🔖(minor) bump release to 1.18.0

Last PR was merged a bit too quicly and another migration
was added before the PR one.

.github/workflows/meet.yml

@@ -305,6 +305,7 @@ jobs:
         working-directory: src/summary
 
     env:
+      V1_TENANT_ID: 'test-tenant'
       AUTHORIZED_TENANTS: '[{"id": "test-tenant", "api_key": "test-api-token", "webhook_url": "https://example.com/webhook", "webhook_api_key": "test-webhook-api-key"}]'
       AWS_STORAGE_BUCKET_NAME: "http://meet-media-storage"
       AWS_S3_ENDPOINT_URL: "minio:9000"

.gitignore

@@ -83,3 +83,6 @@ docker/livekit/out
 
 # LiveKit CA configuration
 docker/livekit/rootCA.pem
+
+# Frontend rollup-plugin-visualizer
+/src/frontend/rollup-plugin-visualizer/*

CHANGELOG.md

@@ -8,6 +8,21 @@ and this project adheres to
 
 ## [Unreleased]
 
+## [1.18.0] - 2026-06-03
+
+### Added
+
+- 🔧(backend) backport logging configuration from docs
+- 🧑‍💻(backend) add management command to merge duplicate users
+- 👷(helm) add Kubernetes job for duplicate user merge command
+
+### Fixed
+
+- 🐛(backend) prevent duplicate pending users on concurrent requests
+- 🔒️(backend) prevent file change post checks #1377
+
+## [1.17.0] - 2026-05-31
+
 ### Added
 
 - ✨(fullstack) allow participants to mute others based on room configuration
@@ -15,12 +30,21 @@ and this project adheres to
 - ✨(frontend) make reaction toolbar responsive on small viewports
 - ✨(frontend) enable reactions on mobile devices
 - ✨(frontend) introduce picture-in-picture meeting
+- ✨(backend) add core.recording.event.parsers.S3Parser
+- ✨(summary) extended support for all video / audio files #1358
 
-### Changed 
+### Changed
 
 - ♻️(fullstack) simplify source serialization
 - ✨(backend) expose room configuration to all API consumers
 - 🩹(frontend) improve reaction toolbar centering with dynamic positioning
+- 🚀 (paas) remove buildpack requirements.txt to use the new uv.lock #1349
+- ✨(backend) allow room configuration and access level via external api #1260
+- ♻️(backend) prefix Swagger routes with /api
+
+### Fixed
+
+- 🩹(backend) fix swagger and redoc documentation URLs
 
 ## [1.16.0] - 2026-05-13
 

bin/Tiltfile

@@ -23,8 +23,8 @@ docker_build(
     live_update=[
         sync('../src/backend', '/app'),
         run(
-            'pip install -r /app/requirements.txt',
-            trigger=['./api/requirements.txt']
+            'uv sync --locked --no-dev',
+            trigger=['../src/backend/uv.lock', '../src/backend/pyproject.toml']
         )
     ]
 )
@@ -110,11 +110,20 @@ k8s_resource('meet-celery-backend', resource_deps=['redis'])
 k8s_resource('meet-celery-summarize', resource_deps=['redis'])
 k8s_resource('meet-celery-summary-backend', resource_deps=['redis'])
 k8s_resource('meet-celery-transcribe-default', resource_deps=['redis'])
-k8s_resource('meet-backend-migrate', resource_deps=['meet-backend'])
 k8s_resource('livekit-livekit-server', resource_deps=['redis'])
 k8s_resource('livekit-livekit-server-test-connection', resource_deps=['livekit-livekit-server'])
 k8s_resource('keycloak', resource_deps=['kc-postgresql'])
-k8s_resource('meet-backend-createsuperuser', resource_deps=['meet-backend-migrate'])
+# Trigger once on launch
+k8s_resource(
+    'meet-backend-createsuperuser',
+    resource_deps=['meet-backend-migrate'],
+    trigger_mode=TRIGGER_MODE_MANUAL,
+)
+k8s_resource(
+    'meet-backend-migrate',
+    resource_deps=['meet-backend'],
+    trigger_mode=TRIGGER_MODE_MANUAL,
+)
 
 migration = '''
 set -eu

bin/buildpack_postfrontend.sh

@@ -47,4 +47,3 @@ mv src/backend/* ./
 mv deploy/paas/* ./
 
 echo "3.13" > .python-version
-echo "." > requirements.txt

docs/openapi.yaml

@@ -185,6 +185,7 @@ paths:
                           pin_code: "123456"
                           phone_number: "+1-555-0100"
                           default_country: "US"
+                        configuration: {}
         '401':
           $ref: '#/components/responses/UnauthorizedError'
         '403':
@@ -198,10 +199,6 @@ paths:
       description: |
         Creates a new room with secure defaults for external API usage.
         
-        **Restrictions:**
-        - Rooms are always created with `trusted` access (no public rooms via API)
-        - Room access_level can be updated from the webapp interface.
-        
         **Defaults:**
         - Delegated user is set as owner
         - Room slug auto-generated for uniqueness
@@ -218,8 +215,17 @@ paths:
               $ref: '#/components/schemas/RoomCreate'
             examples:
               emptyBody:
-                summary: No parameters (default)
-                value: {}
+                summary: No parameters (use all defaults)
+                value: { }
+              withAccessLevel:
+                summary: Specify access level
+                value:
+                  access_level: "trusted"
+              withConfiguration:
+                summary: Provide room configuration
+                value:
+                  configuration:
+                    everyone_can_mute: true
       responses:
         '201':
           description: Room created successfully
@@ -269,6 +275,7 @@ paths:
                       pin_code: "123456"
                       phone_number: "+1-555-0100"
                       default_country: "US"
+                    configuration: {}
         '401':
           $ref: '#/components/responses/UnauthorizedError'
         '403':
@@ -344,8 +351,56 @@ components:
 
     RoomCreate:
       type: object
-      description: Empty object - all room properties are auto-generated
-      properties: {}
+      description: |
+        Optional fields for room creation. All fields have secure defaults if omitted.
+      properties:
+        access_level:
+          $ref: '#/components/schemas/RoomAccessLevel'
+        configuration:
+          $ref: '#/components/schemas/RoomConfiguration'
+
+    RoomConfiguration:
+      type: object
+      description: |
+        Optional room behaviour settings. Unknown fields are rejected.
+        All fields are optional and default to `null` (server-side defaults apply).
+      properties:
+        can_publish_sources:
+          type: array
+          nullable: true
+          description: |
+            Restricts which media tracks participants are allowed to publish.
+            If `null`, all sources are permitted.
+          items:
+            type: string
+            enum:
+              - camera
+              - microphone
+              - screen_share
+              - screen_share_audio
+          example: [ "camera", "microphone" ]
+        everyone_can_mute:
+          type: boolean
+          nullable: true
+          description: |
+            Whether any participant can mute others, or only the room owner/moderator.
+            If `null`, the server default applies.
+          example: true
+      additionalProperties: false
+
+    RoomAccessLevel:
+      type: string
+      enum:
+        - public
+        - trusted
+        - restricted
+      description: |
+        Controls who can join the room without going through the lobby.
+
+        - `public`: Anyone with the room link can join directly, no authentication required.
+        - `trusted`: Authenticated users join directly. Unauthenticated users wait in the lobby for approval.
+        - `restricted`: Only participants explicitly trusted by the owner bypass the lobby. Everyone else waits for approval regardless of authentication.
+      example: "trusted"
 
     Room:
       type: object
@@ -362,10 +417,7 @@ components:
           description: URL-friendly room identifier (auto-generated)
           example: "aze-eere-zer"
         access_level:
-          type: string
-          readOnly: true
-          description: Room access level (always 'trusted' for API-created rooms)
-          example: "trusted"
+          $ref: '#/components/schemas/RoomAccessLevel'
         url:
           type: string
           format: uri
@@ -393,6 +445,8 @@ components:
               type: string
               description: Default country code
               example: "US"
+        configuration:
+          $ref: '#/components/schemas/RoomConfiguration'
 
     OAuthError:
       type: object

docs/resource_server.yaml

@@ -48,7 +48,7 @@ paths:
       summary: List rooms
       description: |
         Returns a list of rooms accessible to the authenticated user.
-        Only rooms where the delegated user has access will be returned.
+        Only rooms where the user has access will be returned.
       operationId: listRooms
       security:
         - BearerAuth: [rooms:list]
@@ -108,6 +108,7 @@ paths:
                           pin_code: "123456"
                           phone_number: "+1-555-0100"
                           default_country: "US"
+                        configuration: { }
         '401':
           $ref: '#/components/responses/UnauthorizedError'
         '403':
@@ -120,13 +121,9 @@ paths:
       summary: Create a room
       description: |
         Creates a new room with secure defaults for external API usage.
-        
-        **Restrictions:**
-        - Rooms are always created with `trusted` access (no public rooms via API)
-        - Room access_level can be updated from the webapp interface.
-        
+
         **Defaults:**
-        - Delegated user is set as owner
+        - user is set as owner
         - Room slug auto-generated for uniqueness
         - Telephony PIN auto-generated when enabled
         - Creation tracked with application client_id for auditing
@@ -141,8 +138,17 @@ paths:
               $ref: '#/components/schemas/RoomCreate'
             examples:
               emptyBody:
-                summary: No parameters (default)
-                value: {}
+                summary: No parameters (use all defaults)
+                value: { }
+              withAccessLevel:
+                summary: Specify access level
+                value:
+                  access_level: "trusted"
+              withConfiguration:
+                summary: Provide room configuration
+                value:
+                  configuration:
+                    everyone_can_mute: true
       responses:
         '201':
           description: Room created successfully
@@ -192,6 +198,7 @@ paths:
                       pin_code: "123456"
                       phone_number: "+1-555-0100"
                       default_country: "US"
+                    configuration: { }
         '401':
           $ref: '#/components/responses/UnauthorizedError'
         '403':
@@ -210,65 +217,58 @@ components:
         Include in requests as: `Authorization: Bearer <token>`
 
   schemas:
-    TokenRequest:
-      type: object
-      required:
-        - client_id
-        - client_secret
-        - grant_type
-        - scope
-      properties:
-        client_id:
-          type: string
-          description: Application client identifier
-          example: "550e8400-e29b-41d4-a716-446655440000"
-        client_secret:
-          type: string
-          format: password
-          writeOnly: true
-          description: Application secret key
-          example: "1234567890abcdefghijklmnopqrstuvwxyz"
-        grant_type:
-          type: string
-          enum:
-            - client_credentials
-          description: OAuth2 grant type (must be 'client_credentials')
-          example: "client_credentials"
-        scope:
-          type: string
-          format: email
-          description: |
-            Email address of the user to delegate.
-            The application will act on behalf of this user.
-            Note: This parameter is named 'scope' to align with OAuth2 conventions,
-            but accepts an email address to identify the user. This design allows
-            for future extensibility.
-          example: "user@example.com"
-
-    TokenResponse:
-      type: object
-      properties:
-        access_token:
-          type: string
-          description: JWT access token
-          example: "eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJpc3MiOiJtZWV0LWFwaSIsImF1ZCI6Im1lZXQtY2xpZW50cyIsImlhdCI6MTcwOTQ5MTIwMCwiZXhwIjoxNzA5NDk0ODAwLCJjbGllbnRfaWQiOiI1NTBlODQwMC1lMjliLTQxZDQtYTcxNi00NDY2NTU0NDAwMDAiLCJzY29wZSI6InJvb21zOmxpc3Qgcm9vbXM6cmV0cmlldmUgcm9vbXM6Y3JlYXRlIiwidXNlcl9pZCI6IjdiOGQ5YzQwLTNhMmItNGVkZi04NzFjLTJmM2Q0ZTVmNmE3YiIsImRlbGVnYXRlZCI6dHJ1ZX0.signature"
-        token_type:
-          type: string
-          description: Token type (always 'Bearer')
-          example: "Bearer"
-        expires_in:
-          type: integer
-          description: Token lifetime in seconds
-          example: 3600
-        scope:
-          type: string
-          description: Space-separated list of granted permission scopes
-          example: "rooms:list rooms:retrieve rooms:create"
-
     RoomCreate:
       type: object
-      description: Empty object - all room properties are auto-generated
-      properties: {}
+      description: |
+        Optional fields for room creation. All fields have secure defaults if omitted.
+      properties:
+        access_level:
+          $ref: '#/components/schemas/RoomAccessLevel'
+        configuration:
+          $ref: '#/components/schemas/RoomConfiguration'
+
+    RoomConfiguration:
+      type: object
+      description: |
+        Optional room behaviour settings. Unknown fields are rejected.
+        All fields are optional and default to `null` (server-side defaults apply).
+      properties:
+        can_publish_sources:
+          type: array
+          nullable: true
+          description: |
+            Restricts which media tracks participants are allowed to publish.
+            If `null`, all sources are permitted.
+          items:
+            type: string
+            enum:
+              - camera
+              - microphone
+              - screen_share
+              - screen_share_audio
+          example: [ "camera", "microphone" ]
+        everyone_can_mute:
+          type: boolean
+          nullable: true
+          description: |
+            Whether any participant can mute others, or only the room owner/moderator.
+            If `null`, the server default applies.
+          example: true
+      additionalProperties: false
+
+    RoomAccessLevel:
+      type: string
+      enum:
+        - public
+        - trusted
+        - restricted
+      description: |
+        Controls who can join the room without going through the lobby.
+
+        - `public`: Anyone with the room link can join directly, no authentication required.
+        - `trusted`: Authenticated users join directly. Unauthenticated users wait in the lobby for approval.
+        - `restricted`: Only participants explicitly trusted by the owner bypass the lobby. Everyone else waits for approval regardless of authentication.
+      example: "trusted"
 
