acting, if any, reported as ``service.origin.name``, and the
+    ``lasuite`` ones. Everything is read from ``request`` unless overridden.
+    ``actor=None`` means no account, whoever the request is signed in as:
+    an explicit ``actor_type`` alone does not discard it.
+    Without a request or an actor, the actor is the system. ``user`` is the
+    account whose authority the action used, see ``ActorType``: None for a
+    service, the system or an anonymous caller.
+    """
+    user = getattr(request, "user", None) if actor is FROM_REQUEST else actor
+    client_id = client_id or client_id_from_auth(getattr(request, "auth", None))
+    actor_type = actor_type or _default_actor_type(request, user, client_id)
+    is_account = _is_account(user)
+
+    lasuite: dict[str, Any] = {
+        "actor": {
+            "type": str(ActorType(actor_type)),
+            "sub": user_sub(user) if is_account else None,
+        },
+        "auth": {"method": auth_method or request_auth_method(request)},
+        "application": {"client_id": client_id},
+    }
+    tenant = client_id or (
+        email_domain(getattr(user, "email", None)) if is_account else None
+    )
+    return {
+        "user": (
+            {**describe_user(user), "roles": user_roles(user)} if is_account else None
+        ),
+        "organization": {"id": tenant},
+        "service": user.get_username() if _is_service(user) else None,
+        "lasuite": lasuite,
+    }

src/backend/core/audit/admin.py

@@ -0,0 +1,361 @@
+"""Audit the writes performed through the Django admin.
+
+Every ``ModelAdmin`` registered on :class:`AuditedAdminSite` emits an audit
+event when an object is created, changed or deleted, and when a bulk action
+runs. Django's own ``LogEntry`` keeps being written exactly as before: this
+stream is additive.
+
+Actions are named ``admin.<target>.<verb>`` where ``<target>`` is the model
+name, for instance ``admin.room.update`` or ``admin.user.delete``.
+Unlike the rest of the catalogue this family is templated rather than
+enumerated: it follows whatever models are registered.
+
+Only writes are audited. Browsing a change list or a change form emits
+nothing.
+
+Which field values may be recorded, and the event category, are registered
+per model; see ``core.audit.registry``.
+"""
+
+import copy
+import logging
+from contextlib import contextmanager
+from enum import StrEnum
+from functools import wraps
+from typing import Any
+
+from django.contrib.admin import ModelAdmin
+from django.contrib.admin.sites import AdminSite
+from django.contrib.auth import get_user_model
+from django.contrib.auth.models import Group, Permission
+
+from .actions import Action
+from .emitter import log
+from .enums import EventCategory, EventType, Outcome, Reason
+from .registry import model_options
+from .utils import render_value
+
+ADMIN_ACCESS_ACTION = Action(
+    "admin.access", category=EventCategory.WEB, types=(EventType.ACCESS,)
+)
+DIFF_ATTRIBUTE = "audit_admin_diff"
+PENDING_DELETIONS_ATTRIBUTE = "audit_admin_pending_deletions"
+DELETED_COPIES_ATTRIBUTE = "audit_admin_deleted_copies"
+UNAUDITED_ACTIONS = frozenset({"delete_selected"})
+
+SENSITIVE_FIELD_NAMES = frozenset(
+    {"api_key", "client_secret", "pin_code", "secret", "sub", "token"}
+)
+SENSITIVE_FIELD_MARKERS = ("password", "secret", "token")
+
+_logger = logging.getLogger(__name__)
+
+
+class AdminVerb(StrEnum):
+    """What was done to an object through the admin."""
+
+    CREATE = "create"
+    UPDATE = "update"
+    DELETE = "delete"
+    ACTION = "action"
+
+
+_VERB_TYPES: dict[AdminVerb, list[EventType]] = {
+    AdminVerb.CREATE: [EventType.CREATION],
+    AdminVerb.UPDATE: [EventType.CHANGE],
+    AdminVerb.DELETE: [EventType.DELETION],
+    AdminVerb.ACTION: [EventType.CHANGE],
+}
+
+
+def is_sensitive(field_name: str) -> bool:
+    """Tell whether the value of a field must never be recorded."""
+    return field_name in SENSITIVE_FIELD_NAMES or any(
+        marker in field_name for marker in SENSITIVE_FIELD_MARKERS
+    )
+
+
+def value_fields_for(model: type) -> frozenset[str]:
+    """Return the fields of ``model`` whose before and after values may be recorded.
+
+    Anything that looks like a secret is dropped from the ``admin_values`` of
+    the model here, so a mistake in the registration cannot leak one.
+    """
+    names = model_options(model).admin_values
+    return frozenset(name for name in names if not is_sensitive(name))
+
+
+def category_for(model: type) -> EventCategory:
+    """Return the registered category, else IAM for Django's auth models.
+
+    Anything granting access to the product is IAM, the rest configuration.
+    """
+    if category := model_options(model).category:
+        return category
+    if model is get_user_model() or issubclass(model, (Group, Permission)):
+        return EventCategory.IAM
+    return EventCategory.CONFIGURATION
+
+
+def types_for(model: type, verb: AdminVerb) -> list[EventType]:
+    """Return the event types of ``verb`` on ``model``.
+
+    ECS expects ``user`` or ``group`` before the verb when one was the target.
+    """
+    if issubclass(model, get_user_model()):
+        return [EventType.USER, *_VERB_TYPES[verb]]
+    if issubclass(model, Group):
+        return [EventType.GROUP, *_VERB_TYPES[verb]]
+    return _VERB_TYPES[verb]
+
+
+def action_name(model: type, verb: AdminVerb) -> str:
+    """Return the audit action for ``verb`` on ``model``."""
+    return f"admin.{model._meta.model_name}.{verb}"  # noqa: SLF001
+
+
+def form_diff(form, value_fields: frozenset[str]) -> dict[str, Any]:
+    """Return the names of the fields a form changed, and the allowed values.
+
+    Field names are always reported. Values are reported for allow-listed
+    fields only, as ``{"from": ..., "to": ...}``.
+    """
+    changed = sorted(form.changed_data)
+    changes = {
+        name: {
+            "from": render_value(form.initial.get(name)),
+            "to": render_value(form.cleaned_data.get(name)),
+        }
+        for name in changed
+        if name in value_fields
+    }
+    return {"changed_fields": changed, "changes": changes}
+
+
+def related_diffs(formsets) -> list[tuple[Any, AdminVerb, dict[str, Any] | None]]:
+    """Return one ``(object, verb, diff)`` triple per inline object touched.
+
+    Called after ``save_related``, so the formsets already carry what they
+    saved. The objects they list are the very instances their forms bound, so
+    the matching form, and with it the before and after values, is found by
+    identity. Deleted objects are reported through the copies ``save_formset``
+    took, as deleting an instance clears its primary key.
+    """
+    touched = []
+    for formset in formsets or ():
+        forms = {id(form.instance): form for form in formset.forms}
+        deleted_copies = getattr(formset, DELETED_COPIES_ATTRIBUTE, {})
+        value_fields = value_fields_for(formset.model)
+
+        def diff_of(obj, forms=forms, value_fields=value_fields):
+            form = forms.get(id(obj))
+            return form_diff(form, value_fields) if form is not None else None
+
+        for obj in getattr(formset, "new_objects", ()):
+            touched.append((obj, AdminVerb.CREATE, diff_of(obj)))
+        for obj, _fields in getattr(formset, "changed_objects", ()):
+            touched.append((obj, AdminVerb.UPDATE, diff_of(obj)))
+        for obj in getattr(formset, "deleted_objects", ()):
+            # A deleted inline has no meaningful diff
+            touched.append((deleted_copies.get(id(obj), obj), AdminVerb.DELETE, None))
+    return touched
+
+
+class AuditedModelAdminMixin:
+    """Emit an audit event for every write made through this ModelAdmin."""
+
+    def construct_change_message(self, request, form, formsets, add=False):
+        """Stash the structured diff for the ``log_*`` hook that follows."""
+        message = super().construct_change_message(request, form, formsets, add)
+        try:
+            diff = {
+                "own": form_diff(form, value_fields_for(self.model)),
+                "related": related_diffs(formsets),
+            }
+        except Exception:  # pylint: disable=broad-exception-caught
+            _logger.exception("Admin audit diff could not be built")
+            diff = None
+        setattr(request, DIFF_ATTRIBUTE, diff)
+        return message
+
+    def save_formset(self, request, form, formset, change):
+        """Save the inline objects, keeping copies of those about to be deleted."""
+        setattr(
+            formset,
+            DELETED_COPIES_ATTRIBUTE,
+            {id(f.instance): copy.copy(f.instance) for f in formset.deleted_forms},
+        )
+        super().save_formset(request, form, formset, change)
+
+    def log_addition(self, request, obj, message):
+        """Record the creation, and that of any inline object saved with it."""
+        entry = super().log_addition(request, obj, message)
+        self.audit_form_write(request, AdminVerb.CREATE, obj)
+        return entry
+
+    def log_change(self, request, obj, message):
+        """Record the change, and that of any inline object saved with it."""
+        entry = super().log_change(request, obj, message)
+        self.audit_form_write(request, AdminVerb.UPDATE, obj)
+        return entry
+
+    def log_deletions(self, request, queryset):
+        """Note the objects about to be deleted.
+
+        Django calls this before ``delete_model`` and ``delete_queryset``, in
+        both the single and the bulk path. Those emit the events, once the
+        deletion has succeeded or failed. Copies are kept because deleting an
+        instance clears its primary key.
+        """
+        targets = list(queryset)
+        entries = super().log_deletions(request, targets)
+        setattr(
+            request, PENDING_DELETIONS_ATTRIBUTE, [copy.copy(obj) for obj in targets]
+        )
+        return entries
+
+    def delete_model(self, request, obj):
+        """Delete the object, then record one deletion."""
+        with self.auditing_deletions(request, lambda: [copy.copy(obj)]):
+            super().delete_model(request, obj)
+
+    def delete_queryset(self, request, queryset):
+        """Delete the objects, then record one deletion per object."""
+        with self.auditing_deletions(request, lambda: list(queryset)):
+            super().delete_queryset(request, queryset)
+
+    @contextmanager
+    def auditing_deletions(self, request, default_targets):
+        """Record the deletions noted by ``log_deletions`` with their outcome.
+
+        ``default_targets`` lists the objects when ``log_deletions`` did not
+        run, as when a custom action deletes through these methods directly.
+        """
+        targets = getattr(request, PENDING_DELETIONS_ATTRIBUTE, None)
+        setattr(request, PENDING_DELETIONS_ATTRIBUTE, None)
+        if targets is None:
+            targets = default_targets()
+        try:
+            yield
+        except Exception as error:
+            for obj in targets:
+                self.audit_write(request, AdminVerb.DELETE, obj, error=error)
+            raise
+        for obj in targets:
+            self.audit_write(request, AdminVerb.DELETE, obj)
+
+    def get_actions(self, request):
+        """Return the available actions, each wrapped so that running it is audited."""
+        return {
+            name: (self.audited_action(func, name), name, description)
+            for name, (func, _name, description) in super().get_actions(request).items()
+        }
+
+    def audited_action(self, func, name):
+        """Wrap an admin action so every run emits an event, success or not."""
+        if name in UNAUDITED_ACTIONS:
+            return func
+
+        @wraps(func)
+        def run(modeladmin, request, queryset):
+            count = queryset.count()
+            try:
+                response = func(modeladmin, request, queryset)
+            except Exception as error:
+                modeladmin.audit_action(request, name, count, error=error)
+                raise
+            modeladmin.audit_action(request, name, count)
+            return response
+
+        return run
+
+    def audit_form_write(self, request, verb, obj):
+        """Emit the event for a form write and for the inlines saved with it."""
+        diff = getattr(request, DIFF_ATTRIBUTE, None) or {}
+        setattr(request, DIFF_ATTRIBUTE, None)
+        self.audit_write(request, verb, obj, diff.get("own"))
+        for related_obj, related_verb, related_diff in diff.get("related", ()):
+            self.audit_write(request, related_verb, related_obj, related_diff)
+
+    def audit_write(self, request, verb, obj, diff=None, *, error=None):  # pylint: disable=too-many-arguments
+        """Emit one event for a write on ``obj``, a failed one if ``error`` is set."""
+        model = obj.__class__
+        log(
+            action_name(model, verb),
+            request=request,
+            outcome=Outcome.SUCCESS if error is None else Outcome.FAILURE,
+            reason=None if error is None else Reason.INTERNAL_ERROR,
+            error=error,
+            category=category_for(model),
+            types=types_for(model, verb),
+            target=obj,
+            **(diff or {}),
+        )
+
+    def audit_action(self, request, name, count, error=None):
+        """Emit one event for a bulk action run on ``count`` objects."""
+        log(
+            action_name(self.model, AdminVerb.ACTION),
+            request=request,
+            outcome=Outcome.SUCCESS if error is None else Outcome.FAILURE,
+            reason=None if error is None else Reason.INTERNAL_ERROR,
+            category=category_for(self.model),
+            types=types_for(self.model, AdminVerb.ACTION),
+            error=error,
+            admin_action=name,
+            count=count,
+        )
+
+
+def audited(admin_class: type) -> type:
+    """Return ``admin_class`` with the audit mixin."""
+    if issubclass(admin_class, AuditedModelAdminMixin):
+        return admin_class
+    return type(
+        f"Audited{admin_class.__name__}",
+        (AuditedModelAdminMixin, admin_class),
+        {"__module__": admin_class.__module__, "__doc__": admin_class.__doc__},
+    )
+
+
+class AuditedAdminSite(AdminSite):
+    """Admin site whose model admins all emit audit events.
+
+    Installed through ``AdminConfig.default_site`` so that admin classes
+    declared by Django itself, or by a third-party app, are covered as well as
+    the project's own.
+    """
+
+    def register(self, model_or_iterable, admin_class=None, **options):
+        """Register the audited flavour of the given admin class."""
+        super().register(
+            model_or_iterable, audited(admin_class or ModelAdmin), **options
+        )
+
+    def admin_view(self, view, cacheable=False):
+        """Record when a signed-in account without staff access tries an admin view.
+
+        Django asks ``has_permission`` several times per request, the login
+        page included, so the refusal is recorded here instead: once per
+        refused view. The answer is taken before the view runs, which may log
+        the user out.
+        """
+        guarded = super().admin_view(view, cacheable)
+
+        @wraps(guarded)
+        def inner(request, *args, **kwargs):
+            refused = getattr(
+                request.user, "is_authenticated", False
+            ) and not self.has_permission(request)
+            response = guarded(request, *args, **kwargs)
+            if refused:
+                log(
+                    ADMIN_ACCESS_ACTION,
+                    outcome=Outcome.DENIED,
+                    reason=Reason.PERMISSION_DENIED,
+                    request=request,
+                    status_code=response.status_code,
+                )
+            return response
+
+        return inner

src/backend/core/audit/apps.py

@@ -0,0 +1,29 @@
+"""Application configurations of the audit facility."""
+
+from django.apps import AppConfig
+from django.contrib.admin.apps import AdminConfig
+from django.utils.module_loading import autodiscover_modules
+
+from .signals import connect_auth_signals
+
+
+class AuditConfig(AppConfig):
+    """Audit Django's authentication signals and load the project's declarations."""
+
+    name = "core.audit"
+    label = "audit"
+
+    def ready(self):
+        """Connect the login, failed login and logout receivers.
+
+        Then import the ``audit_registry`` module of every installed app, where
+        the project registers its models and authentication classes.
+        """
+        connect_auth_signals()
+        autodiscover_modules("audit_registry")
+
+
+class AuditedAdminConfig(AdminConfig):
+    """Serve the admin from the site that audits every write."""
+
+    default_site = "core.audit.admin.AuditedAdminSite"

src/backend/core/audit/drf.py

@@ -0,0 +1,191 @@
+"""Django REST framework integration
+
+``AuditViewMixin`` turns every response of an audited action into one audit
+event, from DRF's ``finalize_response`` hook, which runs for successes and for
+handled errors alike. An exception DRF does not handle is audited as an
+internal error from ``handle_exception`` before it propagates.
+
+The CRUD actions a viewset audits are mapped in ``audit_actions``.
+Extra action names require a decorator::
+
+    class RoomViewSet(audit.AuditViewMixin, viewsets.ModelViewSet):
+        audit_actions = {"create": ROOM_CREATE, "retrieve": ROOM_RETRIEVE}
+
+        @action(detail=True, methods=["post"], audit_action=ROOM_INVITE)
+        def invite(self, request, pk=None): ...
+
+A refusal is recorded under the action that was attempted, with its outcome
+and reason derived from the response status.
+"""
+
+import copy
+import logging
+from collections.abc import Mapping
+from typing import Any
+
+from .actions import Action
+from .actor import FROM_REQUEST
+from .ecs import DEFAULT_CATEGORY
+from .emitter import EVENT_FIELDS, log
+from .enums import EventCategory, EventType, Outcome, Reason
+from .utils import exception_type
+
+ACTION_TYPES = {
+    "create": EventType.CREATION,
+    "update": EventType.CHANGE,
+    "partial_update": EventType.CHANGE,
+    "destroy": EventType.DELETION,
+    "retrieve": EventType.ACCESS,
+    "list": EventType.ACCESS,
+}
+STATUS_REASONS = {
+    400: Reason.VALIDATION_ERROR,
+    401: Reason.AUTHENTICATION_FAILED,
+    403: Reason.PERMISSION_DENIED,
+    404: Reason.NOT_FOUND,
+    409: Reason.CONFLICT,
+    429: Reason.RATE_LIMITED,
+}
+DENIED_STATUSES = frozenset({401, 403, 429})
+
+_logger = logging.getLogger(__name__)
+
+
+def error_message(response) -> Any:
+    """Return the message of an error response, as DRF or the view wrote it."""
+    data = getattr(response, "data", None)
+    if isinstance(data, Mapping):
+        return data.get("detail") or data.get("error")
+    return None
+
+
+class AuditViewMixin:
+    """Emit one audit event per response of an audited action.
+
+    ``audit_actions`` maps the CRUD actions only. An extra action is audited
+    by passing ``audit_action`` to its ``@action`` decorator.
+
+    While handling a request, a view may *assign* ``audit_target``,
+    ``audit_user_target``, ``audit_actor`` and ``audit_details``;
+    ``check_object_permissions`` sets the target on its own, before a refusal
+    can happen. The actor is the account of the request unless ``audit_actor``
+    is assigned, ``None`` recording no account. The account the action is
+    about is found from the target unless ``audit_user_target`` is assigned.
+    A detail named after an event field, as ``outcome`` or ``request``, is
+    dropped: overriding one is done in ``get_audit_fields``.
+    """
+
+    audit_actions: Mapping[str, Action | str] = {}
+    # Only declared so the router may pass the ``@action`` keyword arguments
+    # to ``as_view``; the action is read from the handler of the request.
+    audit_action: Action | str | None = None
+    audit_target: Any = None
+    audit_user_target: Any = None
+    audit_actor: Any = FROM_REQUEST
+    audit_details: Mapping[str, Any] | None = None
+
+    def __init_subclass__(cls, **kwargs):
+        """Refuse extra actions in ``audit_actions``, keyed by a method name."""
+        super().__init_subclass__(**kwargs)
+        if extra := sorted(set(cls.audit_actions) - set(ACTION_TYPES)):
+            raise TypeError(
+                f"{cls.__qualname__}.audit_actions only maps CRUD actions: "
+                f"audit {', '.join(extra)} with @action(audit_action=...)"
+            )
+
+    def check_object_permissions(self, request, obj):
+        """Remember the object as the target."""
+        self.audit_target = obj
+        super().check_object_permissions(request, obj)
+
+    def perform_destroy(self, instance):
+        """Keep a copy of the target, since deleting an instance clears its pk."""
+        self.audit_target = copy.copy(instance)
+        super().perform_destroy(instance)
+
+    def finalize_response(self, request, response, *args, **kwargs):
+        """Audit the response once DRF has built it."""
+        response = super().finalize_response(request, response, *args, **kwargs)
+        self.emit_audit_event(request, response.status_code, error_message(response))
+        return response
+
+    def handle_exception(self, exc):
+        """Audit an exception DRF cannot turn into a response, then let it propagate.
+
+        Only its class is recorded since its message could carry personal data.
+        """
+        try:
+            return super().handle_exception(exc)
+        except Exception as error:
+            self.emit_audit_event(self.request, 500, error_type=exception_type(error))
+            raise
+
+    def get_audit_action(self) -> Action | str | None:
+        """Return what the current request audits, if anything.
+
+        An extra action is read from its handler, so a request that reaches
+        none, as an OPTIONS request or a refused method, audits nothing.
+        """
+        name = getattr(self, "action", None)
+        if name in ACTION_TYPES:
+            return self.audit_actions.get(name)
+        handler = getattr(self, name, None) if name else None
+        return getattr(handler, "kwargs", {}).get("audit_action")
+
+    def emit_audit_event(self, request, status_code, error=None, error_type=None):
+        """Emit the event of the current action, if it is audited.
+
+        Never raises: a response must not fail because it could not be audited.
+        """
+        try:
+            action = self.get_audit_action()
+            if action is not None:
+                fields = self.get_audit_fields(status_code, error)
+                log(action, request=request, error_type=error_type, **fields)
+        except Exception:  # pylint: disable=broad-exception-caught
+            _logger.exception("Audit event of %s could not be emitted", request.path)
+
+    def get_audit_fields(self, status_code, error=None) -> dict[str, Any]:
+        """Return the fields of the event for a response of ``status_code``.
+
+        The category and types of the ``Action`` win over those derived from
+        the DRF action. A 401 is also filed under ``authentication``, so that
+        it counts as a failed authentication.
+        """
+        action = self.get_audit_action()
+        category, types = None, []
+        if isinstance(action, Action):
+            category, types = action.category, list(action.types)
+        details = {
+            key: value
+            for key, value in (self.audit_details or {}).items()
+            if key not in EVENT_FIELDS
+        }
+        category = category or DEFAULT_CATEGORY
+        fields = {
+            **details,
+            "category": (
+                [category, EventCategory.AUTHENTICATION]
+                if status_code == 401
+                else category
+            ),
+            "types": types
+            or [ACTION_TYPES.get(getattr(self, "action", None), EventType.INFO)],
+            "target": self.audit_target,
+            "user_target": self.audit_user_target,
+            "actor": self.audit_actor,
+            "status_code": status_code,
+        }
+        if status_code >= 400:
+            fields |= {
+                "outcome": (
+                    Outcome.DENIED
+                    if status_code in DENIED_STATUSES
+                    else Outcome.FAILURE
+                ),
+                "reason": STATUS_REASONS.get(
+                    status_code, Reason.INTERNAL_ERROR if status_code >= 500 else None
+                ),
+                "error": error,
+            }
+        return fields

src/backend/core/audit/ecs.py

@@ -0,0 +1,130 @@
+"""What the Elastic Common Schema says about audit events.
+
+Reference:
+- https://github.com/elastic/ecs/blob/v9.5.0/schemas/event.yml
+- https://github.com/elastic/ecs/blob/v9.5.0/schemas/entity.yml
+"""
+
+from collections.abc import Iterable
+
+from django.conf import settings
+
+from .enums import EventCategory, EventType
+
+ECS_VERSION = "9.5.0"
+
+# The category of an event that names none, as an API call
+DEFAULT_CATEGORY = EventCategory.API
+
+# ``expected_event_types`` of the categories in ``EventCategory``
+EXPECTED_EVENT_TYPES: dict[EventCategory, frozenset[EventType]] = {
+    EventCategory.API: frozenset(
+        {
+            EventType.ACCESS,
+            EventType.ADMIN,
+            EventType.ALLOWED,
+            EventType.CHANGE,
+            EventType.CREATION,
+            EventType.DELETION,
+            EventType.DENIED,
+            EventType.END,
+            EventType.INFO,
+            EventType.START,
+            EventType.USER,
+        }
+    ),
+    EventCategory.AUTHENTICATION: frozenset(
+        {EventType.START, EventType.END, EventType.INFO}
+    ),
+    EventCategory.CONFIGURATION: frozenset(
+        {
+            EventType.ACCESS,
+            EventType.CHANGE,
+            EventType.CREATION,
+            EventType.DELETION,
+            EventType.INFO,
+        }
+    ),
+    EventCategory.EMAIL: frozenset({EventType.INFO}),
+    EventCategory.FILE: frozenset(
+        {
+            EventType.ACCESS,
+            EventType.CHANGE,
+            EventType.CREATION,
+            EventType.DELETION,
+            EventType.INFO,
+        }
+    ),
+    EventCategory.IAM: frozenset(
+        {
+            EventType.ADMIN,
+            EventType.CHANGE,
+            EventType.CREATION,
+            EventType.DELETION,
+            EventType.GROUP,
+            EventType.INFO,
+            EventType.USER,
+        }
+    ),
+    EventCategory.SESSION: frozenset({EventType.START, EventType.END, EventType.INFO}),
+    EventCategory.WEB: frozenset({EventType.ACCESS, EventType.ERROR, EventType.INFO}),
+}
+
+# Allowed values of ``entity.type``
+ENTITY_TYPES = frozenset(
+    {
+        "application",
+        "bucket",
+        "cloud",
+        "container",
+        "database",
+        "function",
+        "host",
+        "orchestrator",
+        "queue",
+        "service",
+        "session",
+        "user",
+    }
+)
+
+
+def is_expected(categories: Iterable[EventCategory], event_type: EventType) -> bool:
+    """Tell whether one of ``categories`` expects ``event_type``."""
+    return any(event_type in EXPECTED_EVENT_TYPES[category] for category in categories)
+
+
+def check_classification(
+    categories: Iterable[EventCategory | str], types: Iterable[EventType | str]
+) -> None:
+    """Raise ``ValueError`` unless every type is expected by one of the categories."""
+    categories = [EventCategory(category) for category in categories]
+    unexpected = [
+        str(event_type)
+        for event_type in (EventType(item) for item in types)
+        if not is_expected(categories, event_type)
+    ]
+    if unexpected:
+        raise ValueError(
+            f"ECS {ECS_VERSION} does not expect event type {', '.join(unexpected)} "
+            f"in category {', '.join(str(category) for category in categories)}"
+        )
+
+
+def dataset() -> str:
+    """Return the dataset of audit events, ``<service>.audit``."""
+    service_name = settings.AUDIT_LOG_SERVICE_NAME
+    return f"{service_name}.audit".lower().replace("-", "_")
+
+
+def stream_fields() -> dict[str, dict[str, str]]:
+    """Return the ``data_stream`` and ``event.dataset`` fields of audit events."""
+    name = dataset()
+    return {
+        "data_stream": {
+            "type": "logs",
+            "dataset": name,
+            "namespace": settings.AUDIT_LOG_DATA_STREAM_NAMESPACE,
+        },
+        "event": {"dataset": name},
+    }

src/backend/core/audit/emitter.py

@@ -0,0 +1,231 @@
+"""Build ECS audit documents and emit them on the ``audit`` logger."""
+
+import functools
+import inspect
+import logging
+import socket
+import uuid
+from collections.abc import Iterable
+from datetime import datetime, timezone
+from typing import Any
+
+from django.conf import settings
+
+from .actions import Action
+from .actor import FROM_REQUEST, describe_actor, describe_user
+from .ecs import (
+    DEFAULT_CATEGORY,
+    ECS_VERSION,
+    check_classification,
+    is_expected,
+    stream_fields,
+)
+from .enums import ActorType, EventCategory, EventType, Outcome, Reason
+from .request import RequestContext, request_context
+from .targets import describe_target, user_target_of
+from .utils import prune_empty, render_value
+
+AUDIT_LOGGER_NAME = "audit"
+
+audit_logger = logging.getLogger(AUDIT_LOGGER_NAME)
+logger = logging.getLogger(__name__)
+
+
+def log(action: Action | str, **fields: Any) -> None:
+    """Emit one audit event."""
+    try:
+        document = build_document(action, **fields)
+    except Exception:  # pylint: disable=broad-exception-caught
+        logger.exception("Audit event %r could not be built", action)
+        return
+
+    audit_logger.log(
+        level_for(document["lasuite"]["outcome"], document["event"].get("reason")),
+        str(action),
+        extra={"audit": document},
+    )
+
+
+def level_for(outcome: Outcome | str, reason: Reason | str | None) -> int:
+    """Derive the logging level so call sites never choose one."""
+    if Outcome(outcome) == Outcome.SUCCESS:
+        return logging.INFO
+    if reason is not None and Reason(reason) == Reason.INTERNAL_ERROR:
+        return logging.ERROR
+    return logging.WARNING
+
+
+@functools.cache
+def service_version() -> str | None:
+    """Return the release of the backend."""
+    return getattr(settings, "RELEASE", None)
+
+
+@functools.cache
+def service_node_name() -> str:
+    """Return the name of the node serving, its pod name on Kubernetes."""
+    return socket.gethostname()
+
+
+def build_document(  # noqa: PLR0913  # pylint: disable=too-many-arguments,too-many-locals
+    action: Action | str,
+    *,
+    request: Any = None,
+    outcome: Outcome | str = Outcome.SUCCESS,
+    reason: Reason | str | None = None,
+    category: EventCategory | str | Iterable[EventCategory | str] | None = None,
+    types: list[EventType | str] | None = None,
+    target: Any = None,
+    user_target: Any = None,
+    actor: Any = FROM_REQUEST,
+    actor_type: ActorType | str | None = None,
+    auth_method: str | None = None,
+    client_id: str | None = None,
+    target_service: str | None = None,
+    status_code: int | None = None,
+    error: Any = None,
+    error_type: str | None = None,
+    message: str | None = None,
+    **details: Any,
+) -> dict[str, Any]:
+    """Return the ECS document of an event, pruned of empty fields.
+
+    ``action`` is what was attempted: an ``Action``, whose category and types
+    apply unless given here, or a bare dotted name (``room.create``).
+    ``category`` may be a list, for an event filed under several.
+    The actor, auth method and network fields are read from ``request``, by
+    default from the context of the request being served.
+    ``actor``, ``actor_type``, ``auth_method`` and ``client_id`` override them;
+    ``actor=None`` records no account even when the request is signed in.
+    ``target`` is the resource acted on, reported as ``entity.target``, and
+    ``user_target`` the account the action was about, reported as
+    ``user.target``: by default the target if it is a user, or the account
+    registered for its model. ``target_service`` names the peer service the
+    backend called, reported as ``service.target.name``. Any other keyword
+    argument lands under ``lasuite.details``, unless ``None`` or an empty
+    mapping. The value of a detail is data and is kept whole: a ``None`` or an
+    empty mapping inside it, as in the ``from`` and ``to`` of a change, stays.
+    """
+    context = (
+        request_context() if request is None else RequestContext.from_request(request)
+    )
+    outcome = Outcome(outcome)
+    reason = Reason(reason) if reason is not None else None
+    if isinstance(action, Action):
+        category = category or action.category
+        types = types or list(action.types)
+    if user_target is None and target is not None:
+        user_target = user_target_of(target)
+    actor_fields = describe_actor(
+        context.request,
+        actor=actor,
+        actor_type=actor_type,
+        client_id=client_id,
+        auth_method=auth_method,
+    )
+    stream = stream_fields()
+
+    document = prune_empty(
+        {
+            "@timestamp": datetime.now(timezone.utc).isoformat(timespec="milliseconds"),
+            "ecs": {"version": ECS_VERSION},
+            "data_stream": stream["data_stream"],
+            "message": message,
+            "service": {
+                "name": settings.AUDIT_LOG_SERVICE_NAME,
+                "environment": getattr(settings, "ENVIRONMENT", None),
+                "version": service_version(),
+                "node": {"name": service_node_name()},
+                "origin": {"name": actor_fields["service"]},
+                "target": {"name": target_service},
+            },
+            "event": _event_fields(action, outcome, reason, category, types)
+            | stream["event"],
+            "client": {"ip": context.client_ip},
+            "source": {"ip": context.client_ip},
+            "http": {
+                "request": {"id": context.request_id, "method": context.method},
+                "response": {"status_code": status_code},
+            },
+            "url": {"path": context.path},
+            "user_agent": {"original": context.user_agent},
+            "user": {
+                **(actor_fields["user"] or {}),
+                "target": describe_user(user_target) if user_target else None,
+            },
+            "organization": actor_fields["organization"],
+            "entity": {
+                "target": describe_target(target) if target is not None else None
+            },
+            "lasuite": {
+                **actor_fields["lasuite"],
+                "outcome": str(outcome),
+            },
+            "error": {
+                "message": str(error) if error is not None else None,
+                "type": error_type,
+            },
+        }
+    )
+    # Pruned apart and one level deep only: what a detail holds is data
+    if details := prune_empty(render_value(details), depth=1):
+        document["lasuite"]["details"] = details
+    return document
+
+
+# The allowed kwargs of  the``log`` function that fill an event field
+EVENT_FIELDS = frozenset(
+    name
+    for name, parameter in inspect.signature(build_document).parameters.items()
+    if parameter.kind is inspect.Parameter.KEYWORD_ONLY
+)
+
+
+def _categories(category) -> list[EventCategory]:
+    if category is None:
+        return [DEFAULT_CATEGORY]
+    if isinstance(category, str):
+        return [EventCategory(category)]
+    return list(dict.fromkeys(EventCategory(item) for item in category)) or [
+        DEFAULT_CATEGORY
+    ]
+
+
+def _event_fields(action, outcome, reason, category, types) -> dict[str, Any]:
+    """Return the ECS ``event`` fields of the event."""
+    categories = _categories(category)
+    type_list = [EventType(item) for item in (types or [])]
+    if not type_list:
+        type_list = [_default_type(outcome, categories)]
+    if (
+        outcome == Outcome.DENIED
+        and EventType.DENIED not in type_list
+        and is_expected(categories, EventType.DENIED)
+    ):
+        type_list.append(EventType.DENIED)
+    try:
+        check_classification(categories, type_list)
+    except ValueError:
+        logger.exception("Audit event %r is misclassified", str(action))
+
+    return {
+        "kind": "event",
+        "id": str(uuid.uuid4()),
+        "action": str(action),
+        "category": [str(item) for item in categories],
+        "type": [str(item) for item in type_list],
+        "outcome": str(Outcome.FAILURE if outcome == Outcome.DENIED else outcome),
+        "reason": str(reason) if reason is not None else None,
+    }
+
+
+def _default_type(outcome: Outcome, categories: list[EventCategory]) -> EventType:
+    """Return the type of an event whose action names none.
+
+    ``denied`` or ``error`` when one of the categories expects it, else ``info``.
+    """
+    preferred = {Outcome.DENIED: EventType.DENIED, Outcome.FAILURE: EventType.ERROR}
+    event_type = preferred.get(outcome)
+    if event_type is not None and is_expected(categories, event_type):
+        return event_type
+    return EventType.INFO