     Room:
       type: object
@@ -285,10 +285,7 @@ components:
           description: URL-friendly room identifier (auto-generated)
           example: "aze-eere-zer"
         access_level:
-          type: string
-          readOnly: true
-          description: Room access level (always 'trusted' for API-created rooms)
-          example: "trusted"
+          $ref: '#/components/schemas/RoomAccessLevel'
         url:
           type: string
           format: uri
@@ -316,6 +313,8 @@ components:
               type: string
               description: Default country code
               example: "US"
+        configuration:
+          $ref: '#/components/schemas/RoomConfiguration'
 
     OAuthError:
       type: object

env.d/development/common.dist

@@ -64,9 +64,8 @@ ALLOW_UNREGISTERED_ROOMS=False
 RECORDING_ENABLE=True
 RECORDING_STORAGE_EVENT_ENABLE=True
 RECORDING_STORAGE_EVENT_TOKEN=password
-SUMMARY_SERVICE_ENDPOINT=http://app-summary-dev:8000/api/v2/async-jobs/transcribe/
+SUMMARY_SERVICE_ENDPOINT=http://app-summary-dev:8000/api/v1/tasks/
 SUMMARY_SERVICE_API_TOKEN=password
-SUMMARY_SERVICE_WEBHOOK_API_TOKEN=webhook-password
 RECORDING_DOWNLOAD_BASE_URL=http://localhost:3000/recording
 
 # Recording encoding (LiveKit Egress advanced options).

src/addons/outlook/package-lock.json

@@ -9,7 +9,7 @@
       "version": "0.0.1",
       "license": "MIT",
       "dependencies": {
-        "core-js": "^3.36.0",
+        "core-js": "^3.49.0",
         "regenerator-runtime": "^0.14.1"
       },
       "devDependencies": {
@@ -6863,9 +6863,9 @@
       }
     },
     "node_modules/core-js": {
-      "version": "3.48.0",
-      "resolved": "https://registry.npmjs.org/core-js/-/core-js-3.48.0.tgz",
-      "integrity": "sha512-zpEHTy1fjTMZCKLHUZoVeylt9XrzaIN2rbPXEt0k+q7JE5CkCZdo6bNq55bn24a69CH7ErAVLKijxJja4fw+UQ==",
+      "version": "3.49.0",
+      "resolved": "https://registry.npmjs.org/core-js/-/core-js-3.49.0.tgz",
+      "integrity": "sha512-es1U2+YTtzpwkxVLwAFdSpaIMyQaq0PBgm3YD1W3Qpsn1NAmO3KSgZfu+oGSWVu6NvLHoHCV/aYcsE5wiB7ALg==",
       "hasInstallScript": true,
       "license": "MIT",
       "funding": {

src/addons/outlook/package.json

@@ -26,7 +26,7 @@
     "watch": "webpack --mode development --watch"
   },
   "dependencies": {
-    "core-js": "^3.36.0",
+    "core-js": "^3.49.0",
     "regenerator-runtime": "^0.14.1"
   },
   "devDependencies": {

src/agents/pyproject.toml

@@ -1,7 +1,7 @@
 
 [project]
 name = "agents"
-version = "1.16.0"
+version = "1.18.0"
 requires-python = ">=3.12"
 dependencies = [
     "livekit-agents==1.4.5",

src/agents/uv.lock

@@ -9,7 +9,7 @@ resolution-markers = [
 
 [[package]]
 name = "agents"
-version = "1.16.0"
+version = "1.18.0"
 source = { virtual = "." }
 dependencies = [
     { name = "livekit-agents" },

src/backend/core/api/__init__.py

@@ -8,6 +8,8 @@ from rest_framework import views as drf_views
 from rest_framework.decorators import api_view
 from rest_framework.response import Response
 
+from core.utils import build_telephony_config
+
 
 def exception_handler(exc, context):
     """Handle Django ValidationError as an accepted exception.
@@ -58,13 +60,7 @@ def get_frontend_configuration(request):
                 "allowed_mimetypes"
             ],
         },
-        "telephony": {
-            "enabled": settings.ROOM_TELEPHONY_ENABLED,
-            "phone_number": settings.ROOM_TELEPHONY_PHONE_NUMBER
-            if settings.ROOM_TELEPHONY_ENABLED
-            else None,
-            "default_country": settings.ROOM_TELEPHONY_DEFAULT_COUNTRY,
-        },
+        "telephony": build_telephony_config(),
         "subtitle": {"enabled": settings.ROOM_SUBTITLE_ENABLED},
         "livekit": {
             "url": settings.LIVEKIT_CONFIGURATION["url"],

src/backend/core/api/viewsets.py

@@ -39,10 +39,7 @@ from core import enums, models, utils
 from core.api.filters import ListFileFilter
 from core.enums import MEDIA_STORAGE_URL_PATTERN
 from core.recording.enums import FileExtension
-from core.recording.event.authentication import (
-    RecordingProcessWebhookAuthentication,
-    StorageEventAuthentication,
-)
+from core.recording.event.authentication import StorageEventAuthentication
 from core.recording.event.exceptions import (
     InvalidBucketError,
     InvalidFilepathError,
@@ -998,47 +995,6 @@ class RecordingViewSet(
             {"message": "Event processed."},
         )
 
-    @decorators.action(
-        detail=False,
-        methods=["post"],
-        url_path="external-process-hook",
-        authentication_classes=[RecordingProcessWebhookAuthentication],
-    )
-    def on_external_process_event_received(self, request, pk=None):  # pylint: disable=unused-argument
-        """Handle incoming external process events for recordings."""
-        logger.debug("Processing external process event %s", request.data)
-        data = request.data
-        if not data.get("job_id"):
-            raise drf_exceptions.ValidationError(detail="No job_id provided")
-
-        job_id = data["job_id"]
-        try:
-            recording = models.Recording.objects.get(external_process_id=job_id)
-        except models.Recording.DoesNotExist as e:
-            logger.warning("No recording found for job_id %s: %s", job_id, e)
-            recording = None
-
-        changed = False
-        if recording and data.get("type") == "transcript":
-            if data.get("status") == "success":
-                logger.info("External process received for recording %s", job_id)
-                recording.status = (
-                    models.RecordingStatusChoices.EXTERNAL_PROCESS_SUCCESSFUL
-                )
-                changed = True
-            if data.get("status") == "failure":
-                recording.status = models.RecordingStatusChoices.EXTERNAL_PROCESS_FAILED
-                changed = True
-
-        if changed and recording:
-            recording.save()
-        else:
-            logger.info("No changes to save for external process id %s", job_id)
-
-        return drf_response.Response(
-            {"message": "Event processed."},
-        )
-
     def _auth_get_original_url(self, request):
         """
         Extracts and parses the original URL from the "HTTP_X_ORIGINAL_URL" header.
@@ -1240,96 +1196,124 @@ class FileViewSet(
         """
         Check the actual uploaded file and mark it as ready.
         """
-
+        # Ensures we go through authorization checks
         file = self.get_object()
 
-        if not file.is_pending_upload:
+        # Try to update the file with the new state. If the file is already in this state
+        # we are in a concurrent request, and we should reject that request
+        updated_rows = models.File.objects.filter(
+            upload_state=models.FileUploadStateChoices.PENDING,
+            pk=kwargs["pk"],
+        ).update(upload_state=models.FileUploadStateChoices.ANALYZING)
+        if updated_rows != 1:
             raise drf_exceptions.ValidationError(
                 {"file": "This action is only available for files in PENDING state."},
                 code="file_upload_state_not_pending",
             )
+        file.refresh_from_db()
 
         s3_client = default_storage.connection.meta.client
+        validation_error = None
 
-        head_response = s3_client.head_object(
-            Bucket=default_storage.bucket_name, Key=file.file_key
-        )
-        file_size = head_response["ContentLength"]
-
-        if settings.FILE_UPLOAD_APPLY_RESTRICTIONS:
-            config_for_file_type = settings.FILE_UPLOAD_RESTRICTIONS[file.type]
-            if file_size > config_for_file_type["max_size"]:
-                self._complete_file_deletion(file)
-                logger.info(
-                    "upload_ended: file size (%s) for file %s higher than the allowed max size",
-                    file_size,
-                    file.file_key,
-                )
-                raise drf_exceptions.ValidationError(
-                    detail="The file size is higher than the allowed max size.",
-                    code="file_size_exceeded",
-                )
-
-        # python-magic recommends using at least the first 2048 bytes
-        # to reduce incorrect identification.
-        # This is a tradeoff between pulling in the whole file and the most likely relevant bytes
-        # of the file for mime type identification.
-        if file_size > 2048:
-            range_response = s3_client.get_object(
-                Bucket=default_storage.bucket_name,
-                Key=file.file_key,
-                Range="bytes=0-2047",
-            )
-            file_head = range_response["Body"].read()
-        else:
-            file_head = s3_client.get_object(
-                Bucket=default_storage.bucket_name, Key=file.file_key
-            )["Body"].read()
-
-        # Use improved MIME type detection combining magic bytes and file extension
-        logger.info("upload_ended: detecting mimetype for file: %s", file.file_key)
-        mimetype = utils.detect_mimetype(file_head, filename=file.filename)
-
-        if settings.FILE_UPLOAD_APPLY_RESTRICTIONS:
-            config_for_file_type = settings.FILE_UPLOAD_RESTRICTIONS[file.type]
-            allowed_file_mimetypes = config_for_file_type["allowed_mimetypes"]
-            if mimetype not in allowed_file_mimetypes:
-                self._complete_file_deletion(file)
-                logger.warning(
-                    "upload_ended: mimetype not allowed %s for file %s",
-                    mimetype,
-                    file.file_key,
-                )
-                raise drf_exceptions.ValidationError(
-                    detail="The file type is not allowed.",
-                    code="file_type_not_allowed",
-                )
-
-        file.upload_state = models.FileUploadStateChoices.READY
-        file.mimetype = mimetype
-        file.size = file_size
-
-        file.save(update_fields=["upload_state", "mimetype", "size"])
-
-        if head_response["ContentType"] != mimetype:
-            logger.info(
-                "upload_ended: content type mismatch between object storage and file,"
-                " updating from %s to %s",
-                head_response["ContentType"],
-                mimetype,
-            )
+        try:
+            # We copy the file to its final destination, we will run the checks on that
+            # final file and ignore any updates to the temporary file. (We cannot revoke the policy,
+            # so the temporary file might still be updated after that.)
+            # The temporary folders will need to be cleaned periodically
             s3_client.copy_object(
                 Bucket=default_storage.bucket_name,
                 Key=file.file_key,
                 CopySource={
                     "Bucket": default_storage.bucket_name,
-                    "Key": file.file_key,
+                    "Key": file.temporary_file_key,
                 },
-                ContentType=mimetype,
-                Metadata=head_response["Metadata"],
-                MetadataDirective="REPLACE",
             )
 