src/backend/core/audit/enums.py

@@ -0,0 +1,79 @@
+"""ECS enums shared by every audit event."""
+
+from enum import StrEnum
+
+
+class Outcome(StrEnum):
+    """Whether the audited action succeeded, failed, or was refused.
+
+    ``unknown`` is for an action whose result was reported in terms the
+    backend does not recognise.
+    """
+
+    SUCCESS = "success"
+    FAILURE = "failure"
+    DENIED = "denied"
+    UNKNOWN = "unknown"
+
+
+class Reason(StrEnum):
+    """Why an action did not succeed."""
+
+    AUTHENTICATION_FAILED = "authentication_failed"
+    PERMISSION_DENIED = "permission_denied"
+    RATE_LIMITED = "rate_limited"
+    VALIDATION_ERROR = "validation_error"
+    NOT_FOUND = "not_found"
+    CONFLICT = "conflict"
+    INTERNAL_ERROR = "internal_error"
+
+
+class ActorType(StrEnum):
+    """Kind of principal behind an action.
+
+    ``user.*`` is the account whose authority the action used: the actor for
+    ``user``, the delegating user for ``application``, absent otherwise.
+    """
+
+    # A person's account acting for itself.
+    USER = "user"
+    # A client application acting on behalf of a user, named by its client id.
+    APPLICATION = "application"
+    # An internal peer of the deployment acting on its own behalf
+    # named by ``service.origin.name``
+    SERVICE = "service"
+    # The backend itself, with no inbound request.
+    SYSTEM = "system"
+    # A caller that did not authenticate, or failed to.
+    ANONYMOUS = "anonymous"
+
+
+class EventCategory(StrEnum):
+    """Subset of the ECS ``event.category``."""
+
+    API = "api"
+    AUTHENTICATION = "authentication"
+    CONFIGURATION = "configuration"
+    EMAIL = "email"
+    FILE = "file"
+    IAM = "iam"
+    SESSION = "session"
+    WEB = "web"
+
+
+class EventType(StrEnum):
+    """Subset of the ECS ``event.type``."""
+
+    ACCESS = "access"
+    ADMIN = "admin"
+    ALLOWED = "allowed"
+    CHANGE = "change"
+    CREATION = "creation"
+    DELETION = "deletion"
+    DENIED = "denied"
+    END = "end"
+    ERROR = "error"
+    GROUP = "group"
+    INFO = "info"
+    START = "start"
+    USER = "user"

src/backend/core/audit/formatter.py

@@ -0,0 +1,39 @@
+"""Render audit records as single-line ECS JSON format."""
+
+import json
+import logging
+from datetime import datetime, timezone
+from typing import Any
+
+from .ecs import ECS_VERSION, stream_fields
+
+
+class AuditJsonFormatter(logging.Formatter):
+    """Serialise the document attached to the record under ``audit`` in ECS format."""
+
+    def format(self, record: logging.LogRecord) -> str:
+        document = getattr(record, "audit", None)
+        if not isinstance(document, dict):
+            stream = stream_fields()
+            document = {
+                "@timestamp": datetime.fromtimestamp(
+                    record.created, tz=timezone.utc
+                ).isoformat(timespec="milliseconds"),
+                "ecs": {"version": ECS_VERSION},
+                "data_stream": stream["data_stream"],
+                "message": record.getMessage(),
+                "event": {**stream["event"], "action": record.getMessage()},
+            }
+
+        document = {
+            **document,
+            "log": {"level": record.levelname.lower(), "logger": record.name},
+        }
+        if record.exc_info:
+            error: dict[str, Any] = dict(document.get("error") or {})
+            error["stack_trace"] = self.formatException(record.exc_info)
+            document["error"] = error
+
+        return json.dumps(
+            document, ensure_ascii=False, default=str, separators=(",", ":")
+        )

src/backend/core/audit/registry.py

@@ -0,0 +1,116 @@
+"""Declare what audit events may say about models and authentication classes.
+
+The project registers them from an ``audit_registry`` module in one of its apps,
+imported once the audit app is ready::
+
+    audit.register(
+        Room,
+        fields=("slug", "access_level"),  # describe the target
+        admin_values=("name", "access_level"),  # values diffed in the admin
+        category=audit.EventCategory.CONFIGURATION,  # ECS category of admin writes
+    )
+    audit.register(Application, entity_type="application")  # ECS ``entity.type``
+    audit.register(ResourceAccess, user_target="user")  # the account it is about
+    audit.register_auth_method(ApplicationJWTAuthentication, "application_jwt")
+
+A target is always identified by its model name and primary key, so a model
+that is not registered is still identifiable, just less detailed.
+"""
+
+from dataclasses import dataclass
+
+from django.db.models import Model
+
+from .ecs import ENTITY_TYPES
+from .enums import EventCategory
+
+
+class AlreadyRegistered(Exception):
+    """A model or an authentication class that was registered twice."""
+
+
+@dataclass(frozen=True)
+class ModelOptions:
+    """What audit events may say about a model.
+
+    ``fields`` describe the model when it is the target of an event, under
+    ``entity.target``. ``admin_values`` are the fields whose before and after
+    values may be recorded when they change in the Django admin. ``category``
+    is the ECS category of admin writes: ``iam`` for anything granting access
+    to the product, ``configuration`` by default. ``entity_type`` is the ECS
+    ``entity.type`` of the model, when one of its allowed values fits.
+    ``user_target`` names the attribute holding the account an event on the
+    model is about, reported as ``user.target``.
+    """
+
+    fields: tuple[str, ...] = ()
+    admin_values: tuple[str, ...] = ()
+    category: EventCategory | None = None
+    entity_type: str | None = None
+    user_target: str | None = None
+
+
+_models: dict[type[Model], ModelOptions] = {}
+_auth_methods: dict[str, str] = {}
+
+
+def register(  # noqa: PLR0913  # pylint: disable=too-many-arguments
+    model: type[Model],
+    *,
+    fields=(),
+    admin_values=(),
+    category: EventCategory | str | None = None,
+    entity_type: str | None = None,
+    user_target: str | None = None,
+) -> None:
+    """Declare what audit events may say about ``model``."""
+    if model in _models:
+        raise AlreadyRegistered(f"{model._meta.label} is already registered")  # noqa: SLF001
+    if entity_type is not None and entity_type not in ENTITY_TYPES:
+        raise ValueError(
+            f"{entity_type!r} is not an ECS entity type: "
+            f"use one of {', '.join(sorted(ENTITY_TYPES))}"
+        )
+    _models[model] = ModelOptions(
+        fields=tuple(fields),
+        admin_values=tuple(admin_values),
+        category=EventCategory(category) if category is not None else None,
+        entity_type=entity_type,
+        user_target=user_target,
+    )
+
+
+def unregister(model: type[Model]) -> ModelOptions | None:
+    """Forget ``model`` and return what was registered for it, if anything."""
+    return _models.pop(model, None)
+
+
+def model_options(model: type[Model]) -> ModelOptions:
+    """Return what is registered for a model, or for its concrete model."""
+    for klass in (model, model._meta.concrete_model):  # noqa: SLF001
+        if (options := _models.get(klass)) is not None:
+            return options
+    return ModelOptions()
+
+
+def dotted_path(klass: type) -> str:
+    """Return the dotted path Django and DRF name a class by."""
+    return f"{klass.__module__}.{klass.__qualname__}"
+
+
+def register_auth_method(klass: type, name: str) -> None:
+    """Name the ``lasuite.auth.method`` of a DRF authentication class or a login backend.
+
+    A DRF class is also the default of its subclasses. A login backend must be
+    registered itself: custom backends often subclass ``ModelBackend`` only for
+    its permission checks, and must not pass for password logins.
+    """
+    path = dotted_path(klass)
+    if path in _auth_methods:
+        raise AlreadyRegistered(f"{path} is already registered")
+    _auth_methods[path] = name
+
+
+def auth_methods() -> dict[str, str]:
+    """Return the registered auth methods, keyed by dotted path."""
+    return dict(_auth_methods)

src/backend/core/audit/request.py

@@ -0,0 +1,114 @@
+"""Read the network fields and the request id behind an audit event."""
+
+import uuid
+from contextvars import ContextVar, Token
+from dataclasses import dataclass
+from typing import Any
+
+from django.conf import settings
+
+from dockerflow.logging import request_id_context
+from rest_framework.throttling import BaseThrottle
+
+USER_AGENT_MAX_LENGTH = 1024
+
+
+def current_request_id() -> str | None:
+    """Return the id of the request being served, if any."""
+    return request_id_context.get(None)
+
+
+def resolve_client_ip(request) -> str | None:
+    """Return the address of the real client, never the one of a proxy.
+
+    It reuses DRF's throttles to identify the client.
+    """
+    return BaseThrottle().get_ident(request) or request.META.get("REMOTE_ADDR")
+
+
+@dataclass(frozen=True)
+class RequestContext:
+    """What an audit event reads from the request behind it.
+
+    The network fields are read once, when the request comes in. The request
+    itself is kept for the actor, only known once it is authenticated: it is
+    the Django request, onto which DRF copies its user and auth, but not its
+    authenticator, so the auth method of a DRF view is not known from it.
+    Outside a request, every field is ``None``.
+    """
+
+    request: Any = None
+    request_id: str | None = None
+    method: str | None = None
+    path: str | None = None
+    client_ip: str | None = None
+    user_agent: str | None = None
+
+    @classmethod
+    def from_request(cls, request) -> "RequestContext":
+        """Read the context of ``request``, its user agent cut where ECS stops."""
+        meta = getattr(request, "META", None) or {}
+        return cls(
+            request=request,
+            request_id=current_request_id(),
+            method=getattr(request, "method", None),
+            path=getattr(request, "path", None) or None,
+            client_ip=resolve_client_ip(request),
+            user_agent=meta.get("HTTP_USER_AGENT", "")[:USER_AGENT_MAX_LENGTH] or None,
+        )
+
+
+_request_context: ContextVar[RequestContext | None] = ContextVar(
+    "audit_request_context", default=None
+)
+
+
+def request_context() -> RequestContext:
+    """Return the context of the request being served, as set by ``AuditLogMiddleware``.
+
+    It is empty outside a request.
+    """
+    return _request_context.get() or RequestContext()
+
+
+def set_request_context(context: RequestContext) -> Token:
+    """Make ``context`` the one of the request being served, until reset."""
+    return _request_context.set(context)
+
+
+def reset_request_context(token: Token) -> None:
+    """Restore the context that was current before ``set_request_context``."""
+    _request_context.reset(token)
+
+
+class AuditLogMiddleware:
+    """Settle the request id and the request context, then echo the id.
+
+    It must come right after ``DockerflowMiddleware``, which sets the id from
+    the inbound ``DOCKERFLOW_REQUEST_ID_HEADER_NAME`` header. Unless
+    ``REQUEST_ID_TRUST_HEADER`` says the ingress overwrites that header, the id
+    is replaced by a fresh one before anything logs, so that a client, the web
+    server access log and the audit events of a request can be joined on an id
+    the client did not choose.
+
+    The context of the request is kept while it is served, so that an audit
+    event emitted far from the view, as from a service, still reads its actor
+    and network fields from it.
+    """
+
+    def __init__(self, get_response):
+        self.get_response = get_response
+
+    def __call__(self, request):
+        if not settings.REQUEST_ID_TRUST_HEADER:
+            request_id_context.set(str(uuid.uuid4()))
+
+        token = set_request_context(RequestContext.from_request(request))
+        try:
+            response = self.get_response(request)
+        finally:
+            reset_request_context(token)
+        header = settings.DOCKERFLOW_REQUEST_ID_HEADER_NAME
+        if not response.has_header(header):
+            response[header] = current_request_id()
+        return response

src/backend/core/audit/signals.py

@@ -0,0 +1,81 @@
+"""Audit Django's authentication signals: login, failed login, logout."""
+
+from django.contrib.auth import BACKEND_SESSION_KEY
+from django.contrib.auth.signals import (
+    user_logged_in,
+    user_logged_out,
+    user_login_failed,
+)
+
+from .actions import Action
+from .actor import AUTH_METHOD_UNKNOWN, auth_method_for_backend
+from .emitter import log
+from .enums import ActorType, EventCategory, EventType, Outcome, Reason
+
+LOGIN_ACTION = Action(
+    "user.login", category=EventCategory.AUTHENTICATION, types=(EventType.START,)
+)
+LOGOUT_ACTION = Action(
+    "user.logout", category=EventCategory.AUTHENTICATION, types=(EventType.END,)
+)
+
+
+def get_login_backend(request, user) -> str | None:
+    """Return the dotted path of the backend a login went through."""
+    session = getattr(request, "session", None)
+    from_session = session.get(BACKEND_SESSION_KEY) if session is not None else None
+    return from_session or getattr(user, "backend", None)
+
+
+def get_auth_method_from_credentials(credentials) -> str:
+    """Name the mechanism of a failed login from the credentials it submitted."""
+    if "password" in credentials:
+        return "password"
+    if "nonce" in credentials:
+        return "oidc"
+    return AUTH_METHOD_UNKNOWN
+
+
+def on_user_logged_in(sender, request, user, **kwargs):  # pylint: disable=unused-argument
+    """Record a successful login."""
+    backend = get_login_backend(request, user)
+    log(
+        LOGIN_ACTION,
+        request=request,
+        actor=user,
+        auth_method=auth_method_for_backend(backend),
+        auth_backend=backend,
+    )
+
+
+def on_user_login_failed(sender, credentials, request, **kwargs):  # pylint: disable=unused-argument
+    """Record a failed login."""
+    log(
+        LOGIN_ACTION,
+        outcome=Outcome.DENIED,
+        reason=Reason.AUTHENTICATION_FAILED,
+        request=request,
+        actor=None,
+        actor_type=ActorType.ANONYMOUS,
+        auth_method=get_auth_method_from_credentials(credentials),
+    )
+
+
+def on_user_logged_out(sender, request, user, **kwargs):  # pylint: disable=unused-argument
+    """Record a logout, unless no one was signed in."""
+    if user is None:
+        return
+    log(
+        LOGOUT_ACTION,
+        request=request,
+        actor=user,
+    )
+
+
+def connect_auth_signals() -> None:
+    """Connect the receivers to authentication signal."""
+    user_logged_in.connect(on_user_logged_in, dispatch_uid="audit.user_logged_in")
+    user_login_failed.connect(
+        on_user_login_failed, dispatch_uid="audit.user_login_failed"
+    )
+    user_logged_out.connect(on_user_logged_out, dispatch_uid="audit.user_logged_out")

src/backend/core/audit/targets.py

@@ -0,0 +1,89 @@
+"""Describe the resource an audit event is about, as an ECS ``entity.target``.
+
+The fields describing each model are those registered for it, see
+``core.audit.registry``. A target is always identified by its model name and
+primary key, so a model that is not registered is still identifiable, just
+less detailed.
+"""
+
+import logging
+from collections.abc import Mapping
+from typing import Any
+
+from django.contrib.auth import get_user_model
+from django.db.models import Model
+
+from .actor import user_sub
+from .registry import model_options
+from .utils import prune_empty, render_value
+
+NAME_FIELD = "name"
+
+_logger = logging.getLogger(__name__)
+
+
+def _is_user(obj: Any) -> bool:
+    return isinstance(obj, get_user_model())
+
+
+def describe_target(obj: Any) -> dict[str, Any]:
+    """Return the ``entity.target`` fields of a target.
+
+    ``id`` is its primary key and ``sub_type`` its model name. ``type`` is the
+    ECS entity type registered for its model, ``user`` for a user. A
+    registered field called ``name`` is reported as ``name``, the others
+    under ``raw``, as the OIDC sub of a user. Empty values are left out, as is
+    a registered field that cannot be read, which is reported.
+    A mapping is taken as already described.
+    """
+    if isinstance(obj, Mapping):
+        return dict(obj)
+    if not isinstance(obj, Model):
+        return {"id": str(obj), "sub_type": obj.__class__.__name__.lower()}
+
+    meta = obj._meta  # noqa: SLF001
+    options = model_options(meta.model)
+    entity_type = options.entity_type or ("user" if _is_user(obj) else None)
+    raw: dict[str, Any] = {}
+    for name in options.fields:
+        try:
+            raw[name] = render_value(getattr(obj, name))
+        except Exception:  # pylint: disable=broad-exception-caught
+            _logger.exception(
+                "Audit field %r of %s could not be read", name, meta.label
+            )
+    if _is_user(obj):
+        raw["sub"] = user_sub(obj)
+    return prune_empty(
+        {
+            "id": str(obj.pk) if obj.pk is not None else None,
+            "type": [entity_type] if entity_type else None,
+            "sub_type": meta.model_name,
+            "name": raw.pop(NAME_FIELD, None),
+            "raw": raw,
+        }
+    )
+
+
+def user_target_of(obj: Any) -> Any:
+    """Return the account an event on ``obj`` is about, if any.
+
+    It is ``obj`` itself for a user, else the attribute registered as the
+    ``user_target`` of its model, as the user an access is granted to.
+    """
+    if _is_user(obj):
+        return obj
+    if not isinstance(obj, Model):
+        return None
+    meta = obj._meta  # noqa: SLF001
+    attribute = model_options(meta.model).user_target
+    if attribute is None:
+        return None
+    try:
+        user = getattr(obj, attribute)
+    except Exception:  # pylint: disable=broad-exception-caught
+        _logger.exception(
+            "Audit user target %r of %s could not be read", attribute, meta.label
+        )
+        return None
+    return user if _is_user(user) else None

src/backend/core/audit/testing.py

@@ -0,0 +1,62 @@
+"""Helpers for asserting on audit events in tests."""
+
+import logging
+from collections.abc import Iterator
+from contextlib import contextmanager
+from dataclasses import asdict
+from typing import Any
+
+from . import registry
+from .actions import Action
+from .emitter import AUDIT_LOGGER_NAME
+
+
+class _CollectingHandler(logging.Handler):
+    """Keep the documents attached to the records it receives."""
+
+    def __init__(self):
+        super().__init__(level=logging.DEBUG)
+        self.documents: list[dict[str, Any]] = []
+
+    def emit(self, record: logging.LogRecord) -> None:
+        document = getattr(record, "audit", None)
+        if not isinstance(document, dict):
+            document = {"message": record.getMessage()}
+        self.documents.append({**document, "log": {"level": record.levelname.lower()}})
+
+
+@contextmanager
+def capture_audit() -> Iterator[list[dict[str, Any]]]:
+    """Collect the audit documents emitted inside the block"""
+    logger = logging.getLogger(AUDIT_LOGGER_NAME)
+    handler = _CollectingHandler()
+    previous_level = logger.level
+    logger.addHandler(handler)
+    logger.setLevel(logging.DEBUG)
+    try:
+        yield handler.documents
+    finally:
+        logger.removeHandler(handler)
+        logger.setLevel(previous_level)
+
+
+def find_events(
+    events: list[dict[str, Any]], action: Action | str
+) -> list[dict[str, Any]]:
+    """Return the captured events whose ``event.action`` is ``action``."""
+    return [
+        event for event in events if event.get("event", {}).get("action") == str(action)
+    ]
+
+
+@contextmanager
+def override_registration(model, **options) -> Iterator[None]:
+    """Register ``model`` with ``options`` inside the block, whatever it was before."""
+    previous = registry.unregister(model)
+    registry.register(model, **options)
+    try:
+        yield
+    finally:
+        registry.unregister(model)
+        if previous is not None:
+            registry.register(model, **asdict(previous))

src/backend/core/audit/utils.py

@@ -0,0 +1,52 @@
+"""Value helpers used to assemble audit logs."""
+
+from collections.abc import Mapping
+from enum import Enum
+from typing import Any
+
+from django.db.models import Model, QuerySet
+
+
+def render_value(value: Any) -> Any:
+    """Render a value as something stable and JSON-friendly.
+
+    Model instances are reduced to their primary key, enums to their value.
+    """
+    if isinstance(value, Model):
+        return str(value.pk)
+    if isinstance(value, Enum):
+        return value.value
+    if isinstance(value, Mapping):
+        return {str(key): render_value(item) for key, item in value.items()}
+    if isinstance(value, (QuerySet, list, tuple, set, frozenset)):
+        return [render_value(item) for item in value]
+    if value is None or isinstance(value, (bool, int, float, str)):
+        return value
+    return str(value)
+
+
+def exception_type(error: BaseException) -> str:
+    """Return the dotted name of an exception's class.
+
+    Audit events record it rather than the message, which may carry personal
+    data.
+    """
+    error_class = type(error)
+    return f"{error_class.__module__}.{error_class.__qualname__}"
+
+
+def prune_empty(value: Any, depth: int | None = None) -> Any:
+    """Drop ``None`` values and empty mappings, recursively.
+
+    With ``depth``, only that many levels are pruned: the values below are
+    kept whole, ``None`` and empty mappings included.
+    """
+    if not isinstance(value, Mapping) or depth == 0:
+        return value
+    pruned = {}
+    for key, item in value.items():
+        cleaned = prune_empty(item, None if depth is None else depth - 1)
+        if cleaned is None or (isinstance(cleaned, Mapping) and not cleaned):
+            continue
+        pruned[key] = cleaned
+    return pruned

src/backend/core/audit_registry.py

@@ -0,0 +1,84 @@
+"""How Meet describes itself to the audit facility: its models and authentication classes.
+
+Imported by the audit app once it is ready, see ``core.audit.apps``. The actions
+Meet audits are declared in ``core.auditing``.
+"""
+
+from django.contrib.auth.models import Group
+
+from lasuite.oidc_resource_server.authentication import ResourceServerAuthentication
+
+from core import audit, models
+from core.audit import EventCategory
+from core.authentication.backends import OIDCAuthenticationBackend
+from core.authentication.livekit import LiveKitTokenAuthentication
+from core.authentication.user_token import UserAccessJWTAuthentication
+from core.external_api.authentication import (
+    AddonsJWTAuthentication,
+    ApplicationJWTAuthentication,
+    MenshenAuthentication,
+)
+from core.recording.event.authentication import HeaderBasedAuthentication
+from core.roomkit.authentication import ServerToServerAuthentication
+
+# Models
+
+audit.register(
+    models.User,
+    category=EventCategory.IAM,
+    admin_values=(
+        "is_active",
+        "is_staff",
+        "is_superuser",
+        "is_device",
+        "groups",
+        "user_permissions",
+    ),
+)
+audit.register(Group, category=EventCategory.IAM, admin_values=("name", "permissions"))
+audit.register(
+    models.Application,
+    category=EventCategory.IAM,
+    entity_type="application",
+    fields=("client_id", "name", "is_active", "scopes"),
+    admin_values=("name", "is_active", "scopes"),
+)
+audit.register(
+    models.ApplicationDomain, category=EventCategory.IAM, admin_values=("domain",)
+)
+audit.register(
+    models.ResourceAccess,
+    category=EventCategory.IAM,
+    fields=("resource_id", "user_id", "role"),
+    admin_values=("role",),
+    user_target="user",
+)
+audit.register(
+    models.RecordingAccess,
+    category=EventCategory.IAM,
+    admin_values=("role",),
+    user_target="user",
+)
+audit.register(
+    models.Room,
+    fields=("slug", "name", "access_level"),
+    admin_values=("name", "slug", "access_level", "configuration"),
+)
+audit.register(
+    models.Recording,
+    fields=("room_id", "status", "mode", "requested_mode", "is_transcribed"),
+    admin_values=("status", "mode"),
+)
+audit.register(models.File, admin_values=("title", "upload_state"))
+
+# Authentication classes and login backends -> ``lasuite.auth.method``
+
+audit.register_auth_method(OIDCAuthenticationBackend, "oidc")
+audit.register_auth_method(ApplicationJWTAuthentication, "application_jwt")
+audit.register_auth_method(AddonsJWTAuthentication, "addons_jwt")
+audit.register_auth_method(ResourceServerAuthentication, "resource_server")
+audit.register_auth_method(MenshenAuthentication, "menshen_token")
+audit.register_auth_method(LiveKitTokenAuthentication, "livekit_token")
+audit.register_auth_method(UserAccessJWTAuthentication, "user_access_jwt")
+audit.register_auth_method(HeaderBasedAuthentication, "shared_secret")
+audit.register_auth_method(ServerToServerAuthentication, "shared_secret")

src/backend/core/auditing.py

@@ -0,0 +1,54 @@
+"""The catalogue of what Meet audits: its actions and the targets that are not models.
+
+It imports nothing but the audit facility and leaf helpers, so that any module can
+import it, authentication classes included. Models and authentication classes
+are registered in ``core.audit_registry``.
+"""
+
+from core import audit
+from core.audit import EventCategory, EventType
+from core.services.transit_code import TransitCodeService
+
+# Actions
+
+APPLICATION_TOKEN_ISSUE = audit.Action(
+    "application.token.issue",
+    category=EventCategory.AUTHENTICATION,
+    types=(EventType.START,),
+)
+USER_PROVISION = audit.Action(
+    "user.provision",
+    category=EventCategory.IAM,
+    types=(EventType.USER, EventType.CREATION),
+)
+TRANSIT_CODE_ISSUE = audit.Action("transit_code.issue", types=(EventType.CREATION,))
+TRANSIT_CODE_EXCHANGE = audit.Action(
+    "transit_code.exchange",
+    category=EventCategory.AUTHENTICATION,
+    types=(EventType.START,),
+)
+ROOM_CREATE = audit.Action("room.create")
+ROOM_LIST = audit.Action("room.list")
+ROOM_RETRIEVE = audit.Action("room.retrieve")
+ROOM_DELETE = audit.Action("room.delete")
+ROOM_UPDATE = audit.Action("room.update")
+RECORDING_START = audit.Action("recording.start", types=(EventType.START,))
+RECORDING_STOP = audit.Action("recording.stop", types=(EventType.END,))
+RECORDING_END = audit.Action("recording.end", types=(EventType.END,))
+RECORDING_DELETE = audit.Action("recording.delete", types=(EventType.DELETION,))
+RECORDING_TRANSCRIPT_REQUEST = audit.Action(
+    "recording.transcript.request", types=(EventType.START,)
+)
+RECORDING_TRANSCRIPT_REPORT = audit.Action(
+    "recording.transcript.report", types=(EventType.END,)
+)
+RECORDING_SUMMARY_REPORT = audit.Action(
+    "recording.summary.report", types=(EventType.END,)
+)
+
+# Targets that are not models
+
+
+def transit_code_target(code: str) -> dict[str, str]:
+    """Describe a transit code as a target, by its digest: never the code itself."""
+    return {"id": TransitCodeService.digest(code), "sub_type": "transit_code"}

src/backend/core/authentication/backends.py

@@ -82,9 +82,6 @@ class OIDCAuthenticationBackend(LaSuiteOIDCAuthenticationBackend):
                 "User info contained an invalid sub claim"
             ) from err
 
-        if len(sub) > 255:
-            raise SuspiciousOperation("User info contained an invalid sub claim")
-
         try:
             return User.objects.get(sub=sub)
         except User.DoesNotExist:

src/backend/core/external_api/authentication.py

@@ -4,21 +4,134 @@
 # ruff: noqa: PLR0913
 
 import logging
+from dataclasses import asdict
+from functools import lru_cache
 
 from django.conf import settings
 from django.contrib.auth import get_user_model
-from django.core.exceptions import SuspiciousOperation
+from django.core.exceptions import SuspiciousOperation, ValidationError
 
+import requests
 from lasuite.oidc_resource_server.backend import ResourceServerBackend as LaSuiteBackend
+from menshen_client import Configuration, IntrospectionRequest, TokenExchangeClient
+from menshen_client.exceptions import ResponseParsingError
 from rest_framework import authentication, exceptions
 
-from core.models import Application
+from core import audit, auditing
+from core.models import Application, ApplicationScope
 from core.services import jwt_token
+from core.validators import sub_validator
 
 User = get_user_model()
 logger = logging.getLogger(__name__)
 
 
+def get_token(request, token_type):
+    """Extract the token from the Authorization header.
+
+    Args:
+        request: The incoming request
+        token_type: Expected Authorization scheme (e.g. Bearer), matched
+            case-insensitively
+
+    Returns:
+        Token string, or None if the request carries no token of this type
+
+    Raises:
+        AuthenticationFailed: If the Authorization header is malformed
+    """
+
+    auth_header = authentication.get_authorization_header(request).split()
+
+    if not auth_header or auth_header[0].lower() != token_type.lower().encode():
+        return None
+
+    if len(auth_header) != 2:
+        logger.warning("Invalid token header format")
+        raise exceptions.AuthenticationFailed("Invalid token header.")
+
+    try:
+        return auth_header[1].decode("utf-8")
+    except UnicodeError as e:
+        logger.warning("Token decode error: %s", e)
+        raise exceptions.AuthenticationFailed("Invalid token encoding.") from e
+
+
+def get_or_create_user_by_sub(sub, email=None, *, auth_method, client_id=None):
+    """Retrieve the user matching a token subject, creating it if allowed.
+
+    Shared by the resource server backends, so that tokens introspected with the
+    OIDC provider or with Menshen resolve users the same way.
+
+    Args:
+        sub: Subject identifier from the introspected token
+        email: Email to store on a newly created user
+        auth_method: How the token was validated, for the audit log
+        client_id: Client the token was issued to, for the audit log
+
+    Returns:
+        User instance, or None if unknown and OIDC_CREATE_USER is unset
+
+    Raises:
+        SuspiciousOperation: If the sub is invalid, the email of a user to create
+            is already used, or the user account is disabled
+    """
+    if sub is not None:
+        sub = str(sub)
+
+    try:
+        sub_validator(sub)
+    except ValidationError as err:
+        raise SuspiciousOperation("User info contained an invalid sub claim") from err
+
+    try:
+        user = User.objects.get(sub=sub)
+    except User.DoesNotExist:
+        if not settings.OIDC_CREATE_USER:
+            return None
+
+        # Users are never identified by email here. But a second account with the
+        # same email (e.g. provisionnal account) would break the lookups by email:
+        # refuse it.
+        existing_user = (
+            User.objects.filter(email__iexact=email).first()
+            if settings.OIDC_FALLBACK_TO_EMAIL_FOR_IDENTIFICATION and email
+            else None
+        )
+        if existing_user is not None:
+            logger.warning("Email already used, not creating user: %s", sub)
+            audit.log(
+                auditing.USER_PROVISION,
+                outcome=audit.Outcome.FAILURE,
+                reason=audit.Reason.CONFLICT,
+                actor=None,
+                auth_method=auth_method,
+                client_id=client_id,
+                target=existing_user,
+                requested_sub=sub,
+            )
+            raise SuspiciousOperation(
+                "Email already used by another account."
+            ) from None
+
+        user = User(sub=sub, email=email)
+        user.set_unusable_password()
+        user.save()
+        audit.log(
+            auditing.USER_PROVISION,
+            actor=None,
+            auth_method=auth_method,
+            client_id=client_id,
+            target=user,
+        )
+
+    if not user.is_active:
+        logger.warning("Inactive user attempted authentication: %s", user.pk)
+        raise SuspiciousOperation("User account is disabled.")
+
+    return user
+
+
 class BaseJWTAuthentication(authentication.BaseAuthentication):
     """Base JWT authentication class."""
 
@@ -72,25 +185,12 @@ class BaseJWTAuthentication(authentication.BaseAuthentication):
         if not self.is_enabled:
             return None
 
-        auth_header = authentication.get_authorization_header(request).split()
+        token = get_token(request, self._token_type)
 
-        if (
-            not auth_header
-            or auth_header[0].lower() != self._token_type.lower().encode()
-        ):
+        if token is None:
             # Defer to next authentication backend
             return None
 
-        if len(auth_header) != 2:
-            logger.warning("Invalid token header format")
-            raise exceptions.AuthenticationFailed("Invalid token header.")
-
-        try:
-            token = auth_header[1].decode("utf-8")
-        except UnicodeError as e:
-            logger.warning("Token decode error: %s", e)
-            raise exceptions.AuthenticationFailed("Invalid token encoding.") from e
-
         return self.authenticate_credentials(token)
 
     def decode_jwt(self, token):
@@ -256,6 +356,118 @@ class AddonsJWTAuthentication(BaseJWTAuthentication):
         )
 
 
+# Menshen grants scopes following La Suite's "service:resource:action" convention.
+# Map them to the scopes expected by the external API permissions.
+MENSHEN_SCOPES_MAPPING = {
+    "meet:room:create": ApplicationScope.ROOMS_CREATE,
+}
+
+
+@lru_cache(1)
+def _get_token_exchange_client():
+    return TokenExchangeClient(
+        config=Configuration(
+            settings.MENSHEN_CLIENT_ID,
+            settings.MENSHEN_CLIENT_SECRET,
+            settings.MENSHEN_SERVER_URL,
+        )
+    )
+
+
+class MenshenAuthentication(authentication.BaseAuthentication):
+    """Authentication for tokens exchanged through Menshen.
+
+    Menshen is La Suite's OAuth 2.0 token exchange server (RFC 8693): another service
+    exchanges its user's access token for a token targeting Meet, then calls the external
+    API on behalf of that user. Tokens are validated by introspection (RFC 7662). Menshen
+    only reports a token as active when Meet is among its audiences.
+    """
+
+    def authenticate(self, request):
+        """Introspect the bearer token with Menshen.
+
+        Returns:
+            Tuple of (user, payload) if the token is active, None otherwise
+        """
+
+        if not settings.MENSHEN_ENABLED:
+            return None
+
+        token = get_token(request, "bearer")
+
+        if token is None:
+            return None
+
+        client = _get_token_exchange_client()
+
+        try:
+            response = client.introspect(IntrospectionRequest(token=token))
+        except (requests.RequestException, ResponseParsingError) as e:
+            logger.warning("Menshen introspection failed: %s", e)
+            return None
+
+        # Permission classes expect a dict payload in request.auth.
+        payload = asdict(response)
+
+        if not payload.get("active"):
+            # Not a Menshen token, or an expired or revoked one: defer to next
+            # authentication backend
+            return None
+
+        user = self.get_or_create_user(payload)
+
+        scopes = payload.get("scope") or ""
+        payload["scope"] = [
+            MENSHEN_SCOPES_MAPPING[scope]
+            for scope in scopes.split()
+            if scope in MENSHEN_SCOPES_MAPPING
+        ]
+
+        return (user, payload)
+
+    def get_or_create_user(self, payload):
+        """Retrieve or create the user from the introspection response.
+
+        Menshen forwards the `sub` and `email` of the subject token, as introspected
+        with the OIDC provider.
+
+        Args:
+            payload: Introspection response dict
+
+        Returns:
+            User instance
+
+        Raises:
+            AuthenticationFailed: If user not found or inactive
+        """
+
+        sub = payload.get("sub")
+
+        if not sub:
+            logger.warning("Missing 'sub' in Menshen introspection response")
+            raise exceptions.AuthenticationFailed("Invalid token claims.")
+
+        try:
+            user = get_or_create_user_by_sub(
+                sub,
+                email=payload.get("email"),
+                auth_method="menshen_token",
+                client_id=payload.get("client_id"),
+            )
+        except SuspiciousOperation as e:
+            raise exceptions.AuthenticationFailed(str(e)) from e
+
+        if user is None:
+            logger.warning("User not found: %s", sub)
+            raise exceptions.AuthenticationFailed("User not found.")
+
+        return user
+
+    def authenticate_header(self, request):
+        """Return authentication scheme for WWW-Authenticate header."""
+        return "bearer"
+
+
 class ResourceServerBackend(LaSuiteBackend):
     """OIDC Resource Server backend for user creation and retrieval."""
 
@@ -285,28 +497,6 @@ class ResourceServerBackend(LaSuiteBackend):
             logger.debug(message)
             raise SuspiciousOperation(message)
 
-        user = self.get_user(access_token, id_token, payload)
-
-        if user is None and settings.OIDC_CREATE_USER:
-            user = self.create_user(sub)
-
-        if user is not None and not user.is_active:
-            logger.warning("Inactive user attempted authentication: %s", user.pk)
-            raise SuspiciousOperation("User account is disabled.")
-
-        return user
-
-    def create_user(self, sub):
-        """Create new user from subject claim.
-
-        Args:
-            sub: Subject identifier from token
-
-        Returns:
-            Newly created User instance
-        """
-        user = self.UserModel(sub=sub)
-        user.set_unusable_password()
-        user.save()
-
-        return user
+        return get_or_create_user_by_sub(
+            sub, auth_method="resource_server", client_id=payload.get("client_id")
+        )

src/backend/core/external_api/viewsets.py

@@ -1,7 +1,6 @@
 """External API endpoints"""
 
 import copy
-from logging import getLogger
 
 from django.conf import settings
 from django.core.exceptions import ValidationError
@@ -21,11 +20,14 @@ from rest_framework import (
 from rest_framework import (
     status as drf_status,
 )
+from rest_framework.generics import get_object_or_404
 
-from core import analytics, api, models
+from core import analytics, api, audit, auditing, models
+from core.api.exceptions import ensure_room_not_deleted
 from core.api.feature_flag import FeatureFlag
+from core.api.locks import room_locked_for_update
 from core.services.jwt_token import JwtTokenService
-from core.services.room_management import RoomManagement
+from core.services.room_management import RoomManagement, RoomManagementException
 from core.services.transit_code import TransitCodeService
 
 from ..services.provisional_user_service import (
@@ -35,18 +37,20 @@ from ..services.provisional_user_service import (
 )
 from . import authentication, permissions, serializers
 
-logger = getLogger(__name__)
 
-
-class ApplicationViewSet(viewsets.ViewSet):
+class ApplicationViewSet(audit.AuditViewMixin, viewsets.ViewSet):
     """API endpoints for application authentication and token generation."""
 