+            head_response = s3_client.head_object(
+                Bucket=default_storage.bucket_name, Key=file.file_key
+            )
+            file_size = head_response["ContentLength"]
+            # python-magic recommends using at least the first 2048 bytes
+            # to reduce incorrect identification.
+            # This is a tradeoff between pulling in the whole file and
+            # the most likely relevant bytes
+            # of the file for mime type identification.
+            if file_size > 2048:
+                range_response = s3_client.get_object(
+                    Bucket=default_storage.bucket_name,
+                    Key=file.file_key,
+                    Range="bytes=0-2047",
+                )
+                file_head = range_response["Body"].read()
+            else:
+                file_head = s3_client.get_object(
+                    Bucket=default_storage.bucket_name, Key=file.file_key
+                )["Body"].read()
+
+            logger.info("upload_ended: detecting mimetype for file: %s", file.file_key)
+            mimetype = utils.detect_mimetype(file_head, filename=file.filename)
+
+            if settings.FILE_UPLOAD_APPLY_RESTRICTIONS:
+                config_for_file_type = settings.FILE_UPLOAD_RESTRICTIONS[file.type]
+                if file_size > config_for_file_type["max_size"]:
+                    logger.info(
+                        "upload_ended: file size (%s) for file %s higher than the allowed max size",
+                        file_size,
+                        file.file_key,
+                    )
+                    validation_error = drf_exceptions.ValidationError(
+                        detail="The file size is higher than the allowed max size.",
+                        code="file_size_exceeded",
+                    )
+                else:
+                    # Use improved MIME type detection combining magic bytes and file extension
+                    allowed_file_mimetypes = config_for_file_type["allowed_mimetypes"]
+                    if mimetype not in allowed_file_mimetypes:
+                        logger.warning(
+                            "upload_ended: mimetype not allowed %s for file %s",
+                            mimetype,
+                            file.file_key,
+                        )
+                        validation_error = drf_exceptions.ValidationError(
+                            detail="The file type is not allowed.",
+                            code="file_type_not_allowed",
+                        )
+
+            if validation_error is not None:
+                self._complete_file_deletion(file)
+            else:
+                file.upload_state = models.FileUploadStateChoices.READY
+                file.mimetype = mimetype
+                file.size = file_size
+                file.save(update_fields=["upload_state", "mimetype", "size"])
+
+                if head_response["ContentType"] != mimetype:
+                    logger.info(
+                        "upload_ended: content type mismatch between object storage and file,"
+                        " updating from %s to %s",
+                        head_response["ContentType"],
+                        mimetype,
+                    )
+                    s3_client.copy_object(
+                        Bucket=default_storage.bucket_name,
+                        Key=file.file_key,
+                        CopySource={
+                            "Bucket": default_storage.bucket_name,
+                            "Key": file.file_key,
+                        },
+                        ContentType=mimetype,
+                        Metadata=head_response["Metadata"],
+                        MetadataDirective="REPLACE",
+                    )
+        except Exception as e:
+            logger.exception("Failed to analyze file, reverting to pending state")
+            file.upload_state = models.FileUploadStateChoices.PENDING
+            file.save()
+            raise e
+
+        if validation_error:
+            raise validation_error
+
         # Not yet implemented
         # Change the file.upload_state when this will be done
         # malware_detection.analyse_file(file.file_key, file_id=file.id)

src/backend/core/external_api/serializers.py

@@ -4,10 +4,11 @@
 
 from django.conf import settings
 
+from pydantic import ValidationError
 from rest_framework import serializers
 
 from core import models, utils
-from core.api.serializers import BaseValidationOnlySerializer
+from core.api.serializers import BaseValidationOnlySerializer, RoomConfiguration
 
 OAUTH2_GRANT_TYPE_CLIENT_CREDENTIALS = "client_credentials"
 
@@ -34,10 +35,37 @@ class RoomSerializer(serializers.ModelSerializer):
     following the principle of least privilege.
     """
 
+    configuration = serializers.JSONField(required=False)
+
     class Meta:
         model = models.Room
-        fields = ["id", "name", "slug", "pin_code", "access_level"]
-        read_only_fields = ["id", "name", "slug", "pin_code", "access_level"]
+        fields = ["id", "name", "slug", "pin_code", "access_level", "configuration"]
+        read_only_fields = ["id", "name", "slug", "pin_code"]
+
+    def validate_configuration(self, value):
+        """Validate room configuration against the RoomConfiguration schema."""
+        if value is None or value == {}:
+            return value
+        try:
+            RoomConfiguration.model_validate(value)
+        except ValidationError as e:
+            raise serializers.ValidationError(e.errors()) from e
+        return value
+
+    def validate_access_level(self, access_level):
+        """Reject public access_level unless explicitly allowed or the default is already public."""
+
+        if settings.EXTERNAL_API_DEFAULT_ACCESS_LEVEL == models.RoomAccessLevel.PUBLIC:
+            return access_level
+
+        if (
+            access_level == models.RoomAccessLevel.PUBLIC
+            and not settings.EXTERNAL_API_ALLOW_PUBLIC_ACCESS
+        ):
+            raise serializers.ValidationError(
+                "Public rooms are disabled for the external API."
+            )
+        return access_level
 
     def to_representation(self, instance):
         """Enrich response with application-specific computed fields."""
@@ -68,6 +96,9 @@ class RoomSerializer(serializers.ModelSerializer):
 
         # Set secure defaults
         validated_data["name"] = utils.generate_room_slug()
-        validated_data["access_level"] = models.RoomAccessLevel.TRUSTED
+        validated_data.setdefault(
+            "access_level", settings.EXTERNAL_API_DEFAULT_ACCESS_LEVEL
+        )
+        validated_data.setdefault("configuration", {})
 
         return super().create(validated_data)

src/backend/core/external_api/viewsets.py

@@ -4,7 +4,7 @@ from logging import getLogger
 
 from django.conf import settings
 from django.contrib.auth.hashers import check_password
-from django.core.exceptions import SuspiciousOperation, ValidationError
+from django.core.exceptions import ValidationError
 from django.core.validators import validate_email
 
 from lasuite.oidc_resource_server.authentication import ResourceServerAuthentication
@@ -23,6 +23,11 @@ from core import api, models
 from core.api.feature_flag import FeatureFlag
 from core.services.jwt_token import JwtTokenService
 
+from ..services.provisional_user_service import (
+    ProvisionalUserCreationDisabledError,
+    ProvisionalUserIntegrityError,
+    ProvisionalUserService,
+)
 from . import authentication, permissions, serializers
 
 logger = getLogger(__name__)
@@ -94,40 +99,14 @@ class ApplicationViewSet(viewsets.ViewSet):
             )
 
         try:
-            user = models.User.objects.get(email__iexact=email)
-        except models.User.DoesNotExist as e:
-            if (
-                settings.APPLICATION_ALLOW_USER_CREATION
-                and settings.OIDC_FALLBACK_TO_EMAIL_FOR_IDENTIFICATION
-                and not settings.OIDC_USER_SUB_FIELD_IMMUTABLE
-            ):
-                # Create a provisional user without `sub`, identified by email only.
-                #
-                # This relies on Django LaSuite implicitly updating the `sub` field on the
-                # user's first successful OIDC authentication. If this stops working,
-                # check for behavior changes in Django LaSuite.
-                #
-                # `OIDC_USER_SUB_FIELD_IMMUTABLE` comes from Django LaSuite and prevents `sub`
-                # updates. We override its default value to allow setting `sub` for
-                # provisional users.
-                user = models.User(
-                    sub=None,
-                    email=email,
-                )
-                user.set_unusable_password()
-                user.save()
-                logger.info(
-                    "Provisional user created via application: user_id=%s, email=%s, client_id=%s",
-                    user.id,
-                    email,
-                    application.client_id,
-                )
-            else:
-                raise drf_exceptions.NotFound("User not found.") from e
-        except models.User.MultipleObjectsReturned as e:
-            raise SuspiciousOperation(
-                "Multiple user accounts share a common email."
-            ) from e
+            user, _ = ProvisionalUserService().get_or_create(email, client_id)
+        except ProvisionalUserCreationDisabledError as not_found_error:
+            raise drf_exceptions.NotFound("User not found.") from not_found_error
+        except ProvisionalUserIntegrityError:
+            return drf_response.Response(
+                {"error": "Failed to create or retrieve provisional user."},
+                status=drf_status.HTTP_409_CONFLICT,
+            )
 
         scope = " ".join(application.scopes or [])
 

src/backend/core/management/commands/merge_duplicate_users.py

@@ -0,0 +1,168 @@
+"""Management command to merge duplicate users based on their email address."""
+
+# pylint: disable=too-many-locals
+
+from django.contrib.auth import get_user_model
+from django.core.management.base import BaseCommand, CommandError
+from django.db import transaction
+from django.db.models import Count
+
+from core.models import File, RecordingAccess, ResourceAccess, RoleChoices
+
+User = get_user_model()
+
+ROLE_PRIORITY = {
+    RoleChoices.OWNER: 3,
+    RoleChoices.ADMIN: 2,
+    RoleChoices.MEMBER: 1,
+}
+
+
+class Command(BaseCommand):
+    """
+    Merge duplicate users sharing the same email into the most recently created one.
+
+    The KEPT user is the most recently created. All room memberships, recording
+    accesses and files are transferred to it. When a conflict exists, the
+    higher-privilege role wins. Stale users are then deleted.
+    Each email group is processed inside a single database transaction.
+    """
+
+    help = __doc__
+
+    def add_arguments(self, parser):
+        parser.add_argument(
+            "--dry-run",
+            action="store_true",
+            help="Simulate the merge without writing any changes to the database.",
+        )
+        parser.add_argument(
+            "--email-filter",
+            type=str,
+            default=None,
+            help="Only merge users whose email contains this string (e.g. '@example.com').",
+        )
+
+    def handle(self, *args, **options):
+        """Execute the management command."""
+        dry_run = options["dry_run"]
+        email_filter = options["email_filter"]
+
+        if dry_run:
+            self.stdout.write("[DRY-RUN] No changes will be written.\n")
+
+        users_qs = User.objects.all()
+        if email_filter:
+            users_qs = users_qs.filter(email__icontains=email_filter)
+            self.stdout.write(f"[INFO] Filtering emails containing '{email_filter}'.\n")
+
+        duplicate_emails = (
+            users_qs.exclude(email__isnull=True)
+            .exclude(email="")
+            .values("email")
+            .annotate(cnt=Count("id"))
+            .filter(cnt__gt=1)
+            .values_list("email", flat=True)
+        )
+
+        if not duplicate_emails:
+            self.stdout.write("[INFO] No duplicate users found. Nothing to do.")
+            return
+
+        self.stdout.write(
+            f"[INFO] Found {len(duplicate_emails)} email(s) with duplicate users."
+        )
+
+        total_merged = 0
+        total_deleted = 0
+        failed_emails = []
+
+        for email in duplicate_emails:
+            # Secondary sort by id ensures a stable, deterministic order when
+            # created_at timestamps are equal (common in tests and bulk imports).
+            users = list(User.objects.filter(email=email).order_by("created_at", "id"))
+            kept_user = users[-1]
+            stale_users = users[:-1]
+
+            self.stdout.write(
+                f"\n[INFO] Email '{email}': {len(users)} users — "
+                f"keeping {kept_user.id} (created {kept_user.created_at.date()})."
+            )
+            for u in stale_users:
+                self.stdout.write(
+                    f"       stale: {u.id} (created {u.created_at.date()})"
+                )
+
+            if dry_run:
+                ra_count = ResourceAccess.objects.filter(user__in=stale_users).count()
+                rca_count = RecordingAccess.objects.filter(user__in=stale_users).count()
+                f_count = File.objects.filter(creator__in=stale_users).count()
+                self.stdout.write(
+                    f"       [DRY-RUN] Would migrate: {ra_count} ResourceAccess, "
+                    f"{rca_count} RecordingAccess, {f_count} File(s)."
+                )
+                continue
+
+            try:
+                group_deleted = 0
+                with transaction.atomic():
+                    for stale_user in stale_users:
+                        self._merge_resource_accesses(stale_user, kept_user)
+                        self._merge_recording_accesses(stale_user, kept_user)
+                        self._merge_files(stale_user, kept_user)
+                        stale_user.delete()
+                        group_deleted += 1
+
+                total_deleted += group_deleted
+                total_merged += 1
+
+            except Exception as exc:  # noqa: BLE001 #pylint: disable=broad-exception-caught
+                failed_emails.append(email)
+                self.stderr.write(f"[ERROR] Failed to merge '{email}': {exc}")
+
+        if failed_emails:
+            raise CommandError(
+                f"Failed to merge {len(failed_emails)} email group(s): {', '.join(failed_emails)}"
+            )
+
+        self.stdout.write(
+            self.style.SUCCESS(
+                f"\n[DONE] Merged {total_merged} group(s), deleted {total_deleted} user(s)."
+            )
+        )
+
+    def _merge_resource_accesses(self, stale_user, kept_user):
+        """Transfer room memberships from stale_user to kept_user."""
+        for ra in ResourceAccess.objects.filter(user=stale_user):
+            existing = ResourceAccess.objects.filter(
+                user=kept_user, resource=ra.resource
+            ).first()
+
+            if existing is None:
+                ra.user = kept_user
+                ra.save(update_fields=["user"])
+            else:
+                if ROLE_PRIORITY.get(ra.role, 0) > ROLE_PRIORITY.get(existing.role, 0):
+                    existing.role = ra.role
+                    existing.save(update_fields=["role"])
+                ra.delete()
+
+    def _merge_recording_accesses(self, stale_user, kept_user):
+        """Transfer recording accesses from stale_user to kept_user."""
+        for rca in RecordingAccess.objects.filter(user=stale_user):
+            existing = RecordingAccess.objects.filter(
+                user=kept_user, recording=rca.recording
+            ).first()
+
+            if existing is None:
+                rca.user = kept_user
+                rca.save(update_fields=["user"])
+            else:
+                if ROLE_PRIORITY.get(rca.role, 0) > ROLE_PRIORITY.get(existing.role, 0):
+                    existing.role = rca.role
+                    existing.save(update_fields=["role"])
+                rca.delete()
+
+    def _merge_files(self, stale_user, kept_user):
+        """Re-assign files created by stale_user to kept_user."""
+        File.objects.filter(creator=stale_user).update(creator=kept_user)

src/backend/core/migrations/0019_recording_external_process_id_alter_recording_status.py