+    audit_actor = None
+    audit_claimed_client_id = None
+
     @decorators.action(
         detail=False,
         methods=["post"],
         url_path="token",
         url_name="token",
         parser_classes=[drf_parsers.FormParser, drf_parsers.JSONParser],
+        audit_action=auditing.APPLICATION_TOKEN_ISSUE,
     )
     @FeatureFlag.require("application")
     def generate_jwt_access_token(self, request, *args, **kwargs):
@@ -68,6 +72,10 @@ class ApplicationViewSet(viewsets.ViewSet):
 
         client_id = serializer.validated_data["client_id"]
         client_secret = serializer.validated_data["client_secret"]
+        email = serializer.validated_data["scope"]
+
+        self.audit_claimed_client_id = client_id
+        self.audit_details = {"requested_domain": audit.email_domain(email)}
 
         try:
             application = models.Application.objects.get(client_id=client_id)
@@ -80,7 +88,8 @@ class ApplicationViewSet(viewsets.ViewSet):
         if not application.is_active:
             raise drf_exceptions.AuthenticationFailed("Application is inactive")
 
-        email = serializer.validated_data["scope"]
+        self.audit_target = application
+
         try:
             validate_email(email)
         except ValidationError:
@@ -92,11 +101,6 @@ class ApplicationViewSet(viewsets.ViewSet):
             )
 
         if not application.can_delegate_email(email):
-            logger.warning(
-                "Application %s denied delegation for %s",
-                application.client_id,
-                email,
-            )
             return drf_response.Response(
                 {
                     "error": "This application is not authorized for this email domain.",
@@ -105,7 +109,7 @@ class ApplicationViewSet(viewsets.ViewSet):
             )
 
         try:
-            user, _ = ProvisionalUserService().get_or_create(email, client_id)
+            user, created = ProvisionalUserService().get_or_create(email, client_id)
         except ProvisionalUserCreationDisabledError as not_found_error:
             raise drf_exceptions.NotFound("User not found.") from not_found_error
         except ProvisionalUserIntegrityError:
@@ -134,14 +138,45 @@ class ApplicationViewSet(viewsets.ViewSet):
             },
         )
 
+        self.audit_actor = user
+        self.audit_details = {
+            "scopes": list(application.scopes or []),
+            "user_provisioned": created,
+            "expires_in": settings.APPLICATION_JWT_EXPIRATION_SECONDS,
+        }
+
         return drf_response.Response(
             data,
             status=drf_status.HTTP_200_OK,
         )
 
+    def get_audit_fields(self, status_code, error=None):
+        """Report the application as the actor once its credentials are verified.
 
-class RoomViewSet(
+        Until then the submitted client id is only a claim: it is kept apart so
+        that it never names the application or the tenant of the event. Either
+        way, a session the request carries never makes its account the actor.
+        """
+        application = self.audit_target
+        fields = {
+            **super().get_audit_fields(status_code, error),
+            "auth_method": "client_credentials",
+            "actor_type": audit.ActorType.ANONYMOUS,
+        }
+        if application:
+            fields |= {
+                "actor_type": audit.ActorType.APPLICATION,
+                "client_id": application.client_id,
+            }
+        else:
+            fields["claimed_client_id"] = self.audit_claimed_client_id
+        return fields
+
+
+class RoomViewSet(  # pylint: disable=too-many-ancestors
+    audit.AuditViewMixin,
     mixins.CreateModelMixin,
+    mixins.DestroyModelMixin,
     mixins.RetrieveModelMixin,
     mixins.ListModelMixin,
     mixins.UpdateModelMixin,
@@ -159,13 +194,26 @@ class RoomViewSet(
     - create: Create a new room owned by the user (requires 'rooms:create' scope)
     - partial_update: Update a room's access level and configuration, for
       administrators and owners only (requires 'rooms:update' scope)
+    - destroy: Soft delete a room and close its LiveKit room, for owners only
+      (requires 'rooms:delete' scope)
+
+    Detail operations on a soft-deleted room answer 410 Gone.
     """
 
-    http_method_names = ["get", "post", "patch", "head", "options"]
+    http_method_names = ["get", "post", "patch", "delete", "head", "options"]
+
+    audit_actions = {
+        "list": auditing.ROOM_LIST,
+        "retrieve": auditing.ROOM_RETRIEVE,
+        "create": auditing.ROOM_CREATE,
+        "partial_update": auditing.ROOM_UPDATE,
+        "destroy": auditing.ROOM_DELETE,
+    }
 
     authentication_classes = [
         authentication.ApplicationJWTAuthentication,
         authentication.AddonsJWTAuthentication,
+        authentication.MenshenAuthentication,
         ResourceServerAuthentication,
     ]
     permission_classes = [
@@ -176,6 +224,17 @@ class RoomViewSet(
     queryset = models.Room.objects.all()
     serializer_class = serializers.RoomSerializer
 
+    def get_object(self):
+        """Get the room, answer 410 if it has been deleted.
+
+        Permissions are checked first so a deleted room is only revealed to
+        users who would have been granted access to it.
+        """
+        room = get_object_or_404(models.Room.all_objects, pk=self.kwargs["pk"])
+        self.check_object_permissions(self.request, room)
+        ensure_room_not_deleted(room)
+        return room
+
     def list(self, request, *args, **kwargs):
         """Limit listed rooms to the ones related to the authenticated user."""
 
@@ -191,29 +250,22 @@ class RoomViewSet(
         page = self.paginate_queryset(queryset)
         if page is not None:
             serializer = self.get_serializer(page, many=True)
+            self.audit_details = {"total": self.paginator.page.paginator.count}
             return self.get_paginated_response(serializer.data)
 
         serializer = self.get_serializer(queryset, many=True)
+        self.audit_details = {"total": len(serializer.data)}
         return drf_response.Response(serializer.data)
 
     def _track_room_event(self, room, event, **extra_properties):
-        """Log a room operation for auditing and forward it to analytics."""
+        """Add a room operation to the audit event and forward it to analytics."""
+
+        self.audit_target = room
+        self.audit_details = extra_properties
 
         auth_method = type(self.request.successful_authenticator).__name__
         client_id = (self.request.auth or {}).get("client_id", "unknown")
 
-        # Log for auditing
-        details = "".join(f", {key}={value}" for key, value in extra_properties.items())
-        logger.info(
-            "Room %s via application: room_id=%s, user_id=%s, client_id=%s, auth_method=%s%s",
-            event.removeprefix("room_"),
-            room.id,
-            self.request.user.id,
-            client_id,
-            auth_method,
-            details,
-        )
-
         analytics.capture(
             self.request.user,
             event,
@@ -231,6 +283,7 @@ class RoomViewSet(
     def perform_create(self, serializer: serializers.RoomSerializer):
         """Set the current user as owner of the newly created room."""
         room = serializer.save()
+        self.audit_target = room
         models.ResourceAccess.objects.create(
             resource=room,
             user=self.request.user,
@@ -239,17 +292,31 @@ class RoomViewSet(
 
         self._track_room_event(room, analytics.AnalyticsEvent.ROOM_CREATED)
 
+    def perform_destroy(self, instance):
+        """Soft delete the room, close its LiveKit room, then log and track it."""
+        try:
+            RoomManagement.soft_delete(instance)
+        except RoomManagementException as e:
+            raise drf_exceptions.APIException(
+                "Could not delete the room, please try again."
+            ) from e
+        self._track_room_event(instance, analytics.AnalyticsEvent.ROOM_DELETED)
+
     def perform_update(self, serializer: serializers.RoomSerializer):
-        """Persist the room update, sync it to LiveKit, then log and track it."""
+        """Persist the room update under a row lock, sync it to LiveKit, then track it."""
 
-        previous_values = {
-            "access_level": serializer.instance.access_level,
-            "configuration": copy.deepcopy(serializer.instance.configuration),
-        }
+        with room_locked_for_update(serializer.instance) as locked_room:
+            serializer.instance = locked_room
 
-        room = serializer.save()
+            previous_values = {
+                "access_level": locked_room.access_level,
+                "configuration": copy.deepcopy(locked_room.configuration),
+            }
+
+            room = serializer.save()
+
+        self.audit_target = room
 
-        # Report the fields that actually changed, not the ones that were submitted.
         updated_fields = sorted(
             field
             for field, previous_value in previous_values.items()
@@ -267,7 +334,7 @@ class RoomViewSet(
         )
 
 
-class UserViewSet(viewsets.GenericViewSet):
+class UserViewSet(audit.AuditViewMixin, viewsets.GenericViewSet):
     """Application-delegated API for user operations.
 
     Provides JWT-authenticated access to user operations for external
@@ -292,6 +359,7 @@ class UserViewSet(viewsets.GenericViewSet):
         methods=["post"],
         url_path="transit-code",
         url_name="transit-code",
+        audit_action=auditing.TRANSIT_CODE_ISSUE,
     )
     @FeatureFlag.require("user_access_token")
     def generate_transit_code(self, request):
@@ -311,12 +379,9 @@ class UserViewSet(viewsets.GenericViewSet):
 
         code = TransitCodeService().create_code(request.user, client_id=client_id)
 
-        # Log for auditing
-        logger.info(
-            "Transit code issued: user_id=%s, client_id=%s",
-            request.user.id,
-            client_id,
-        )
+        self.audit_target = auditing.transit_code_target(code)
+        self.audit_user_target = request.user
+        self.audit_details = {"expires_in": settings.TRANSIT_CODE_TTL}
 
         return drf_response.Response(
             {

src/backend/core/fields.py

@@ -50,4 +50,4 @@ class SecretField(models.CharField):
             setattr(model_instance, self.attname, hashed_secret)
             return hashed_secret
 
-        return super().pre_save(model_instance, add)
+        return super().pre_save(model_instance, add)  # pylint: disable=no-member

src/backend/core/management/commands/purge_inactive_rooms.py

@@ -1,6 +1,8 @@
-"""Purge inactive rooms."""
+"""Purge inactive and soft-deleted rooms."""
 
+import operator
 from datetime import timedelta
+from functools import reduce
 from itertools import batched
 from logging import getLogger
 
@@ -22,10 +24,12 @@ class Command(BaseCommand):
     - rooms which were last started before that period
     - rooms never started and created before that period
 
+    Also delete rooms soft deleted more than ROOM_DELETED_RETENTION_DAYS days ago.
+
     Rooms holding a saved recording that has not expired are kept.
     """
 
-    help = "Purge inactive rooms"
+    help = "Purge inactive and soft-deleted rooms"
 
     def add_arguments(self, parser):
         parser.add_argument(
@@ -35,53 +39,68 @@ class Command(BaseCommand):
         )
 
     def handle(self, *args, **options):
-        """Browse inactive rooms and delete them chunk by chunk."""
+        """Browse purgeable rooms and delete them chunk by chunk."""
 
-        if not settings.ROOM_INACTIVITY_DELETION_DAYS:
+        if not (
+            settings.ROOM_INACTIVITY_DELETION_DAYS
+            or settings.ROOM_DELETED_RETENTION_DAYS
+        ):
             self.stdout.write(
-                "Purging inactive rooms is disabled "
-                "(ROOM_INACTIVITY_DELETION_DAYS is not set)."
+                "Purging rooms is disabled (neither ROOM_INACTIVITY_DELETION_DAYS "
+                "nor ROOM_DELETED_RETENTION_DAYS is set)."
             )
             return
 
         now = timezone.now()
-        inactive_rooms = self.get_inactive_rooms(now)
+        purgeable_rooms = self.get_purgeable_rooms(now)
 
-        inactive_count = inactive_rooms.count()
-        if not inactive_count:
-            self.stdout.write("No inactive room to purge.")
+        purgeable_count = purgeable_rooms.count()
+        if not purgeable_count:
+            self.stdout.write("No room to purge.")
             return
 
         if options["dry_run"]:
-            self.stdout.write(
-                f"[dry-run] {inactive_count} inactive room(s) would be purged:"
-            )
-            names = inactive_rooms.values_list("name", flat=True)
-            for name in names.iterator(chunk_size=CHUNK_SIZE):
-                self.stdout.write(f"- {name}")
+            self.stdout.write(f"[dry-run] {purgeable_count} room(s) would be purged:")
+            rooms = purgeable_rooms.values_list("name", "deleted_at")
+            for name, deleted_at in rooms.iterator(chunk_size=CHUNK_SIZE):
+                self.stdout.write(f"- {name}{' (deleted)' if deleted_at else ''}")
             return
 
         purged_count = 0
-        rooms = inactive_rooms.values_list("pk", "slug").iterator(chunk_size=CHUNK_SIZE)
+        rooms = purgeable_rooms.values_list("pk", "slug", "deleted_at").iterator(
+            chunk_size=CHUNK_SIZE
+        )
         for chunk in batched(rooms, CHUNK_SIZE, strict=False):
-            for room_id, slug in chunk:
-                logger.info("Purging inactive room %s (%s)", room_id, slug)
+            for room_id, slug, deleted_at in chunk:
+                state = "deleted" if deleted_at else "inactive"
+                logger.info("Purging %s room %s (%s)", state, room_id, slug)
 
-            _, deleted_by_model = inactive_rooms.filter(
-                pk__in=[room_id for room_id, _ in chunk]
+            _, deleted_by_model = purgeable_rooms.filter(
+                pk__in=[room_id for room_id, _, _ in chunk]
             ).delete()
             purged_count += deleted_by_model.get("core.Room", 0)
 
-        self.stdout.write(f"Purged {purged_count} inactive room(s).")
+        self.stdout.write(f"Purged {purged_count} room(s).")
 
     @staticmethod
-    def get_inactive_rooms(now):
-        """Return the rooms inactive for too long that no recording protects."""
+    def get_purgeable_rooms(now):
+        """Return the inactive or long-deleted rooms that no recording protects.
 
-        threshold = now - timedelta(days=settings.ROOM_INACTIVITY_DELETION_DAYS)
-        is_inactive = Q(last_started_at__lt=threshold) | Q(
-            last_started_at__isnull=True, created_at__lt=threshold
-        )
+        Soft-deleted rooms are hidden by `Room.objects`, hence `Room.all_objects`.
+        """
+
+        conditions = []
+        if settings.ROOM_INACTIVITY_DELETION_DAYS:
+            threshold = now - timedelta(days=settings.ROOM_INACTIVITY_DELETION_DAYS)
+            conditions.append(
+                Q(last_started_at__lt=threshold)
+                | Q(last_started_at__isnull=True, created_at__lt=threshold)
+            )
+        if settings.ROOM_DELETED_RETENTION_DAYS:
+            deleted_before = now - timedelta(days=settings.ROOM_DELETED_RETENTION_DAYS)
+            conditions.append(Q(deleted_at__lt=deleted_before))
+        if not conditions:
+            return Room.all_objects.none()
 
         protected_recordings = Recording.objects.filter(
             room=OuterRef("pk"), status__in=RecordingStatusChoices.saved_statuses()
@@ -91,4 +110,6 @@ class Command(BaseCommand):
                 created_at__gte=now - timedelta(days=settings.RECORDING_EXPIRATION_DAYS)
             )
 
-        return Room.objects.filter(is_inactive, ~Exists(protected_recordings))
+        return Room.all_objects.filter(
+            reduce(operator.or_, conditions), ~Exists(protected_recordings)
+        )

src/backend/core/migrations/0027_user_email_upper_idx.py

@@ -0,0 +1,23 @@
+# Generated by Django 5.2.14 on 2026-10-07 18:45
+
+from django.contrib.postgres.operations import AddIndexConcurrently
+from django.db import migrations, models
+from django.db.models.functions import Upper
+
+
+class Migration(migrations.Migration):
+    atomic = False
+
+    dependencies = [
+        ('core', '0026_alter_application_scopes'),
+    ]
+
+    operations = [
+        AddIndexConcurrently(
+            model_name="user",
+            index=models.Index(
+                Upper("email"),
+                name="user_email_upper_idx",
+            ),
+        ),
+    ]

src/backend/core/migrations/0028_room_deleted_at.py

@@ -0,0 +1,29 @@
+# Generated by Django 5.2.14 on 2026-09-16 10:00
+
+import django.db.models.manager
+from django.db import migrations, models
+
+
+class Migration(migrations.Migration):
+
+    dependencies = [
+        ('core', '0027_user_email_upper_idx'),
+    ]
+
+    operations = [
+        migrations.AddField(
+            model_name='room',
+            name='deleted_at',
+            field=models.DateTimeField(blank=True, null=True),
+        ),
+        migrations.AlterModelOptions(
+            name='room',
+            options={'default_manager_name': 'all_objects', 'ordering': ('name',), 'verbose_name': 'Room', 'verbose_name_plural': 'Rooms'},
+        ),
+        migrations.AlterModelManagers(
+            name='room',
+            managers=[
+                ('all_objects', django.db.models.manager.Manager()),
+            ],
+        ),
+    ]

src/backend/core/models.py

@@ -246,6 +246,9 @@ class User(AbstractBaseUser, BaseModel, auth_models.PermissionsMixin):
                 name="unique_email_when_sub_is_null",
             )
         ]
+        indexes = [
+            models.Index(models.functions.Upper("email"), name="user_email_upper_idx"),
+        ]
 
     def __str__(self):
         return self.email or self.admin_email or str(self.id)
@@ -407,6 +410,33 @@ class ResourceAccess(BaseModel):
         return super().delete(*args, **kwargs)
 
 
+class RoomQuerySet(models.QuerySet):
+    """QuerySet exposing the room lifecycle filters."""
+
+    def active(self):
+        """Rooms that have not been soft deleted."""
+        return self.filter(deleted_at__isnull=True)
+
+    def deleted(self):
+        """Rooms that have been soft deleted."""
+        return self.filter(deleted_at__isnull=False)
+
+
+class RoomManager(models.Manager.from_queryset(RoomQuerySet)):
+    """Manager hiding soft-deleted rooms, exposed as ``Room.objects``.
+
+    It is deliberately not the model's default manager: Django relies on
+    ``_default_manager`` for unique validation, which must see deleted rooms as
+    they still guard their slug and pin code. Other object relations (e.g.
+    ``recording.room``) go through the base manager and still resolve deleted
+    rooms, which keeps recordings and their notifications working.
+    """
+
+    def get_queryset(self):
+        """Exclude soft-deleted rooms."""
+        return super().get_queryset().active()
+
+
 class Room(Resource):
     """Model for one room"""
 
@@ -430,6 +460,7 @@ class Room(Resource):
         verbose_name=_("Visio room configuration"),
         help_text=_("Values for Visio parameters to configure the room."),
     )
+    deleted_at = models.DateTimeField(null=True, blank=True)
     pin_code = models.CharField(
         max_length=None,
         unique=True,
@@ -446,8 +477,13 @@ class Room(Resource):
         editable=False,
     )
 
+    # Managers
+    objects = RoomManager()
+    all_objects = models.Manager.from_queryset(RoomQuerySet)()
+
     class Meta:
         db_table = "meet_room"
+        default_manager_name = "all_objects"
         ordering = ("name",)
         verbose_name = _("Room")
         verbose_name_plural = _("Rooms")
@@ -470,6 +506,28 @@ class Room(Resource):
             )
         super().save(*args, **kwargs)
 
+    @property
+    def is_deleted(self):
+        """Whether the room has been soft deleted."""
+        return self.deleted_at is not None
+
+    def soft_delete(self):
+        """Soft delete the room.
+
+        The room is hidden from the default manager making it impossible to
+        list, join or update.
+        """
+        deleted_at = timezone.now()
+
+        updated = Room.all_objects.filter(pk=self.pk, deleted_at__isnull=True).update(
+            deleted_at=deleted_at
+        )
+
+        if not updated:
+            raise RuntimeError("This room is already deleted.")
+
+        self.deleted_at = deleted_at
+
     def clean_fields(self, exclude=None):
         """
         Automatically generate the slug from the name and make sure it does not look like a UUID.
@@ -505,7 +563,7 @@ class Room(Resource):
 
         for _ in range(settings.ROOM_TELEPHONY_PIN_MAX_RETRIES):
             pin_code = str(secrets.randbelow(max_value)).zfill(length)
-            if not Room.objects.filter(pin_code=pin_code).exists():
+            if not Room.all_objects.filter(pin_code=pin_code).exists():
                 return pin_code
 
         # Log a warning as a temporary measure until backend observability is implemented.
@@ -685,11 +743,38 @@ class Recording(BaseModel):
         return {
             "destroy": is_owner_or_admin and is_final_status,
             "partial_update": False,
-            "retrieve": is_owner_or_admin,
+            "retrieve": bool(roles),
             "stop": is_owner_or_admin and not is_final_status,
             "update": False,
         }
 
+    def grant_initial_accesses(self, starter):
+        """Grant the starter and the room's owners/administrators access to the recording.
+
+        The starter's access is created first, so it is the oldest one: the
+        transcript summary, which goes to a single user, is sent to them.
+
+        Room roles are copied when the recording starts: later changes to the
+        room's accesses do not affect existing recordings.
+        """
+        room_privileged_user_ids = set(
+            self.room.accesses.filter(
+                role__in=[RoleChoices.OWNER, RoleChoices.ADMIN]
+            ).values_list("user_id", flat=True)
+        )
+        starter_is_privileged = starter.id in room_privileged_user_ids
+        room_privileged_user_ids.discard(starter.id)
+
+        RecordingAccess.objects.create(
+            user=starter,
+            role=RoleChoices.OWNER if starter_is_privileged else RoleChoices.MEMBER,
+            recording=self,
+        )
+        RecordingAccess.objects.bulk_create(
+            RecordingAccess(user_id=user_id, role=RoleChoices.OWNER, recording=self)
+            for user_id in room_privileged_user_ids
+        )
+
     def is_savable(self) -> bool:
         """Determine if the recording can be saved based on its current status."""
 
@@ -703,6 +788,22 @@ class Recording(BaseModel):
         """Check if the recording is in a saved state."""
         return self.status in RecordingStatusChoices.saved_statuses()
 
+    @property
+    def requested_mode(self) -> str:
+        """Return the mode the user asked for.
+
+        A transcript started with a screen capture is stored as a screen
+        recording, which keeps the transcript as its original mode.
+        """
+        return (self.options or {}).get("original_mode") or self.mode
+
+    @property
+    def is_transcribed(self) -> bool:
+        """Tell whether the recording is sent to the summary service."""
+        return self.mode == RecordingModeChoices.TRANSCRIPT or bool(
+            (self.options or {}).get("transcribe", False)
+        )
+
     @property
     def extension(self):
         """Get recording extension based on its mode."""

src/backend/core/recording/event/authentication.py

@@ -40,6 +40,8 @@ class HeaderBasedAuthentication(BaseAuthentication):
     AUTH_HEADER = "Authorization"
     TOKEN_TYPE = "Bearer"  # noqa S105
     REALM = ""
+    # Names the service in the audit log
+    MACHINE_USER_NAME = "machine_user"
 
     EXPECTED_TOKEN_SETTINGS_KEY = None
 
@@ -74,7 +76,7 @@ class HeaderBasedAuthentication(BaseAuthentication):
             )
             raise AuthenticationFailed("Invalid token")
 
-        return MachineUser(), token
+        return MachineUser(self.MACHINE_USER_NAME), token
 
     def authenticate_header(self, request):
         """Return the WWW-Authenticate header value."""
@@ -88,4 +90,5 @@ class RecordingProcessWebhookAuthentication(HeaderBasedAuthentication):
     """
 
     REALM = "External process webhook API"
+    MACHINE_USER_NAME = "summary"
     EXPECTED_TOKEN_SETTINGS_KEY = "SUMMARY_SERVICE_WEBHOOK_API_TOKEN"  # noqa S105

src/backend/core/recording/event/notification.py

@@ -7,18 +7,17 @@ from datetime import datetime, timezone
 from zoneinfo import ZoneInfo, ZoneInfoNotFoundError
 
 from django.conf import settings
-from django.core.mail import send_mail
-from django.template.loader import render_to_string
-from django.utils.translation import get_language, gettext, override
+from django.utils.translation import get_language, gettext, gettext_noop, override
 from django.utils.translation import gettext_lazy as _
 
-import aiohttp
 import requests
 from asgiref.sync import async_to_sync
+from celery.exceptions import OperationalError as CeleryOperationalError
 from livekit import api as livekit_api
 
-from core import models, utils
+from core import audit, auditing, models, utils
 from core.analytics import UserFeatureFlag, is_user_feature_flag_enabled
+from core.tasks.mail import send_email
 from core.utils import generate_download_s3_url
 
 logger = logging.getLogger(__name__)
@@ -52,7 +51,7 @@ class NotificationService:
 
         if recording.mode == models.RecordingModeChoices.SCREEN_RECORDING:
             summary_success = True
-            if recording.options.get("transcribe", False):
+            if recording.is_transcribed:
                 summary_success = self._notify_summary_service(recording)
 
             email_success = self._notify_user_by_email(recording)
@@ -68,18 +67,20 @@ class NotificationService:
     @staticmethod
     def _notify_user_by_email(recording) -> bool:
         """
-        Send an email notification to recording owners when their recording is ready.
+        Queue an email notification to every user with access to the recording
+        when it is ready: its starter and the room's owners/administrators.
 
         The email includes a direct link that redirects owners to a dedicated download
         page in the frontend where they can access their specific recording.
+
+        Rendering and SMTP delivery happen in a Celery worker (``send_email``), so
+        this only does one DB query and enqueues one message per owner.
+        Returns True when every email was queued (or sent, if Celery is disabled).
         """
 
         owner_accesses = (
             models.RecordingAccess.objects.select_related("user")
-            .filter(
-                role=models.RoleChoices.OWNER,
-                recording_id=recording.id,
-            )
+            .filter(recording_id=recording.id)
             .order_by("created_at")
         )
 
@@ -88,10 +89,6 @@ class NotificationService:
             return False
 
         context = {
-            "brandname": settings.EMAIL_BRAND_NAME,
-            "support_email": settings.EMAIL_SUPPORT_EMAIL,
-            "logo_img": settings.EMAIL_LOGO_IMG,
-            "domain": settings.EMAIL_DOMAIN,
             "room_name": recording.room.name,
             "recording_expiration_days": settings.RECORDING_EXPIRATION_DAYS,
             "link": f"{get_recording_download_base_url()}/{recording.id}",
@@ -104,37 +101,22 @@ class NotificationService:
         # 2. The number of recipients per recording is typically small (not thousands)
         for access in owner_accesses:
             user = access.user
-            language = user.language or get_language()
-            with override(language):
-                personalized_context = {
-                    "recording_date": recording.created_at.astimezone(
-                        user.timezone
-                    ).strftime("%Y-%m-%d"),
-                    "recording_time": recording.created_at.astimezone(
-                        user.timezone
-                    ).strftime("%H:%M"),
-                    **context,
-                }
-                msg_html = render_to_string(
-                    "mail/html/screen_recording.html", personalized_context
+            local_created_at = recording.created_at.astimezone(user.timezone)
+            try:
+                send_email.delay(
+                    template="screen_recording",
+                    subject=gettext_noop("Your recording is ready"),
+                    recipients=[user.email],
+                    language=user.language or get_language(),
+                    context={
+                        **context,
+                        "recording_date": local_created_at.strftime("%Y-%m-%d"),
+                        "recording_time": local_created_at.strftime("%H:%M"),
+                    },
                 )
-                msg_plain = render_to_string(
-                    "mail/text/screen_recording.txt", personalized_context
-                )
-                subject = gettext("Your recording is ready")  # Force translation
-
-                try:
-                    send_mail(
-                        subject.capitalize(),
-                        msg_plain,
-                        settings.EMAIL_FROM,
-                        [user.email],
-                        html_message=msg_html,
-                        fail_silently=False,
-                    )
-                except smtplib.SMTPException as exception:
-                    logger.error("notification could not be sent: %s", exception)
-                    has_failures = True
+            except (smtplib.SMTPException, CeleryOperationalError) as exception:
+                logger.error("notification could not be sent: %s", exception)
+                has_failures = True
 
         return not has_failures
 
@@ -155,11 +137,7 @@ class NotificationService:
         if not worker_id:
             return None, None
 
-        custom_configuration = {
-            **settings.LIVEKIT_CONFIGURATION,
-            "timeout": aiohttp.ClientTimeout(total=10),
-        }
-        lkapi = utils.create_livekit_client(custom_configuration=custom_configuration)
+        lkapi = utils.create_livekit_client()
         try:
             egress_list = await lkapi.egress.list_egress(
                 livekit_api.ListEgressRequest(egress_id=worker_id)  # pylint: disable=no-member
@@ -213,14 +191,53 @@ class NotificationService:
 
     @staticmethod
     def _notify_summary_service(recording: models.Recording):
-        if settings.SUMMARY_SERVICE_VERSION == 1:
-            return NotificationService._notify_summary_service_v1(recording)
-        if settings.SUMMARY_SERVICE_VERSION == 2:
-            return NotificationService._notify_summary_service_v2(recording)
+        succeeded = False
+        audit_details = {}
+        try:
+            if settings.SUMMARY_SERVICE_VERSION == 1:
+                succeeded = NotificationService._notify_summary_service_v1(recording)
+            elif settings.SUMMARY_SERVICE_VERSION == 2:
+                succeeded = NotificationService._notify_summary_service_v2(
+                    recording, audit_details
+                )
+            else:
+                raise NotImplementedError(
+                    "Unknown summary service version: "
+                    f"{settings.SUMMARY_SERVICE_VERSION}"
+                )
+            return succeeded
+        finally:
+            audit.log(
+                auditing.RECORDING_TRANSCRIPT_REQUEST,
+                actor=None,
+                actor_type=audit.ActorType.SYSTEM,
+                target=recording,
+                target_service="summary",
+                outcome=audit.Outcome.SUCCESS if succeeded else audit.Outcome.FAILURE,
+                job_id=recording.external_process_id,
+                **audit_details,
+            )
 
-        raise NotImplementedError(
-            f"Unknown summary service version: {settings.SUMMARY_SERVICE_VERSION}"
+    @staticmethod
+    def _get_summary_recipient(recording: models.Recording):
+        """Return the single user who receives the transcript summary.
+
+        A recording can have multiple accesses (the starter and the room's
+        owners/administrators), but its summary is generated only once.
+
+        Temporarily, until the document can be created and shared with all
+        recording accesses, the summary is assigned to the oldest access,
+        which belongs to the starter (see `Recording.grant_initial_accesses`).
+
+        Since the starter may have a MEMBER role, the lookup must not filter by role.
+        """
+        oldest_access = (
+            models.RecordingAccess.objects.select_related("user")
+            .filter(recording_id=recording.id)
+            .order_by("created_at")
+            .first()
         )
+        return oldest_access.user if oldest_access else None
 
     @staticmethod
     def _notify_summary_service_v1(recording: models.Recording):
@@ -233,14 +250,7 @@ class NotificationService:
             logger.error("Summary service not configured")
             return False
 
-        owner_access = (
-            models.RecordingAccess.objects.select_related("user")
-            .filter(
-                role=models.RoleChoices.OWNER,
-                recording_id=recording.id,
-            )
-            .first()
-        )
+        recipient = NotificationService._get_summary_recipient(recording)
 
         if settings.METADATA_COLLECTOR_ENABLED and recording.options.get(
             "collect_metadata", False
@@ -250,7 +260,7 @@ class NotificationService:
         else:
             metadata_filename = None
 
-        if not owner_access:
+        if not recipient:
             logger.error("No owner found for recording %s", recording.id)
             return False
 
@@ -259,16 +269,16 @@ class NotificationService:
         )(recording.worker_id)
 
         payload = {
-            "owner_id": str(owner_access.user.id),
+            "owner_id": str(recipient.id),
             "recording_filename": recording.key,
             "metadata_filename": metadata_filename,
-            "email": owner_access.user.email,
-            "sub": owner_access.user.sub,
+            "email": recipient.email,
+            "sub": recipient.sub,
             "room": recording.room.name,
             "language": recording.options.get("language"),
-            "owner_timezone": str(owner_access.user.timezone),
+            "owner_timezone": str(recipient.timezone),
             "download_link": f"{get_recording_download_base_url()}/{recording.id}",
-            "context_language": owner_access.user.language,
+            "context_language": recipient.language,
             "recording_start_at": (started_at.isoformat() if started_at else None),
             "recording_end_at": (ended_at.isoformat() if ended_at else None),
         }
@@ -298,8 +308,11 @@ class NotificationService:
         return True
 
     @staticmethod
-    def _notify_summary_service_v2(recording: models.Recording):
-        """Notify summary service about a new recording."""
+    def _notify_summary_service_v2(recording: models.Recording, audit_details=None):
+        """Notify summary service about a new recording.
+
+        Whether a summary is asked for is added to ``audit_details``.
+        """
 
         if (
             not settings.SUMMARY_SERVICE_ENDPOINT
@@ -308,14 +321,7 @@ class NotificationService:
             logger.error("Summary service not configured")
             return False
 
-        owner_access = (
-            models.RecordingAccess.objects.select_related("user")
-            .filter(
-                role=models.RoleChoices.OWNER,
-                recording_id=recording.id,
-            )
-            .first()
-        )
+        recipient = NotificationService._get_summary_recipient(recording)
         metadata_filename: None | str = None
         if settings.METADATA_COLLECTOR_ENABLED and recording.options.get(
             "collect_metadata", False
@@ -323,7 +329,7 @@ class NotificationService:
             output_folder = settings.METADATA_COLLECTOR_OUTPUT_FOLDER
             metadata_filename = f"{output_folder}/{recording.id}-metadata.json"
 
-        if not owner_access:
+        if not recipient:
             logger.error("No owner found for recording %s", recording.id)
             return False
 
@@ -349,9 +355,15 @@ class NotificationService:
                 "ended_at": ended_at.isoformat(),
             }
 
+        summary_requested = is_user_feature_flag_enabled(
+            recipient, UserFeatureFlag.TRANSCRIPT_SUMMARY_ENABLED
+        )
+        if audit_details is not None:
+            audit_details["summary_requested"] = summary_requested
+
         payload = {
-            "user_sub": owner_access.user.sub,
-            "user_email": owner_access.user.email,
+            "user_sub": recipient.sub,
+            "user_email": recipient.email,
             "cloud_storage_url": generate_download_s3_url(
                 recording.key,
                 expires_in=settings.SUMMARY_SERVICE_CLOUD_STORAGE_SIGNED_URL_EXPIRY_SECONDS,
@@ -360,21 +372,19 @@ class NotificationService:
             "language": recording.options.get(
                 "language", get_language().split("-")[0].lower()
             ),
-            "context_language": owner_access.user.language,
+            "context_language": recipient.language,
             "push_to_docs_config": {
-                "user_email": owner_access.user.email,
+                "user_email": recipient.email,
                 "title": NotificationService._generate_title(
-                    locale=owner_access.user.language
+                    locale=recipient.language
                     or recording.options.get("language", get_language()),
                     room=recording.room.name,
                     recording_datetime=started_at,
-                    owner_timezone=str(owner_access.user.timezone),
+                    owner_timezone=str(recipient.timezone),
                 ),
                 "download_link": f"{get_recording_download_base_url()}/{recording.id}",
                 "form_link": form_link,
-                "auto_create_summary": is_user_feature_flag_enabled(
-                    owner_access.user, UserFeatureFlag.TRANSCRIPT_SUMMARY_ENABLED
-                ),
+                "auto_create_summary": summary_requested,
             },
             "metadata": metadata_payload,
         }

src/backend/core/recording/services/recording_events.py

@@ -84,7 +84,7 @@ class RecordingEventsService:
     @staticmethod
     def _notify_participants(recording: Recording, event: RecordingWorkerEvent):
         """Notify the room's participants that a recording ended on the given event."""
-        recording_mode = recording.options.get("original_mode", None) or recording.mode
+        recording_mode = recording.requested_mode
 
         notification_type = get_notification_type(recording_mode, event)
         if not notification_type:

src/backend/core/recording/worker/mediator.py

@@ -68,7 +68,7 @@ class WorkerServiceMediator:
         finally:
             recording.save()
 
-        mode = recording.options.get("original_mode", None) or recording.mode
+        mode = recording.requested_mode
 
         try:
             RoomManagement.update_metadata(

src/backend/core/services/livekit_events.py

@@ -12,8 +12,9 @@ from django.utils import timezone
 
 from livekit import api
 
-from core import models
-from core.recording.enums import RecordingWorkerEvent
+from core import audit, auditing, models
+from core.recording.enums import UNSUCCESSFUL_EVENTS, RecordingWorkerEvent
+from core.recording.event.authentication import MachineUser
 from core.recording.services.metadata_collector import (
     MetadataCollectorException,
     MetadataCollectorService,
@@ -31,6 +32,8 @@ from .sip_management import SIPException, SIPManagement
 
 logger = getLogger(__name__)
 
+SERVICE_ORIGIN = "livekit"
+
 
 class LiveKitWebhookError(Exception):
     """Base exception for LiveKit webhook processing errors."""
@@ -219,6 +222,7 @@ class LiveKitEventsService:
             ) from err
 
         event = to_recording_event(data.egress_info.status)
+        self._audit_recording_end(recording, event, data.egress_info.error_code)
 
         # Log if/why the recording failed
         self.recording_events.log_worker_error(
@@ -254,6 +258,28 @@ class LiveKitEventsService:
 
         self.recording_events.handle_terminal_event(recording, event)
 
+    @staticmethod
+    def _audit_recording_end(recording, event, error_code=None):
+        """Audit the end of a recording, as LiveKit reports it.
+
+        An egress status the backend does not map has an unknown outcome.
+        """
+        if event is None:
+            outcome = audit.Outcome.UNKNOWN
+        elif event in UNSUCCESSFUL_EVENTS:
+            outcome = audit.Outcome.FAILURE
+        else:
+            outcome = audit.Outcome.SUCCESS
+        audit.log(
+            auditing.RECORDING_END,
+            actor=MachineUser(SERVICE_ORIGIN),
+            auth_method="shared_secret",
+            target=recording,
+            outcome=outcome,
+            worker_event=event.value if event is not None else None,
+            error_code=error_code or None,
+        )
+
     @staticmethod
     def _is_connection_test_room(room_name: str) -> bool:
         """Return True for ephemeral rooms created by the connection test endpoint."""
@@ -271,20 +297,24 @@ class LiveKitEventsService:
             )
             raise ActionFailedError("Failed to process room started event") from e
 
-        room_updated_count = models.Room.objects.filter(pk=room_id).update(
+        try:
+            room = models.Room.all_objects.get(id=room_id)
+        except models.Room.DoesNotExist as err:
+            raise ActionFailedError(f"Room with ID {room_id} does not exist") from err
+
+        # The block below is intended to fix the issue where long-lived livekit
+        # tokens allow users who already entered a room to re-create it,
+        # even if it was closed.
+        if room.is_deleted:
+            self._close_deleted_room(room_id)
+            return
+
+        # Update through the queryset to skip the full_clean run by save()
+        models.Room.all_objects.filter(pk=room.pk).update(
             last_started_at=timezone.now()
         )
-        if not room_updated_count:
-            raise ActionFailedError(f"Room with ID {room_id} does not exist")
 
         if settings.ROOM_TELEPHONY_ENABLED or settings.ROOMKIT_ENABLED:
-            try:
-                room = models.Room.objects.get(pk=room_id)
-            except models.Room.DoesNotExist as err:
-                raise ActionFailedError(
-                    f"Room with ID {room_id} does not exist"
-                ) from err
-
             try:
                 self.sip_management.ensure_dispatch_rule(room)
             except SIPException as e:
@@ -292,6 +322,25 @@ class LiveKitEventsService:
                     f"Failed to create sip dispatch rule for room {room_id}"
                 ) from e
 
+    @staticmethod
+    def _close_deleted_room(room_id):
+        """Close a LiveKit room recreated after its room was soft deleted.
+
+        LiveKit auto-creates a room on join, so a participant still holding a
+        valid token can bring a deleted room back to life until the token expires.
+        """
+
+        logger.warning(
+            "LiveKit room %s started for a deleted room, closing it", room_id
+        )
+
+        try:
+            RoomManagement.delete_room(str(room_id))
+        except RoomNotFoundException:
+            logger.info("LiveKit room %s is already closed", room_id)
+        except RoomManagementException as e:
+            raise ActionFailedError(f"Failed to close deleted room {room_id}") from e
+
     def _handle_room_finished(self, data):
         """Handle 'room_finished' event."""
 

src/backend/core/services/participants_management.py

@@ -13,6 +13,7 @@ from livekit.api import (
     MuteRoomTrackRequest,
     RoomParticipantIdentity,
     TwirpError,
+    TwirpErrorCode,
     UpdateParticipantRequest,
 )
 from livekit.protocol.models import ParticipantInfo
@@ -52,8 +53,8 @@ class ParticipantsManagement:
                 )
             )
 
-        except TwirpError as e:
-            if e.code == "not_found":
+        except (TwirpError, TimeoutError) as e:
+            if isinstance(e, TwirpError) and e.code == TwirpErrorCode.NOT_FOUND:
                 logger.warning(
                     "Participant %s not found in room %s, skipping muting",
                     identity,
@@ -95,8 +96,8 @@ class ParticipantsManagement:
             await lkapi.room.remove_participant(
                 RoomParticipantIdentity(room=room_name, identity=identity)
             )
-        except TwirpError as e:
-            if e.code == "not_found":
+        except (TwirpError, TimeoutError) as e:
+            if isinstance(e, TwirpError) and e.code == TwirpErrorCode.NOT_FOUND:
                 logger.warning(
                     "Participant %s not found in room %s, skipping removing",
                     identity,
@@ -140,8 +141,8 @@ class ParticipantsManagement:
                 )
             )
 
-        except TwirpError as e:
-            if e.code == "not_found":
+        except (TwirpError, TimeoutError) as e:
+            if isinstance(e, TwirpError) and e.code == TwirpErrorCode.NOT_FOUND:
                 logger.warning(
                     "Participant %s not found in room %s, skipping update",
                     identity,
@@ -203,8 +204,8 @@ class ParticipantsManagement:
                     identity=identity,
                 )
             )
-        except TwirpError as e:
-            if e.code == "not_found":
+        except (TwirpError, TimeoutError) as e:
+            if isinstance(e, TwirpError) and e.code == TwirpErrorCode.NOT_FOUND:
                 raise ParticipantNotFoundException("Participant does not exist") from e
 
             logger.exception(

src/backend/core/services/provisional_user_service.py

@@ -1,14 +1,10 @@
 """Service for provisional user creation."""
 
-import logging
-
 from django.conf import settings
 from django.core.exceptions import SuspiciousOperation, ValidationError
 from django.db import IntegrityError
 
-from core import models
-
-logger = logging.getLogger(__name__)
+from core import audit, auditing, models
 
 
 class ProvisionalUserError(Exception):
@@ -54,6 +50,21 @@ class ProvisionalUserService:
                 "Multiple user accounts share a common email."
             ) from e
 
+    def _audit(self, client_id: str, **fields) -> None:
+        """Emit a ``user.provision`` event on behalf of the application.
+
+        The user is identified by its id since it has no `sub` yet, therefore
+        the user id is what correlate this event to the ones of its later sign-ins.
+        """
+        audit.log(
+            auditing.USER_PROVISION,
+            actor=None,
+            actor_type=audit.ActorType.APPLICATION,
+            auth_method="client_credentials",
+            client_id=client_id,
+            **fields,
+        )
+
     def get_or_create(
         self, email: str, client_id: str
     ) -> tuple[models.User | None, bool]:
@@ -86,21 +97,16 @@ class ProvisionalUserService:
             user = models.User(sub=None, email=email)
             user.set_unusable_password()
             user.save()
-            logger.info(
-                "Provisional user created via application: user_id=%s, email=%s, client_id=%s",
-                user.id,
-                email,
-                client_id,
-            )
-            return user, True
         except (IntegrityError, ValidationError) as e:
-            logger.warning(
-                "Race condition on provisional user creation, fetching existing: "
-                "email=%s, client_id=%s",
-                email,
-                client_id,
-            )
+            # Race condition on provisional user creation
             user = self._get_by_email(email)
+            self._audit(
+                client_id,
+                outcome=audit.Outcome.FAILURE,
+                reason=audit.Reason.CONFLICT,
+                target=user,
+                error_type=audit.exception_type(e),
+            )
 
             if user:
                 return user, False
@@ -108,3 +114,6 @@ class ProvisionalUserService:
             raise ProvisionalUserIntegrityError(
                 "Failed to create or retrieve provisional user."
             ) from e
+
+        self._audit(client_id, target=user)
+        return user, True

src/backend/core/services/room_management.py

@@ -2,19 +2,26 @@
 
 # pylint: disable=no-name-in-module
 
+import contextlib
 import json
 from logging import getLogger
 from typing import Dict, Optional
 
+from django.conf import settings
+
 from asgiref.sync import async_to_sync
 from livekit.api import (
     DeleteRoomRequest,
     ListRoomsRequest,
     TwirpError,
+    TwirpErrorCode,
     UpdateRoomMetadataRequest,
 )
 
 from core import utils
+from core.models import Room
+
+from .sip_management import SIPException, SIPManagement
 
 logger = getLogger(__name__)
 
@@ -74,8 +81,8 @@ class RoomManagement:
                 )
             )
 
-        except TwirpError as e:
-            if e.code == "not_found":
+        except (TwirpError, TimeoutError) as e:
+            if isinstance(e, TwirpError) and e.code == TwirpErrorCode.NOT_FOUND:
                 raise RoomNotFoundException("Room does not exist") from e
 
             logger.exception(
@@ -102,8 +109,8 @@ class RoomManagement:
         try:
             await lkapi.room.delete_room(DeleteRoomRequest(room=room_name))
             logger.info("Deleted LiveKit room %s", room_name)
-        except TwirpError as e:
-            if e.code == "not_found":
+        except (TwirpError, TimeoutError) as e:
+            if isinstance(e, TwirpError) and e.code == TwirpErrorCode.NOT_FOUND:
                 logger.warning(
                     "Room %s not found in LiveKit, skipping deletion",
                     room_name,
@@ -115,6 +122,54 @@ class RoomManagement:
         finally:
             await lkapi.aclose()
 
+    @classmethod
+    def soft_delete(cls, room: Room):
+        """Soft delete a room, remove its SIP routing and close its LiveKit room."""
+
+        room.soft_delete()
+        rule_deleted = False
+
+        try:
+            rule_deleted = cls._delete_dispatch_rule(room)
+
+            with contextlib.suppress(RoomNotFoundException):
+                cls.delete_room(str(room.id))
+        except Exception:
+            Room.all_objects.filter(pk=room.pk, deleted_at=room.deleted_at).update(
+                deleted_at=None
+            )
+            room.deleted_at = None
+            if rule_deleted:
+                cls._restore_dispatch_rule(room)
+            raise
+
+    @staticmethod
+    def _delete_dispatch_rule(room: Room):
+        """Delete a room's SIP dispatch rule, so its PIN no longer routes calls.
+
+        This cannot be left to the room_finished webhook: a roomkit join creates
+        the rule before any LiveKit room exists, so no room may ever finish.
+
+        Returns whether a rule was deleted
+        """
+
+        if not (settings.ROOM_TELEPHONY_ENABLED or settings.ROOMKIT_ENABLED):
+            return False
+
+        try:
+            return SIPManagement().delete_dispatch_rule(room.id)
+        except SIPException as e:
+            raise RoomManagementException("Could not delete dispatch rule") from e
+
+    @staticmethod
+    def _restore_dispatch_rule(room: Room):
+        """Recreate a room's SIP dispatch rule after a failed soft delete."""
+
+        try:
+            SIPManagement().ensure_dispatch_rule(room)
+        except Exception:  # pylint: disable=broad-exception-caught
+            logger.exception("Could not restore dispatch rule for room %s", room.id)
+
     @classmethod
     def sync_room_metadata(cls, room):
         """Push a room's configuration and access level to its LiveKit room metadata.

src/backend/core/services/sip_management.py

@@ -54,8 +54,8 @@ class SIPManagement:
 
         try:
             await lkapi.sip.create_sip_dispatch_rule(create=request)
-        except TwirpError as e:
-            if e.code == TwirpErrorCode.ALREADY_EXISTS:
+        except (TwirpError, TimeoutError) as e:
+            if isinstance(e, TwirpError) and e.code == TwirpErrorCode.ALREADY_EXISTS:
                 raise DispatchRuleConflictError("Dispatch rule already exists") from e
             logger.exception(
                 "Unexpected error creating dispatch rule for room %s", room.id
@@ -83,7 +83,7 @@ class SIPManagement:
             existing_rules = await lkapi.sip.list_sip_dispatch_rule(
                 list=ListSIPDispatchRuleRequest()
             )
-        except TwirpError as e:
+        except (TwirpError, TimeoutError) as e:
             logger.exception("Failed to list dispatch rules for room %s", room_id)
             raise SIPException("Could not list dispatch rules") from e
         finally:
@@ -124,7 +124,11 @@ class SIPManagement:
 
     @async_to_sync
     async def delete_dispatch_rule(self, room_id):
-        """Delete all SIP inbound dispatch rules associated with a specific room."""
+        """Delete all SIP inbound dispatch rules associated with a specific room.
+
+        A rule deleted meanwhile (e.g. by both a room deletion and its
+        room_finished webhook) is not an error.
+        """
 
         rules_ids = await self._list_dispatch_rules_ids(room_id)
 
@@ -138,13 +142,20 @@ class SIPManagement:
         lkapi = utils.create_livekit_client()
         try:
             for rule_id in rules_ids:
-                await lkapi.sip.delete_sip_dispatch_rule(
-                    delete=DeleteSIPDispatchRuleRequest(sip_dispatch_rule_id=rule_id)
-                )
+                try:
+                    await lkapi.sip.delete_sip_dispatch_rule(
+                        delete=DeleteSIPDispatchRuleRequest(
+                            sip_dispatch_rule_id=rule_id
+                        )
+                    )
+                except TwirpError as e:
+                    if e.code != TwirpErrorCode.NOT_FOUND:
+                        raise
+                    logger.info("Dispatch rule %s was already deleted", rule_id)
 
             return True
 
-        except TwirpError as e:
+        except (TwirpError, TimeoutError) as e:
             logger.exception("Failed to delete dispatch rules for room %s", room_id)
             raise SIPException("Could not delete dispatch rules") from e
 

src/backend/core/services/transit_code.py

@@ -18,14 +18,21 @@ class TransitCodeService:
     """Create and consume single-use transit codes."""
 
     @staticmethod
-    def _cache_key(code):
+    def digest(code):
+        """Return the SHA-256 hex digest of a code.
+
+        It identifies a code, in the cache and in audit events
+        """
+        return hashlib.sha256(code.encode("utf-8")).hexdigest()
+
+    @classmethod
+    def _cache_key(cls, code):
         """Build the cache key for a code.
 
         The code is hashed so that a dump of the cache never reveals
         directly usable codes.
         """
-        digest = hashlib.sha256(code.encode("utf-8")).hexdigest()
-        return f"{settings.TRANSIT_CODE_CACHE_PREFIX}:{digest}"
+        return f"{settings.TRANSIT_CODE_CACHE_PREFIX}:{cls.digest(code)}"
 
     def create_code(self, user, client_id):
         """Generate a transit code for a user, and store it.

src/backend/core/tasks/__init__.py

@@ -2,8 +2,10 @@
 
 from core.tasks.connection_test import delete_connection_test_room
 from core.tasks.file import process_file_deletion
+from core.tasks.mail import send_email
 
 __all__ = (
     "delete_connection_test_room",
     "process_file_deletion",
+    "send_email",
 )

src/backend/core/tasks/mail.py

@@ -0,0 +1,74 @@
+"""Send mail using celery task."""
+
+import logging
+import smtplib
+
+from django.conf import settings
+from django.core.mail import send_mail
+from django.template.loader import render_to_string
+from django.utils.translation import get_language, gettext, override
+
+from core.tasks._task import task
+
+logger = logging.getLogger(__name__)
+
+
+def get_base_email_context() -> dict:
+    """Context shared by every email template (branding, support, domain)."""
+    return {
+        "brandname": settings.EMAIL_BRAND_NAME,
+        "support_email": settings.EMAIL_SUPPORT_EMAIL,
+        "logo_img": settings.EMAIL_LOGO_IMG,
+        "domain": settings.EMAIL_DOMAIN,
+    }
+
+
+@task(
+    autoretry_for=(smtplib.SMTPException, ConnectionError, TimeoutError),
+    retry_backoff=True,
+    retry_backoff_max=600,
+    retry_jitter=True,
+    max_retries=5,
+)
+def send_email(
+    *,
+    template: str,
+    subject: str,
+    recipients: list[str],
+    context: dict | None = None,
+    language: str | None = None,
+):
+    """Render a mail template and send it.
+
+    Generic on purpose: any feature can reuse it with its own template and context.
+
+    Args:
+        template: Template base name, e.g. "screen_recording". Both
+            "mail/html/<template>.html" and "mail/text/<template>.txt" must exist.
+        subject: Untranslated subject msgid. Mark it with ``gettext_noop`` at the
+            call site; it is translated here, in ``language``.
+        recipients: Email addresses, all receiving the same rendered message.
+        context: Template context. Must be JSON-serializable (str, int, list, dict…):
+            pre-format dates, cast UUIDs to str. Merged over the base branding context.
+        language: Language to render the email in. Defaults to the active language.
+
+    Raises:
+        OSError: SMTP or network failure, after retries are exhausted (or
+            immediately when Celery is disabled and the call runs synchronously).
+    """
+    full_context = {**get_base_email_context(), **(context or {})}
+
+    with override(language or get_language()):
+        msg_html = render_to_string(f"mail/html/{template}.html", full_context)
+        msg_plain = render_to_string(f"mail/text/{template}.txt", full_context)
+        translated_subject = gettext(subject)
+
+    send_mail(
+        translated_subject,
+        msg_plain,
+        settings.EMAIL_FROM,
+        recipients,
+        html_message=msg_html,
+        fail_silently=False,
+    )
+    logger.info("Email '%s' sent to %d recipient(s)", template, len(recipients))

src/backend/core/tests/analytics/test_base.py

@@ -0,0 +1,124 @@
+"""
+Unit tests for NoOpAnalytics and the analytics backend loader.
+"""
+
+# pylint: disable=redefined-outer-name,unused-argument
+
+import pytest
+
+from core.analytics import get_analytics
+from core.analytics.base import NoOpAnalytics
+from core.analytics.user_feature_flags import UserFeatureFlag
+from core.factories import UserFactory
+
+pytestmark = pytest.mark.django_db
+
+
+@pytest.fixture(autouse=True)
+def clear_analytics_cache():
+    """Clear the cached backend before and after each test."""
+    get_analytics.cache_clear()
+    yield
+    get_analytics.cache_clear()
+
+
+# ==============================
+# NoOpAnalytics
+# ==============================
+
+
+def test_noop_has_no_feature_flags_by_default():
+    """Should keep every feature flag disabled when none is declared."""
+    backend = NoOpAnalytics()
+    user = UserFactory()
+
+    assert not backend.get_user_feature_flags(user)
+    assert (
+        backend.is_user_feature_enabled(
+            user, UserFeatureFlag.TRANSCRIPT_SUMMARY_ENABLED
+        )
+        is False
+    )
+
+
+def test_noop_enables_declared_feature_flags():
+    """Should enable a feature flag declared as True."""
+    backend = NoOpAnalytics(feature_flags={"summary-enabled": True})
+    user = UserFactory()
+
+    assert backend.get_user_feature_flags(user) == {"summary-enabled": True}
+    assert (
+        backend.is_user_feature_enabled(
+            user, UserFeatureFlag.TRANSCRIPT_SUMMARY_ENABLED
+        )
+        is True
+    )
+
+
+@pytest.mark.parametrize("value", [False, None, "true"])
+def test_noop_only_enables_feature_flags_set_to_true(value):
+    """Should keep a feature flag disabled unless its value is exactly True."""
+    backend = NoOpAnalytics(feature_flags={"summary-enabled": value})
+    user = UserFactory()
+
+    assert (
+        backend.is_user_feature_enabled(
+            user, UserFeatureFlag.TRANSCRIPT_SUMMARY_ENABLED
+        )
+        is False
+    )
+
+
+def test_noop_ignores_unrelated_settings():
+    """Should accept settings meant for another backend without failing."""
+    backend = NoOpAnalytics(api_key="my-key", host="https://eu.i.posthog.com")
+
+    assert not backend.get_user_feature_flags(UserFactory())
+
+
+# ==============================
+# get_analytics
+# ==============================
+
+
+def test_get_analytics_defaults_to_noop_without_feature_flags(settings):
+    """Should return a no-op backend with no feature flag by default."""
+    settings.ANALYTICS_BACKEND = None
+    settings.ANALYTICS_BACKEND_SETTINGS = {}
+
+    backend = get_analytics()
+
+    assert isinstance(backend, NoOpAnalytics)
+    assert not backend.get_user_feature_flags(UserFactory())
+
+
+def test_get_analytics_passes_feature_flags_to_noop(settings):
+    """Should forward the feature flags when no backend is configured."""
+    settings.ANALYTICS_BACKEND = None
+    settings.ANALYTICS_BACKEND_SETTINGS = {"feature_flags": {"summary-enabled": True}}
+
+    backend = get_analytics()
+
+    assert isinstance(backend, NoOpAnalytics)
+    assert (
+        backend.is_user_feature_enabled(
+            UserFactory(), UserFeatureFlag.TRANSCRIPT_SUMMARY_ENABLED
+        )
+        is True
+    )
+
+
+def test_get_analytics_instantiates_configured_backend_with_settings(settings):
+    """Should instantiate the configured backend with its settings."""
+    settings.ANALYTICS_BACKEND = "core.analytics.base.NoOpAnalytics"
+    settings.ANALYTICS_BACKEND_SETTINGS = {"feature_flags": {"summary-enabled": True}}
+
+    backend = get_analytics()
+
+    assert isinstance(backend, NoOpAnalytics)
+    assert (
+        backend.is_user_feature_enabled(
+            UserFactory(), UserFeatureFlag.TRANSCRIPT_SUMMARY_ENABLED
+        )
+        is True
+    )

src/backend/core/tests/audit/__init__.py

@@ -0,0 +1 @@
+"""Tests for the audit logging facility."""

src/backend/core/tests/audit/test_admin.py

@@ -0,0 +1,447 @@
+"""Tests for the audit of writes made through the Django admin."""
+
+import json
+from unittest import mock
+
+from django.test import override_settings
+
+import pytest
+
+from core import models
+from core.audit.testing import find_events
+from core.factories import (
+    FileFactory,
+    RecordingFactory,
+    RoomFactory,
+    UserFactory,
+    UserResourceAccessFactory,
+)
+
+pytestmark = pytest.mark.django_db
+
+# Admin pages render static files: serve them without a manifest.
+plain_storages = override_settings(
+    STORAGES={
+        "default": {"BACKEND": "django.core.files.storage.FileSystemStorage"},
+        "staticfiles": {
+            "BACKEND": "django.contrib.staticfiles.storage.StaticFilesStorage"
+        },
+    }
+)
+
+
+@pytest.fixture(name="staff_client")
+def staff_client_fixture(client):
+    """A client signed in as a superuser, able to reach every admin page."""
+    client.force_login(UserFactory(is_staff=True, is_superuser=True))
+    return client
+
+
+def room_payload(room=None, accesses=0, **overrides):
+    """Return what the room change form expects, inline management included."""
+    payload = {
+        "name": room.name if room else "Weekly sync",
+        "slug": room.slug if room else "weekly-sync",
+        "access_level": room.access_level if room else models.RoomAccessLevel.PUBLIC,
+        "configuration": "{}",
+        # ``configuration`` has a callable default, so the form renders a hidden
+        # ``initial-`` input. Without it the field always looks changed.
+        "initial-configuration": "{}",
+        "pin_code": (room.pin_code if room else None) or "",
+        "accesses-TOTAL_FORMS": str(accesses),
+        "accesses-INITIAL_FORMS": "0",
+        "accesses-MIN_NUM_FORMS": "0",
+        "accesses-MAX_NUM_FORMS": "1000",
+    }
+    payload.update(overrides)
+    return payload
+
+
+def test_room_creation_is_audited(audit_events, staff_client):
+    """Adding a room through the admin records a creation on the room."""
+    response = staff_client.post("/admin/core/room/add/", room_payload())
+
+    assert response.status_code == 302
+
+    [event] = find_events(audit_events, "admin.room.create")
+
+    assert event["event"]["category"] == ["configuration"]
+    assert event["event"]["type"] == ["creation"]
+    assert event["event"]["outcome"] == "success"
+    assert event["entity"]["target"]["sub_type"] == "room"
+    assert event["entity"]["target"]["raw"]["slug"] == "weekly-sync"
+    assert event["lasuite"]["details"]["changes"]["name"] == {
+        "from": None,
+        "to": "Weekly sync",
+    }
+
+
+def test_room_change_records_field_names_and_allowed_values(audit_events, staff_client):
+    """A change reports the raw field names, and the values of allowed fields."""
+    room = RoomFactory(access_level=models.RoomAccessLevel.PUBLIC)
+
+    response = staff_client.post(
+        f"/admin/core/room/{room.pk}/change/",
+        room_payload(room, access_level=models.RoomAccessLevel.RESTRICTED),
+    )
+
+    assert response.status_code == 302
+
+    [event] = find_events(audit_events, "admin.room.update")
+
+    assert event["event"]["type"] == ["change"]
+    assert event["lasuite"]["details"]["changed_fields"] == ["access_level"]
+    assert event["lasuite"]["details"]["changes"] == {
+        "access_level": {"from": "public", "to": "restricted"}
+    }
+
+
+def test_room_configuration_change_records_both_versions(audit_events, staff_client):
+    """The configuration is allow-listed, and kept as JSON rather than stringified."""
+    room = RoomFactory(configuration={"a": 1})
+
+    response = staff_client.post(
+        f"/admin/core/room/{room.pk}/change/",
+        room_payload(
+            room,
+            configuration='{"a": 2, "b": "new"}',
+            **{"initial-configuration": '{"a": 1}'},
+        ),
+    )
+
+    assert response.status_code == 302
+
+    [event] = find_events(audit_events, "admin.room.update")
+
+    assert event["lasuite"]["details"]["changed_fields"] == ["configuration"]
+    assert event["lasuite"]["details"]["changes"]["configuration"] == {
+        "from": {"a": 1},
+        "to": {"a": 2, "b": "new"},
+    }
+
+
+def test_room_configuration_change_keeps_nulls_and_empty_objects(
+    audit_events, staff_client
+):
+    """A null or an empty object in the configuration is a value, recorded as is."""
+    room = RoomFactory(configuration={"a": None})
+
+    response = staff_client.post(
+        f"/admin/core/room/{room.pk}/change/",
+        room_payload(
+            room,
+            configuration='{"a": {}}',
+            **{"initial-configuration": '{"a": null}'},
+        ),
+    )
+
+    assert response.status_code == 302
+
+    [event] = find_events(audit_events, "admin.room.update")
+
+    assert event["lasuite"]["details"]["changes"] == {
+        "configuration": {"from": {"a": None}, "to": {"a": {}}}
+    }
+
+
+def test_room_deletion_is_audited(audit_events, staff_client):
+    """Deleting a room from its own page records a deletion."""
+    room = RoomFactory()
+
+    response = staff_client.post(f"/admin/core/room/{room.pk}/delete/", {"post": "yes"})
+
+    assert response.status_code == 302
+
+    [event] = find_events(audit_events, "admin.room.delete")
+
+    assert event["event"]["type"] == ["deletion"]
+    assert event["entity"]["target"]["id"] == str(room.pk)
+
+
+def test_inline_access_grant_emits_its_own_iam_event(audit_events, staff_client):
+    """A role granted through the inline is an IAM event of its own."""
+    room = RoomFactory()
+    user = UserFactory()
+
+    response = staff_client.post(
+        f"/admin/core/room/{room.pk}/change/",
+        room_payload(
+            room,
+            accesses=1,
+            **{
+                "accesses-0-user": str(user.pk),
+                "accesses-0-role": models.RoleChoices.OWNER,
+                "accesses-0-id": "",
+                "accesses-0-resource": str(room.pk),
+            },
+        ),
+    )
+
+    assert response.status_code == 302
+
+    [room_event] = find_events(audit_events, "admin.room.update")
+    [access_event] = find_events(audit_events, "admin.resourceaccess.create")
+
+    assert access_event["event"]["category"] == ["iam"]
+    assert access_event["event"]["type"] == ["creation"]
+    assert access_event["entity"]["target"]["raw"]["role"] == "owner"
+    assert access_event["lasuite"]["details"]["changes"]["role"] == {
+        "from": None,
+        "to": "owner",
+    }
+    # The account granted the role is the target user
+    assert access_event["user"]["target"]["id"] == str(user.pk)
+    # The grant and the room change belong to the same request.
+    assert access_event["http"]["request"]["id"] == room_event["http"]["request"]["id"]
+
+
+def test_inline_access_removal_identifies_the_removed_access(
+    audit_events, staff_client
+):
+    """An access removed through the inline is identified by its primary key."""
+    room = RoomFactory()
+    owner = UserResourceAccessFactory(resource=room, role=models.RoleChoices.OWNER)
+    member = UserResourceAccessFactory(resource=room, role=models.RoleChoices.MEMBER)
+    inline = {"accesses-INITIAL_FORMS": "2"}
+    for index, access in enumerate((owner, member)):
+        inline.update(
+            {
+                f"accesses-{index}-id": str(access.pk),
+                f"accesses-{index}-resource": str(room.pk),
+                f"accesses-{index}-user": str(access.user.pk),
+                f"accesses-{index}-role": access.role,
+            }
+        )
+    inline["accesses-1-DELETE"] = "on"
+
+    response = staff_client.post(
+        f"/admin/core/room/{room.pk}/change/",
+        room_payload(room, accesses=2, **inline),
+    )
+
+    assert response.status_code == 302
+    assert not models.ResourceAccess.objects.filter(pk=member.pk).exists()
+
+    [event] = find_events(audit_events, "admin.resourceaccess.delete")
+
+    assert event["event"]["type"] == ["deletion"]
+    assert event["entity"]["target"]["id"] == str(member.pk)
+
+
+def test_user_change_targets_the_user_and_never_leaks_the_password(
+    audit_events, staff_client
+):
+    """Promoting a user is an IAM event naming the account, never its secret."""
+    user = UserFactory(email="promoted@example.com", is_staff=False)
+
+    response = staff_client.post(
+        f"/admin/core/user/{user.pk}/password/",
+        {
+            "usable_password": "true",
+            "password1": "sup3r-s3cret-value",
+            "password2": "sup3r-s3cret-value",
+        },
+    )
+
+    assert response.status_code == 302
+
+    [event] = find_events(audit_events, "admin.user.update")
+
+    assert event["event"]["category"] == ["iam"]
+    assert event["event"]["type"] == ["user", "change"]
+    assert event["user"]["target"] == {"id": str(user.pk), "domain": "example.com"}
+    assert event["entity"]["target"]["raw"] == {"sub": user.sub}
+    assert event["lasuite"]["details"]["changed_fields"] == ["password"]
+    assert "changes" not in event["lasuite"]["details"]
+    assert "sup3r-s3cret-value" not in json.dumps(event)
+
+
+def test_user_permission_change_records_the_flag_values(audit_events, staff_client):
+    """Staff and superuser flags are allow-listed, so their values are kept."""
+    user = UserFactory(is_staff=False, is_superuser=False)
+
+    response = staff_client.post(
+        f"/admin/core/user/{user.pk}/change/",
+        {
+            "admin_email": "",
+            "language": user.language,
+            "timezone": str(user.timezone),
+            "is_active": "on",
+            "is_staff": "on",
+            "files_created-TOTAL_FORMS": "0",
+            "files_created-INITIAL_FORMS": "0",
+            "files_created-MIN_NUM_FORMS": "0",
+            "files_created-MAX_NUM_FORMS": "1000",
+        },
+    )
+
+    assert response.status_code == 302
+
+    [event] = find_events(audit_events, "admin.user.update")
+
+    assert event["lasuite"]["details"]["changes"]["is_staff"] == {
+        "from": False,
+        "to": True,
+    }
+    assert event["user"]["target"]["id"] == str(user.pk)
+
+
+def test_bulk_delete_audits_each_object_but_not_the_action(audit_events, staff_client):
+    """``delete_selected`` reports its objects, and nothing about itself."""
+    recordings = RecordingFactory.create_batch(2)
+
+    response = staff_client.post(
+        "/admin/core/recording/",
+        {
+            "action": "delete_selected",
+            "_selected_action": [str(recording.pk) for recording in recordings],
+            "post": "yes",
+        },
+    )
+
+    assert response.status_code == 302
+
+    events = find_events(audit_events, "admin.recording.delete")
+
+    assert {event["entity"]["target"]["id"] for event in events} == {
+        str(recording.pk) for recording in recordings
+    }
+    assert find_events(audit_events, "admin.recording.action") == []
+
+
+def test_custom_action_is_audited(audit_events, staff_client):
+    """A custom admin action reports its name and how many objects it ran on."""
+    recordings = RecordingFactory.create_batch(2)
+
+    response = staff_client.post(
+        "/admin/core/recording/",
+        {
+            "action": "mark_as_failed_to_stop",
+            "_selected_action": [str(recording.pk) for recording in recordings],
+        },
+    )
+
+    assert response.status_code == 302
+
+    [event] = find_events(audit_events, "admin.recording.action")
+
+    assert event["event"]["outcome"] == "success"
+    assert event["lasuite"]["details"] == {
+        "admin_action": "mark_as_failed_to_stop",
+        "count": 2,
+    }
+
+
+def test_hard_deleted_file_is_audited_once(audit_events, staff_client):
+    """``FileAdmin`` hard deletes without going through ``Model.delete``."""
+    file = FileFactory()
+
+    response = staff_client.post(f"/admin/core/file/{file.pk}/delete/", {"post": "yes"})
+
+    assert response.status_code == 302
+
+    [event] = find_events(audit_events, "admin.file.delete")
+
+    assert event["entity"]["target"]["id"] == str(file.pk)
+
+
+def test_failed_deletion_is_audited_as_a_failure(audit_events, staff_client):
+    """A deletion that raises is recorded as failed, never as done."""
+    file = FileFactory()
+
+    with (
+        mock.patch("core.admin.hard_delete_file", side_effect=RuntimeError("S3 down")),
+        pytest.raises(RuntimeError),
+    ):
+        staff_client.post(f"/admin/core/file/{file.pk}/delete/", {"post": "yes"})
+
+    [event] = find_events(audit_events, "admin.file.delete")
+
+    assert event["event"]["type"] == ["deletion"]
+    assert event["event"]["reason"] == "internal_error"
+    assert event["lasuite"]["outcome"] == "failure"
+    assert event["entity"]["target"]["id"] == str(file.pk)
+    assert event["error"] == {"message": "S3 down"}
+    assert event["log"]["level"] == "error"
+
+
+def test_failed_bulk_deletion_is_audited_as_a_failure(audit_events, staff_client):
+    """A bulk deletion that raises reports every selected object as failed."""
+    files = FileFactory.create_batch(2)
+
+    with (
+        mock.patch("core.admin.hard_delete_file", side_effect=RuntimeError("S3 down")),
+        pytest.raises(RuntimeError),
+    ):
+        staff_client.post(
+            "/admin/core/file/",
+            {
+                "action": "delete_selected",
+                "_selected_action": [str(file.pk) for file in files],
+                "post": "yes",
+            },
+        )
+
+    events = find_events(audit_events, "admin.file.delete")
+
+    assert {event["entity"]["target"]["id"] for event in events} == {
+        str(file.pk) for file in files
+    }
+    assert {event["lasuite"]["outcome"] for event in events} == {"failure"}
+
+
+@plain_storages
+def test_reading_the_admin_emits_nothing(audit_events, staff_client):
+    """Browsing is not audited: only writes are."""
+    room = RoomFactory()
+    UserResourceAccessFactory(resource=room, user=UserFactory())
+
+    assert staff_client.get("/admin/").status_code == 200
+    assert staff_client.get("/admin/core/room/").status_code == 200
+    assert staff_client.get(f"/admin/core/room/{room.pk}/change/").status_code == 200
+    assert staff_client.get(f"/admin/core/room/{room.pk}/history/").status_code == 200
+
+    assert [
+        event["event"]["action"]
+        for event in audit_events
+        if event["event"]["action"].startswith("admin.")
+    ] == []
+
+
+def test_non_staff_user_reaching_the_admin_is_recorded(audit_events, client):
+    """A signed-in account without staff access trying the admin is a denial."""
+    client.force_login(UserFactory(is_staff=False))
+
+    response = client.get("/admin/core/room/")
+
+    assert response.status_code == 302
+
+    [event] = find_events(audit_events, "admin.access")
+
+    assert event["event"]["category"] == ["web"]
+    assert event["event"]["type"] == ["access"]
+    assert event["event"]["outcome"] == "failure"
+    assert event["event"]["reason"] == "permission_denied"
+    assert event["lasuite"]["outcome"] == "denied"
+    assert event["lasuite"]["auth"] == {"method": "session"}
+    assert event["http"]["response"] == {"status_code": 302}
+    assert event["log"]["level"] == "warning"
+
+
+@plain_storages
+def test_non_staff_user_is_recorded_once_per_refused_view(audit_events, client):
+    """Landing on the login page after the refusal records nothing more."""
+    client.force_login(UserFactory(is_staff=False))
+
+    response = client.get("/admin/", follow=True)
+
+    assert response.redirect_chain[-1][0].startswith("/admin/login/")
+    assert response.status_code == 200
+    assert len(find_events(audit_events, "admin.access")) == 1
+
+
+def test_anonymous_visitor_is_not_recorded(audit_events, client):
+    """An anonymous hit is a redirect to the login page, not a denial worth keeping."""
+    assert client.get("/admin/").status_code == 302
+
+    assert find_events(audit_events, "admin.access") == []