@@ -1,23 +0,0 @@
-# Generated by Django 5.2.14 on 2026-05-26 14:30
-
-from django.db import migrations, models
-
-
-class Migration(migrations.Migration):
-
-    dependencies = [
-        ('core', '0018_rename_active_application_is_active'),
-    ]
-
-    operations = [
-        migrations.AddField(
-            model_name='recording',
-            name='external_process_id',
-            field=models.CharField(blank=True, help_text='ID of the external process associated with the recording.', max_length=255, null=True, unique=True, verbose_name='External Process ID'),
-        ),
-        migrations.AlterField(
-            model_name='recording',
-            name='status',
-            field=models.CharField(choices=[('initiated', 'Initiated'), ('active', 'Active'), ('stopped', 'Stopped'), ('saved', 'Saved'), ('aborted', 'Aborted'), ('failed_to_start', 'Failed to Start'), ('failed_to_stop', 'Failed to Stop'), ('notification_succeeded', 'Notification succeeded'), ('external_process_successful', 'External process successful'), ('external_process_failed', 'External process failed')], default='initiated', max_length=50),
-        ),
-    ]

src/backend/core/migrations/0019_user_unique_email_when_sub_is_null.py

@@ -0,0 +1,19 @@
+# Generated by Django 5.2.14 on 2026-06-02 17:31
+
+import django.db.models.functions.text
+from django.db import migrations, models
+
+
+class Migration(migrations.Migration):
+
+    dependencies = [
+        ('auth', '0012_alter_user_first_name_max_length'),
+        ('core', '0018_rename_active_application_is_active'),
+    ]
+
+    operations = [
+        migrations.AddConstraint(
+            model_name='user',
+            constraint=models.UniqueConstraint(django.db.models.functions.text.Lower('email'), condition=models.Q(('sub__isnull', True)), name='unique_email_when_sub_is_null'),
+        ),
+    ]

src/backend/core/migrations/0020_alter_file_upload_state.py

@@ -0,0 +1,18 @@
+# Generated by Django 5.2.14 on 2026-06-03 12:14
+
+from django.db import migrations, models
+
+
+class Migration(migrations.Migration):
+
+    dependencies = [
+        ('core', '0019_user_unique_email_when_sub_is_null'),
+    ]
+
+    operations = [
+        migrations.AlterField(
+            model_name='file',
+            name='upload_state',
+            field=models.CharField(choices=[('pending', 'Pending'), ('analyzing', 'Analyzing'), ('ready', 'Ready')], max_length=25),
+        ),
+    ]

src/backend/core/models.py

@@ -60,11 +60,6 @@ class RecordingStatusChoices(models.TextChoices):
     FAILED_TO_START = "failed_to_start", _("Failed to Start")
     FAILED_TO_STOP = "failed_to_stop", _("Failed to Stop")
     NOTIFICATION_SUCCEEDED = "notification_succeeded", _("Notification succeeded")
-    EXTERNAL_PROCESS_SUCCESSFUL = (
-        "external_process_successful",
-        _("External process successful"),
-    )
-    EXTERNAL_PROCESS_FAILED = "external_process_failed", _("External process failed")
 
     @classmethod
     def is_final(cls, status):
@@ -78,8 +73,6 @@ class RecordingStatusChoices(models.TextChoices):
             cls.STOPPED,
             cls.SAVED,
             cls.ABORTED,
-            cls.EXTERNAL_PROCESS_SUCCESSFUL,
-            cls.EXTERNAL_PROCESS_FAILED,
             cls.FAILED_TO_START,
             cls.FAILED_TO_STOP,
         }
@@ -218,6 +211,13 @@ class User(AbstractBaseUser, BaseModel, auth_models.PermissionsMixin):
         ordering = ("-created_at",)
         verbose_name = _("user")
         verbose_name_plural = _("users")
+        constraints = [
+            models.UniqueConstraint(
+                models.functions.Lower("email"),
+                condition=models.Q(sub__isnull=True),
+                name="unique_email_when_sub_is_null",
+            )
+        ]
 
     def __str__(self):
         return self.email or self.admin_email or str(self.id)
@@ -598,14 +598,6 @@ class Recording(BaseModel):
         verbose_name=_("Recording options"),
         help_text=_("Recording options"),
     )
-    external_process_id = models.CharField(
-        max_length=255,
-        null=True,
-        blank=True,
-        unique=True,
-        verbose_name=_("External Process ID"),
-        help_text=_("ID of the external process associated with the recording."),
-    )
 
     class Meta:
         db_table = "meet_recording"
@@ -661,8 +653,6 @@ class Recording(BaseModel):
         return self.status in {
             RecordingStatusChoices.NOTIFICATION_SUCCEEDED,
             RecordingStatusChoices.SAVED,
-            RecordingStatusChoices.EXTERNAL_PROCESS_SUCCESSFUL,
-            RecordingStatusChoices.EXTERNAL_PROCESS_FAILED,
         }
 
     @property
@@ -856,8 +846,8 @@ class FileUploadStateChoices(models.TextChoices):
     """Possible states of a file."""
 
     PENDING = "pending", _("Pending")
+    ANALYZING = "analyzing", _("Analyzing")
     # Commented out for now, as we may need this when we implement the malware detection logic.
-    # ANALYZING = "analyzing", _("Analyzing")
     # SUSPICIOUS = "suspicious", _("Suspicious")
     # FILE_TOO_LARGE_TO_ANALYZE = (
     #     "file_too_large_to_analyze",
@@ -964,6 +954,16 @@ class File(BaseModel):
 
         return f"{settings.FILE_UPLOAD_PATH}/{self.pk!s}"
 
+    @property
+    def temporary_key_base(self):
+        """Temporary key base used while upload is still pending."""
+        if not self.pk:
+            raise RuntimeError(
+                "The file instance must be saved before requesting a storage key."
+            )
+
+        return f"{settings.FILE_UPLOAD_TMP_PATH}/{self.pk!s}"
+
     @property
     def file_key(self):
         """Key used to store the file in object storage."""
@@ -972,6 +972,12 @@ class File(BaseModel):
         # leaking Personal Information in logs, etc.
         return f"{self.key_base}{extension!s}"
 
+    @property
+    def temporary_file_key(self):
+        """Temporary key used to upload the file before it is finalized."""
+        _, extension = splitext(self.filename)
+        return f"{self.temporary_key_base}{extension!s}"
+
     def get_abilities(self, user):
         """
         Compute and return abilities for a given user on the file.

src/backend/core/recording/event/authentication.py

@@ -14,9 +14,9 @@ logger = logging.getLogger(__name__)
 class MachineUser:
     """Represent a non-interactive system user for automated storage operations."""
 
-    def __init__(self, username: str = "storage_event_user") -> None:
+    def __init__(self) -> None:
         self.pk = None
-        self.username = username
+        self.username = "storage_event_user"
         self.is_active = True
 
     @property
@@ -91,29 +91,3 @@ class StorageEventAuthentication(BaseAuthentication):
     def authenticate_header(self, request):
         """Return the WWW-Authenticate header value."""
         return f"{self.TOKEN_TYPE} realm='Storage event API'"
-
-
-class RecordingProcessWebhookAuthentication(BaseAuthentication):
-    """
-    Custom authentication class for recording process webhook requests.
-    Validates the API key in the Authorization header.
-    """
-
-    def authenticate(self, request):
-        """
-        Authenticate the request and return a two-tuple of (user, token).
-        """
-        logger.info("Authentificating")
-        authorization_header: str = request.headers.get("Authorization") or ""
-
-        if not secrets.compare_digest(
-            authorization_header.removeprefix("Bearer "),
-            settings.SUMMARY_SERVICE_WEBHOOK_API_TOKEN,
-        ):
-            logger.warning(
-                "Authentication failed: Bad Authorization header (ip: %s)",
-                request.META.get("REMOTE_ADDR"),
-            )
-            raise AuthenticationFailed()
-
-        return MachineUser("external_process_user"), None

src/backend/core/recording/event/notification.py

@@ -1,10 +1,8 @@
 """Service to notify external services when a new recording is ready."""
 
 import asyncio
-import json
 import logging
 import smtplib
-import warnings
 from datetime import datetime, timezone
 
 from django.conf import settings
@@ -19,7 +17,6 @@ from asgiref.sync import async_to_sync
 from livekit import api as livekit_api
 
 from core import models, utils
-from core.utils import generate_download_s3_file_url
 
 logger = logging.getLogger(__name__)
 
@@ -218,45 +215,18 @@ class NotificationService:
         )(recording.worker_id)
 
         payload = {
-            # Legacy V1 params to avoid a breaking change
             "owner_id": str(owner_access.user.id),
             "recording_filename": recording.key,
             "metadata_filename": metadata_filename,
             "email": owner_access.user.email,
             "sub": owner_access.user.sub,
             "room": recording.room.name,
+            "language": recording.options.get("language"),
             "owner_timezone": str(owner_access.user.timezone),
             "download_link": f"{get_recording_download_base_url()}/{recording.id}",
+            "context_language": owner_access.user.language,
             "recording_start_at": (started_at.isoformat() if started_at else None),
             "recording_end_at": (ended_at.isoformat() if ended_at else None),
-            # V2 params
-            "user_sub": owner_access.user.sub,
-            "user_email": owner_access.user.email,
-            "cloud_storage_url": generate_download_s3_file_url(
-                recording.key, expires_in=60 * 60 * 24, override_domain=False
-            ),
-            "language": recording.options.get("language", "fr"),
-            "context_language": owner_access.user.language,
-            "push_to_docs_config": {
-                "user_email": owner_access.user.email,
-                "title": "TODO",
-                "download_link": f"{get_recording_download_base_url()}/{recording.id}",
-                # For now the feature flag logic is handled on summary side
-                "auto_create_summary": True,
-            },
-            "metadata": (
-                {
-                    "cloud_storage_url": generate_download_s3_file_url(
-                        metadata_filename,
-                        expires_in=60 * 60 * 24,
-                        override_domain=False,
-                    ),
-                    "started_at": started_at.isoformat(),
-                    "ended_at": ended_at.isoformat(),
-                }
-                if (started_at and ended_at)
-                else None
-            ),
         }
 
         headers = {
@@ -272,31 +242,6 @@ class NotificationService:
                 timeout=30,
             )
             response.raise_for_status()
-            is_v2_implementation = False
-            try:
-                response_json = response.json()
-                # We do not require a job_id to avoid a breaking change
-                if job_id := response_json.get("job_id"):
-                    recording.external_process_id = job_id
-                    recording.save()
-                    is_v2_implementation = True
-            except json.JSONDecodeError:
-                pass
-
-            if not is_v2_implementation:
-                warnings.warn(
-                    "You are likely using your own implementation for the summary / "
-                    "transcribe service."
-                    "We have released a new version and API contract for that service, "
-                    "we recommend checking it out"
-                    # pylint: disable=line-too-long
-                    "https://github.com/suitenumerique/meet/blob/19c2a378e7e66652afbfa3e749badd697e3917ac/src/summary/summary/api/route/tasks_v2.py "
-                    "and mimicking it's behavior. We will remove the legacy "
-                    "handling in a future version.",
-                    DeprecationWarning,
-                    stacklevel=2,
-                )
-
         except requests.RequestException as exc:
             logger.exception(
                 "Summary service error for recording %s. URL: %s. Exception: %s",

src/backend/core/recording/event/parsers.py

@@ -1,6 +1,7 @@
 """Meet storage event parser classes."""
 
 import logging
+import mimetypes
 import re
 from dataclasses import dataclass
 from functools import lru_cache
@@ -18,6 +19,9 @@ from .exceptions import (
     ParsingEventDataError,
 )
 
+# Additional MIME type mapping
+mimetypes.add_type("audio/ogg", ".ogg")
+
 logger = logging.getLogger(__name__)
 
 
@@ -74,8 +78,8 @@ def get_parser() -> EventParser:
     return event_parser_cls(bucket_name=settings.AWS_STORAGE_BUCKET_NAME)
 
 
-class MinioParser:
-    """Handle parsing and validation of Minio storage events."""
+class BaseS3Parser:
+    """Base class for handling parsing and validation of S3-compatible storage events."""
 
     def __init__(self, bucket_name: str, allowed_filetypes=None):
         """Initialize parser with target bucket name and accepted filetypes."""
@@ -91,32 +95,6 @@ class MinioParser:
             rf"(?P<url_encoded_folder_path>(?:[^%]+%2F)+)?{settings.RECORDING_OUTPUT_FOLDER}%2F(?P<recording_id>{UUID_REGEX})\.(?P<extension>{FILE_EXT_REGEX})"
         )
 
-    @staticmethod
-    def parse(data):
-        """Convert raw Minio event dictionary to StorageEvent object."""
-
-        if not data:
-            raise ParsingEventDataError("Received empty data.")
-
-        try:
-            record = data["Records"][0]
-            s3 = record["s3"]
-            bucket_name = s3["bucket"]["name"]
-            file_object = s3["object"]
-            filepath = file_object["key"]
-            filetype = file_object["contentType"]
-        except (KeyError, IndexError) as e:
-            raise ParsingEventDataError(f"Missing or malformed key: {e}.") from e
-        try:
-            return StorageEvent(
-                filepath=filepath,
-                filetype=filetype,
-                bucket_name=bucket_name,
-                metadata=None,
-            )
-        except TypeError as e:
-            raise ParsingEventDataError(f"Missing essential data fields: {e}") from e
-
     def validate(self, event_data: StorageEvent) -> str:
         """Verify StorageEvent matches bucket, filetype and filepath requirements."""
 