src/backend/core/tests/audit/test_drf.py

@@ -0,0 +1,385 @@
+"""Tests for the audit of DRF views through ``AuditViewMixin``."""
+
+# pylint: disable=missing-function-docstring,unused-argument
+
+from unittest import mock
+
+from django.core.exceptions import PermissionDenied as DjangoPermissionDenied
+
+import pytest
+from rest_framework import (
+    decorators,
+    exceptions,
+    mixins,
+    permissions,
+    routers,
+    viewsets,
+)
+from rest_framework.response import Response
+from rest_framework.test import APIRequestFactory
+
+from core import audit, models
+from core.audit.testing import find_events
+from core.authentication.backends import SessionAuthenticationWith401
+from core.factories import RoomFactory, UserFactory
+
+pytestmark = pytest.mark.django_db
+
+
+class ThingViewSet(audit.AuditViewMixin, viewsets.ViewSet):
+    """A viewset auditing ``list`` and ``create`` but not ``destroy``."""
+
+    authentication_classes = [SessionAuthenticationWith401]
+    permission_classes = []
+    audit_actions = {"list": "thing.list", "create": "thing.create"}
+    error = None
+
+    def list(self, request):
+        if self.error is not None:
+            raise self.error
+        self.audit_details = {"total": 3}
+        return Response([])
+
+    def create(self, request):
+        return Response({"error": "Already exists."}, status=409)
+
+    def destroy(self, request, pk=None):
+        return Response(status=204)
+
+
+class RoomViewSet(
+    audit.AuditViewMixin, mixins.RetrieveModelMixin, viewsets.GenericViewSet
+):
+    """A viewset whose target comes from ``get_object``."""
+
+    authentication_classes = []
+    permission_classes = []
+    queryset = models.Room.objects.all()
+    audit_actions = {"retrieve": "room.retrieve"}
+
+    def get_serializer(self, *args, **kwargs):
+        return type("Serializer", (), {"data": {}})()
+
+
+GRANT = audit.Action(
+    "thing.grant",
+    category=audit.EventCategory.IAM,
+    types=(audit.EventType.CREATION,),
+)
+
+
+class GrantViewSet(audit.AuditViewMixin, viewsets.ViewSet):
+    """A viewset whose extra action declares its audit on the route."""
+
+    authentication_classes = [SessionAuthenticationWith401]
+    permission_classes = []
+    error = None
+
+    @decorators.action(detail=False, methods=["post"], audit_action=GRANT)
+    def grant(self, request):
+        if self.error is not None:
+            raise self.error
+        return Response({})
+
+    @decorators.action(detail=False, methods=["post"])
+    def ping(self, request):
+        return Response({})
+
+
+class ListingViewSet(ThingViewSet):
+    """A ``ThingViewSet`` keeping the details it was built with."""
+
+    def list(self, request):
+        return Response([])
+
+
+class DenyObjects(permissions.BasePermission):
+    """Refuse every object, whatever the request."""
+
+    def has_object_permission(self, request, view, obj):
+        return False
+
+
+def test_success_is_audited_with_the_view_details(audit_events):
+    """A successful action is recorded with its type and the view's details."""
+    view = ThingViewSet.as_view({"get": "list"})
+
+    response = view(APIRequestFactory().get("/things/", REMOTE_ADDR="1.2.3.4"))
+
+    assert response.status_code == 200
+
+    [event] = find_events(audit_events, "thing.list")
+
+    assert event["event"]["category"] == ["api"]
+    assert event["event"]["type"] == ["access"]
+    assert event["event"]["outcome"] == "success"
+    assert event["lasuite"]["details"] == {"total": 3}
+    assert event["client"] == {"ip": "1.2.3.4"}
+    assert event["url"] == {"path": "/things/"}
+    assert event["http"] == {
+        "request": {"method": "GET"},
+        "response": {"status_code": 200},
+    }
+
+
+def test_missing_credentials_are_audited_as_authentication_denial(audit_events):
+    """A 401 is a denial in the authentication category."""
+    view = ThingViewSet.as_view({"get": "list"}, error=exceptions.NotAuthenticated())
+
+    response = view(APIRequestFactory().get("/things/"))
+
+    assert response.status_code == 401
+
+    [event] = find_events(audit_events, "thing.list")
+
+    assert event["event"]["category"] == ["api", "authentication"]
+    assert event["event"]["type"] == ["access", "denied"]
+    assert event["event"]["reason"] == "authentication_failed"
+    assert event["lasuite"]["outcome"] == "denied"
+    assert event["lasuite"]["actor"] == {"type": "anonymous"}
+    assert event["http"]["response"] == {"status_code": 401}
+    assert event["error"]["message"] == "Authentication credentials were not provided."
+    assert event["log"]["level"] == "warning"
+    assert "details" not in event["lasuite"]
+
+
+@pytest.mark.parametrize(
+    "error,status_code,outcome,reason",
+    [
+        (
+            exceptions.AuthenticationFailed("bad"),
+            401,
+            "denied",
+            "authentication_failed",
+        ),
+        (exceptions.PermissionDenied("scope"), 403, "denied", "permission_denied"),
+        (DjangoPermissionDenied("nope"), 403, "denied", "permission_denied"),
+        (exceptions.Throttled(wait=10), 429, "denied", "rate_limited"),
+        (
+            exceptions.ValidationError({"name": ["x"]}),
+            400,
+            "failure",
+            "validation_error",
+        ),
+        (exceptions.NotFound(), 404, "failure", "not_found"),
+        (exceptions.MethodNotAllowed("PUT"), 405, "failure", None),
+    ],
+)
+def test_errors_are_audited_from_the_status_code(
+    audit_events, error, status_code, outcome, reason
+):
+    """The outcome and the reason are derived from the response status."""
+    view = ThingViewSet.as_view({"get": "list"}, error=error)
+
+    response = view(APIRequestFactory().get("/things/"))
+
+    assert response.status_code == status_code
+
+    [event] = find_events(audit_events, "thing.list")
+
+    assert event["lasuite"]["outcome"] == outcome
+    assert event["event"].get("reason") == reason
+    assert event["http"]["response"] == {"status_code": status_code}
+
+
+def test_error_message_of_a_view_response(audit_events):
+    """An error response built by the view reports its ``error`` message."""
+    view = ThingViewSet.as_view({"post": "create"})
+
+    response = view(APIRequestFactory().post("/things/"))
+
+    assert response.status_code == 409
+
+    [event] = find_events(audit_events, "thing.create")
+
+    assert event["event"]["type"] == ["creation"]
+    assert event["event"]["reason"] == "conflict"
+    assert event["lasuite"]["outcome"] == "failure"
+    assert event["error"] == {"message": "Already exists."}
+
+
+def test_actions_missing_from_the_map_are_not_audited(audit_events):
+    """Only the actions listed in ``audit_actions`` emit events."""
+    view = ThingViewSet.as_view({"delete": "destroy"})
+
+    response = view(APIRequestFactory().delete("/things/1/"), pk="1")
+
+    assert response.status_code == 204
+    assert audit_events == []
+
+
+def test_unhandled_exception_is_audited_as_internal_error(audit_events):
+    """An exception DRF does not handle is recorded, by class only, then raised."""
+    view = ThingViewSet.as_view(
+        {"get": "list"}, error=RuntimeError("user@example.com is broken")
+    )
+
+    with pytest.raises(RuntimeError):
+        view(APIRequestFactory().get("/things/"))
+
+    [event] = find_events(audit_events, "thing.list")
+
+    assert event["event"]["type"] == ["access"]
+    assert event["event"]["reason"] == "internal_error"
+    assert event["lasuite"]["outcome"] == "failure"
+    assert event["http"]["response"] == {"status_code": 500}
+    assert event["error"] == {"type": "builtins.RuntimeError"}
+    assert event["log"]["level"] == "error"
+    assert "user@example.com" not in str(event)
+
+
+def test_object_permission_denial_keeps_the_target(audit_events):
+    """A refusal on a detail route names the object that was refused."""
+    room = RoomFactory()
+    view = RoomViewSet.as_view({"get": "retrieve"}, permission_classes=[DenyObjects])
+
+    response = view(APIRequestFactory().get(f"/rooms/{room.pk}/"), pk=str(room.pk))
+
+    assert response.status_code == 403
+
+    [event] = find_events(audit_events, "room.retrieve")
+
+    assert event["lasuite"]["outcome"] == "denied"
+    assert event["entity"]["target"]["id"] == str(room.pk)
+
+
+def test_object_of_a_detail_route_is_the_target(audit_events):
+    """The object of a detail route becomes the target of the event."""
+    room = RoomFactory()
+    view = RoomViewSet.as_view({"get": "retrieve"})
+
+    response = view(APIRequestFactory().get(f"/rooms/{room.pk}/"), pk=str(room.pk))
+
+    assert response.status_code == 200
+
+    [event] = find_events(audit_events, "room.retrieve")
+
+    assert event["entity"]["target"]["id"] == str(room.pk)
+    assert event["entity"]["target"]["sub_type"] == "room"
+
+
+def test_extra_actions_cannot_be_mapped_by_method_name():
+    """Renaming a method must not silently stop auditing it."""
+    with pytest.raises(TypeError, match="grant"):
+
+        class MappedViewSet(audit.AuditViewMixin, viewsets.ViewSet):  # pylint: disable=unused-variable
+            """Maps an extra action in ``audit_actions``."""
+
+            audit_actions = {"list": "thing.list", "grant": "thing.grant"}
+
+
+def test_extra_action_is_audited_from_its_route(audit_events):
+    """The ``audit_action`` of a routed ``@action`` names the event."""
+    router = routers.SimpleRouter()
+    router.register("things", GrantViewSet, basename="thing")
+    [route] = [url for url in router.urls if url.name == "thing-grant"]
+
+    response = route.callback(APIRequestFactory().post("/things/grant/"))
+
+    assert response.status_code == 200
+
+    [event] = find_events(audit_events, GRANT)
+
+    assert event["event"]["category"] == ["iam"]
+    assert event["event"]["type"] == ["creation"]
+
+
+def test_extra_action_is_audited_without_a_router(audit_events):
+    """A view built by hand reads ``audit_action`` from its handler."""
+    view = GrantViewSet.as_view({"post": "grant"})
+
+    response = view(APIRequestFactory().post("/things/grant/"))
+
+    assert response.status_code == 200
+    assert len(find_events(audit_events, GRANT)) == 1
+
+
+def test_extra_action_without_audit_action_is_not_audited(audit_events):
+    """An ``@action`` that does not name an audit action emits nothing."""
+    view = GrantViewSet.as_view({"post": "ping"})
+
+    response = view(APIRequestFactory().post("/things/ping/"))
+
+    assert response.status_code == 200
+    assert audit_events == []
+
+
+def test_unauthenticated_extra_action_is_an_authentication_denial(audit_events):
+    """A 401 also files the event under ``authentication``, whatever the spec.
+
+    Neither category expects the ``denied`` type, so it is not added.
+    """
+    view = GrantViewSet.as_view({"post": "grant"}, error=exceptions.NotAuthenticated())
+
+    response = view(APIRequestFactory().post("/things/grant/"))
+
+    assert response.status_code == 401
+
+    [event] = find_events(audit_events, GRANT)
+
+    assert event["event"]["category"] == ["iam", "authentication"]
+    assert event["event"]["type"] == ["creation"]
+    assert event["event"]["outcome"] == "failure"
+    assert event["lasuite"]["outcome"] == "denied"
+
+
+@pytest.mark.parametrize("method", ["options", "get"])
+def test_requests_reaching_no_extra_action_are_not_audited(audit_events, method):
+    """An OPTIONS request, or a method the route refuses, audits nothing.
+
+    The router hands the route's ``audit_action`` to every view it builds, the
+    ones answering those requests included.
+    """
+    router = routers.SimpleRouter()
+    router.register("things", GrantViewSet, basename="thing")
+    [route] = [url for url in router.urls if url.name == "thing-grant"]
+
+    response = route.callback(getattr(APIRequestFactory(), method)("/things/grant/"))
+
+    assert response.status_code == (200 if method == "options" else 405)
+    assert audit_events == []
+
+
+def test_details_never_override_event_fields(audit_events):
+    """A detail named after an event field is dropped, never raising."""
+    view = ListingViewSet.as_view(
+        {"get": "list"},
+        audit_details={"request": None, "outcome": "failure", "total": 3},
+    )
+
+    response = view(APIRequestFactory().get("/things/"))
+
+    assert response.status_code == 200
+
+    [event] = find_events(audit_events, "thing.list")
+
+    assert event["event"]["outcome"] == "success"
+    assert event["url"] == {"path": "/things/"}
+    assert event["lasuite"]["details"] == {"total": 3}
+
+
+def test_assigned_user_target_is_reported(audit_events):
+    """The account an action is about can be assigned apart from its target."""
+    user = UserFactory(email="user@example.com")
+    view = ListingViewSet.as_view({"get": "list"}, audit_user_target=user)
+
+    response = view(APIRequestFactory().get("/things/"))
+
+    assert response.status_code == 200
+
+    [event] = find_events(audit_events, "thing.list")
+
+    assert event["user"] == {"target": {"id": str(user.pk), "domain": "example.com"}}
+
+
+def test_failing_audit_never_fails_the_response(audit_events):
+    """An error assembling the event is logged, and the response is kept."""
+    view = ThingViewSet.as_view({"get": "list"})
+
+    with mock.patch.object(
+        ThingViewSet, "get_audit_fields", side_effect=RuntimeError("boom")
+    ):
+        response = view(APIRequestFactory().get("/things/"))
+
+    assert response.status_code == 200
+    assert audit_events == []

src/backend/core/tests/audit/test_ecs.py

@@ -0,0 +1,171 @@
+"""Tests holding audit events to the Elastic Common Schema 9.5.0."""
+
+from collections.abc import Iterator, Mapping
+from typing import Any
+
+from django.apps import apps
+from django.test import RequestFactory
+
+import pytest
+
+from core import audit, auditing
+from core.audit import ecs
+from core.audit.admin import ADMIN_ACCESS_ACTION, AdminVerb, category_for, types_for
+from core.factories import ApplicationFactory, RoomFactory, UserFactory
+from core.recording.event.authentication import MachineUser
+
+pytestmark = pytest.mark.django_db
+
+# The ECS 9.5.0 fields audit events may carry, from
+# https://github.com/elastic/ecs/blob/v9.5.0/generated/ecs/ecs_flat.yml
+ECS_FIELDS = frozenset(
+    {
+        "@timestamp",
+        "client.ip",
+        "data_stream.dataset",
+        "data_stream.namespace",
+        "data_stream.type",
+        "ecs.version",
+        "entity.target.id",
+        "entity.target.name",
+        "entity.target.sub_type",
+        "entity.target.type",
+        "error.message",
+        "error.stack_trace",
+        "error.type",
+        "event.action",
+        "event.category",
+        "event.dataset",
+        "event.id",
+        "event.kind",
+        "event.outcome",
+        "event.reason",
+        "event.type",
+        "http.request.id",
+        "http.request.method",
+        "http.response.status_code",
+        "log.level",
+        "log.logger",
+        "message",
+        "organization.id",
+        "service.environment",
+        "service.name",
+        "service.node.name",
+        "service.origin.name",
+        "service.target.name",
+        "service.version",
+        "source.ip",
+        "url.path",
+        "user.domain",
+        "user.id",
+        "user.roles",
+        "user.target.domain",
+        "user.target.id",
+        "user_agent.original",
+    }
+)
+# What is not ECS lives in these namespaces: ``raw`` holds a target's own fields
+CUSTOM_NAMESPACES = ("lasuite.", "entity.target.raw.")
+
+
+def leaf_paths(document: Mapping[str, Any], prefix: str = "") -> Iterator[str]:
+    """Yield the dotted path of every value of a document."""
+    for key, value in document.items():
+        path = f"{prefix}{key}"
+        if isinstance(value, Mapping):
+            yield from leaf_paths(value, f"{path}.")
+        else:
+            yield path
+
+
+def declared_actions() -> list[audit.Action]:
+    """Return every action the project and the facility declare."""
+    actions = [
+        value for value in vars(auditing).values() if isinstance(value, audit.Action)
+    ]
+    return [*actions, audit.LOGIN_ACTION, audit.LOGOUT_ACTION, ADMIN_ACCESS_ACTION]
+
+
+def test_check_classification_accepts_expected_types():
+    """A type is valid when one of the categories expects it."""
+    ecs.check_classification([audit.EventCategory.IAM], [audit.EventType.USER])
+    ecs.check_classification(
+        [audit.EventCategory.API, audit.EventCategory.AUTHENTICATION],
+        [audit.EventType.CREATION, audit.EventType.DENIED],
+    )
+
+
+def test_check_classification_refuses_unexpected_types():
+    """ECS expects no ``denied`` for an authentication, nor ``end`` on the web."""
+    with pytest.raises(ValueError, match="denied"):
+        ecs.check_classification(
+            [audit.EventCategory.AUTHENTICATION], [audit.EventType.DENIED]
+        )
+    with pytest.raises(ValueError, match="end"):
+        ecs.check_classification([audit.EventCategory.WEB], [audit.EventType.END])
+
+
+def test_every_category_has_its_expected_types():
+    """The subset of categories the facility uses is fully transcribed."""
+    assert set(ecs.EXPECTED_EVENT_TYPES) == set(audit.EventCategory)
+
+
+@pytest.mark.parametrize("action", declared_actions(), ids=str)
+def test_declared_actions_are_classified_as_ecs_expects(action):
+    """Every action of the catalogue is classified as ECS expects.
+
+    ``Action`` refuses anything else when it is declared: this lists them.
+    """
+    ecs.check_classification([action.category or ecs.DEFAULT_CATEGORY], action.types)
+
+
+@pytest.mark.parametrize("verb", list(AdminVerb))
+def test_admin_writes_are_classified_as_ecs_expects(verb):
+    """Writes made through the admin are classified as ECS expects, for any model."""
+    for model in apps.get_models():
+        ecs.check_classification([category_for(model)], types_for(model, verb))
+
+
+def _documents(audit_events) -> list[dict[str, Any]]:
+    """Emit the events covering every field the facility fills."""
+    user = UserFactory(is_staff=True)
+    request = RequestFactory().post(
+        "/external-api/v1.0/rooms/",
+        REMOTE_ADDR="1.2.3.4",
+        HTTP_USER_AGENT="Mozilla/5.0",
+    )
+    request.user = user
+    request.auth = {"client_id": "app-1"}
+
+    audit.log(
+        auditing.ROOM_UPDATE,
+        request=request,
+        target=RoomFactory(),
+        status_code=500,
+        outcome=audit.Outcome.FAILURE,
+        reason=audit.Reason.INTERNAL_ERROR,
+        error="boom",
+        error_type="builtins.RuntimeError",
+        message="anything",
+        updated_fields=["name"],
+    )
+    audit.log(auditing.USER_PROVISION, target=user)
+    audit.log(auditing.APPLICATION_TOKEN_ISSUE, target=ApplicationFactory())
+    audit.log(
+        auditing.RECORDING_TRANSCRIPT_REQUEST,
+        actor=MachineUser("livekit"),
+        target_service="summary",
+    )
+    return audit_events
+
+
+def test_documents_only_carry_ecs_fields_or_custom_namespaces(audit_events):
+    """No field outside ECS 9.5.0 lands anywhere but in a custom namespace."""
+    for document in _documents(audit_events):
+        stray = {
+            path
+            for path in leaf_paths(document)
+            if path not in ECS_FIELDS and not path.startswith(CUSTOM_NAMESPACES)
+        }
+
+        assert not stray, f"{document['event']['action']}: {sorted(stray)}"

src/backend/core/tests/audit/test_emitter.py

@@ -0,0 +1,748 @@
+"""Tests for building and emitting audit events."""
+
+import json
+import logging
+import sys
+import uuid
+from datetime import datetime
+from unittest import mock
+
+from django.contrib.auth.models import AnonymousUser
+from django.test import RequestFactory
+
+import pytest
+from dockerflow.logging import request_id_context
+
+from core import audit
+from core.audit import emitter
+from core.audit import request as audit_request
+from core.audit.formatter import AuditJsonFormatter
+from core.audit.testing import find_events, override_registration
+from core.factories import ApplicationFactory, RoomFactory, UserFactory
+from core.models import Room
+from core.recording.event.authentication import MachineUser
+
+pytestmark = pytest.mark.django_db
+
+
+def test_audit_log_emits_ecs_document(audit_events):
+    """A minimal call produces a complete, pruned ECS document."""
+    with (
+        mock.patch.object(emitter, "service_version", return_value="1.2.3"),
+        mock.patch.object(emitter, "service_node_name", return_value="node-1"),
+    ):
+        audit.log("room.create", target={"sub_type": "room", "id": "1"}, extra="x")
+
+    assert len(audit_events) == 1
+
+    event = audit_events[0]
+    event_id = event["event"].pop("id")
+
+    assert uuid.UUID(event_id).version == 4
+    assert event["ecs"] == {"version": "9.5.0"}
+    assert event["data_stream"] == {
+        "type": "logs",
+        "dataset": "meet.audit",
+        "namespace": "default",
+    }
+    assert event["service"] == {
+        "name": "meet",
+        "environment": "test",
+        "version": "1.2.3",
+        "node": {"name": "node-1"},
+    }
+    assert event["event"] == {
+        "kind": "event",
+        "dataset": "meet.audit",
+        "action": "room.create",
+        "category": ["api"],
+        "type": ["info"],
+        "outcome": "success",
+    }
+    assert event["entity"] == {"target": {"sub_type": "room", "id": "1"}}
+    assert event["lasuite"] == {
+        "actor": {"type": "system"},
+        "auth": {"method": "none"},
+        "outcome": "success",
+        "details": {"extra": "x"},
+    }
+    assert event["log"]["level"] == "info"
+    assert "user" not in event
+    assert "organization" not in event
+
+
+def test_audit_log_identifies_each_event(audit_events):
+    """Every event has its own id, so a shipper retrying it cannot duplicate it."""
+    audit.log("something")
+    audit.log("something")
+
+    assert audit_events[0]["event"]["id"] != audit_events[1]["event"]["id"]
+
+
+@pytest.mark.parametrize(
+    "service_name,namespace,dataset",
+    [
+        ("meet", "default", "meet.audit"),
+        ("La-Suite-Meet", "production", "la_suite_meet.audit"),
+    ],
+)
+def test_audit_log_routes_to_its_data_stream(
+    audit_events, settings, service_name, namespace, dataset
+):
+    """The dataset follows the service name, minus what data stream names forbid."""
+    settings.AUDIT_LOG_SERVICE_NAME = service_name
+    settings.AUDIT_LOG_DATA_STREAM_NAMESPACE = namespace
+
+    audit.log("something")
+
+    event = audit_events[0]
+
+    assert event["data_stream"] == {
+        "type": "logs",
+        "dataset": dataset,
+        "namespace": namespace,
+    }
+    assert event["event"]["dataset"] == dataset
+
+
+def test_audit_log_timestamp_is_utc_with_explicit_offset(audit_events):
+    """Timestamps are ISO 8601, millisecond precision, UTC with offset."""
+    audit.log("something")
+
+    timestamp = audit_events[0]["@timestamp"]
+    parsed = datetime.fromisoformat(timestamp)
+
+    assert timestamp.endswith("+00:00")
+    assert parsed.utcoffset().total_seconds() == 0
+
+
+@pytest.mark.parametrize(
+    "outcome,reason,expected",
+    [
+        ("success", None, ("info", "success", ["info"])),
+        ("failure", "validation_error", ("warning", "failure", ["info"])),
+        ("denied", "permission_denied", ("warning", "failure", ["denied"])),
+        ("failure", "internal_error", ("error", "failure", ["info"])),
+        ("unknown", None, ("warning", "unknown", ["info"])),
+    ],
+)
+def test_audit_log_outcome_reason_and_level(audit_events, outcome, reason, expected):
+    """The level is derived from the outcome."""
+    level, wire_outcome, types = expected
+
+    audit.log("something", outcome=outcome, reason=reason)
+
+    event = audit_events[0]
+
+    assert event["event"]["outcome"] == wire_outcome
+    assert event["event"].get("reason") == reason
+    assert event["event"]["type"] == types
+    assert event["lasuite"]["outcome"] == outcome
+    assert event["log"]["level"] == level
+
+
+def test_audit_log_denied_adds_denied_type_to_explicit_types(audit_events):
+    """A denial carries the ``denied`` ECS type in a category expecting it."""
+    audit.log("something", outcome="denied", reason="rate_limited", types=["access"])
+
+    event = audit_events[0]
+
+    assert event["event"]["type"] == ["access", "denied"]
+
+
+def test_audit_log_denied_type_only_where_ecs_expects_it(audit_events):
+    """ECS expects no ``denied`` type for an authentication, so none is added."""
+    audit.log(
+        "user.login",
+        outcome="denied",
+        reason="authentication_failed",
+        category=audit.EventCategory.AUTHENTICATION,
+        types=[audit.EventType.START],
+    )
+
+    event = audit_events[0]
+
+    assert event["event"]["type"] == ["start"]
+    assert event["event"]["outcome"] == "failure"
+    assert event["lasuite"]["outcome"] == "denied"
+
+
+def test_audit_log_failure_type_is_error_where_ecs_expects_it(audit_events):
+    """A failure without types is an ``error`` in a category expecting one."""
+    audit.log("something", outcome="failure", category=audit.EventCategory.WEB)
+
+    assert audit_events[0]["event"]["type"] == ["error"]
+
+
+def test_audit_log_accepts_several_categories(audit_events):
+    """An event may be filed under several categories, each listed once."""
+    audit.log(
+        "room.create",
+        category=[
+            audit.EventCategory.API,
+            audit.EventCategory.AUTHENTICATION,
+            audit.EventCategory.API,
+        ],
+        types=[audit.EventType.CREATION],
+    )
+
+    assert audit_events[0]["event"]["category"] == ["api", "authentication"]
+
+
+def test_audit_log_reports_a_misclassified_event_and_still_emits_it(
+    audit_events, caplog
+):
+    """A classification ECS does not expect is an error, yet the event is kept."""
+    with caplog.at_level(logging.ERROR, logger="core.audit.emitter"):
+        audit.log(
+            "something",
+            category=audit.EventCategory.AUTHENTICATION,
+            types=[audit.EventType.CREATION],
+        )
+
+    assert audit_events[0]["event"]["type"] == ["creation"]
+    assert "misclassified" in caplog.text
+
+
+def test_audit_log_accepts_categories_and_types(audit_events):
+    """Category and types are validated against the ECS subset."""
+    audit.log(
+        "user.login",
+        category=audit.EventCategory.AUTHENTICATION,
+        types=[audit.EventType.START],
+    )
+
+    event = audit_events[0]
+
+    assert event["event"]["category"] == ["authentication"]
+    assert event["event"]["type"] == ["start"]
+
+
+def test_audit_log_classifies_an_action_by_its_spec(audit_events):
+    """An ``Action`` brings its category and types, and names the event."""
+    action = audit.Action(
+        "thing.grant",
+        category=audit.EventCategory.IAM,
+        types=(audit.EventType.CREATION,),
+    )
+
+    audit.log(action)
+
+    event = audit_events[0]
+
+    assert event["event"]["action"] == "thing.grant"
+    assert event["event"]["category"] == ["iam"]
+    assert event["event"]["type"] == ["creation"]
+
+
+def test_audit_log_arguments_win_over_the_spec(audit_events):
+    """A category or types given to ``log`` override those of the ``Action``."""
+    action = audit.Action(
+        "thing.grant",
+        category=audit.EventCategory.IAM,
+        types=(audit.EventType.CREATION,),
+    )
+
+    audit.log(
+        action,
+        category=audit.EventCategory.CONFIGURATION,
+        types=[audit.EventType.CHANGE],
+    )
+
+    event = audit_events[0]
+
+    assert event["event"]["category"] == ["configuration"]
+    assert event["event"]["type"] == ["change"]
+
+
+def test_action_spec_validates_its_classification():
+    """A category or type outside the ECS subset fails where it is declared."""
+    with pytest.raises(ValueError):
+        audit.Action("thing.grant", category="nonsense")
+    with pytest.raises(ValueError):
+        audit.Action("thing.grant", types=("nonsense",))
+
+
+def test_action_spec_validates_its_classification_against_ecs():
+    """A type the category does not expect in ECS fails where it is declared."""
+    with pytest.raises(ValueError, match="does not expect event type end"):
+        audit.Action(
+            "thing.grant",
+            category=audit.EventCategory.WEB,
+            types=(audit.EventType.END,),
+        )
+    with pytest.raises(ValueError, match="in category api"):
+        audit.Action("thing.grant", types=(audit.EventType.ERROR,))
+
+
+def test_audit_log_records_the_error_type(audit_events):
+    """The class of an error lands in ``error.type``, next to its message."""
+    audit.log(
+        "anything",
+        outcome="failure",
+        reason="internal_error",
+        error="boom",
+        error_type="builtins.RuntimeError",
+    )
+
+    assert audit_events[0]["error"] == {
+        "message": "boom",
+        "type": "builtins.RuntimeError",
+    }
+
+
+def test_audit_log_fails_open_on_invalid_input(audit_events, caplog):
+    """A bad call never raises: it is reported on the application logger."""
+    with caplog.at_level(logging.ERROR, logger="core.audit.emitter"):
+        audit.log("something", outcome="maybe")
+
+    assert audit_events == []
+    assert "could not be built" in caplog.text
+
+
+def test_audit_log_skips_a_target_field_that_cannot_be_read(audit_events, caplog):
+    """A broken registration costs the field, not the event."""
+    room = RoomFactory()
+
+    with (
+        override_registration(Room, fields=("no_such_field", "slug")),
+        caplog.at_level(logging.ERROR, logger="core.audit.targets"),
+    ):
+        audit.log("anything", target=room)
+
+    [event] = audit_events
+
+    assert event["entity"]["target"] == {
+        "id": str(room.pk),
+        "sub_type": "room",
+        "raw": {"slug": room.slug},
+    }
+    assert "no_such_field" in caplog.text
+
+
+def test_audit_log_describes_registered_targets(audit_events):
+    """Describe rooms with the fields registered in ``core.auditing``."""
+    room = RoomFactory(name="Daily standup")
+
+    audit.log("room.create", target=room)
+
+    assert audit_events[0]["entity"]["target"] == {
+        "id": str(room.pk),
+        "sub_type": "room",
+        "name": "Daily standup",
+        "raw": {"slug": room.slug, "access_level": room.access_level},
+    }
+    assert "user" not in audit_events[0]
+
+
+def test_audit_log_reports_a_user_target_as_user_target(audit_events):
+    """A user acted on is the ``user.target``, its sub only in ``entity.target``."""
+    user = UserFactory(email="jane@example.org")
+
+    audit.log("user.provision", target=user)
+
+    event = audit_events[0]
+
+    assert event["user"] == {"target": {"id": str(user.pk), "domain": "example.org"}}
+    assert event["entity"]["target"] == {
+        "id": str(user.pk),
+        "type": ["user"],
+        "sub_type": "user",
+        "raw": {"sub": user.sub},
+    }
+
+
+def test_audit_log_reports_the_registered_user_target(audit_events):
+    """An access names the user it grants a role to as the ``user.target``."""
+    room = RoomFactory(users=[(UserFactory(email="jane@example.org"), "member")])
+    access = room.accesses.get()
+
+    audit.log("thing.grant", target=access)
+
+    event = audit_events[0]
+
+    assert event["user"] == {
+        "target": {"id": str(access.user_id), "domain": "example.org"}
+    }
+    assert event["entity"]["target"]["sub_type"] == "resourceaccess"
+
+
+def test_audit_log_explicit_user_target_wins(audit_events):
+    """A user target given to ``log`` wins over the one of the target."""
+    room = RoomFactory(users=[(UserFactory(), "member")])
+    other = UserFactory(email="other@example.net")
+
+    audit.log("thing.grant", target=room.accesses.get(), user_target=other)
+
+    assert audit_events[0]["user"]["target"]["id"] == str(other.pk)
+
+
+def test_audit_log_registered_entity_type(audit_events):
+    """A model registered with an ECS entity type reports it."""
+    application = ApplicationFactory()
+
+    audit.log("thing.grant", target=application)
+
+    target = audit_events[0]["entity"]["target"]
+
+    assert target["type"] == ["application"]
+    assert target["sub_type"] == "application"
+    assert target["name"] == application.name
+
+
+def test_audit_log_normalises_details(audit_events):
+    """Nested details are rendered: enums, models as keys, lists, no ``None``."""
+    room = RoomFactory()
+
+    audit.log(
+        "something",
+        rooms=[room],
+        nested={"outcome": audit.Outcome.DENIED},
+        empty=None,
+    )
+
+    details = audit_events[0]["lasuite"]["details"]
+
+    assert details["rooms"] == [str(room.pk)]
+    assert details["nested"] == {"outcome": "denied"}
+    assert "empty" not in details
+
+
+def test_audit_log_reads_request_fields(audit_events):
+    """Should read the HTTP fields from the request, the request id from dockerflow."""
+    token = request_id_context.set("request-1")
+    request = RequestFactory().post(
+        "/external-api/v1.0/rooms/",
+        data="{}",
+        content_type="application/json",
+        REMOTE_ADDR="1.2.3.4",
+        HTTP_USER_AGENT="Mozilla/5.0 (X11; Linux x86_64)",
+    )
+
+    try:
+        audit.log("anything", request=request)
+    finally:
+        request_id_context.reset(token)
+
+    event = audit_events[0]
+
+    assert event["http"] == {"request": {"id": "request-1", "method": "POST"}}
+    assert event["url"] == {"path": "/external-api/v1.0/rooms/"}
+    assert event["client"] == {"ip": "1.2.3.4"}
+    assert event["user_agent"] == {"original": "Mozilla/5.0 (X11; Linux x86_64)"}
+    assert "trace" not in event
+
+
+def test_audit_log_truncates_the_user_agent(audit_events):
+    """A user agent is cut where ECS stops indexing it."""
+    request = RequestFactory().get("/", HTTP_USER_AGENT="x" * 5000)
+
+    audit.log("anything", request=request)
+
+    assert audit_events[0]["user_agent"]["original"] == "x" * 1024
+
+
+def test_audit_log_defaults_to_the_request_context(audit_events):
+    """Should read the request fields from the context of the request being served."""
+    request = RequestFactory().post("/rooms/", REMOTE_ADDR="1.2.3.4")
+    request.user = AnonymousUser()
+    token = audit_request.set_request_context(
+        audit_request.RequestContext.from_request(request)
+    )
+
+    try:
+        audit.log("anything")
+    finally:
+        audit_request.reset_request_context(token)
+
+    event = audit_events[0]
+
+    assert event["http"] == {"request": {"method": "POST"}}
+    assert event["url"] == {"path": "/rooms/"}
+    assert event["client"] == {"ip": "1.2.3.4"}
+    assert event["lasuite"]["actor"] == {"type": "anonymous"}
+
+
+def test_audit_log_explicit_request_wins_over_the_request_context(audit_events):
+    """Should prefer the request passed to the one being served."""
+    token = audit_request.set_request_context(
+        audit_request.RequestContext.from_request(RequestFactory().get("/current/"))
+    )
+
+    try:
+        audit.log("anything", request=RequestFactory().get("/explicit/"))
+    finally:
+        audit_request.reset_request_context(token)
+
+    assert audit_events[0]["url"] == {"path": "/explicit/"}
+
+
+def test_audit_log_reports_the_client_not_the_proxy(audit_events):
+    """Should report the forwarded client address, not the one of the proxy."""
+    request = RequestFactory().get(
+        "/", REMOTE_ADDR="1.2.3.4", HTTP_X_FORWARDED_FOR="5.6.7.8"
+    )
+    audit.log("something", request=request)
+
+    event = audit_events[0]
+
+    assert event["client"]["ip"] == "5.6.7.8"
+    assert event["source"] == {"ip": "5.6.7.8"}
+
+
+def test_audit_log_actor_user_is_id_sub_and_domain_only(audit_events):
+    """A human actor is identified without email or name."""
+    user = UserFactory(email="john.doe@example.com", full_name="John Doe")
+    request = RequestFactory().get("/")
+    request.user = user
+
+    audit.log("anything", request=request)
+
+    event = audit_events[0]
+
+    assert event["user"] == {"id": str(user.pk), "domain": "example.com"}
+    assert event["lasuite"]["actor"] == {"type": "user", "sub": user.sub}
+    assert event["lasuite"]["auth"] == {"method": "session"}
+    assert event["organization"] == {"id": "example.com"}
+    assert "John" not in json.dumps(event)
+    assert "john.doe" not in json.dumps(event)
+
+
+@pytest.mark.parametrize(
+    "flags,roles",
+    [
+        ({}, None),
+        ({"is_staff": True}, ["staff"]),
+        ({"is_staff": True, "is_superuser": True}, ["superuser", "staff"]),
+    ],
+)
+def test_audit_log_actor_roles(audit_events, flags, roles):
+    """The privileges of the actor at the time of the event are its roles."""
+    request = RequestFactory().get("/")
+    request.user = UserFactory(**flags)
+
+    audit.log("anything", request=request)
+
+    assert audit_events[0]["user"].get("roles") == roles
+
+
+def test_audit_log_anonymous_plain_request_has_no_auth_method(audit_events):
+    """A plain Django request without a signed-in user is not authenticated."""
+    request = RequestFactory().get("/")
+    request.user = AnonymousUser()
+
+    audit.log("anything", request=request)
+
+    assert audit_events[0]["lasuite"]["auth"] == {"method": "none"}
+
+
+def test_audit_log_actor_application_with_delegated_user(audit_events):
+    """A client id in the token payload makes the actor an application."""
+    user = UserFactory(email="user@example.com")
+    request = RequestFactory().get("/")
+    request.user = user
+    request.auth = {"client_id": "app-1", "delegated": True}
+
+    audit.log("something", request=request)
+
+    event = audit_events[0]
+
+    assert event["lasuite"]["actor"] == {"type": "application", "sub": user.sub}
+    assert event["lasuite"]["application"] == {"client_id": "app-1"}
+    assert event["user"] == {"id": str(user.pk), "domain": "example.com"}
+    assert event["organization"] == {"id": "app-1"}
+
+
+def test_audit_log_actor_service(audit_events):
+    """Machine users are services, named as the origin of the request."""
+    request = RequestFactory().get("/")
+    request.user = MachineUser("roomkit")
+
+    audit.log("something", request=request)
+
+    event = audit_events[0]
+
+    assert event["lasuite"]["actor"] == {"type": "service"}
+    assert event["service"]["origin"] == {"name": "roomkit"}
+    assert "user" not in event
+    assert "organization" not in event
+
+
+def test_audit_log_target_service(audit_events):
+    """A peer service the backend called is the target service."""
+    audit.log("something", target_service="summary")
+
+    event = audit_events[0]
+
+    assert event["service"]["target"] == {"name": "summary"}
+    assert "origin" not in event["service"]
+    assert "target_service" not in event.get("lasuite", {}).get("details", {})
+
+
+def test_audit_log_actor_deleted_user_is_not_a_service(audit_events):
+    """A deleted account has no primary key left, yet it is still a user.
+
+    A service is named by its username, which for an account is an email address.
+    """
+    user = UserFactory(email="john.doe@example.com", admin_email="admin@example.com")
+    user.delete()
+    request = RequestFactory().get("/")
+    request.user = user
+
+    audit.log("anything", request=request)
+
+    event = audit_events[0]
+
+    assert event["lasuite"]["actor"] == {"type": "user", "sub": user.sub}
+    assert event["user"] == {"domain": "example.com"}
+    assert "admin@example.com" not in json.dumps(event)
+
+
+def test_audit_log_explicit_overrides(audit_events):
+    """Actor, actor type, auth method and client id can be forced."""
+    user = UserFactory(email="user@example.com")
+
+    audit.log(
+        "something",
+        actor=user,
+        actor_type="system",
+        auth_method="oidc",
+        client_id="app-2",
+    )
+
+    event = audit_events[0]
+
+    assert event["lasuite"]["actor"] == {"type": "system", "sub": user.sub}
+    assert event["lasuite"]["auth"] == {"method": "oidc"}
+    assert event["lasuite"]["application"] == {"client_id": "app-2"}
+    assert event["user"]["id"] == str(user.pk)
+    assert event["organization"] == {"id": "app-2"}
+
+
+def test_audit_log_explicit_no_actor_ignores_the_signed_in_account(audit_events):
+    """``actor=None`` records no account, whoever the request is signed in as."""
+    request = RequestFactory().get("/")
+    request.user = UserFactory(email="user@example.com")
+
+    audit.log("something", request=request, actor=None)
+
+    event = audit_events[0]
+
+    assert event["lasuite"]["actor"] == {"type": "anonymous"}
+    assert "user" not in event
+    assert "organization" not in event
+    assert "example.com" not in json.dumps(event)
+
+
+def test_audit_log_explicit_actor_type_alone_keeps_the_signed_in_account(
+    audit_events,
+):
+    """Forcing the actor type does not discard the account of the request."""
+    user = UserFactory(email="user@example.com")
+    request = RequestFactory().get("/")
+    request.user = user
+
+    audit.log("something", request=request, actor_type="anonymous")
+
+    assert audit_events[0]["user"]["id"] == str(user.pk)
+
+
+def test_audit_log_application_without_an_account(audit_events):
+    """An application acting for nobody keeps its tenant but no user."""
+    request = RequestFactory().get("/")
+    request.user = UserFactory(email="user@example.com")
+
+    audit.log(
+        "something",
+        request=request,
+        actor=None,
+        actor_type="application",
+        client_id="app-1",
+    )
+
+    event = audit_events[0]
+
+    assert event["lasuite"]["actor"] == {"type": "application"}
+    assert event["lasuite"]["application"] == {"client_id": "app-1"}
+    assert "user" not in event
+    assert event["organization"] == {"id": "app-1"}
+
+
+def test_audit_log_status_code_error_and_message(audit_events):
+    """Response status, error message and free text have their ECS slots."""
+    audit.log(
+        "something",
+        outcome="denied",
+        reason="permission_denied",
+        status_code=403,
+        error="Insufficient permissions.",
+        message="scope missing",
+    )
+
+    event = audit_events[0]
+
+    assert event["http"] == {"response": {"status_code": 403}}
+    assert event["error"] == {"message": "Insufficient permissions."}
+    assert event["message"] == "scope missing"
+
+
+def test_audit_json_formatter_renders_one_line_of_json():
+    """The formatter emits compact, single-line, non-ASCII friendly JSON."""
+    record = logging.makeLogRecord(
+        {
+            "name": "audit",
+            "levelname": "INFO",
+            "msg": "anything",
+            "audit": {"event": {"action": "anything"}, "note": "multi\nline wörld"},
+        }
+    )
+
+    rendered = AuditJsonFormatter().format(record)
+
+    assert "\n" not in rendered
+    assert "wörld" in rendered
+    assert json.loads(rendered) == {
+        "event": {"action": "anything"},
+        "note": "multi\nline wörld",
+        "log": {"level": "info", "logger": "audit"},
+    }
+
+
+def test_audit_json_formatter_wraps_plain_records():
+    """A plain record on the audit logger still renders as JSON."""
+    record = logging.makeLogRecord(
+        {"name": "audit", "levelname": "WARNING", "msg": "log %s", "args": ("x",)}
+    )
+
+    rendered = json.loads(AuditJsonFormatter().format(record))
+
+    assert rendered["ecs"] == {"version": "9.5.0"}
+    assert rendered["data_stream"]["dataset"] == "meet.audit"
+    assert rendered["event"] == {"dataset": "meet.audit", "action": "log x"}
+    assert rendered["message"] == "log x"
+    assert rendered["@timestamp"].endswith("+00:00")
+
+
+def test_audit_json_formatter_adds_stack_trace():
+    """An attached traceback lands under ``error.stack_trace``."""
+    try:
+        raise ValueError("boom")
+    except ValueError:
+        record = logging.makeLogRecord(
+            {"name": "audit", "levelname": "ERROR", "msg": "x", "audit": {}}
+        )
+        record.exc_info = sys.exc_info()
+
+    rendered = json.loads(AuditJsonFormatter().format(record))
+
+    assert "ValueError: boom" in rendered["error"]["stack_trace"]
+
+
+def test_find_events_filters_by_action(audit_events):
+    """The test helper narrows captured events by action."""
+    audit.log("first")
+    audit.log("second")
+
+    found = find_events(audit_events, "second")
+
+    assert [event["event"]["action"] for event in found] == ["second"]

src/backend/core/tests/audit/test_registry.py

@@ -0,0 +1,110 @@
+"""Tests for the registry of audited models and authentication classes."""
+
+from types import SimpleNamespace
+
+from django.contrib.auth.models import Group
+
+import pytest
+
+from core import audit
+from core.audit.actor import auth_method_for, auth_method_for_backend
+from core.audit.registry import (
+    ModelOptions,
+    auth_methods,
+    dotted_path,
+    model_options,
+    unregister,
+)
+from core.audit.testing import override_registration
+from core.authentication.user_token import UserAccessJWTAuthentication
+from core.external_api.authentication import ApplicationJWTAuthentication
+from core.models import Application, Resource, ResourceAccess, Room
+
+
+def test_register_twice_is_refused():
+    """A model is registered once, like in the admin."""
+    audit.register(Resource, fields=("id",))
+    try:
+        with pytest.raises(audit.AlreadyRegistered):
+            audit.register(Resource)
+    finally:
+        unregister(Resource)
+
+
+def test_register_refuses_unknown_options():
+    """A misspelled option is an error, not silently ignored."""
+    with pytest.raises(TypeError):
+        audit.register(Resource, field=("name",))  # pylint: disable=unexpected-keyword-arg
+
+    assert model_options(Resource) == ModelOptions()
+
+
+def test_register_refuses_unknown_categories():
+    """A category outside the ECS subset fails where it is registered."""
+    with pytest.raises(ValueError):
+        audit.register(Resource, category="nonsense")
+
+    assert model_options(Resource) == ModelOptions()
+
+
+def test_register_refuses_unknown_entity_types():
+    """An entity type ECS does not allow fails where it is registered."""
+    with pytest.raises(ValueError, match="not an ECS entity type"):
+        audit.register(Resource, entity_type="room")
+
+    assert model_options(Resource) == ModelOptions()
+
+
+def test_model_options_falls_back_to_the_concrete_model():
+    """A proxy model is described as the model it proxies."""
+    proxy = type("ProxyRoom", (), {"_meta": SimpleNamespace(concrete_model=Room)})
+
+    with override_registration(Room, fields=("slug",)):
+        assert model_options(proxy).fields == ("slug",)
+
+
+def test_override_registration_restores_the_previous_one():
+    """The test helper puts back what the project registered."""
+    registered = model_options(Room)
+
+    with override_registration(Room, fields=("slug",)):
+        assert model_options(Room).fields == ("slug",)
+
+    assert model_options(Room) == registered
+
+
+def test_project_declarations_are_discovered():
+    """``core.auditing`` is imported when the audit app is ready."""
+    assert model_options(Room).fields == ("slug", "name", "access_level")
+    assert model_options(Group).category == audit.EventCategory.IAM
+    assert model_options(Application).entity_type == "application"
+    assert model_options(ResourceAccess).user_target == "user"
+    assert auth_methods()[dotted_path(ApplicationJWTAuthentication)] == (
+        "application_jwt"
+    )
+    assert auth_methods()[dotted_path(UserAccessJWTAuthentication)] == (
+        "user_access_jwt"
+    )
+    assert (
+        auth_method_for_backend(
+            "core.authentication.backends.OIDCAuthenticationBackend"
+        )
+        == "oidc"
+    )
+
+
+def test_register_auth_method_twice_is_refused():
+    """An authentication class is named once."""
+    with pytest.raises(audit.AlreadyRegistered):
+        audit.register_auth_method(ApplicationJWTAuthentication, "other")
+
+
+def test_auth_method_is_inherited_by_subclasses():
+    """A DRF class takes the name of its closest registered base."""
+
+    class CustomAuthentication(ApplicationJWTAuthentication):
+        """A project subclass nobody registered."""
+
+    authenticator = object.__new__(CustomAuthentication)
+
+    assert auth_method_for(authenticator) == "application_jwt"

src/backend/core/tests/audit/test_request.py

@@ -0,0 +1,271 @@
+"""Tests for the network fields and the request id of audit events."""
+
+import uuid
+
+from django.http import HttpResponse
+from django.test import RequestFactory
+
+import pytest
+from dockerflow.logging import request_id_context
+from faker import Faker
+
+from core.api.throttling import CreationCallbackAnonRateThrottle
+from core.audit import request as audit_request
+
+fake = Faker()
+
+
+def _set_num_proxies(settings, count):
+    """Trust ``count`` proxies, as DRF's ``NUM_PROXIES`` setting."""
+    settings.REST_FRAMEWORK = {**settings.REST_FRAMEWORK, "NUM_PROXIES": count}
+
+
+@pytest.fixture(name="dockerflow_request_id")
+def fixture_dockerflow_request_id():
+    """Simulate the dockerflow middleware having assigned a request id."""
+    request_id = fake.uuid4()
+    token = request_id_context.set(request_id)
+    try:
+        yield request_id
+    finally:
+        request_id_context.reset(token)
+
+
+def test_resolve_client_ip_without_forwarded_header():
+    """Should use the peer address when no proxy header is present."""
+    peer_ip = fake.ipv4()
+    request = RequestFactory().get("/", REMOTE_ADDR=peer_ip)
+
+    assert audit_request.resolve_client_ip(request) == peer_ip
+
+
+def test_resolve_client_ip_prefers_the_client_over_the_proxy():
+    """Should return the client the trusted proxy saw, not the proxy address."""
+    request = RequestFactory().get(
+        "/", REMOTE_ADDR="1.2.3.4", HTTP_X_FORWARDED_FOR="4.5.6.7, 10.0.0.1"
+    )
+
+    assert audit_request.resolve_client_ip(request) == "10.0.0.1"
+
+
+def test_resolve_client_ip_skips_trusted_proxies(settings):
+    """Should skip the load balancer entry when two proxies are trusted."""
+    _set_num_proxies(settings, 2)
+    request = RequestFactory().get(
+        "/", HTTP_X_FORWARDED_FOR="1.1.1.1, 2.2.2.2, 8.8.8.8"
+    )
+
+    assert audit_request.resolve_client_ip(request) == "2.2.2.2"
+
+
+def test_resolve_client_ip_clamps_when_fewer_addresses_than_proxies(settings):
+    """Should never index out of range on a short chain."""
+    _set_num_proxies(settings, 5)
+    request = RequestFactory().get("/", HTTP_X_FORWARDED_FOR="1.2.3.4")
+
+    assert audit_request.resolve_client_ip(request) == "1.2.3.4"
+
+
+def test_resolve_client_ip_ignores_an_empty_forwarded_header():
+    """Should fall back to the peer address when the header is blank."""
+    peer_ip = fake.ipv4()
+    request = RequestFactory().get("/", REMOTE_ADDR=peer_ip, HTTP_X_FORWARDED_FOR=" , ")
+
+    assert audit_request.resolve_client_ip(request) == peer_ip
+
+
+def test_resolve_client_ip_without_trusted_proxy(settings):
+    """Should ignore the header entirely when no proxy is trusted."""
+    _set_num_proxies(settings, 0)
+    request = RequestFactory().get(
+        "/", REMOTE_ADDR="1.2.3.4", HTTP_X_FORWARDED_FOR="4.5.6.7"
+    )
+
+    assert audit_request.resolve_client_ip(request) == "1.2.3.4"
+
+
+def test_resolve_client_ip_is_the_throttle_identity(settings):
+    """Should identify the client exactly as Meet's throttles do."""
+    _set_num_proxies(settings, 2)
+    request = RequestFactory().get(
+        "/", REMOTE_ADDR="1.2.3.4", HTTP_X_FORWARDED_FOR="6.6.6.6, 5.6.7.8, 10.0.0.1"
+    )
+
+    assert audit_request.resolve_client_ip(request) == "5.6.7.8"
+    assert CreationCallbackAnonRateThrottle().get_ident(request) == "5.6.7.8"
+
+
+def test_resolve_client_ip_tolerates_bare_requests():
+    """Should accept requests built by hand, which have an empty META."""
+    request = RequestFactory().get("/")
+    request.META = {}
+
+    assert audit_request.resolve_client_ip(request) is None
+
+
+def test_current_request_id_is_dockerflow_request_id(dockerflow_request_id):
+    """Should reuse the dockerflow request id as the trace id."""
+    assert audit_request.current_request_id() == dockerflow_request_id
+
+
+def test_current_request_id_outside_a_request():
+    """Should have no id when dockerflow did not assign one."""
+    assert audit_request.current_request_id() is None
+
+
+def test_middleware_replaces_an_untrusted_request_id(dockerflow_request_id):
+    """Should not reuse an inbound id unless the ingress is trusted to set it."""
+    middleware = audit_request.AuditLogMiddleware(lambda request: HttpResponse())
+
+    response = middleware(RequestFactory().get("/"))
+
+    request_id = response["X-Request-ID"]
+
+    assert request_id != dockerflow_request_id
+    assert str(uuid.UUID(request_id)) == request_id
+    assert audit_request.current_request_id() == request_id
+
+
+def test_middleware_echoes_a_trusted_request_id(settings, dockerflow_request_id):
+    """Should keep and echo the inbound id when the ingress is trusted."""
+    settings.REQUEST_ID_TRUST_HEADER = True
+    middleware = audit_request.AuditLogMiddleware(lambda request: HttpResponse())
+
+    response = middleware(RequestFactory().get("/"))
+
+    assert response["X-Request-ID"] == dockerflow_request_id
+
+
+def test_middleware_echoes_on_the_configured_header(settings, dockerflow_request_id):
+    """Should echo the id on the header dockerflow reads it from."""
+    settings.REQUEST_ID_TRUST_HEADER = True
+    settings.DOCKERFLOW_REQUEST_ID_HEADER_NAME = "X-Trace-ID"
+    middleware = audit_request.AuditLogMiddleware(lambda request: HttpResponse())
+
+    response = middleware(RequestFactory().get("/"))
+
+    assert response["X-Trace-ID"] == dockerflow_request_id
+    assert not response.has_header("X-Request-ID")
+
+
+@pytest.mark.usefixtures("dockerflow_request_id")
+def test_middleware_keeps_an_existing_response_header():
+    """Should leave an X-Request-ID set by the view untouched."""
+
+    def view(request):  # pylint: disable=unused-argument
+        response = HttpResponse()
+        response["X-Request-ID"] = "from-the-view"
+        return response
+
+    response = audit_request.AuditLogMiddleware(view)(RequestFactory().get("/"))
+
+    assert response["X-Request-ID"] == "from-the-view"
+
+
+@pytest.mark.django_db
+def test_request_id_from_the_client_is_replaced_by_default(client):
+    """Should answer with an id of its own, not the one the client sent."""
+    response = client.get("/api/v1.0/config/", HTTP_X_REQUEST_ID="abc-123")
+
+    assert response.status_code == 200
+    assert response["X-Request-ID"] != "abc-123"
+    assert uuid.UUID(response["X-Request-ID"])
+
+
+@pytest.mark.django_db
+def test_request_id_flows_through_the_test_client_when_trusted(client, settings):
+    """Should echo the id dockerflow read when the ingress is trusted."""
+    settings.REQUEST_ID_TRUST_HEADER = True
+
+    response = client.get("/api/v1.0/config/", HTTP_X_REQUEST_ID="abc-123")
+
+    assert response.status_code == 200
+    assert response["X-Request-ID"] == "abc-123"
+
+
+@pytest.mark.django_db
+def test_request_id_is_echoed_on_responses_of_outer_middleware(client):
+    """Should reach responses that never get to the view, as slash redirects."""
+    response = client.get("/api/v1.0/config")
+
+    assert response.status_code == 301
+    assert uuid.UUID(response["X-Request-ID"])
+
+
+def test_request_context_reads_the_request(dockerflow_request_id):
+    """Should read the network fields and the request id of a request."""
+    request = RequestFactory().post(
+        "/rooms/",
+        REMOTE_ADDR="1.2.3.4",
+        HTTP_USER_AGENT="Mozilla/5.0 (X11; Linux x86_64)",
+    )
+
+    context = audit_request.RequestContext.from_request(request)
+
+    assert context == audit_request.RequestContext(
+        request=request,
+        request_id=dockerflow_request_id,
+        method="POST",
+        path="/rooms/",
+        client_ip="1.2.3.4",
+        user_agent="Mozilla/5.0 (X11; Linux x86_64)",
+    )
+
+
+def test_request_context_truncates_the_user_agent():
+    """A user agent is cut where ECS stops indexing it."""
+    request = RequestFactory().get("/", HTTP_USER_AGENT="x" * 5000)
+
+    context = audit_request.RequestContext.from_request(request)
+
+    assert context.user_agent == "x" * audit_request.USER_AGENT_MAX_LENGTH
+
+
+def test_request_context_without_a_user_agent():
+    """Should have no user agent when the client sent none."""
+    context = audit_request.RequestContext.from_request(RequestFactory().get("/"))
+
+    assert context.user_agent is None
+
+
+def test_request_context_outside_a_request():
+    """Should have an empty request context when no request is being served."""
+    assert audit_request.request_context() == audit_request.RequestContext()
+
+
+def test_middleware_sets_the_request_context_while_serving():
+    """Should expose the request context to the code serving it, then forget it."""
+    seen = []
+
+    def view(request):  # pylint: disable=unused-argument
+        seen.append(audit_request.request_context())
+        return HttpResponse()
+
+    request = RequestFactory().get(
+        "/rooms/", REMOTE_ADDR="1.2.3.4", HTTP_USER_AGENT="calendar-app/2.3"
+    )
+    response = audit_request.AuditLogMiddleware(view)(request)
+
+    assert seen == [
+        audit_request.RequestContext(
+            request=request,
+            request_id=response["X-Request-ID"],
+            method="GET",
+            path="/rooms/",
+            client_ip="1.2.3.4",
+            user_agent="calendar-app/2.3",
+        )
+    ]
+    assert audit_request.request_context() == audit_request.RequestContext()
+
+
+def test_middleware_forgets_the_request_context_when_the_view_raises():
+    """Should not leak the request context to the next one when the view raises."""
+
+    def view(request):
+        raise RuntimeError("boom")
+
+    with pytest.raises(RuntimeError):
+        audit_request.AuditLogMiddleware(view)(RequestFactory().get("/"))
+
+    assert audit_request.request_context() == audit_request.RequestContext()

src/backend/core/tests/audit/test_signals.py

@@ -0,0 +1,179 @@
+"""Tests for the audit of Django's authentication signals."""
+
+import json
+
+from django.contrib.auth import authenticate, login
+from django.contrib.sessions.middleware import SessionMiddleware
+from django.http import HttpResponse
+from django.test import RequestFactory
+
+import pytest
+
+from core import audit
+from core.audit.testing import find_events
+from core.factories import UserFactory
+
+pytestmark = pytest.mark.django_db
+
+
+def _request_with_session(method="get"):
+    request = getattr(RequestFactory(), method)("/", REMOTE_ADDR="1.2.3.4")
+    SessionMiddleware(lambda req: HttpResponse())(request)
+    return request
+
+
+def test_login_is_audited(audit_events, client):
+    """A login records the user, the mechanism and the backend."""
+    user = UserFactory(email="user@example.com")
+
+    client.force_login(user)
+
+    [event] = find_events(audit_events, "user.login")
+
+    assert event["event"]["category"] == ["authentication"]
+    assert event["event"]["type"] == ["start"]
+    assert event["event"]["outcome"] == "success"
+    assert event["user"] == {"id": str(user.pk), "domain": "example.com"}
+    assert event["lasuite"]["actor"] == {"type": "user", "sub": user.sub}
+    assert event["lasuite"]["auth"] == {"method": "password"}
+    assert event["lasuite"]["details"]["auth_backend"].endswith("ModelBackend")
+
+
+def test_login_through_oidc_backend_is_named_oidc(audit_events):
+    """The OIDC backend is reported as the ``oidc`` auth method."""
+    user = UserFactory()
+    user.backend = "core.authentication.backends.OIDCAuthenticationBackend"
+    request = _request_with_session()
+
+    login(request, user)
+
+    [event] = find_events(audit_events, "user.login")
+
+    assert event["lasuite"]["auth"] == {"method": "oidc"}
+    assert event["client"] == {"ip": "1.2.3.4"}
+    assert event["lasuite"]["details"]["auth_backend"] == user.backend
+
+
+def test_login_given_its_backend_is_named_after_it(audit_events):
+    """A backend passed to ``login`` rather than set by ``authenticate`` counts."""
+    backend = "core.authentication.backends.OIDCAuthenticationBackend"
+
+    login(_request_with_session(), UserFactory(), backend=backend)
+
+    [event] = find_events(audit_events, "user.login")
+
+    assert event["lasuite"]["auth"] == {"method": "oidc"}
+    assert event["lasuite"]["details"]["auth_backend"] == backend
+
+
+def test_login_through_an_unlisted_backend_is_unknown(audit_events):
+    """A backend missing from the setting is unknown, even a ModelBackend subclass."""
+    user = UserFactory()
+    user.backend = "django.contrib.auth.backends.RemoteUserBackend"
+
+    login(_request_with_session(), user)
+
+    [event] = find_events(audit_events, "user.login")
+
+    assert event["lasuite"]["auth"] == {"method": "unknown"}
+    assert event["lasuite"]["details"]["auth_backend"] == user.backend
+
+
+def test_failed_login_is_audited_without_credentials(audit_events):
+    """A failed login is a warning that never contains the credentials."""
+    request = _request_with_session("post")
+
+    assert authenticate(request=request, username="nobody", password="s3cret") is None
+
+    [event] = find_events(audit_events, "user.login")
+
+    assert event["event"]["outcome"] == "failure"
+    assert event["event"]["type"] == ["start"]
+    assert event["event"]["reason"] == "authentication_failed"
+    assert event["lasuite"]["outcome"] == "denied"
+    assert event["lasuite"]["actor"] == {"type": "anonymous"}
+    assert event["lasuite"]["auth"] == {"method": "password"}
+    assert event["log"]["level"] == "warning"
+    assert "s3cret" not in json.dumps(event)
+    assert "nobody" not in json.dumps(event)
+
+
+def test_failed_login_in_a_signed_in_session_is_anonymous(audit_events):
+    """A failed login never records the account the session is signed in as."""
+    request = _request_with_session("post")
+    request.user = UserFactory(email="signed-in@example.com")
+
+    assert authenticate(request=request, username="nobody", password="s3cret") is None
+
+    [event] = find_events(audit_events, "user.login")
+
+    assert event["lasuite"]["actor"] == {"type": "anonymous"}
+    assert "user" not in event
+    assert "organization" not in event
+    assert "example.com" not in json.dumps(event)
+
+
+def test_failed_login_without_request_is_anonymous(audit_events):
+    """A failed login is anonymous even when no request is at hand."""
+    assert authenticate(username="nobody", password="s3cret") is None
+
+    [event] = find_events(audit_events, "user.login")
+
+    assert event["event"]["outcome"] == "failure"
+    assert event["lasuite"]["outcome"] == "denied"
+    assert event["lasuite"]["actor"] == {"type": "anonymous"}
+    assert event["lasuite"]["auth"] == {"method": "password"}
+
+
+@pytest.mark.parametrize(
+    "credentials,method",
+    [
+        # What the OIDC callback hands to ``authenticate``.
+        ({"nonce": "n-0nce", "code_verifier": "v3rifier"}, "oidc"),
+        ({"token": "t0ken"}, "unknown"),
+    ],
+)
+def test_failed_login_is_named_after_its_credentials(audit_events, credentials, method):
+    """A failed attempt is named after what it submitted, never recording it."""
+    request = _request_with_session()
+
+    assert authenticate(request=request, **credentials) is None
+
+    [event] = find_events(audit_events, "user.login")
+
+    assert event["event"]["outcome"] == "failure"
+    assert event["lasuite"]["outcome"] == "denied"
+    assert event["lasuite"]["auth"] == {"method": method}
+    for value in credentials.values():
+        assert value not in json.dumps(event)
+
+
+def test_logout_is_audited(audit_events, client):
+    """A logout records the user who left."""
+    user = UserFactory()
+    client.force_login(user)
+
+    client.logout()
+
+    [event] = find_events(audit_events, "user.logout")
+
+    assert event["event"]["type"] == ["end"]
+    assert event["user"]["id"] == str(user.pk)
+
+
+def test_logout_without_a_signed_in_user_is_not_audited(audit_events, client):
+    """Django signals a logout without a user when no one was signed in."""
+    client.logout()
+
+    assert find_events(audit_events, "user.logout") == []
+
+
+def test_connect_auth_signals_is_idempotent(audit_events, client):
+    """Connecting twice does not duplicate events."""
+    audit.connect_auth_signals()
+    audit.connect_auth_signals()
+    user = UserFactory()
+
+    client.force_login(user)
+
+    assert len(find_events(audit_events, "user.login")) == 1

src/backend/core/tests/audit/test_targets.py

@@ -0,0 +1,197 @@
+"""Tests for the description of audit targets."""
+
+from django.utils.functional import SimpleLazyObject
+
+import pytest
+
+from core.audit.registry import ModelOptions, model_options
+from core.audit.targets import describe_target, user_target_of
+from core.audit.testing import override_registration
+from core.factories import (
+    ApplicationFactory,
+    RecordingFactory,
+    RoomFactory,
+    UserFactory,
+    UserRecordingAccessFactory,
+)
+from core.models import Application, Recording, Resource, ResourceAccess, Room
+
+pytestmark = pytest.mark.django_db
+
+
+def test_describe_target_reads_the_registered_fields():
+    """A model is an ECS entity: its key, its model name and its registered fields."""
+    room = RoomFactory()
+
+    with override_registration(Room, fields=("slug", "access_level")):
+        described = describe_target(room)
+
+    assert described == {
+        "id": str(room.pk),
+        "sub_type": "room",
+        "raw": {"slug": room.slug, "access_level": room.access_level},
+    }
+
+
+def test_describe_target_promotes_its_name():
+    """A registered ``name`` is the ECS ``entity.name``, not a raw field."""
+    room = RoomFactory(name="Daily standup")
+
+    with override_registration(Room, fields=("name", "slug")):
+        described = describe_target(room)
+
+    assert described == {
+        "id": str(room.pk),
+        "sub_type": "room",
+        "name": "Daily standup",
+        "raw": {"slug": room.slug},
+    }
+
+
+def test_describe_target_reports_the_registered_entity_type():
+    """A model registered with an ECS entity type is of that type."""
+    application = ApplicationFactory()
+
+    with override_registration(Application, entity_type="application"):
+        described = describe_target(application)
+
+    assert described == {
+        "id": str(application.pk),
+        "type": ["application"],
+        "sub_type": "application",
+    }
+
+
+def test_describe_target_renders_values():
+    """Foreign keys, enums and other values are rendered for JSON."""
+    recording = RecordingFactory()
+
+    with override_registration(Recording, fields=("room_id", "room")):
+        described = describe_target(recording)
+
+    assert described == {
+        "id": str(recording.pk),
+        "sub_type": "recording",
+        "raw": {"room_id": str(recording.room_id), "room": str(recording.room_id)},
+    }
+
+
+def test_describe_target_without_fields():
+    """A model registered without fields stays identifiable."""
+    room = RoomFactory()
+
+    with override_registration(Room):
+        described = describe_target(room)
+
+    assert described == {"id": str(room.pk), "sub_type": "room"}
+
+
+def test_describe_target_identifies_users_without_their_email():
+    """A user is an ECS user entity, identified by its key and OIDC sub."""
+    user = UserFactory(email="jane@Example.org", sub="oidc-sub-1")
+
+    described = describe_target(user)
+
+    assert described == {
+        "id": str(user.pk),
+        "type": ["user"],
+        "sub_type": "user",
+        "raw": {"sub": "oidc-sub-1"},
+    }
+    assert "example.org" not in str(described).lower()
+
+
+def test_describe_target_of_a_user_without_sub():
+    """A user who never signed in, such as a provisional one, has no sub."""
+    user = UserFactory(email="jane@example.org", sub=None)
+
+    assert describe_target(user) == {
+        "id": str(user.pk),
+        "type": ["user"],
+        "sub_type": "user",
+    }
+
+
+def test_describe_target_sees_through_lazy_objects():
+    """A lazy proxy is described as the object it wraps."""
+    room = RoomFactory()
+
+    with override_registration(Room, fields=("slug",)):
+        described = describe_target(SimpleLazyObject(lambda: room))
+
+    assert described == {
+        "id": str(room.pk),
+        "sub_type": "room",
+        "raw": {"slug": room.slug},
+    }
+
+
+def test_describe_target_mapping_passes_through():
+    """A ready-made dict is used verbatim."""
+    assert describe_target({"sub_type": "x", "id": "1"}) == {
+        "sub_type": "x",
+        "id": "1",
+    }
+
+
+def test_describe_target_of_a_plain_object():
+    """Anything else is identified by its class and string form."""
+
+    class Thing:  # pylint: disable=missing-class-docstring
+        def __str__(self):
+            return "thing-1"
+
+    assert describe_target(Thing()) == {"id": "thing-1", "sub_type": "thing"}
+
+
+def test_model_options_by_model():
+    """Options are looked up by model, and default to nothing."""
+    with override_registration(Room, fields=("slug",)):
+        assert model_options(Room) == ModelOptions(fields=("slug",))
+    assert model_options(Resource) == ModelOptions()
+
+
+def test_user_target_of_a_user_is_itself():
+    """An event on an account is about that account."""
+    user = UserFactory()
+
+    assert user_target_of(user) == user
+
+
+def test_user_target_of_reads_the_registered_attribute():
+    """An event on an access is about the user it grants a role to."""
+    user = UserFactory()
+    access = RoomFactory(users=[(user, "member")]).accesses.get()
+
+    assert user_target_of(access) == user
+
+
+def test_user_target_of_a_recording_access():
+    """``core.auditing`` registers the user of a recording access."""
+    access = UserRecordingAccessFactory()
+
+    assert user_target_of(access) == access.user
+
+
+def test_user_target_of_an_unregistered_model_is_none():
+    """A model registered without a user target is about no account."""
+    assert user_target_of(RoomFactory()) is None
+    assert user_target_of("something") is None
+
+
+def test_user_target_of_a_broken_registration_is_none(caplog):
+    """An attribute that cannot be read costs the user target, not the event."""
+    access = RoomFactory(users=[(UserFactory(), "member")]).accesses.get()
+
+    with override_registration(ResourceAccess, user_target="no_such_attribute"):
+        assert user_target_of(access) is None
+
+    assert "no_such_attribute" in caplog.text
+
+
+def test_user_target_of_an_attribute_that_is_not_a_user_is_none():
+    """A registered attribute holding anything but an account is ignored."""
+    access = RoomFactory(users=[(UserFactory(), "member")]).accesses.get()
+
+    with override_registration(ResourceAccess, user_target="role"):
+        assert user_target_of(access) is None

src/backend/core/tests/audit/test_utils_prune_empty.py

@@ -0,0 +1,44 @@
+"""
+Test audit.utils.prune_empty
+"""
+
+from core.audit.utils import prune_empty
+
+
+def test_prune_empty_drops_none_and_empty_mappings():
+    """Should drop None and emptied mappings but keep falsy values."""
+    document = {
+        "none": None,
+        "emptied": {"inner": None, "deeper": {"again": None}},
+        "kept": {"zero": 0, "false": False, "blank": "", "none": None},
+        "list": [],
+    }
+
+    assert prune_empty(document) == {
+        "kept": {"zero": 0, "false": False, "blank": ""},
+        "list": [],
+    }
+
+
+def test_prune_empty_leaves_non_mappings_untouched():
+    """Should return anything that is not a mapping as it is."""
+    assert prune_empty([None, {}]) == [None, {}]
+    assert prune_empty("text") == "text"
+    assert prune_empty(None) is None
+
+
+def test_prune_empty_keeps_values_below_depth_whole():
+    """Should prune only ``depth`` levels and keep anything deeper as it is."""
+    document = {
+        "none": None,
+        "empty": {},
+        "change": {"from": None, "to": {}},
+        "deeper": {"inner": {"none": None}},
+    }
+
+    assert prune_empty(document, depth=1) == {
+        "change": {"from": None, "to": {}},
+        "deeper": {"inner": {"none": None}},
+    }
+    assert prune_empty(document, depth=2) == {"deeper": {"inner": {"none": None}}}
+    assert prune_empty(document, depth=0) is document

src/backend/core/tests/commands/test_purge_inactive_rooms.py

@@ -9,6 +9,7 @@ from django.core.management import call_command
 from django.utils import timezone
 
 import pytest
+from rest_framework.test import APIClient
 
 from core import factories, models
 
@@ -19,14 +20,25 @@ COMMAND_MODULE = "core.management.commands.purge_inactive_rooms"
 BEFORE_PERIOD = timedelta(days=366)
 WITHIN_PERIOD = timedelta(days=364)
 