@@ -141,9 +119,56 @@ class MinioParser:
         return recording_id
 
     def get_recording_id(self, data):
-        """Extract recording ID from Minio event through parsing and validation."""
+        """Extract recording ID from S3 event through parsing and validation."""
 
         event_data = self.parse(data)
-        recording_id = self.validate(event_data)
+        return self.validate(event_data)
 
-        return recording_id
+    def parse(self, data: Dict) -> StorageEvent:
+        """To be implemented by subclasses."""
+        raise NotImplementedError("Subclasses must implement parse()")
+
+
+class MinioParser(BaseS3Parser):
+    """Minio specific event parsing."""
+
+    def parse(self, data: Dict) -> StorageEvent:
+        if not data:
+            raise ParsingEventDataError("Received empty data.")
+        try:
+            record = data["Records"][0]
+            s3 = record["s3"]
+            return StorageEvent(
+                filepath=s3["object"]["key"],
+                filetype=s3["object"]["contentType"],  # Minio-specific field
+                bucket_name=s3["bucket"]["name"],
+                metadata=None,
+            )
+        except (KeyError, IndexError) as e:
+            raise ParsingEventDataError(f"Malformed Minio event: {e}") from e
+        except TypeError as e:
+            raise ParsingEventDataError(f"Missing essential data fields: {e}") from e
+
+
+class S3Parser(BaseS3Parser):
+    """AWS S3 specific event parsing."""
+
+    def parse(self, data: Dict) -> StorageEvent:
+        if not data:
+            raise ParsingEventDataError("Received empty data.")
+        try:
+            # AWS S3 structure can slightly differ from Minio implementation
+            record = data["Records"][0]
+            s3 = record["s3"]
+            filepath = s3["object"]["key"]
+            if not filepath:
+                raise ParsingEventDataError("Missing object key name")
+            filetype, _ = mimetypes.guess_type(filepath)
+            return StorageEvent(
+                filepath=filepath,
+                filetype=filetype,
+                bucket_name=s3["bucket"]["name"],
+                metadata=None,
+            )
+        except (KeyError, IndexError) as e:
+            raise ParsingEventDataError(f"Malformed S3 event: {e}") from e

src/backend/core/services/provisional_user_service.py

@@ -0,0 +1,110 @@
+"""Service for provisional user creation."""
+
+import logging
+
+from django.conf import settings
+from django.core.exceptions import SuspiciousOperation, ValidationError
+from django.db import IntegrityError
+
+from core import models
+
+logger = logging.getLogger(__name__)
+
+
+class ProvisionalUserError(Exception):
+    """Base exception for provisional user service errors."""
+
+
+class ProvisionalUserCreationDisabledError(ProvisionalUserError):
+    """Raised when provisional user creation is disabled by configuration."""
+
+
+class ProvisionalUserIntegrityError(ProvisionalUserError):
+    """Raised when a provisional user cannot be created or retrieved after a race condition."""
+
+
+class ProvisionalUserService:
+    """Handles creation and retrieval of provisional users.
+
+    A provisional user is created without a `sub`, identified by email only.
+    The `sub` is set on first successful OIDC authentication via Django LaSuite.
+    """
+
+    def __init__(self):
+        """Initialize the service."""
+
+        # `OIDC_USER_SUB_FIELD_IMMUTABLE` comes from Django LaSuite and prevents `sub`
+        # updates. We override its default value to allow setting `sub` for
+        # provisional users.
+
+        self._is_creation_enabled = (
+            settings.APPLICATION_ALLOW_USER_CREATION
+            and settings.OIDC_FALLBACK_TO_EMAIL_FOR_IDENTIFICATION
+            and not settings.OIDC_USER_SUB_FIELD_IMMUTABLE
+        )
+
+    def _get_by_email(self, email: str) -> models.User | None:
+        """Return the user with this email, or None if not found."""
+        try:
+            return models.User.objects.get(email__iexact=email)
+        except models.User.DoesNotExist:
+            return None
+        except models.User.MultipleObjectsReturned as e:
+            raise SuspiciousOperation(
+                "Multiple user accounts share a common email."
+            ) from e
+
+    def get_or_create(
+        self, email: str, client_id: str
+    ) -> tuple[models.User | None, bool]:
+        """Get or create a provisional user identified by email.
+
+        Args:
+            email: The email address to identify the user.
+            client_id: The application client_id, used for audit logging only.
+
+        Returns:
+            A (user, created) tuple — mirrors get_or_create conventions.
+
+        Raises:
+            ProvisionalUserError: If creation and retrieval both fail.
+        """
+        user = self._get_by_email(email)
+        if user:
+            return user, False
+
+        if not self._is_creation_enabled:
+            raise ProvisionalUserCreationDisabledError(
+                "Provisional user creation is disabled by configuration."
+            )
+
+        # Create a provisional user without `sub`, identified by email only.
+        # This relies on Django LaSuite implicitly updating the `sub` field on the
+        # user's first successful OIDC authentication. If this stops working,
+        # check for behavior changes in Django LaSuite.
+        try:
+            user = models.User(sub=None, email=email)
+            user.set_unusable_password()
+            user.save()
+            logger.info(
+                "Provisional user created via application: user_id=%s, email=%s, client_id=%s",
+                user.id,
+                email,
+                client_id,
+            )
+            return user, True
+        except (IntegrityError, ValidationError) as e:
+            logger.warning(
+                "Race condition on provisional user creation, fetching existing: "
+                "email=%s, client_id=%s",
+                email,
+                client_id,
+            )
+            user = self._get_by_email(email)
+
+            if user:
+                return user, False
+
+            raise ProvisionalUserIntegrityError(
+                "Failed to create or retrieve provisional user."
+            ) from e

src/backend/core/tests/authentication/test_backends.py

@@ -346,8 +346,11 @@ def test_authentication_getter_existing_user_change_fields(
 
     # One and only one additional update query when a field has changed
     # Note: .save() triggers uniqueness validation queries for unique fields,
-    # adding extra SELECT queries before the UPDATE (e.g., checking unique=True on 'sub')
-    with django_assert_num_queries(3):
+    # adding extra SELECT queries before the UPDATE:
+    #   - unique=True on 'sub'
+    #   - unique=True on 'admin_email'
+    #   - partial unique index 'unique_email_when_sub_is_null'
+    with django_assert_num_queries(5):
         authenticated_user = klass.get_or_create_user(
             access_token="test-token", id_token=None, payload=None
         )

src/backend/core/tests/files/test_api_files_create.py

@@ -118,7 +118,7 @@ def test_api_files_create_file_authenticated_success():
 
     assert policy_parsed.scheme == "http"
     assert policy_parsed.netloc in ["minio:9000", "localhost:9000"]
-    assert policy_parsed.path == f"/meet-media-storage/files/{file.id!s}.png"
+    assert policy_parsed.path == f"/meet-media-storage/tmp/files/{file.id!s}.png"
 
     query_params = parse_qs(policy_parsed.query)
 

src/backend/core/tests/files/test_api_files_upload_ended.py

@@ -1,6 +1,7 @@
 """Test related to item upload ended API."""
 
 import logging
+from concurrent.futures import ThreadPoolExecutor
 from io import BytesIO
 
 from django.core.files.storage import default_storage
@@ -81,7 +82,7 @@ def test_api_file_upload_ended_success(settings):
     )
 
     default_storage.save(
-        file.file_key,
+        file.temporary_file_key,
         BytesIO(b"my prose"),
     )
 
@@ -97,6 +98,7 @@ def test_api_file_upload_ended_success(settings):
     assert response.json()["mimetype"] == "text/plain"
 
 
+@pytest.mark.django_db(transaction=True)
 def test_api_file_upload_ended_mimetype_not_allowed(settings, caplog):
     """
     Test that the API returns a 400 when the mimetype is not allowed.
@@ -119,7 +121,7 @@ def test_api_file_upload_ended_mimetype_not_allowed(settings, caplog):
     )
 
     default_storage.save(
-        file.file_key,
+        file.temporary_file_key,
         BytesIO(b"my prose"),
     )
 
@@ -156,7 +158,7 @@ def test_api_file_upload_ended_mimetype_not_allowed_not_checking_mimetype(settin
     )
 
     default_storage.save(
-        file.file_key,
+        file.temporary_file_key,
         BytesIO(b"my prose"),
     )
 
@@ -200,7 +202,7 @@ def test_api_upload_ended_mismatch_mimetype_with_object_storage(settings, caplog
 
     s3_client.put_object(
         Bucket=default_storage.bucket_name,
-        Key=file.file_key,
+        Key=file.temporary_file_key,
         ContentType="text/html",
         Body=BytesIO(
             b'<meta http-equiv="refresh" content="0; url=https://fichiers.numerique.gouv.fr">'
@@ -211,7 +213,7 @@ def test_api_upload_ended_mismatch_mimetype_with_object_storage(settings, caplog
     )
 
     head_object = s3_client.head_object(
-        Bucket=default_storage.bucket_name, Key=file.file_key
+        Bucket=default_storage.bucket_name, Key=file.temporary_file_key
     )
 
     assert head_object["ContentType"] == "text/html"
@@ -234,9 +236,10 @@ def test_api_upload_ended_mismatch_mimetype_with_object_storage(settings, caplog
     assert head_object["Metadata"] == {"foo": "bar"}
 
 
+@pytest.mark.django_db(transaction=True)
 def test_api_upload_ended_file_size_exceeded(settings, caplog):
     """
-    Test when the file size exceed the allowed max upload file size
+    Test when the file size exceeds the allowed max upload file size
     should return a 400 and delete the file.
     """
 
@@ -256,7 +259,7 @@ def test_api_upload_ended_file_size_exceeded(settings, caplog):
     )
 
     default_storage.save(
-        file.file_key,
+        file.temporary_file_key,
         BytesIO(b"my prose"),
     )
 
@@ -270,3 +273,48 @@ def test_api_upload_ended_file_size_exceeded(settings, caplog):
 
     assert not models.File.objects.filter(id=file.id).exists()
     assert not default_storage.exists(file.file_key)
+
+
+@pytest.mark.django_db(transaction=True)
+def test_api_file_upload_ended_concurrent_calls_are_serialized(settings):
+    """Only one concurrent upload-ended call can finalize a pending upload."""
+    settings.FILE_UPLOAD_APPLY_RESTRICTIONS = True
+    settings.FILE_UPLOAD_RESTRICTIONS = {
+        "background_image": {
+            **settings.FILE_UPLOAD_RESTRICTIONS["background_image"],
+            "allowed_mimetypes": ["text/plain"],
+        },
+    }
+
+    user = factories.UserFactory()
+    file = factories.FileFactory(
+        type=FileTypeChoices.BACKGROUND_IMAGE,
+        filename="my_file.txt",
+        creator=user,
+    )
+    default_storage.save(file.temporary_file_key, BytesIO(b"my prose"))
+
+    def call_upload_ended():
+        client = APIClient()
+        client.force_login(user)
+        return client.post(f"/api/v1.0/files/{file.id!s}/upload-ended/")
+
+    with ThreadPoolExecutor(max_workers=2) as executor:
+        futures = [
+            executor.submit(call_upload_ended),
+            executor.submit(call_upload_ended),
+        ]
+        responses = [future.result() for future in futures]
+
+    status_codes = sorted(response.status_code for response in responses)
+    assert status_codes == [200, 400]
+
+    failed_response = next(
+        response for response in responses if response.status_code == 400
+    )
+    assert failed_response.json() == {
+        "file": "This action is only available for files in PENDING state."
+    }
+
+    file.refresh_from_db()
+    assert file.upload_state == FileUploadStateChoices.READY

src/backend/core/tests/management/test_management_merge_duplicate_users.py

@@ -0,0 +1,460 @@
+"""Tests for the merge_duplicate_users management command."""
+
+from unittest import mock
+
+from django.core.management import base, call_command
+
+import pytest
+
+from core.factories import (
+    FileFactory,
+    UserFactory,
+    UserRecordingAccessFactory,
+    UserResourceAccessFactory,
+)
+from core.models import RecordingAccess, ResourceAccess, RoleChoices, User
+
+pytestmark = pytest.mark.django_db
+
+# pylint: disable=W0613
+
+
+def test_merge_no_duplicates_does_nothing():
+    """Command should do nothing when no duplicate users exist."""
+    user = UserFactory(email="unique@example.com")
+    call_command("merge_duplicate_users")
+    assert User.objects.count() == 1
+    assert User.objects.filter(id=user.id).exists()
+
+
+def test_merge_keeps_most_recently_created_user():
+    """Command should keep the most recently created user when duplicates exist."""
+    user1 = UserFactory(email="dup@example.com")
+    user2 = UserFactory(email="dup@example.com")
+    call_command("merge_duplicate_users")
+    assert not User.objects.filter(id=user1.id).exists()
+    assert User.objects.filter(id=user2.id).exists()
+
+
+def test_merge_deletes_all_stale_users():
+    """Command should delete all stale users and keep only the most recently created one."""
+    email = "many@example.com"
+    UserFactory(email=email)
+    UserFactory(email=email)
+    user_kept = UserFactory(email=email)
+    call_command("merge_duplicate_users")
+    assert User.objects.filter(email=email).count() == 1
+    assert User.objects.filter(id=user_kept.id).exists()
+
+
+# ── ResourceAccess ─────────────────────────────────────────────────────────────
+
+
+def test_merge_transfers_resource_access_to_kept_user():
+    """ResourceAccess should be transferred to the kept user when stale user is merged."""
+    user1 = UserFactory(email="dup@example.com")
+    user2 = UserFactory(email="dup@example.com")
+    ra = UserResourceAccessFactory(user=user1)
+    call_command("merge_duplicate_users")
+    ra.refresh_from_db()
+    assert ra.user == user2
+
+
+def test_merge_transfers_multiple_room_accesses():
+    """All ResourceAccesses should be transferred to the kept user when stale user is merged."""
+    user1 = UserFactory(email="dup@example.com")
+    user2 = UserFactory(email="dup@example.com")
+    accesses = UserResourceAccessFactory.create_batch(3, user=user1)
+    call_command("merge_duplicate_users")
+    assert not ResourceAccess.objects.filter(user=user1).exists()
+    for ra in accesses:
+        assert ResourceAccess.objects.filter(user=user2, resource=ra.resource).exists()
+
+
+def test_merge_all_resource_accesses_owned_by_kept_user_nothing_changes():
+    """ResourceAccesses should remain unchanged when all are already owned by the kept user."""
+    user1 = UserFactory(email="dup@example.com")
+    user2 = UserFactory(email="dup@example.com")
+    accesses = UserResourceAccessFactory.create_batch(3, user=user2)
+    call_command("merge_duplicate_users")
+    assert not ResourceAccess.objects.filter(user=user1).exists()
+    for ra in accesses:
+        ra.refresh_from_db()
+        assert ra.user == user2
+
+
+def test_merge_resource_access_conflict_upgrades_to_owner():
+    """ResourceAccess role should be upgraded to owner when stale user has a higher role."""
+    user1 = UserFactory(email="dup@example.com")
+    user2 = UserFactory(email="dup@example.com")
+    ra1 = UserResourceAccessFactory(user=user1, role=RoleChoices.OWNER)
+    ra2 = UserResourceAccessFactory(
+        user=user2, resource=ra1.resource, role=RoleChoices.MEMBER
+    )
+    other_accesses = UserResourceAccessFactory.create_batch(
+        3, user=user1, role=RoleChoices.MEMBER
+    )
+    call_command("merge_duplicate_users")
+    ra2.refresh_from_db()
+    assert ra2.role == RoleChoices.OWNER
+    assert not ResourceAccess.objects.filter(user=user1).exists()
+    for ra in other_accesses:
+        assert ResourceAccess.objects.filter(
+            user=user2, resource=ra.resource, role=RoleChoices.MEMBER
+        ).exists()
+
+
+def test_merge_resource_access_conflict_upgrades_to_admin():
+    """ResourceAccess role should be upgraded to admin when stale user has a higher role."""
+    user1 = UserFactory(email="dup@example.com")
+    user2 = UserFactory(email="dup@example.com")
+    ra1 = UserResourceAccessFactory(user=user1, role=RoleChoices.ADMIN)
+    ra2 = UserResourceAccessFactory(
+        user=user2, resource=ra1.resource, role=RoleChoices.MEMBER
+    )
+    other_accesses = UserResourceAccessFactory.create_batch(
+        3, user=user1, role=RoleChoices.MEMBER
+    )
+    call_command("merge_duplicate_users")
+    ra2.refresh_from_db()
+    assert ra2.role == RoleChoices.ADMIN
+    assert not ResourceAccess.objects.filter(user=user1).exists()
+    for ra in other_accesses:
+        assert ResourceAccess.objects.filter(
+            user=user2, resource=ra.resource, role=RoleChoices.MEMBER
+        ).exists()
+
+
+def test_merge_resource_access_conflict_does_not_downgrade_role():
+    """ResourceAccess role should not be downgraded when stale user has a lower role."""
+    user1 = UserFactory(email="dup@example.com")
+    user2 = UserFactory(email="dup@example.com")
+    ra1 = UserResourceAccessFactory(user=user1, role=RoleChoices.MEMBER)
+    ra2 = UserResourceAccessFactory(
+        user=user2, resource=ra1.resource, role=RoleChoices.OWNER
+    )
+    other_accesses = UserResourceAccessFactory.create_batch(
+        3, user=user1, role=RoleChoices.MEMBER
+    )
+    call_command("merge_duplicate_users")
+    ra2.refresh_from_db()
+    assert ra2.role == RoleChoices.OWNER
+    assert not ResourceAccess.objects.filter(user=user1).exists()
+    for ra in other_accesses:
+        assert ResourceAccess.objects.filter(
+            user=user2, resource=ra.resource, role=RoleChoices.MEMBER
+        ).exists()
+
+
+def test_merge_resource_access_conflict_equal_role_keeps_single_access():
+    """ResourceAccess should keep one entry for the kept user when both ones have the same role."""
+    user1 = UserFactory(email="dup@example.com")
+    user2 = UserFactory(email="dup@example.com")
+    ra1 = UserResourceAccessFactory(user=user1, role=RoleChoices.MEMBER)
+    UserResourceAccessFactory(
+        user=user2, resource=ra1.resource, role=RoleChoices.MEMBER
+    )
+    call_command("merge_duplicate_users")
+    accesses = ResourceAccess.objects.filter(resource=ra1.resource)
+    assert accesses.count() == 1
+    assert accesses.first().user == user2
+    assert accesses.first().role == RoleChoices.MEMBER
+
+
+# ── RecordingAccess ────────────────────────────────────────────────────────────
+
+
+def test_merge_transfers_recording_access_to_kept_user():
+    """RecordingAccess should be transferred to the kept user when stale user is merged."""
+    user1 = UserFactory(email="dup@example.com")
+    user2 = UserFactory(email="dup@example.com")
+    rca = UserRecordingAccessFactory(user=user1)
+    call_command("merge_duplicate_users")
+    rca.refresh_from_db()
+    assert rca.user == user2
+
+
+def test_merge_transfers_multiple_recording_accesses():
+    """All RecordingAccesses should be transferred to the kept user when stale user is merged."""
+    user1 = UserFactory(email="dup@example.com")
+    user2 = UserFactory(email="dup@example.com")
+    accesses = UserRecordingAccessFactory.create_batch(3, user=user1)
+    call_command("merge_duplicate_users")
+    assert not RecordingAccess.objects.filter(user=user1).exists()
+    for rca in accesses:
+        assert RecordingAccess.objects.filter(
+            user=user2, recording=rca.recording
+        ).exists()
+
+
+def test_merge_all_recording_accesses_owned_by_kept_user_nothing_changes():
+    """RecordingAccesses should remain unchanged when all are already owned by the kept user."""
+    user1 = UserFactory(email="dup@example.com")
+    user2 = UserFactory(email="dup@example.com")
+    accesses = UserRecordingAccessFactory.create_batch(3, user=user2)
+    call_command("merge_duplicate_users")
+    assert not RecordingAccess.objects.filter(user=user1).exists()
+    for rca in accesses:
+        rca.refresh_from_db()
+        assert rca.user == user2
+
+
+def test_merge_recording_access_conflict_upgrades_to_owner():
+    """RecordingAccess role should be upgraded to owner when stale user has a higher role."""
+    user1 = UserFactory(email="dup@example.com")
+    user2 = UserFactory(email="dup@example.com")
+    rca1 = UserRecordingAccessFactory(user=user1, role=RoleChoices.OWNER)
+    rca2 = UserRecordingAccessFactory(
+        user=user2, recording=rca1.recording, role=RoleChoices.MEMBER
+    )
+    other_accesses = UserRecordingAccessFactory.create_batch(
+        3, user=user1, role=RoleChoices.MEMBER
+    )
+    call_command("merge_duplicate_users")
+    rca2.refresh_from_db()
+    assert rca2.role == RoleChoices.OWNER
+    assert not RecordingAccess.objects.filter(user=user1).exists()
+    for rca in other_accesses:
+        assert RecordingAccess.objects.filter(
+            user=user2, recording=rca.recording, role=RoleChoices.MEMBER
+        ).exists()
+
+
+def test_merge_recording_access_conflict_upgrades_to_admin():
+    """RecordingAccess role should be upgraded to admin when stale user has a higher role."""
+    user1 = UserFactory(email="dup@example.com")
+    user2 = UserFactory(email="dup@example.com")
+    rca1 = UserRecordingAccessFactory(user=user1, role=RoleChoices.ADMIN)
+    rca2 = UserRecordingAccessFactory(
+        user=user2, recording=rca1.recording, role=RoleChoices.MEMBER
+    )
+    other_accesses = UserRecordingAccessFactory.create_batch(
+        3, user=user1, role=RoleChoices.MEMBER
+    )
+    call_command("merge_duplicate_users")
+    rca2.refresh_from_db()
+    assert rca2.role == RoleChoices.ADMIN
+    assert not RecordingAccess.objects.filter(user=user1).exists()
+    for rca in other_accesses:
+        assert RecordingAccess.objects.filter(
+            user=user2, recording=rca.recording, role=RoleChoices.MEMBER
+        ).exists()
+
+
+def test_merge_recording_access_conflict_does_not_downgrade_role():
+    """RecordingAccess role should not be downgraded when stale user has a lower role."""
+    user1 = UserFactory(email="dup@example.com")
+    user2 = UserFactory(email="dup@example.com")
+    rca1 = UserRecordingAccessFactory(user=user1, role=RoleChoices.MEMBER)
+    rca2 = UserRecordingAccessFactory(
+        user=user2, recording=rca1.recording, role=RoleChoices.OWNER
+    )
+    other_accesses = UserRecordingAccessFactory.create_batch(
+        3, user=user1, role=RoleChoices.MEMBER
+    )
+    call_command("merge_duplicate_users")
+    rca2.refresh_from_db()
+    assert rca2.role == RoleChoices.OWNER
+    assert not RecordingAccess.objects.filter(user=user1).exists()
+    for rca in other_accesses:
+        assert RecordingAccess.objects.filter(
+            user=user2, recording=rca.recording, role=RoleChoices.MEMBER
+        ).exists()
+
+
+def test_merge_recording_access_conflict_equal_role_keeps_single_access():
+    """RecordingAccess should keep one entry for the user when both users have the same role."""
+    user1 = UserFactory(email="dup@example.com")
+    user2 = UserFactory(email="dup@example.com")
+    rca1 = UserRecordingAccessFactory(user=user1, role=RoleChoices.MEMBER)
+    UserRecordingAccessFactory(
+        user=user2, recording=rca1.recording, role=RoleChoices.MEMBER
+    )
+    call_command("merge_duplicate_users")
+    accesses = RecordingAccess.objects.filter(recording=rca1.recording)
+    assert accesses.count() == 1
+    assert accesses.first().user == user2
+    assert accesses.first().role == RoleChoices.MEMBER
+
+
+# ── Files ──────────────────────────────────────────────────────────────────────
+
+
+def test_merge_reassigns_files_to_kept_user():
+    """Files should be reassigned to the kept user when stale user is merged."""
+    user1 = UserFactory(email="dup@example.com")
+    user2 = UserFactory(email="dup@example.com")
+    files = FileFactory.create_batch(3, creator=user1)
+    call_command("merge_duplicate_users")
+    for f in files:
+        f.refresh_from_db()
+        assert f.creator == user2
+
+
+def test_merge_kept_user_own_files_untouched():
+    """Files already owned by the kept user should remain unchanged after merge."""
+    user1 = UserFactory(email="dup@example.com")
+    user2 = UserFactory(email="dup@example.com")
+    FileFactory(creator=user1)
+    kept_file = FileFactory(creator=user2)
+    call_command("merge_duplicate_users")
+    kept_file.refresh_from_db()
+    assert kept_file.creator == user2
+
+
+# ── Dry-run ────────────────────────────────────────────────────────────────────
+
+
+def test_merge_dry_run_does_not_delete_users():
+    """Command should not delete any users when dry-run is enabled."""
+    UserFactory(email="dup@example.com")
+    UserFactory(email="dup@example.com")
+    call_command("merge_duplicate_users", dry_run=True)
+    assert User.objects.filter(email="dup@example.com").count() == 2
+
+
+def test_merge_dry_run_does_not_move_resource_access():
+    """Command should not move resource accesses when dry-run is enabled."""
+    user1 = UserFactory(email="dup@example.com")
+    UserFactory(email="dup@example.com")
+    ra = UserResourceAccessFactory(user=user1)
+    call_command("merge_duplicate_users", dry_run=True)
+    ra.refresh_from_db()
+    assert ra.user == user1
+
+
+def test_merge_dry_run_does_not_move_recording_access():
+    """Command should not move recording accesses when dry-run is enabled."""
+    user1 = UserFactory(email="dup@example.com")
+    UserFactory(email="dup@example.com")
+    ra = UserRecordingAccessFactory(user=user1)
+    call_command("merge_duplicate_users", dry_run=True)
+    ra.refresh_from_db()
+    assert ra.user == user1
+
+
+def test_merge_dry_run_does_not_move_files():
+    """Command should not reassign files when dry-run is enabled."""
+    user1 = UserFactory(email="dup@example.com")
+    UserFactory(email="dup@example.com")
+    f = FileFactory(creator=user1)
+    call_command("merge_duplicate_users", dry_run=True)
+    f.refresh_from_db()
+    assert f.creator == user1
+
+
+# ── Isolation ──────────────────────────────────────────────────────────────────
+
+
+def test_merge_non_duplicate_users_untouched():
+    """Non-duplicate users should remain untouched when other duplicates are merged."""
+    unique = UserFactory(email="unique@example.com")
+    UserFactory(email="dup@example.com")
+    UserFactory(email="dup@example.com")
+    call_command("merge_duplicate_users")
+    assert User.objects.filter(id=unique.id).exists()
+
+
+def test_merge_non_duplicate_resource_access_untouched():
+    """ResourceAccess of non-duplicate users should remain untouched."""
+    unique = UserFactory(email="unique@example.com")
+    ra = UserResourceAccessFactory(user=unique)
+    UserFactory(email="dup@example.com")
+    UserFactory(email="dup@example.com")
+    call_command("merge_duplicate_users")
+    ra.refresh_from_db()
+    assert ra.user == unique
+
+
+def test_merge_multiple_email_groups_all_merged():
+    """Command should merge all duplicate email groups in a single run."""
+    for i in range(3):
+        UserFactory(email=f"group{i}@example.com")
+        UserFactory(email=f"group{i}@example.com")
+    call_command("merge_duplicate_users")
+    for i in range(3):
+        assert User.objects.filter(email=f"group{i}@example.com").count() == 1
+    assert User.objects.count() == 3
+
+
+# ── NULL / blank email guard ───────────────────────────────────────────────────
+
+
+def test_merge_does_not_merge_users_with_null_email():
+    """Users with NULL email must never be merged together, even if multiple exist."""
+    user1 = UserFactory(email=None)
+    user2 = UserFactory(email=None)
+    call_command("merge_duplicate_users")
+    assert User.objects.filter(id=user1.id).exists()
+    assert User.objects.filter(id=user2.id).exists()
+
+
+def test_merge_does_not_merge_users_with_blank_email():
+    """Users with empty-string email must never be merged together, even if multiple exist."""
+    user1 = UserFactory(email="")
+    user2 = UserFactory(email="")
+    call_command("merge_duplicate_users")
+    assert User.objects.filter(id=user1.id).exists()
+    assert User.objects.filter(id=user2.id).exists()
+
+
+# ── Atomicity ──────────────────────────────────────────────────────────────────
+
+
+@mock.patch(
+    "core.management.commands.merge_duplicate_users.Command._merge_recording_accesses",
+    side_effect=Exception("forced failure"),
+)
+def test_merge_is_atomic_rolls_back_all_on_any_failure(mock_reassign_files):
+    """Merge should be fully rolled back when any step fails."""
+    user1 = UserFactory(email="dup@example.com")
+    user2 = UserFactory(email="dup@example.com")
+    resource_accesses = UserResourceAccessFactory.create_batch(3, user=user1)
+    recording_accesses = UserRecordingAccessFactory.create_batch(3, user=user1)
+    files = FileFactory.create_batch(3, creator=user1)
+
+    with pytest.raises(base.CommandError):
+        call_command("merge_duplicate_users")
+
+    assert User.objects.filter(id=user1.id).exists()
+    assert User.objects.filter(id=user2.id).exists()
+    for ra in resource_accesses:
+        ra.refresh_from_db()
+        assert ra.user == user1
+    for rca in recording_accesses:
+        rca.refresh_from_db()
+        assert rca.user == user1
+    for f in files:
+        f.refresh_from_db()
+        assert f.creator == user1
+
+
+# ── Email filter ───────────────────────────────────────────────────────────────
+
+
+def test_merge_email_filter_only_merges_matching_emails():
+    """Command should only merge users whose email matches the filter."""
+    UserFactory(email="user1@example.com")
+    UserFactory(email="user1@example.com")
+    other1 = UserFactory(email="user1@other.com")
+    other2 = UserFactory(email="user1@other.com")
+    call_command("merge_duplicate_users", email_filter="@example.com")
+    assert User.objects.filter(email="user1@example.com").count() == 1
+    assert User.objects.filter(id=other1.id).exists()
+    assert User.objects.filter(id=other2.id).exists()
+
+
+def test_merge_email_filter_no_match_does_nothing():
+    """Command should do nothing when the email filter matches no users."""
+    UserFactory(email="user1@example.com")
+    UserFactory(email="user1@example.com")
+    call_command("merge_duplicate_users", email_filter="@nomatch.com")
+    assert User.objects.filter(email="user1@example.com").count() == 2
+
+
+def test_merge_email_filter_is_case_insensitive():
+    """Command should match emails case-insensitively when filtering."""
+    UserFactory(email="user1@Example.com")
+    UserFactory(email="user1@Example.com")
+    call_command("merge_duplicate_users", email_filter="@example.com")
+    assert User.objects.filter(email="user1@Example.com").count() == 1