+BEFORE_RETENTION = timedelta(days=31)
+WITHIN_RETENTION = timedelta(days=29)
+
 
 @pytest.fixture(name="purge_enabled", autouse=True)
 def fixture_purge_enabled(settings):
     """Enable the purge of the rooms inactive for a year."""
     settings.ROOM_INACTIVITY_DELETION_DAYS = 365
+    settings.ROOM_DELETED_RETENTION_DAYS = None
     settings.RECORDING_EXPIRATION_DAYS = 30
 
 
+@pytest.fixture(name="retention_only")
+def fixture_retention_only(settings):
+    """Only purge the rooms soft deleted more than 30 days ago."""
+    settings.ROOM_INACTIVITY_DELETION_DAYS = None
+    settings.ROOM_DELETED_RETENTION_DAYS = 30
+
+
 def create_at(date, factory, **kwargs):
     """Build an object with the factory as if it was created at the given date."""
     with mock.patch("django.utils.timezone.now", return_value=date):
@@ -41,12 +53,12 @@ def call_purge(*args):
 
 
 def room_exists(room):
-    """Tell whether the room is still in database."""
-    return models.Room.objects.filter(pk=room.pk).exists()
+    """Tell whether the room is still in database, soft deleted or not."""
+    return models.Room.all_objects.filter(pk=room.pk).exists()
 
 
 def test_purge_inactive_rooms_disabled(settings):
-    """Should delete nothing when no inactivity period is configured."""
+    """Should delete nothing when neither period is configured."""
     settings.ROOM_INACTIVITY_DELETION_DAYS = None
     room = create_at(timezone.now() - BEFORE_PERIOD, factories.RoomFactory)
 
@@ -68,7 +80,7 @@ def test_purge_inactive_rooms_without_recording_expiration(settings):
         status=models.RecordingStatusChoices.SAVED,
     )
 
-    assert call_purge() == "Purged 1 inactive room(s).\n"
+    assert call_purge() == "Purged 1 room(s).\n"
 
     assert not room_exists(room)
     assert room_exists(room_with_recording)
@@ -97,7 +109,7 @@ def test_purge_inactive_rooms_started_before_period(caplog):
     with caplog.at_level(logging.INFO, logger=COMMAND_MODULE):
         output = call_purge()
 
-    assert output == "Purged 1 inactive room(s).\n"
+    assert output == "Purged 1 room(s).\n"
     assert not room_exists(room)
     assert f"Purging inactive room {room.pk} ({room.slug})" in caplog.text
 
@@ -120,7 +132,7 @@ def test_purge_inactive_rooms_started_within_period():
         last_started_at=now - WITHIN_PERIOD,
     )
 
-    assert call_purge() == "No inactive room to purge.\n"
+    assert call_purge() == "No room to purge.\n"
 
     assert room_exists(room)
 
@@ -129,7 +141,7 @@ def test_purge_inactive_rooms_never_started_created_within_period():
     """Should keep a room that was never started but created within the period."""
     room = create_at(timezone.now() - WITHIN_PERIOD, factories.RoomFactory)
 
-    assert call_purge() == "No inactive room to purge.\n"
+    assert call_purge() == "No room to purge.\n"
 
     assert room_exists(room)
 
@@ -221,7 +233,7 @@ def test_purge_inactive_rooms_dry_run():
     factories.RoomFactory(name="Recent room")
 
     assert call_purge("--dry-run") == (
-        "[dry-run] 2 inactive room(s) would be purged:\n- Alpha room\n- Beta room\n"
+        "[dry-run] 2 room(s) would be purged:\n- Alpha room\n- Beta room\n"
     )
 
     assert all(room_exists(room) for room in rooms)
@@ -235,5 +247,134 @@ def test_purge_inactive_rooms_several_chunks():
     with mock.patch(f"{COMMAND_MODULE}.CHUNK_SIZE", 2):
         output = call_purge()
 
-    assert output == "Purged 5 inactive room(s).\n"
+    assert output == "Purged 5 room(s).\n"
     assert not any(room_exists(room) for room in rooms)
+
+
+def test_purge_inactive_rooms_soft_deleted(caplog):
+    """Should delete an inactive room even if it was soft deleted recently."""
+    now = timezone.now()
+    room = create_at(
+        now - BEFORE_PERIOD,
+        factories.RoomFactory,
+        deleted_at=now - timedelta(days=1),
+    )
+
+    with caplog.at_level(logging.INFO, logger=COMMAND_MODULE):
+        output = call_purge()
+
+    assert output == "Purged 1 room(s).\n"
+    assert not room_exists(room)
+    assert f"Purging deleted room {room.pk} ({room.slug})" in caplog.text
+
+
+@pytest.mark.usefixtures("retention_only")
+def test_purge_deleted_rooms_before_retention(caplog):
+    """Should delete a room soft deleted before the retention period."""
+    room = factories.RoomFactory(deleted_at=timezone.now() - BEFORE_RETENTION)
+
+    with caplog.at_level(logging.INFO, logger=COMMAND_MODULE):
+        output = call_purge()
+
+    assert output == "Purged 1 room(s).\n"
+    assert not room_exists(room)
+    assert f"Purging deleted room {room.pk} ({room.slug})" in caplog.text
+
+
+@pytest.mark.usefixtures("retention_only")
+def test_purge_deleted_rooms_within_retention():
+    """Should keep a room soft deleted within the retention period."""
+    room = factories.RoomFactory(deleted_at=timezone.now() - WITHIN_RETENTION)
+
+    assert call_purge() == "No room to purge.\n"
+
+    assert room_exists(room)
+
+
+@pytest.mark.usefixtures("retention_only")
+def test_purge_deleted_rooms_retention_only_keeps_inactive_rooms():
+    """Should keep inactive rooms that are not deleted when only retention is set."""
+    room = create_at(timezone.now() - BEFORE_PERIOD, factories.RoomFactory)
+
+    assert call_purge() == "No room to purge.\n"
+
+    assert room_exists(room)
+
+
+def test_purge_deleted_rooms_within_retention_but_inactive(settings):
+    """Should delete an inactive room even if it was deleted within the retention."""
+    settings.ROOM_DELETED_RETENTION_DAYS = 30
+    now = timezone.now()
+    room = create_at(
+        now - BEFORE_PERIOD,
+        factories.RoomFactory,
+        deleted_at=now - WITHIN_RETENTION,
+    )
+
+    call_purge()
+
+    assert not room_exists(room)
+
+
+@pytest.mark.usefixtures("retention_only")
+def test_purge_deleted_rooms_recording_not_expired():
+    """Should keep a deleted room holding a saved recording that has not expired."""
+    room = factories.RoomFactory(deleted_at=timezone.now() - BEFORE_RETENTION)
+    factories.RecordingFactory(room=room, status=models.RecordingStatusChoices.SAVED)
+
+    assert call_purge() == "No room to purge.\n"
+
+    assert room_exists(room)
+
+
+@pytest.mark.usefixtures("retention_only")
+def test_purge_deleted_rooms_recording_expired():
+    """Should delete a deleted room along with its expired recordings."""
+    now = timezone.now()
+    room = create_at(
+        now - timedelta(days=40),
+        factories.RoomFactory,
+        deleted_at=now - BEFORE_RETENTION,
+    )
+    recording = create_at(
+        now - timedelta(days=40),
+        factories.RecordingFactory,
+        room=room,
+        status=models.RecordingStatusChoices.SAVED,
+    )
+
+    call_purge()
+
+    assert not room_exists(room)
+    assert not models.Recording.objects.filter(pk=recording.pk).exists()
+
+
+def test_purge_rooms_dry_run_flags_deleted_rooms(settings):
+    """Should flag the soft-deleted rooms listed on a dry run."""
+    settings.ROOM_DELETED_RETENTION_DAYS = 30
+    now = timezone.now()
+    rooms = [
+        create_at(now - BEFORE_PERIOD, factories.RoomFactory, name="Alpha room"),
+        factories.RoomFactory(name="Beta room", deleted_at=now - BEFORE_RETENTION),
+    ]
+    factories.RoomFactory(name="Gamma room", deleted_at=now - WITHIN_RETENTION)
+
+    assert call_purge("--dry-run") == (
+        "[dry-run] 2 room(s) would be purged:\n- Alpha room\n- Beta room (deleted)\n"
+    )
+
+    assert all(room_exists(room) for room in rooms)
+
+
+@pytest.mark.usefixtures("retention_only")
+def test_purge_deleted_rooms_frees_slug():
+    """Should let a new room take the slug of a purged deleted room."""
+    factories.RoomFactory(name="my room", deleted_at=timezone.now() - BEFORE_RETENTION)
+    client = APIClient()
+    client.force_login(factories.UserFactory())
+
+    call_purge()
+    response = client.post("/api/v1.0/rooms/", {"name": "My Room!"})
+
+    assert response.status_code == 201
+    assert models.Room.objects.get().slug == "my-room"

src/backend/core/tests/conftest.py

@@ -3,6 +3,9 @@
 from unittest import mock
 
 import pytest
+from dockerflow.logging import request_id_context
+
+from core.audit.testing import capture_audit
 
 USER = "user"
 TEAM = "team"
@@ -14,3 +17,23 @@ def mock_user_get_teams():
     """Mock for the "get_teams" method on the User model."""
     with mock.patch("core.models.User.get_teams") as mock_get_teams:
         yield mock_get_teams
+
+
+@pytest.fixture
+def audit_events():
+    """Collect the audit events emitted during the test, as dicts."""
+    with capture_audit() as events:
+        yield events
+
+
+@pytest.fixture(autouse=True)
+def isolated_request_id():
+    """Keep dockerflow's request id from leaking from one test to the next.
+
+    Its middleware sets the context variable on every request the test client
+    makes and never clears it, which would make the trace id of a later test
+    depend on the order tests ran in.
+    """
+    token = request_id_context.set(None)
+    yield
+    request_id_context.reset(token)

src/backend/core/tests/files/test_api_files_create.py

@@ -6,6 +6,7 @@ from concurrent.futures import ThreadPoolExecutor
 from urllib.parse import parse_qs, urlparse
 from uuid import uuid4
 
+from django.db import connection
 from django.utils import timezone
 
 import pytest
@@ -361,18 +362,21 @@ def test_api_files_create_file_race_condition():
     """
 
     def create_item(title):
-        user = factories.UserFactory()
-        client = APIClient()
-        client.force_login(user)
-        return client.post(
-            "/api/v1.0/files/",
-            {
-                "title": title,
-                "type": FileTypeChoices.BACKGROUND_IMAGE,
-                "filename": "my_file.png",
-            },
-            format="json",
-        )
+        try:
+            user = factories.UserFactory()
+            client = APIClient()
+            client.force_login(user)
+            return client.post(
+                "/api/v1.0/files/",
+                {
+                    "title": title,
+                    "type": FileTypeChoices.BACKGROUND_IMAGE,
+                    "filename": "my_file.png",
+                },
+                format="json",
+            )
+        finally:
+            connection.close()
 
     with ThreadPoolExecutor(max_workers=2) as executor:
         future1 = executor.submit(create_item, "my item 1")

src/backend/core/tests/files/test_api_files_upload_ended.py

@@ -5,6 +5,7 @@ from concurrent.futures import ThreadPoolExecutor
 from io import BytesIO
 
 from django.core.files.storage import default_storage
+from django.db import connection
 
 import pytest
 from rest_framework.test import APIClient
@@ -295,9 +296,12 @@ def test_api_file_upload_ended_concurrent_calls_are_serialized(settings):
     default_storage.save(file.temporary_file_key, BytesIO(b"my prose"))
 
     def call_upload_ended():
-        client = APIClient()
-        client.force_login(user)
-        return client.post(f"/api/v1.0/files/{file.id!s}/upload-ended/")
+        try:
+            client = APIClient()
+            client.force_login(user)
+            return client.post(f"/api/v1.0/files/{file.id!s}/upload-ended/")
+        finally:
+            connection.close()
 
     with ThreadPoolExecutor(max_workers=2) as executor:
         futures = [

src/backend/core/tests/recording/event/test_authentication.py

@@ -24,6 +24,8 @@ def test_successful_authentication(settings):
     user, token = RecordingProcessWebhookAuthentication().authenticate(request)
     assert token == "valid-test-token"
     assert isinstance(user, MachineUser)
+    # Names the summary service in the audit log
+    assert user.get_username() == "summary"
 
 
 def test_authentication_fails_when_token_not_configured(settings):

src/backend/core/tests/recording/event/test_notification.py

@@ -12,9 +12,11 @@ from unittest import mock
 from django.contrib.sites.models import Site
 
 import pytest
+from celery.exceptions import OperationalError as CeleryOperationalError
 
 from core import factories, models
 from core.analytics import UserFeatureFlag
+from core.audit.testing import find_events
 from core.recording.event.notification import NotificationService, notification_service
 
 pytestmark = pytest.mark.django_db
@@ -99,7 +101,7 @@ def test_notify_external_services_unknown_mode(caplog):
 
 # pylint: disable=too-many-locals
 def test_notify_user_by_email_success(mocked_current_site, settings):
-    """Test successful email notification to recording owners."""
+    """Test successful email notification to every user with access to the recording."""
     settings.EMAIL_BRAND_NAME = "ACME"
     settings.EMAIL_SUPPORT_EMAIL = "support@acme.com"
     settings.EMAIL_LOGO_IMG = "https://acme.com/logo"
@@ -132,21 +134,19 @@ def test_notify_user_by_email_success(mocked_current_site, settings):
         recording=recording, role=models.RoleChoices.OWNER, user=english_user
     )
 
-    # Create non-owner users to verify they don't receive emails
+    # Members (e.g. a starter with no privileged room role) are notified too
+    member = factories.UserFactory(email="member@test.com", language="en-us")
     factories.UserRecordingAccessFactory(
-        recording=recording, role=models.RoleChoices.MEMBER
-    )
-    factories.UserRecordingAccessFactory(
-        recording=recording, role=models.RoleChoices.ADMIN
+        recording=recording, role=models.RoleChoices.MEMBER, user=member
     )
 
     notification_service = NotificationService()
 
-    with mock.patch("core.recording.event.notification.send_mail") as mock_send_mail:
+    with mock.patch("core.tasks.mail.send_mail") as mock_send_mail:
         result = notification_service._notify_user_by_email(recording)
 
         assert result is True
-        assert mock_send_mail.call_count == 3
+        assert mock_send_mail.call_count == 4
 
         call_args_list = mock_send_mail.call_args_list
 
@@ -210,6 +210,9 @@ def test_notify_user_by_email_success(mocked_current_site, settings):
         assert recipients3 == ["john@test.com"]
         assert sender3 == "notifications@acme.com"
 
+        _, _, _, recipients4 = call_args_list[3][0]
+        assert recipients4 == ["member@test.com"]
+
 
 def test_notify_user_by_email_no_owners(mocked_current_site, caplog):
     """Test email notification when no owners are found."""
@@ -237,7 +240,7 @@ def test_notify_user_by_email_smtp_exception(mocked_current_site, caplog):
     notification_service = NotificationService()
 
     with mock.patch(
-        "core.recording.event.notification.send_mail",
+        "core.tasks.mail.send_mail",
         side_effect=smtplib.SMTPException("SMTP Error"),
     ) as mock_send_mail:
         result = notification_service._notify_user_by_email(recording)
@@ -247,6 +250,60 @@ def test_notify_user_by_email_smtp_exception(mocked_current_site, caplog):
         assert "notification could not be sent:" in caplog.text
 
 
+def test_notify_user_by_email_queues_generic_task(settings):
+    """One generic send_email task is queued per owner, with serializable args."""
+    settings.RECORDING_DOWNLOAD_BASE_URL = "https://acme.com/recordings"
+    settings.RECORDING_EXPIRATION_DAYS = 7
+
+    recording = factories.RecordingFactory(room__name="Conference Room A")
+    recording.created_at = datetime.datetime(
+        2023, 5, 15, 14, 30, 0, tzinfo=datetime.timezone.utc
+    )
+    user = factories.UserFactory(
+        email="franc@test.com", language="fr-fr", timezone="Europe/Paris"
+    )
+    factories.UserRecordingAccessFactory(
+        recording=recording, role=models.RoleChoices.OWNER, user=user
+    )
+
+    with mock.patch("core.recording.event.notification.send_email.delay") as mock_delay:
+        result = notification_service._notify_user_by_email(recording)
+
+    assert result is True
+    mock_delay.assert_called_once_with(
+        template="screen_recording",
+        subject="Your recording is ready",
+        recipients=["franc@test.com"],
+        language="fr-fr",
+        context={
+            "room_name": "Conference Room A",
+            "recording_expiration_days": 7,
+            "link": f"https://acme.com/recordings/{recording.id}",
+            "recording_date": "2023-05-15",
+            "recording_time": "16:30",
+        },
+    )
+    # Celery's JSON serializer must accept every argument
+    json.dumps(mock_delay.call_args.kwargs)
+
+
+def test_notify_user_by_email_broker_unavailable(caplog):
+    """A broker outage is reported as a failure without crashing the caller."""
+    recording = factories.RecordingFactory()
+    factories.UserRecordingAccessFactory(
+        recording=recording, role=models.RoleChoices.OWNER
+    )
+
+    with mock.patch(
+        "core.recording.event.notification.send_email.delay",
+        side_effect=CeleryOperationalError("broker down"),
+    ):
+        result = notification_service._notify_user_by_email(recording)
+
+    assert result is False
+    assert "notification could not be sent: broker down" in caplog.text
+
+
 @mock.patch("core.recording.event.notification.requests.post")
 @mock.patch("core.recording.event.notification.generate_download_s3_url")
 @mock.patch.object(
@@ -479,3 +536,98 @@ def test_notify_summary_service_v2_payload_json_serializable_without_timestamps(
     assert isinstance(title, str)
     # ...so the payload serializes exactly the way ``requests`` serializes it.
     json.dumps(payload)
+
+
+def test_summary_recipient_is_oldest_access():
+    """With several accesses, the summary goes to the oldest one."""
+    recording = factories.RecordingFactory()
+    oldest = factories.UserRecordingAccessFactory(
+        recording=recording, role=models.RoleChoices.OWNER
+    )
+    for _ in range(2):
+        factories.UserRecordingAccessFactory(
+            recording=recording, role=models.RoleChoices.OWNER
+        )
+
+    assert NotificationService._get_summary_recipient(recording) == oldest.user
+
+
+def test_summary_recipient_is_member_starter():
+    """A starter holding a MEMBER access still receives the summary."""
+    recording = factories.RecordingFactory()
+    starter = factories.UserRecordingAccessFactory(
+        recording=recording, role=models.RoleChoices.MEMBER
+    )
+    factories.UserRecordingAccessFactory(
+        recording=recording, role=models.RoleChoices.OWNER
+    )
+
+    assert NotificationService._get_summary_recipient(recording) == starter.user
+
+
+def test_summary_recipient_none_without_access():
+    """No access: nobody to send the summary to."""
+    recording = factories.RecordingFactory()
+
+    assert NotificationService._get_summary_recipient(recording) is None
+
+
+@pytest.mark.parametrize("summary_requested", [True, False])
+@mock.patch("core.recording.event.notification.requests.post")
+@mock.patch("core.recording.event.notification.generate_download_s3_url")
+@mock.patch.object(
+    NotificationService, "_get_recording_timestamps", new_callable=mock.AsyncMock
+)
+def test_notify_summary_service_is_audited(  # noqa: PLR0913, PLR0917
+    mock_get_recording_timestamps,
+    mock_generate_download_s3_url,
+    mock_post,
+    summary_requested,
+    settings,
+    audit_events,
+):  # pylint: disable=too-many-arguments,too-many-positional-arguments
+    """Sending a recording to be transcribed says whether a summary is asked for."""
+    settings.SUMMARY_SERVICE_VERSION = 2
+    settings.SUMMARY_SERVICE_ENDPOINT = "https://summary.test/api/v2/tasks"
+    settings.SUMMARY_SERVICE_API_TOKEN = "summary-token"
+    settings.METADATA_COLLECTOR_ENABLED = False
+
+    recording = factories.RecordingFactory(mode="transcript")
+    factories.UserRecordingAccessFactory(
+        recording=recording, role=models.RoleChoices.OWNER
+    )
+    mock_get_recording_timestamps.return_value = (None, None)
+    mock_generate_download_s3_url.return_value = "https://storage.test/recording.ogg"
+    mock_post.return_value.json.return_value = {"job_id": "job-7"}
+
+    with mock.patch(
+        "core.recording.event.notification.is_user_feature_flag_enabled",
+        return_value=summary_requested,
+    ):
+        assert NotificationService._notify_summary_service(recording) is True
+
+    [event] = find_events(audit_events, "recording.transcript.request")
+
+    assert event["lasuite"]["outcome"] == "success"
+    assert event["lasuite"]["actor"] == {"type": "system"}
+    assert event["entity"]["target"]["id"] == str(recording.id)
+    assert event["service"]["target"] == {"name": "summary"}
+    assert event["lasuite"]["details"] == {
+        "job_id": "job-7",
+        "summary_requested": summary_requested,
+    }
+
+
+def test_notify_summary_service_failure_is_audited(settings, audit_events):
+    """A recording the summary service never received is a failure."""
+    settings.SUMMARY_SERVICE_VERSION = 2
+    settings.SUMMARY_SERVICE_ENDPOINT = None
+
+    recording = factories.RecordingFactory(mode="transcript")
+
+    assert NotificationService._notify_summary_service(recording) is False
+
+    [event] = find_events(audit_events, "recording.transcript.request")
+
+    assert event["lasuite"]["outcome"] == "failure"
+    assert event["entity"]["target"]["id"] == str(recording.id)

src/backend/core/tests/recording/test_api_recordings_delete.py

@@ -5,6 +5,7 @@ Test recordings API endpoints in the Meet core app: delete.
 import pytest
 from rest_framework.test import APIClient
 
+from ...audit.testing import capture_audit, find_events
 from ...factories import RecordingFactory, UserFactory, UserRecordingAccessFactory
 from ...models import Recording
 
@@ -112,3 +113,24 @@ def test_api_recordings_delete_final(role):
 
     assert response.status_code == 204
     assert Recording.objects.count() == 0
+
+
+def test_api_recordings_delete_is_audited():
+    """A deleted recording is still identified by the event."""
+    user = UserFactory()
+    recording = RecordingFactory(status="saved", mode="transcript")
+    UserRecordingAccessFactory(role="owner", user=user, recording=recording)
+    client = APIClient()
+    client.force_login(user)
+
+    with capture_audit() as events:
+        response = client.delete(f"/api/v1.0/recordings/{recording.id}/")
+
+    assert response.status_code == 204
+
+    [event] = find_events(events, "recording.delete")
+
+    assert event["event"]["type"] == ["deletion"]
+    assert event["lasuite"]["outcome"] == "success"
+    assert event["entity"]["target"]["id"] == str(recording.id)
+    assert event["entity"]["target"]["raw"]["mode"] == "transcript"

src/backend/core/tests/recording/test_api_recordings_external_process_hook.py

@@ -6,6 +6,7 @@ Test recordings API endpoints: external process hook.
 
 import pytest
 
+from ...audit.testing import find_events
 from ...factories import RecordingFactory
 from ...models import RecordingStatusChoices
 
@@ -132,3 +133,83 @@ def test_external_process_event_non_transcript_event_does_not_change_status(
 
     recording.refresh_from_db()
     assert recording.status == RecordingStatusChoices.SAVED
+
+
+@pytest.mark.parametrize(
+    "process_type,action",
+    [
+        ("transcript", "recording.transcript.report"),
+        ("summary", "recording.summary.report"),
+    ],
+)
+@pytest.mark.parametrize(
+    "process_status,outcome", [("success", "success"), ("failure", "failure")]
+)
+def test_external_process_event_is_audited(  # noqa: PLR0913, PLR0917
+    external_process_settings,
+    client,
+    audit_events,
+    process_type,
+    action,
+    process_status,
+    outcome,
+):  # pylint: disable=too-many-arguments,too-many-positional-arguments
+    """A transcript and a summary are audited apart, as reported by the service."""
+    recording = RecordingFactory(
+        status=RecordingStatusChoices.SAVED, external_process_id="job-123"
+    )
+
+    response = client.post(
+        "/api/v1.0/recordings/external-process-hook/",
+        {"job_id": "job-123", "type": process_type, "status": process_status},
+        HTTP_AUTHORIZATION="Bearer testWebhookToken",
+    )
+
+    assert response.status_code == 200
+
+    [event] = find_events(audit_events, action)
+
+    assert event["lasuite"]["outcome"] == outcome
+    assert event["lasuite"]["actor"] == {"type": "service"}
+    assert event["service"]["origin"] == {"name": "summary"}
+    assert event["entity"]["target"]["id"] == str(recording.id)
+    assert event["lasuite"]["details"] == {
+        "job_id": "job-123",
+        "status": process_status,
+    }
+
+
+def test_external_process_event_unknown_recording_is_audited(
+    external_process_settings, client, audit_events
+):
+    """An event about an unknown job keeps its job id, with no target."""
+    response = client.post(
+        "/api/v1.0/recordings/external-process-hook/",
+        {"job_id": "job-unknown", "type": "summary", "status": "success"},
+        HTTP_AUTHORIZATION="Bearer testWebhookToken",
+    )
+
+    assert response.status_code == 200
+
+    [event] = find_events(audit_events, "recording.summary.report")
+
+    assert "target" not in event["lasuite"]
+    assert event["lasuite"]["details"]["job_id"] == "job-unknown"
+
+
+def test_external_process_event_refused_is_audited(
+    external_process_settings, client, audit_events
+):
+    """A caller without the token is denied under the transcript action."""
+    response = client.post(
+        "/api/v1.0/recordings/external-process-hook/",
+        {"job_id": "job-1", "type": "summary", "status": "success"},
+        HTTP_AUTHORIZATION="Bearer wrongToken",
+    )
+
+    assert response.status_code == 401
+
+    [event] = find_events(audit_events, "recording.transcript.report")
+
+    assert event["lasuite"]["outcome"] == "denied"
+    assert not find_events(audit_events, "recording.summary.report")

src/backend/core/tests/recording/test_api_recordings_media_auth.py

@@ -89,9 +89,9 @@ def test_api_recordings_media_auth_no_abilities():
     assert response.status_code == 403
 
 
-def test_api_recordings_media_auth_wrong_abilities():
+def test_api_recordings_media_auth_member():
     """
-    Test that users with insufficient role permissions cannot download recordings
+    Members of a recording (e.g. its starter) are allowed to download it.
     """
     user = UserFactory()
 
@@ -102,13 +102,14 @@ def test_api_recordings_media_auth_wrong_abilities():
 
     UserRecordingAccessFactory(user=user, recording=recording, role="member")
 
-    original_url = f"http://localhost/media/recordings/{recording.id!s}.mp4"
+    original_url = f"http://localhost/media/{recording.key:s}"
 
     response = client.get(
         "/api/v1.0/recordings/media-auth/", HTTP_X_ORIGINAL_URL=original_url
     )
 
-    assert response.status_code == 403
+    assert response.status_code == 200
+    assert "AWS4-HMAC-SHA256 Credential=" in response["Authorization"]
 
 
 @pytest.mark.parametrize("wrong_status", ["initiated", "active", "failed_to_stop"])

src/backend/core/tests/recording/test_api_recordings_retrieve.py

@@ -47,7 +47,8 @@ def test_api_recording_retrieve_authenticated():
 
 def test_api_recording_retrieve_members():
     """
-    A user who is a member of a recording should not be able to retrieve it.
+    A user who is a member of a recording (e.g. its starter) should be able
+    to retrieve it.
     """
     user = UserFactory()
     recording = RecordingFactory()
@@ -58,10 +59,8 @@ def test_api_recording_retrieve_members():
     client.force_login(user)
 
     response = client.get(f"/api/v1.0/recordings/{recording.id!s}/")
-    assert response.status_code == 403
-    assert response.json() == {
-        "detail": "You do not have permission to perform this action."
-    }
+    assert response.status_code == 200
+    assert response.json()["id"] == str(recording.id)
 
 
 def test_api_recording_retrieve_administrators(settings):

src/backend/core/tests/rooms/test_api_rooms_create.py

@@ -117,6 +117,29 @@ def test_api_rooms_create_authenticated_existing_slug():
     assert response.json() == {"slug": ["Room with this Slug already exists."]}
 
 
+def test_api_rooms_create_authenticated_slug_held_by_soft_deleted_room():
+    """
+    A deleted room keeps its slug: creating a room with the same name should
+    fail validation rather than hit the database constraint.
+    """
+    RoomFactory(name="my room").soft_delete()
+    user = UserFactory()
+
+    client = APIClient()
+    client.force_login(user)
+
+    response = client.post(
+        "/api/v1.0/rooms/",
+        {
+            "name": "My Room!",
+        },
+    )
+
+    assert response.status_code == 400
+    assert response.json() == {"slug": ["Room with this Slug already exists."]}
+    assert Room.all_objects.count() == 1
+
+
 def test_api_rooms_create_authenticated_user_default_access_level():
     """
     The user's default room access level should be applied to the new room

src/backend/core/tests/rooms/test_api_rooms_delete.py

@@ -2,11 +2,16 @@
 Test rooms API endpoints in the Meet core app: delete.
 """
 
+from unittest import mock
+
 import pytest
 from rest_framework.test import APIClient
 
+from ...analytics import AnalyticsEvent
 from ...factories import RoomFactory, UserFactory
-from ...models import Room
+from ...models import Room, RoomAccessLevel
+from ...services.room_management import RoomManagement, RoomNotFoundException
+from ...services.sip_management import SIPManagement
 
 pytestmark = pytest.mark.django_db
 
@@ -83,12 +88,52 @@ def test_api_rooms_delete_administrators():
     assert Room.objects.count() == 1
 