src/backend/core/tests/recording/event/test_parsers.py

@@ -18,10 +18,13 @@ from core.recording.event.exceptions import (
 )
 from core.recording.event.parsers import (
     MinioParser,
+    S3Parser,
     StorageEvent,
     get_parser,
 )
 
+# MinioParser
+
 
 @pytest.fixture
 def valid_minio_event():
@@ -47,7 +50,7 @@ def minio_parser():
     return MinioParser(bucket_name="test-bucket")
 
 
-def test_parse_valid_event(minio_parser, valid_minio_event):
+def test_minio_parse_valid_event(minio_parser, valid_minio_event):
     """Test parsing a valid Minio event."""
     event = minio_parser.parse(valid_minio_event)
     assert isinstance(event, StorageEvent)
@@ -57,13 +60,33 @@ def test_parse_valid_event(minio_parser, valid_minio_event):
     assert event.metadata is None
 
 
-def test_parse_empty_data(minio_parser):
+def test_minio_parse_with_video_type(minio_parser):
+    """Test parsing event with video file type."""
+    video_event = {
+        "Records": [
+            {
+                "s3": {
+                    "bucket": {"name": "test-bucket"},
+                    "object": {
+                        "key": "46d1a121-2426-484d-8fb3-09b5d886f7a8.mp4",
+                        "contentType": "video/mp4",
+                    },
+                }
+            }
+        ]
+    }
+    event = minio_parser.parse(video_event)
+    assert event.filetype == "video/mp4"
+    assert event.filepath.endswith(".mp4")
+
+
+def test_minio_parse_empty_data(minio_parser):
     """Test parsing empty event data raises error."""
     with pytest.raises(ParsingEventDataError, match="Received empty data."):
         minio_parser.parse({})
 
 
-def test_parse_missing_keys(minio_parser):
+def test_minio_parse_missing_keys(minio_parser):
     """Test parsing event with missing key."""
 
     invalid_minio_event = {
@@ -77,11 +100,11 @@ def test_parse_missing_keys(minio_parser):
         ]
     }
 
-    with pytest.raises(ParsingEventDataError, match="Missing or malformed key"):
+    with pytest.raises(ParsingEventDataError, match="Malformed Minio event:"):
         minio_parser.parse(invalid_minio_event)
 
 
-def test_parse_none_key(minio_parser):
+def test_minio_parse_none_key(minio_parser):
     """Test parsing event with None field."""
 
     invalid_minio_event = {
@@ -102,7 +125,7 @@ def test_parse_none_key(minio_parser):
         minio_parser.parse(invalid_minio_event)
 
 
-def test_validate_invalid_bucket(minio_parser):
+def test_minio_validate_invalid_bucket(minio_parser):
     """Test validation with wrong bucket name."""
     event = StorageEvent(
         filepath="recording%2F46d1a121-2426-484d-8fb3-09b5d886f7a8.ogg",
@@ -114,7 +137,7 @@ def test_validate_invalid_bucket(minio_parser):
         minio_parser.validate(event)
 
 
-def test_validate_invalid_filetype(minio_parser):
+def test_minio_validate_invalid_filetype(minio_parser):
     """Test validation with unsupported file type."""
     event = StorageEvent(
         filepath="recording%2F46d1a121-2426-484d-8fb3-09b5d886f7a8.txt",
@@ -139,7 +162,7 @@ def test_validate_invalid_filetype(minio_parser):
         "folder%2Fuploads%2F46d1a121-2426-484d-8fb3-09b5d886f7a8.ogg",  # nested but no recordings/
     ],
 )
-def test_validate_invalid_filepath(invalid_filepath, minio_parser):
+def test_minio_validate_invalid_filepath(invalid_filepath, minio_parser):
     """Test validation with malformed filepath."""
     event = StorageEvent(
         filepath=invalid_filepath,
@@ -151,7 +174,7 @@ def test_validate_invalid_filepath(invalid_filepath, minio_parser):
         minio_parser.validate(event)
 
 
-def test_validate_valid_event(minio_parser):
+def test_minio_validate_valid_event(minio_parser):
     """Test validation with valid event data."""
     event = StorageEvent(
         filepath="recordings%2F46d1a121-2426-484d-8fb3-09b5d886f7a8.ogg",
@@ -163,13 +186,13 @@ def test_validate_valid_event(minio_parser):
     assert recording_id == "46d1a121-2426-484d-8fb3-09b5d886f7a8"
 
 
-def test_get_recording_id_success(minio_parser, valid_minio_event):
+def test_minio_get_recording_id_success(minio_parser, valid_minio_event):
     """Test successful extraction of recording ID."""
     recording_id = minio_parser.get_recording_id(valid_minio_event)
     assert recording_id == "46d1a121-2426-484d-8fb3-09b5d886f7a8"
 
 
-def test_validate_filepath_with_folder(minio_parser):
+def test_minio_validate_filepath_with_folder(minio_parser):
     """Test validation of filepath with folder structure."""
     event = StorageEvent(
         filepath="parent_folder%2Frecordings%2F46d1a121-2426-484d-8fb3-09b5d886f7a8.ogg",
@@ -181,41 +204,21 @@ def test_validate_filepath_with_folder(minio_parser):
     assert recording_id == "46d1a121-2426-484d-8fb3-09b5d886f7a8"
 
 
-def test_parse_with_video_type(minio_parser):
-    """Test parsing event with video file type."""
-    video_event = {
-        "Records": [
-            {
-                "s3": {
-                    "bucket": {"name": "test-bucket"},
-                    "object": {
-                        "key": "46d1a121-2426-484d-8fb3-09b5d886f7a8.mp4",
-                        "contentType": "video/mp4",
-                    },
-                }
-            }
-        ]
-    }
-    event = minio_parser.parse(video_event)
-    assert event.filetype == "video/mp4"
-    assert event.filepath.endswith(".mp4")
-
-
-def test_empty_allowed_filetypes():
+def test_minio_empty_allowed_filetypes():
     """Test MinioParser with empty allowed_filetypes."""
     empty_types = set()
     parser = MinioParser(bucket_name="test-bucket", allowed_filetypes=empty_types)
     assert parser._allowed_filetypes == {"audio/ogg", "video/mp4"}
 
 
-def test_custom_allowed_filetypes():
+def test_minio_custom_allowed_filetypes():
     """Test MinioParser with empty allowed_filetypes."""
     custom_types = {"audio/mp3", "video/mov"}
     parser = MinioParser(bucket_name="test-bucket", allowed_filetypes=custom_types)
     assert parser._allowed_filetypes == {"audio/mp3", "video/mov"}
 
 
-def test_validate_custom_filetypes():
+def test_minio_validate_custom_filetypes():
     """Test validation of filepath with folder structure."""
 
     parser = MinioParser(bucket_name="test-bucket", allowed_filetypes={"audio/mp3"})
@@ -229,18 +232,143 @@ def test_validate_custom_filetypes():
     parser.validate(event)
 
 
-def test_constructor_none_bucket():
+def test_minio_constructor_none_bucket():
     """Test MinioParser constructor with None bucket name."""
     with pytest.raises(ValueError, match="Bucket name cannot be None or empty"):
         MinioParser(bucket_name=None)
 
 
-def test_constructor_empty_bucket():
+def test_minio_constructor_empty_bucket():
     """Test MinioParser constructor with empty bucket name."""
     with pytest.raises(ValueError, match="Bucket name cannot be None or empty"):
         MinioParser(bucket_name="")
 