 
-def test_api_rooms_delete_owners():
+@mock.patch("core.api.viewsets.analytics.capture")
+@mock.patch.object(SIPManagement, "delete_dispatch_rule")
+@mock.patch.object(RoomManagement, "delete_room")
+def test_api_rooms_delete_owners(mock_delete_room, _, mock_capture):
     """
     Authenticated users should be able to delete a room for which they are directly
-    owner.
+    owner. The room is soft deleted, its LiveKit room is closed and a ROOM_DELETED
+    analytics event is emitted.
     """
     user = UserFactory()
+    room = RoomFactory(users=[(user, "owner")], access_level=RoomAccessLevel.TRUSTED)
+
+    client = APIClient()
+    client.force_login(user)
+
+    response = client.delete(
+        f"/api/v1.0/rooms/{room.id}/",
+    )
+
+    assert response.status_code == 204
+    mock_delete_room.assert_called_once_with(str(room.id))
+    assert Room.objects.exists() is False
+    assert Room.all_objects.get(id=room.id).deleted_at is not None
+
+    mock_capture.assert_called_once_with(
+        user,
+        AnalyticsEvent.ROOM_DELETED,
+        {"room_id": str(room.pk), "access_level": RoomAccessLevel.TRUSTED},
+    )
+
+
+@mock.patch.object(SIPManagement, "delete_dispatch_rule")
+@mock.patch.object(
+    RoomManagement,
+    "delete_room",
+    side_effect=RoomNotFoundException("Room does not exist"),
+)
+def test_api_rooms_delete_owners_room_not_live(
+    mock_delete_room, mock_delete_dispatch_rule, settings
+):
+    """
+    Deleting a room that is not live in LiveKit should still soft delete it, and
+    delete its SIP dispatch rule, as no room_finished webhook will.
+    """
+    settings.ROOM_TELEPHONY_ENABLED = True
+    user = UserFactory()
     room = RoomFactory(users=[(user, "owner")])
 
     client = APIClient()
@@ -99,4 +144,47 @@ def test_api_rooms_delete_owners():
     )
 
     assert response.status_code == 204
+    mock_delete_room.assert_called_once_with(str(room.id))
+    mock_delete_dispatch_rule.assert_called_once_with(room.id)
     assert Room.objects.exists() is False
+    assert Room.all_objects.get(id=room.id).deleted_at is not None
+
+
+@mock.patch.object(RoomManagement, "delete_room")
+def test_api_rooms_delete_soft_deleted(mock_delete_room):
+    """Deleting a room that is already soft deleted should return a 410."""
+    user = UserFactory()
+    room = RoomFactory(users=[(user, "owner")])
+    room.soft_delete()
+
+    client = APIClient()
+    client.force_login(user)
+
+    response = client.delete(
+        f"/api/v1.0/rooms/{room.id}/",
+    )
+
+    assert response.status_code == 410
+    assert response.json() == {"detail": "This room has been deleted."}
+    mock_delete_room.assert_not_called()
+
+
+@mock.patch.object(RoomManagement, "delete_room")
+def test_api_rooms_delete_soft_deleted_not_owner(mock_delete_room):
+    """
+    Deleting a soft-deleted room as a non-owner should return a 403,
+    not revealing that the room has been deleted.
+    """
+    user = UserFactory()
+    room = RoomFactory(users=[(user, "administrator")])
+    room.soft_delete()
+
+    client = APIClient()
+    client.force_login(user)
+
+    response = client.delete(
+        f"/api/v1.0/rooms/{room.id}/",
+    )
+
+    assert response.status_code == 403
+    mock_delete_room.assert_not_called()

src/backend/core/tests/rooms/test_api_rooms_lobby.py

@@ -974,3 +974,19 @@ def test_request_entry_accepts_signed_credential(generate_config, _notify):
     assert response.json()["livekit"] == {"token": "test-token"}
     generate_config.assert_called_once()
     assert generate_config.call_args.kwargs["participant_id"] == public_id
+
+
+@mock.patch(
+    "core.services.participants_management.ParticipantsManagement.check_if_in_meeting",
+    return_value=True,
+)
+def test_lobby_not_affected_by_recording_setting(mock_check, settings):
+    """The recording opt-out must not leak into the lobby capability."""
+    settings.RECORDING_AUTHENTICATED_PARTICIPANTS_ENABLED = False
+    room = RoomFactory(access_level=RoomAccessLevel.TRUSTED)
+    user = UserFactory()
+    client = APIClient()
+    client.force_login(user)
+    response = client.get(f"/api/v1.0/rooms/{room.id}/waiting-participants/")
+
+    assert response.status_code == 200

src/backend/core/tests/rooms/test_api_rooms_participants_management.py

@@ -2,7 +2,8 @@
 Test rooms API endpoints in the Meet core app: participants management.
 """
 
-# pylint: disable=redefined-outer-name,unused-argument,protected-access,no-name-in-module,too-many-lines
+# pylint: disable=redefined-outer-name,unused-argument,protected-access
+# pylint: disable=no-name-in-module,too-many-lines
 
 import random
 from unittest import mock

src/backend/core/tests/rooms/test_api_rooms_recording_participants.py

@@ -0,0 +1,412 @@
+"""Trusted and public rooms: any authenticated participant present in the meeting can record."""
+
+# pylint: disable=redefined-outer-name,unused-argument,protected-access
+
+from unittest import mock
+
+import pytest
+from rest_framework.test import APIClient
+
+from core.factories import RecordingFactory, RoomFactory, UserFactory
+from core.models import (
+    Recording,
+    RecordingStatusChoices,
+    RoleChoices,
+    RoomAccessLevel,
+)
+from core.recording.event.notification import NotificationService
+from core.services.presence import PresenceCache
+
+pytestmark = pytest.mark.django_db
+
+
+@pytest.fixture
+def mock_worker_manager():
+    """Mock the worker service factory and mediator."""
+    with (
+        mock.patch("core.api.viewsets.get_worker_service"),
+        mock.patch("core.api.viewsets.WorkerServiceMediator") as mediator_class,
+    ):
+        mediator = mock.Mock()
+        mediator_class.return_value = mediator
+        yield mediator
+
+
+@pytest.fixture(autouse=True)
+def enable_recording(settings):
+    """Recording must be enabled for the endpoints to be reachable."""
+    settings.RECORDING_ENABLE = True
+
+
+@pytest.mark.parametrize(
+    "access_level", [RoomAccessLevel.TRUSTED, RoomAccessLevel.PUBLIC]
+)
+@mock.patch(
+    "core.services.participants_management.ParticipantsManagement.check_if_in_meeting",
+    return_value=True,
+)
+def test_open_room_present_user_can_start_recording(
+    mock_check, access_level, mock_worker_manager
+):
+    """Authenticated + present in a trusted/public room -> 201, starter is member."""
+    user = UserFactory()
+    room = RoomFactory(access_level=access_level)
+
+    client = APIClient()
+    client.force_login(user)
+
+    response = client.post(
+        f"/api/v1.0/rooms/{room.id}/start-recording/", {"mode": "screen_recording"}
+    )
+
+    assert response.status_code == 201
+    mock_check.assert_called_once_with(room_name=str(room.id), identity=str(user.sub))
+    recording = Recording.objects.get()
+    mock_worker_manager.start.assert_called_once_with(recording)
+    access = recording.accesses.get()
+    assert access.user == user
+    assert access.role == RoleChoices.MEMBER
+
+
+@mock.patch(
+    "core.services.participants_management.ParticipantsManagement.check_if_in_meeting",
+    return_value=True,
+)
+def test_presence_is_cached_until_participant_leaves(mock_check, mock_worker_manager):
+    """Presence is memoized; clearing it forces a LiveKit re-check."""
+    user = UserFactory()
+    room = RoomFactory(access_level=RoomAccessLevel.TRUSTED)
+    RecordingFactory(room=room, status=RecordingStatusChoices.ACTIVE)
+
+    client = APIClient()
+    client.force_login(user)
+
+    url = f"/api/v1.0/rooms/{room.id}/stop-recording/"
+
+    assert client.post(url).status_code == 200
+    assert client.post(url).status_code == 200
+    assert mock_check.call_count == 1
+
+    # participant_left webhook
+    PresenceCache().clear(room.id, str(user.sub))
+    mock_check.return_value = False
+
+    assert client.post(url).status_code == 403
+    assert mock_check.call_count == 2
+
+
+@pytest.mark.parametrize(
+    "access_level", [RoomAccessLevel.TRUSTED, RoomAccessLevel.PUBLIC]
+)
+@mock.patch(
+    "core.services.participants_management.ParticipantsManagement.check_if_in_meeting",
+    return_value=False,
+)
+def test_open_room_absent_user_forbidden(mock_check, access_level, mock_worker_manager):
+    """Authenticated but not connected to the meeting -> 403."""
+    room = RoomFactory(access_level=access_level)
+    user = UserFactory()
+    client = APIClient()
+    client.force_login(user)
+
+    response = client.post(
+        f"/api/v1.0/rooms/{room.id}/start-recording/", {"mode": "screen_recording"}
+    )
+
+    assert response.status_code == 403
+    assert response.json() == {"detail": "You are not allowed to perform this action."}
+    assert Recording.objects.count() == 0
+
+
+@mock.patch(
+    "core.services.participants_management.ParticipantsManagement.check_if_in_meeting",
+    return_value=True,
+)
+def test_restricted_room_present_user_forbidden(mock_check, mock_worker_manager):
+    """Presence is not enough on restricted rooms; LiveKit is not even asked."""
+    room = RoomFactory(access_level=RoomAccessLevel.RESTRICTED)
+    user = UserFactory()
+    client = APIClient()
+    client.force_login(user)
+    response = client.post(
+        f"/api/v1.0/rooms/{room.id}/start-recording/", {"mode": "screen_recording"}
+    )
+
+    assert response.status_code == 403
+    mock_check.assert_not_called()
+    assert Recording.objects.count() == 0
+
+
+@pytest.mark.parametrize(
+    "access_level", [RoomAccessLevel.TRUSTED, RoomAccessLevel.PUBLIC]
+)
+@mock.patch(
+    "core.services.participants_management.ParticipantsManagement.check_if_in_meeting",
+    return_value=True,
+)
+def test_open_room_present_user_can_stop_recording(
+    mock_check, access_level, mock_worker_manager
+):
+    """Any present authenticated user can stop the active recording."""
+    room = RoomFactory(access_level=access_level)
+    recording = RecordingFactory(room=room, status=RecordingStatusChoices.ACTIVE)
+    user = UserFactory()
+    client = APIClient()
+    client.force_login(user)
+    response = client.post(f"/api/v1.0/rooms/{room.id}/stop-recording/")
+
+    assert response.status_code == 200
+    mock_worker_manager.stop.assert_called_once_with(recording)
+
+
+@mock.patch(
+    "core.services.participants_management.ParticipantsManagement.check_if_in_meeting"
+)
+def test_admin_does_not_need_presence(mock_check, mock_worker_manager):
+    """Admins/owners keep recording rights on any room, without a LiveKit check."""
+    user = UserFactory()
+    room = RoomFactory(access_level=RoomAccessLevel.RESTRICTED)
+    room.accesses.create(user=user, role=RoleChoices.ADMIN)
+    client = APIClient()
+    client.force_login(user)
+    response = client.post(
+        f"/api/v1.0/rooms/{room.id}/start-recording/", {"mode": "screen_recording"}
+    )
+
+    assert response.status_code == 201
+    mock_check.assert_not_called()
+
+
+@pytest.mark.parametrize(
+    "access_level", [RoomAccessLevel.TRUSTED, RoomAccessLevel.PUBLIC]
+)
+def test_open_room_anonymous_forbidden(access_level):
+    """Anonymous users never record, even on public rooms."""
+    room = RoomFactory(access_level=access_level)
+    response = APIClient().post(
+        f"/api/v1.0/rooms/{room.id}/start-recording/", {"mode": "screen_recording"}
+    )
+    assert response.status_code == 401
+
+
+@pytest.mark.parametrize(
+    "access_level", [RoomAccessLevel.TRUSTED, RoomAccessLevel.PUBLIC]
+)
+@mock.patch(
+    "core.services.participants_management.ParticipantsManagement.check_if_in_meeting",
+    return_value=True,
+)
+def test_participant_path_disabled_by_setting(
+    mock_check, access_level, settings, mock_worker_manager
+):
+    """Self-hosters can opt out: participants then get 403, LiveKit not asked."""
+    settings.RECORDING_AUTHENTICATED_PARTICIPANTS_ENABLED = False
+    room = RoomFactory(access_level=access_level)
+    RecordingFactory(room=room, status=RecordingStatusChoices.ACTIVE)
+    user = UserFactory()
+    client = APIClient()
+    client.force_login(user)
+
+    start = client.post(
+        f"/api/v1.0/rooms/{room.id}/start-recording/", {"mode": "screen_recording"}
+    )
+    stop = client.post(f"/api/v1.0/rooms/{room.id}/stop-recording/")
+
+    assert start.status_code == 403
+    assert stop.status_code == 403
+    mock_check.assert_not_called()
+    mock_worker_manager.start.assert_not_called()
+    mock_worker_manager.stop.assert_not_called()
+
+
+@mock.patch(
+    "core.services.participants_management.ParticipantsManagement.check_if_in_meeting"
+)
+def test_participant_path_disabled_admin_still_records(
+    mock_check, settings, mock_worker_manager
+):
+    """The setting only removes the participant path, never admin rights."""
+    settings.RECORDING_AUTHENTICATED_PARTICIPANTS_ENABLED = False
+    user = UserFactory()
+    room = RoomFactory(access_level=RoomAccessLevel.TRUSTED)
+    room.accesses.create(user=user, role=RoleChoices.OWNER)
+    client = APIClient()
+    client.force_login(user)
+
+    response = client.post(
+        f"/api/v1.0/rooms/{room.id}/start-recording/", {"mode": "screen_recording"}
+    )
+
+    assert response.status_code == 201
+    mock_check.assert_not_called()
+
+
+@mock.patch(
+    "core.services.participants_management.ParticipantsManagement.check_if_in_meeting",
+    return_value=True,
+)
+def test_public_room_lobby_is_open_but_empty(mock_check):
+    """Participants pass the lobby permission on public rooms, which have no lobby."""
+    room = RoomFactory(access_level=RoomAccessLevel.PUBLIC)
+    user = UserFactory()
+    client = APIClient()
+    client.force_login(user)
+
+    listing = client.get(f"/api/v1.0/rooms/{room.id}/waiting-participants/")
+    entry = client.post(
+        f"/api/v1.0/rooms/{room.id}/enter/",
+        {"participant_id": "2f7f162f-e7d1-421b-90e7-02bfbfbf8def", "allow_entry": True},
+    )
+
+    assert listing.status_code == 200
+    assert listing.json() == {"participants": []}
+    assert entry.status_code == 404
+    assert entry.json() == {"message": "Room has no lobby system."}
+
+
+@pytest.mark.parametrize("enabled", [True, False])
+def test_config_exposes_authenticated_participants_setting(settings, enabled):
+    """The frontend reads the setting from /config/ to gate the UI."""
+    settings.RECORDING_AUTHENTICATED_PARTICIPANTS_ENABLED = enabled
+
+    response = APIClient().get("/api/v1.0/config/")
+
+    assert response.status_code == 200
+    assert response.json()["recording"]["authenticated_participants_enabled"] is enabled
+
+
+@mock.patch(
+    "core.services.participants_management.ParticipantsManagement.check_if_in_meeting",
+    return_value=True,
+)
+def test_room_owners_and_admins_get_access_to_participant_recording(
+    mock_check, mock_worker_manager
+):
+    """Room owners/admins own the recording, the starter is member; room members get nothing."""
+    starter = UserFactory()
+    room_owner = UserFactory()
+    room_admin = UserFactory()
+    room_member = UserFactory()
+    room = RoomFactory(access_level=RoomAccessLevel.TRUSTED)
+    room.accesses.create(user=room_owner, role=RoleChoices.OWNER)
+    room.accesses.create(user=room_admin, role=RoleChoices.ADMIN)
+    room.accesses.create(user=room_member, role=RoleChoices.MEMBER)
+    client = APIClient()
+    client.force_login(starter)
+    response = client.post(
+        f"/api/v1.0/rooms/{room.id}/start-recording/", {"mode": "screen_recording"}
+    )
+
+    assert response.status_code == 201
+    recording = Recording.objects.get()
+    assert dict(recording.accesses.values_list("user_id", "role")) == {
+        starter.id: RoleChoices.MEMBER,
+        room_owner.id: RoleChoices.OWNER,
+        room_admin.id: RoleChoices.OWNER,
+    }
+
+    # Room admins can see and download it; plain members cannot.
+    client.force_login(room_admin)
+    assert client.get(f"/api/v1.0/recordings/{recording.id}/").status_code == 200
+    client.force_login(room_member)
+    assert client.get(f"/api/v1.0/recordings/{recording.id}/").status_code == 404
+
+
+@mock.patch(
+    "core.services.participants_management.ParticipantsManagement.check_if_in_meeting"
+)
+def test_room_admin_starter_is_not_duplicated(mock_check, mock_worker_manager):
+    """A room admin who starts the recording gets an exclusive access."""
+    starter = UserFactory()
+    co_owner = UserFactory()
+    room = RoomFactory(access_level=RoomAccessLevel.RESTRICTED)
+    room.accesses.create(user=starter, role=RoleChoices.ADMIN)
+    room.accesses.create(user=co_owner, role=RoleChoices.OWNER)
+    client = APIClient()
+    client.force_login(starter)
+    response = client.post(
+        f"/api/v1.0/rooms/{room.id}/start-recording/", {"mode": "screen_recording"}
+    )
+
+    assert response.status_code == 201
+    recording = Recording.objects.get()
+    assert dict(recording.accesses.values_list("user_id", "role")) == {
+        starter.id: RoleChoices.OWNER,
+        co_owner.id: RoleChoices.OWNER,
+    }
+
+
+@mock.patch(
+    "core.services.participants_management.ParticipantsManagement.check_if_in_meeting",
+    return_value=True,
+)
+def test_participant_can_stop_recording_started_by_someone_else(
+    mock_check, mock_worker_manager
+):
+    """Stopping is room-wide on trusted rooms, not tied to who started it."""
+    room = RoomFactory(access_level=RoomAccessLevel.TRUSTED)
+    recording = RecordingFactory(room=room, status=RecordingStatusChoices.ACTIVE)
+    recording.accesses.create(user=UserFactory(), role=RoleChoices.OWNER)
+    user = UserFactory()
+    client = APIClient()
+    client.force_login(user)
+
+    response = client.post(f"/api/v1.0/rooms/{room.id}/stop-recording/")
+
+    assert response.status_code == 200
+    mock_worker_manager.stop.assert_called_once_with(recording)
+
+
+@mock.patch(
+    "core.services.participants_management.ParticipantsManagement.check_if_in_meeting",
+    return_value=True,
+)
+def test_summary_goes_to_starter_among_several_owners(mock_check, mock_worker_manager):
+    """The starter's access is created first, so the summary goes to them."""
+    starter = UserFactory()
+    room = RoomFactory(access_level=RoomAccessLevel.TRUSTED)
+    for _ in range(2):
+        room.accesses.create(user=UserFactory(), role=RoleChoices.OWNER)
+    client = APIClient()
+    client.force_login(starter)
+
+    response = client.post(
+        f"/api/v1.0/rooms/{room.id}/start-recording/", {"mode": "transcript"}
+    )
+
+    assert response.status_code == 201
+    recording = Recording.objects.get()
+    assert recording.accesses.count() == 3
+    assert NotificationService._get_summary_recipient(recording) == starter
+
+
+@mock.patch(
+    "core.services.participants_management.ParticipantsManagement.check_if_in_meeting",
+    return_value=True,
+)
+def test_participant_starter_can_retrieve_but_not_delete(
+    mock_check, mock_worker_manager
+):
+    """A starter without a privileged room role can download but not delete."""
+    starter = UserFactory()
+    room_owner = UserFactory()
+    room = RoomFactory(access_level=RoomAccessLevel.TRUSTED)
+    room.accesses.create(user=room_owner, role=RoleChoices.OWNER)
+    client = APIClient()
+    client.force_login(starter)
+
+    response = client.post(
+        f"/api/v1.0/rooms/{room.id}/start-recording/", {"mode": "screen_recording"}
+    )
+    assert response.status_code == 201
+    recording = Recording.objects.get()
+    recording.status = RecordingStatusChoices.SAVED
+    recording.save()
+
+    assert client.get(f"/api/v1.0/recordings/{recording.id}/").status_code == 200
+    assert client.delete(f"/api/v1.0/recordings/{recording.id}/").status_code == 403
+    assert Recording.objects.filter(id=recording.id).exists()
+
+    client.force_login(room_owner)
+    assert client.delete(f"/api/v1.0/recordings/{recording.id}/").status_code == 204
+    assert not Recording.objects.filter(id=recording.id).exists()

src/backend/core/tests/rooms/test_api_rooms_retrieve.py

@@ -193,6 +193,28 @@ def test_api_rooms_retrieve_anonymous_unregistered_not_allowed():
     assert response.json() == {"detail": "No Room matches the given query."}
 
 
+@pytest.mark.parametrize("allow_unregistered_rooms", [True, False])
+@pytest.mark.parametrize("lookup", ["id", "slug"])
+@mock.patch("core.utils.generate_token", return_value="foo")
+def test_api_rooms_retrieve_soft_deleted(
+    mock_token, lookup, allow_unregistered_rooms, settings
+):
+    """
+    Retrieving a soft-deleted room should return a 410, and never fall back
+    to an unregistered room with the same slug.
+    """
+    settings.ALLOW_UNREGISTERED_ROOMS = allow_unregistered_rooms
+    room = RoomFactory(access_level=RoomAccessLevel.PUBLIC)
+    room.soft_delete()
+
+    client = APIClient()
+    response = client.get(f"/api/v1.0/rooms/{getattr(room, lookup)!s}/")
+
+    assert response.status_code == 410
+    assert response.json() == {"detail": "This room has been deleted."}
+    mock_token.assert_not_called()
+
+
 @mock.patch("core.utils.generate_token", return_value="foo")
 @override_settings(
     LIVEKIT_CONFIGURATION={

src/backend/core/tests/rooms/test_api_rooms_start_recording.py

@@ -2,7 +2,7 @@
 Test rooms API endpoints in the Meet core app: start recording.
 """
 
-# pylint: disable=redefined-outer-name,unused-argument,no-member
+# pylint: disable=redefined-outer-name,unused-argument,no-member,too-many-lines
 
 from unittest import mock
 
@@ -10,8 +10,9 @@ import pytest
 from livekit import api as livekit_api
 from rest_framework.test import APIClient
 
+from ...audit.testing import capture_audit, find_events
 from ...factories import RoomFactory, UserFactory
-from ...models import Recording
+from ...models import Recording, RoomAccessLevel
 from ...recording.worker.exceptions import RecordingStartError
 
 pytestmark = pytest.mark.django_db
@@ -42,8 +43,13 @@ def mock_worker_manager(mock_worker_service):
         yield mock_mediator
 
 
-def test_start_recording_anonymous():
+@pytest.mark.parametrize(
+    "recording_enabled, expected_status",
+    [(True, 401), (False, 404)],
+)
+def test_start_recording_anonymous(settings, recording_enabled, expected_status):
     """Anonymous users should not be allowed to start room recordings."""
+    settings.RECORDING_ENABLE = recording_enabled
     room = RoomFactory()
     client = APIClient()
 
@@ -52,14 +58,24 @@ def test_start_recording_anonymous():
         {"mode": "screen_recording"},
     )
 
-    assert response.status_code == 401
+    assert response.status_code == expected_status
     assert Recording.objects.count() == 0
 
 
-def test_start_recording_non_owner_and_non_administrator(settings):
-    """Non-owner and Non-Administrator users should not be allowed to start room recordings."""
+@pytest.mark.parametrize("authenticated_participants_enabled", [True, False])
+def test_start_recording_restricted_room_non_owner_and_non_administrator(
+    settings, authenticated_participants_enabled
+):
+    """
+    On restricted rooms, non-owner and non-administrator users should not be
+    allowed to start recordings, whether or not authenticated participants
+    are allowed to record.
+    """
     settings.RECORDING_ENABLE = True
-    room = RoomFactory()
+    settings.RECORDING_AUTHENTICATED_PARTICIPANTS_ENABLED = (
+        authenticated_participants_enabled
+    )
+    room = RoomFactory(access_level=RoomAccessLevel.RESTRICTED)
     user = UserFactory()
     client = APIClient()
     client.force_login(user)
@@ -879,3 +895,145 @@ def test_start_recording_options_original_mode_invalid(settings, value):
     )
 
     assert response.status_code == 400
+
+
+def test_start_recording_is_audited(
+    settings, mock_worker_service_factory, mock_worker_manager, audit_events
+):
+    """A started screen recording names the recording and its mode."""
+    settings.RECORDING_ENABLE = True
+    room = RoomFactory()
+    user = UserFactory()
+    room.accesses.create(user=user, role="owner")
+    client = APIClient()
+    client.force_login(user)
+
+    response = client.post(
+        f"/api/v1.0/rooms/{room.id}/start-recording/",
+        {"mode": "screen_recording"},
+    )
+
+    assert response.status_code == 201
+
+    recording = Recording.objects.get(room=room)
+    [event] = find_events(audit_events, "recording.start")
+
+    assert event["event"]["type"] == ["start"]
+    assert event["lasuite"]["outcome"] == "success"
+    assert event["user"]["id"] == str(user.pk)
+    assert event["entity"]["target"] == {
+        "id": str(recording.pk),
+        "sub_type": "recording",
+        "raw": {
+            "room_id": str(room.pk),
+            "status": "initiated",
+            "mode": "screen_recording",
+            "requested_mode": "screen_recording",
+            "is_transcribed": False,
+        },
+    }
+    assert event["lasuite"]["details"] == {"collect_metadata": False}
+
+
+def test_start_recording_transcript_with_screen_capture_is_audited(
+    settings, mock_worker_service_factory, mock_worker_manager, audit_events
+):
+    """A transcript recorded with the screen is told apart from a screen recording."""
+    settings.RECORDING_ENABLE = True
+    room = RoomFactory()
+    user = UserFactory()
+    room.accesses.create(user=user, role="owner")
+    client = APIClient()
+    client.force_login(user)
+
+    response = client.post(
+        f"/api/v1.0/rooms/{room.id}/start-recording/",
+        {
+            "mode": "screen_recording",
+            "options": {"transcribe": True, "original_mode": "transcript"},
+        },
+        format="json",
+    )
+
+    assert response.status_code == 201
+
+    [event] = find_events(audit_events, "recording.start")
+    target = event["entity"]["target"]["raw"]
+
+    assert target["mode"] == "screen_recording"
+    assert target["requested_mode"] == "transcript"
+    assert target["is_transcribed"] is True
+
+
+def test_start_recording_conflict_is_audited_on_the_room(
+    settings, mock_worker_service_factory, mock_worker_manager, audit_events
+):
+    """A conflicting start is a failure aimed at the room, no recording existing."""
+    settings.RECORDING_ENABLE = True
+    room = RoomFactory()
+    user = UserFactory()
+    room.accesses.create(user=user, role="owner")
+    Recording.objects.create(room=room, mode="screen_recording", status="active")
+    client = APIClient()
+    client.force_login(user)
+
+    response = client.post(
+        f"/api/v1.0/rooms/{room.id}/start-recording/",
+        {"mode": "transcript"},
+    )
+
+    assert response.status_code == 409
+
+    [event] = find_events(audit_events, "recording.start")
+
+    assert event["lasuite"]["outcome"] == "failure"
+    assert event["event"]["reason"] == "conflict"
+    assert event["entity"]["target"]["sub_type"] == "room"
+    assert event["entity"]["target"]["id"] == str(room.pk)
+
+
+def test_start_recording_worker_error_is_audited(
+    settings, mock_worker_service_factory, mock_worker_manager, audit_events
+):
+    """A recording the worker could not start is a failure on that recording."""
+    settings.RECORDING_ENABLE = True
+    room = RoomFactory()
+    user = UserFactory()
+    room.accesses.create(user=user, role="owner")
+    mock_worker_manager.start = mock.Mock(side_effect=RecordingStartError("boom"))
+    client = APIClient()
+    client.force_login(user)
+
+    response = client.post(
+        f"/api/v1.0/rooms/{room.id}/start-recording/",
+        {"mode": "transcript"},
+    )
+
+    assert response.status_code == 502
+
+    [event] = find_events(audit_events, "recording.start")
+
+    assert event["lasuite"]["outcome"] == "failure"
+    assert event["http"]["response"]["status_code"] == 502
+    assert event["entity"]["target"]["id"] == str(Recording.objects.get().pk)
+    assert event["entity"]["target"]["raw"]["mode"] == "transcript"
+    assert event["entity"]["target"]["raw"]["is_transcribed"] is True
+
+
+def test_start_recording_anonymous_is_audited(settings):
+    """An anonymous attempt is denied."""
+    settings.RECORDING_ENABLE = True
+    room = RoomFactory()
+
+    with capture_audit() as events:
+        response = APIClient().post(
+            f"/api/v1.0/rooms/{room.id}/start-recording/",
+            {"mode": "screen_recording"},
+        )
+
+    assert response.status_code == 401
+
+    [event] = find_events(events, "recording.start")
+
+    assert event["lasuite"]["outcome"] == "denied"
+    assert event["lasuite"]["actor"]["type"] == "anonymous"

src/backend/core/tests/rooms/test_api_rooms_start_recording_throttling.py

@@ -0,0 +1,212 @@
+"""
+Test rooms API endpoints in the Meet core app: start recording throttling.
+"""
+
+# pylint: disable=redefined-outer-name,unused-argument
+
+from unittest import mock
+
+import pytest
+from rest_framework.test import APIClient
+
+from ...api.throttling import (
+    StartRecordingDailyUserRateThrottle,
+    StartRecordingUserRateThrottle,
+)
+from ...factories import RoomFactory, UserFactory
+from ...models import Recording
+
+pytestmark = pytest.mark.django_db
+
+
+@pytest.fixture
+def start_recording_throttle(monkeypatch):
+    """Lower the start recording rates."""
+    rates = StartRecordingUserRateThrottle.THROTTLE_RATES
+    monkeypatch.setitem(rates, "start_recording", "2/minute")
+    monkeypatch.setitem(rates, "start_recording_daily", "100/day")
+
+
+@pytest.fixture
+def daily_start_recording_throttle(monkeypatch):
+    """Lower the daily start recording rate and control the clock."""
+    rates = StartRecordingDailyUserRateThrottle.THROTTLE_RATES
+    monkeypatch.setitem(rates, "start_recording", "100/minute")
+    monkeypatch.setitem(rates, "start_recording_daily", "3/day")
+    now = [1_000_000.0]
+    monkeypatch.setattr(StartRecordingUserRateThrottle, "timer", lambda self: now[0])
+    return now
+
+
+@mock.patch("core.api.viewsets.WorkerServiceMediator")
+@mock.patch("core.api.viewsets.get_worker_service")
+def test_start_recording_throttled(
+    mock_get_worker_service, mock_mediator_class, start_recording_throttle, settings
+):
+    """Starting a recording should return 429 when exceeding the per-minute rate."""
+    settings.RECORDING_ENABLE = True
+    user = UserFactory()
+    client = APIClient()
+    client.force_login(user)
+
+    for _ in range(2):
+        room = RoomFactory(users=[(user, "owner")])
+        response = client.post(
+            f"/api/v1.0/rooms/{room.id}/start-recording/",
+            {"mode": "screen_recording"},
+        )
+        assert response.status_code == 201
+
+    room = RoomFactory(users=[(user, "owner")])
+    response = client.post(
+        f"/api/v1.0/rooms/{room.id}/start-recording/",
+        {"mode": "screen_recording"},
+    )
+
+    assert response.status_code == 429
+    assert 0 < int(response["Retry-After"]) <= 60
+    assert Recording.objects.count() == 2
+    assert mock_mediator_class.return_value.start.call_count == 2
+
+
+@mock.patch("core.api.viewsets.WorkerServiceMediator")
+@mock.patch("core.api.viewsets.get_worker_service")
+def test_start_recording_throttle_counts_failed_attempts(
+    mock_get_worker_service, mock_mediator_class, start_recording_throttle, settings
+):
+    """Failed recording starts should count toward the rate."""
+    settings.RECORDING_ENABLE = True
+    user = UserFactory()
+    room = RoomFactory(users=[(user, "owner")])
+    Recording.objects.create(room=room, mode="screen_recording", status="active")
+    client = APIClient()
+    client.force_login(user)
+
+    for _ in range(2):
+        response = client.post(
+            f"/api/v1.0/rooms/{room.id}/start-recording/",
+            {"mode": "screen_recording"},
+        )
+        assert response.status_code == 409
+
+    response = client.post(
+        f"/api/v1.0/rooms/{room.id}/start-recording/",
+        {"mode": "screen_recording"},
+    )
+
+    assert response.status_code == 429
+
+
+@mock.patch("core.api.viewsets.WorkerServiceMediator")
+@mock.patch("core.api.viewsets.get_worker_service")
+def test_start_recording_throttle_per_user(
+    mock_get_worker_service, mock_mediator_class, start_recording_throttle, settings
+):
+    """Starting a recording should succeed when another user is throttled."""
+    settings.RECORDING_ENABLE = True
+    client = APIClient()
+
+    user = UserFactory()
+    client.force_login(user)
+    for _ in range(2):
+        room = RoomFactory(users=[(user, "owner")])
+        response = client.post(
+            f"/api/v1.0/rooms/{room.id}/start-recording/",
+            {"mode": "screen_recording"},
+        )
+        assert response.status_code == 201
+
+    room = RoomFactory(users=[(user, "owner")])
+    response = client.post(
+        f"/api/v1.0/rooms/{room.id}/start-recording/",
+        {"mode": "screen_recording"},
+    )
+    assert response.status_code == 429
+
+    other_user = UserFactory()
+    client.force_login(other_user)
+    room = RoomFactory(users=[(other_user, "owner")])
+    response = client.post(
+        f"/api/v1.0/rooms/{room.id}/start-recording/",
+        {"mode": "screen_recording"},
+    )
+
+    assert response.status_code == 201
+
+
+@mock.patch("core.api.viewsets.WorkerServiceMediator")
+@mock.patch("core.api.viewsets.get_worker_service")
+def test_start_recording_throttle_does_not_limit_other_actions(
+    mock_get_worker_service, mock_mediator_class, start_recording_throttle, settings
+):
+    """Other room actions should succeed when starting a recording is throttled."""
+    settings.RECORDING_ENABLE = True
+    user = UserFactory()
+    client = APIClient()
+    client.force_login(user)
+
+    rooms = RoomFactory.create_batch(3, users=[(user, "owner")])
+    for room in rooms[:2]:
+        response = client.post(
+            f"/api/v1.0/rooms/{room.id}/start-recording/",
+            {"mode": "screen_recording"},
+        )
+        assert response.status_code == 201
+
+    response = client.post(
+        f"/api/v1.0/rooms/{rooms[2].id}/start-recording/",
+        {"mode": "screen_recording"},
+    )
+    assert response.status_code == 429
+
+    Recording.objects.filter(room=rooms[0]).update(status="active")
+    response = client.post(f"/api/v1.0/rooms/{rooms[0].id}/stop-recording/")
+    assert response.status_code == 200
+
+    response = client.get("/api/v1.0/rooms/")
+    assert response.status_code == 200
+
+    response = client.post("/api/v1.0/rooms/", {"name": "New room"})
+    assert response.status_code == 201
+
+
+@mock.patch("core.api.viewsets.WorkerServiceMediator")
+@mock.patch("core.api.viewsets.get_worker_service")
+def test_start_recording_daily_throttled(
+    mock_get_worker_service,
+    mock_mediator_class,
+    daily_start_recording_throttle,
+    settings,
+):
+    """Starting a recording should return 429 when exceeding the daily rate."""
+    settings.RECORDING_ENABLE = True
+    now = daily_start_recording_throttle
+    user = UserFactory()
+    client = APIClient()
+    client.force_login(user)
+
+    for _ in range(3):
+        room = RoomFactory(users=[(user, "owner")])
+        response = client.post(
+            f"/api/v1.0/rooms/{room.id}/start-recording/",
+            {"mode": "screen_recording"},
+        )
+        assert response.status_code == 201
+        now[0] += 120
+
+    room = RoomFactory(users=[(user, "owner")])
+    response = client.post(
+        f"/api/v1.0/rooms/{room.id}/start-recording/",
+        {"mode": "screen_recording"},
+    )
+    assert response.status_code == 429
+    assert 60 < int(response["Retry-After"]) <= 86400
+
+    now[0] += 86400
+    room = RoomFactory(users=[(user, "owner")])
+    response = client.post(
+        f"/api/v1.0/rooms/{room.id}/start-recording/",
+        {"mode": "screen_recording"},
+    )
+
+    assert response.status_code == 201