 
+# S3Parser
+
+
+@pytest.fixture
+def valid_s3_event():
+    """Mock a valid S3 event."""
+    return {
+        "Records": [
+            {
+                "s3": {
+                    "bucket": {"name": "test-bucket"},
+                    "object": {
+                        "key": "recordings%2F46d1a121-2426-484d-8fb3-09b5d886f7a8.ogg",
+                    },
+                }
+            }
+        ]
+    }
+
+
+@pytest.fixture
+def s3_parser():
+    """Mock an S3 parser."""
+    return S3Parser(bucket_name="test-bucket")
+
+
+def test_s3_parse_valid_event(s3_parser, valid_s3_event):
+    """Test parsing a valid S3 event."""
+    event = s3_parser.parse(valid_s3_event)
+    assert isinstance(event, StorageEvent)
+    assert event.filepath == "recordings%2F46d1a121-2426-484d-8fb3-09b5d886f7a8.ogg"
+    assert event.filetype == "audio/ogg"
+    assert event.bucket_name == "test-bucket"
+    assert event.metadata is None
+
+
+def test_s3_parse_empty_data(s3_parser):
+    """Test parsing empty S3 event data raises error."""
+    with pytest.raises(ParsingEventDataError, match="Received empty data."):
+        s3_parser.parse({})
+
+
+def test_s3_parse_missing_keys(s3_parser):
+    """Test parsing S3 event with missing key."""
+    invalid_s3_event = {
+        "Records": [
+            {
+                "s3": {
+                    "bucket": {"name": "test-bucket"},
+                    # Missing 'object' key
+                }
+            }
+        ]
+    }
+
+    with pytest.raises(ParsingEventDataError, match="Malformed S3 event:"):
+        s3_parser.parse(invalid_s3_event)
+
+
+def test_s3_parse_none_key(s3_parser):
+    """Test parsing S3 event with None field."""
+    invalid_s3_event = {
+        "Records": [
+            {
+                "s3": {
+                    "bucket": {"name": "test-bucket"},
+                    "object": {
+                        "key": None,
+                    },
+                }
+            }
+        ]
+    }
+
+    with pytest.raises(ParsingEventDataError, match="Missing object key name"):
+        s3_parser.parse(invalid_s3_event)
+
+
+def test_s3_parse_with_video_type(s3_parser):
+    """Test parsing S3 event with mp4 file extension."""
+    video_event = {
+        "Records": [
+            {
+                "s3": {
+                    "bucket": {"name": "test-bucket"},
+                    "object": {
+                        "key": "recordings%2F46d1a121-2426-484d-8fb3-09b5d886f7a8.mp4",
+                    },
+                }
+            }
+        ]
+    }
+    event = s3_parser.parse(video_event)
+    assert event.filetype == "video/mp4"
+    assert event.filepath.endswith(".mp4")
+
+
+def test_s3_parse_unrecognized_extension(s3_parser):
+    """Test parsing S3 event with unrecognized file extension."""
+    event_with_unknown_ext = {
+        "Records": [
+            {
+                "s3": {
+                    "bucket": {"name": "test-bucket"},
+                    "object": {
+                        "key": "recordings%2F46d1a121-2426-484d-8fb3-09b5d886f7a8.zzunknown999",
+                    },
+                }
+            }
+        ]
+    }
+
+    with pytest.raises(TypeError, match="filetype cannot be None"):
+        s3_parser.parse(event_with_unknown_ext)
+
+
+def test_s3_get_recording_id_success(s3_parser, valid_s3_event):
+    """Test successful extraction of recording ID from S3 event."""
+    recording_id = s3_parser.get_recording_id(valid_s3_event)
+    assert recording_id == "46d1a121-2426-484d-8fb3-09b5d886f7a8"
+
+
+# get_parser
+
+
 @pytest.fixture
 def clear_lru_cache():
     """Fixture to clear the LRU cache between tests."""

src/backend/core/tests/recording/test_api_recordings_external_process_hook.py

@@ -1,134 +0,0 @@
-"""
-Test recordings API endpoints: external process hook.
-"""
-
-# pylint: disable=redefined-outer-name,unused-argument
-
-import pytest
-
-from ...factories import RecordingFactory
-from ...models import RecordingStatusChoices
-
-pytestmark = pytest.mark.django_db
-
-
-@pytest.fixture
-def external_process_settings(settings):
-    """Configure authentication token for the external process webhook."""
-    settings.SUMMARY_SERVICE_WEBHOOK_API_TOKEN = "testWebhookToken"
-    return settings
-
-
-def test_external_process_event_missing_authorization_header(
-    external_process_settings, client
-):
-    """Requests without authorization must be rejected."""
-    response = client.post(
-        "/api/v1.0/recordings/external-process-hook/",
-        {"job_id": "job-1", "type": "transcript", "status": "success"},
-    )
-
-    assert response.status_code == 403
-
-
-def test_external_process_event_wrong_bearer_token(external_process_settings, client):
-    """Requests with invalid bearer token must be rejected."""
-    response = client.post(
-        "/api/v1.0/recordings/external-process-hook/",
-        {"job_id": "job-1", "type": "transcript", "status": "success"},
-        HTTP_AUTHORIZATION="Bearer wrongToken",
-    )
-
-    assert response.status_code == 403
-
-
-def test_external_process_event_missing_job_id(external_process_settings, client):
-    """Payload without job_id must fail validation."""
-    response = client.post(
-        "/api/v1.0/recordings/external-process-hook/",
-        {"type": "transcript", "status": "success"},
-        HTTP_AUTHORIZATION="Bearer testWebhookToken",
-    )
-
-    assert response.status_code == 400
-    assert "No job_id provided" in str(response.json())
-
-
-def test_external_process_event_success_updates_recording_status(
-    external_process_settings, client
-):
-    """A successful transcript process should update recording status."""
-    recording = RecordingFactory(
-        status=RecordingStatusChoices.SAVED,
-        external_process_id="job-123",
-    )
-
-    response = client.post(
-        "/api/v1.0/recordings/external-process-hook/",
-        {"job_id": "job-123", "type": "transcript", "status": "success"},
-        HTTP_AUTHORIZATION="Bearer testWebhookToken",
-    )
-
-    assert response.status_code == 200
-    assert response.json() == {"message": "Event processed."}
-
-    recording.refresh_from_db()
-    assert recording.status == RecordingStatusChoices.EXTERNAL_PROCESS_SUCCESSFUL
-
-
-def test_external_process_event_failure_updates_recording_status(
-    external_process_settings, client
-):
-    """A failing transcript process should update recording status."""
-    recording = RecordingFactory(
-        status=RecordingStatusChoices.SAVED,
-        external_process_id="job-456",
-    )
-
-    response = client.post(
-        "/api/v1.0/recordings/external-process-hook/",
-        {"job_id": "job-456", "type": "transcript", "status": "failure"},
-        HTTP_AUTHORIZATION="Bearer testWebhookToken",
-    )
-
-    assert response.status_code == 200
-    assert response.json() == {"message": "Event processed."}
-
-    recording.refresh_from_db()
-    assert recording.status == RecordingStatusChoices.EXTERNAL_PROCESS_FAILED
-
-
-def test_external_process_event_unknown_recording_is_ignored(
-    external_process_settings, client
-):
-    """Unknown job_id should not fail the webhook processing."""
-    response = client.post(
-        "/api/v1.0/recordings/external-process-hook/",
-        {"job_id": "missing-job", "type": "transcript", "status": "success"},
-        HTTP_AUTHORIZATION="Bearer testWebhookToken",
-    )
-
-    assert response.status_code == 200
-    assert response.json() == {"message": "Event processed."}
-
-
-def test_external_process_event_non_transcript_event_does_not_change_status(
-    external_process_settings, client
-):
-    """Only transcript events should update recording status."""
-    recording = RecordingFactory(
-        status=RecordingStatusChoices.SAVED,
-        external_process_id="job-789",
-    )
-
-    response = client.post(
-        "/api/v1.0/recordings/external-process-hook/",
-        {"job_id": "job-789", "type": "thumbnail", "status": "success"},
-        HTTP_AUTHORIZATION="Bearer testWebhookToken",
-    )
-
-    assert response.status_code == 200
-    assert response.json() == {"message": "Event processed."}
-
-    recording.refresh_from_db()
-    assert recording.status == RecordingStatusChoices.SAVED

src/backend/core/tests/swagger/test_openapi_schema.py

@@ -4,6 +4,7 @@ Test suite for generated openapi schema.
 
 import json
 from io import StringIO
+from unittest.mock import patch
 
 from django.core.management import call_command
 from django.test import Client
@@ -33,10 +34,26 @@ def test_openapi_client_schema():
     )
     assert output.getvalue() == ""
 
-    response = Client().get("/v1.0/swagger.json")
+    response = Client().get("/api/v1.0/swagger.json")
 
     assert response.status_code == 200
     with open(
         "core/tests/swagger/swagger.json", "r", encoding="utf-8"
     ) as expected_schema:
         assert response.json() == json.load(expected_schema)
+
+
+@patch(
+    "django.contrib.staticfiles.storage.staticfiles_storage.url",
+    side_effect=lambda name: f"/static/{name}",
+)
+# pylint: disable=unused-argument
+def test_openapi_documentation_routes(mock_staticfiles):
+    """Swagger and ReDoc documentation should be served on canonical URLs."""
+    client = Client()
+
+    swagger_response = client.get("/api/v1.0/swagger/")
+    redoc_response = client.get("/api/v1.0/redoc/")
+
+    assert swagger_response.status_code == 200
+    assert redoc_response.status_code == 200

src/backend/core/tests/test_external_api_rooms.py

@@ -250,6 +250,112 @@ def test_api_rooms_list_filters_by_user():
     assert str(room2.id) not in returned_ids
 
 
+def test_api_rooms_list_access_level_in_results():
+    """Rooms should include the correct access_level for each room."""
+    user = UserFactory()
+    room_trusted = RoomFactory(
+        users=[(user, RoleChoices.OWNER)], access_level=RoomAccessLevel.TRUSTED
+    )
+    room_restricted = RoomFactory(
+        users=[(user, RoleChoices.OWNER)], access_level=RoomAccessLevel.RESTRICTED
+    )
+
+    token = generate_test_token(user, [ApplicationScope.ROOMS_LIST])
+
+    client = APIClient()
+    client.credentials(HTTP_AUTHORIZATION=f"Bearer {token}")
+    response = client.get("/external-api/v1.0/rooms/")
+
+    assert response.status_code == 200
+    results = {r["id"]: r for r in response.data["results"]}
+    assert results[str(room_trusted.id)]["access_level"] == RoomAccessLevel.TRUSTED
+    assert (
+        results[str(room_restricted.id)]["access_level"] == RoomAccessLevel.RESTRICTED
+    )
+
+
+def test_api_rooms_list_does_not_expose_sensitive_fields():
+    """Rooms should not expose pin_code or accesses."""
+    user = UserFactory()
+    RoomFactory(users=[(user, RoleChoices.OWNER)])
+
+    token = generate_test_token(user, [ApplicationScope.ROOMS_LIST])
+
+    client = APIClient()
+    client.credentials(HTTP_AUTHORIZATION=f"Bearer {token}")
+    response = client.get("/external-api/v1.0/rooms/")
+
+    assert response.status_code == 200
+    result = response.data["results"][0]
+    assert "pin_code" not in result
+    assert "accesses" not in result
+    assert "livekit" not in result
+
+
+def test_api_rooms_list_expected_fields(settings):
+    """Rooms should expose exactly the expected fields."""
+
+    settings.APPLICATION_BASE_URL = "https://example.com"
+    settings.ROOM_TELEPHONY_ENABLED = True
+
+    user = UserFactory()
+    RoomFactory(users=[(user, RoleChoices.OWNER)])
+
+    token = generate_test_token(user, [ApplicationScope.ROOMS_LIST])
+
+    client = APIClient()
+    client.credentials(HTTP_AUTHORIZATION=f"Bearer {token}")
+    response = client.get("/external-api/v1.0/rooms/")
+
+    assert response.status_code == 200
+    assert set(response.data["results"][0].keys()) == {
+        "id",
+        "name",
+        "slug",
+        "access_level",
+        "configuration",
+        "telephony",
+        "url",
+    }
+
+
+def test_api_rooms_list_expected_fields_without_telephony(settings):
+    """Rooms shouldn't expose telephony related fields when disabled."""
+
+    settings.APPLICATION_BASE_URL = "https://example.com"
+    settings.ROOM_TELEPHONY_ENABLED = False
+
+    user = UserFactory()
+    RoomFactory(users=[(user, RoleChoices.OWNER)])
+
+    token = generate_test_token(user, [ApplicationScope.ROOMS_LIST])
+
+    client = APIClient()
+    client.credentials(HTTP_AUTHORIZATION=f"Bearer {token}")
+    response = client.get("/external-api/v1.0/rooms/")
+
+    assert response.status_code == 200
+    assert "telephony" not in set(response.data["results"][0].keys())
+
+
+def test_api_rooms_list_expected_fields_missing_base_url(settings):
+    """Rooms shouldn't expose URL field when the application base url is missing."""
+
+    settings.APPLICATION_BASE_URL = None
+
+    user = UserFactory()
+    RoomFactory(users=[(user, RoleChoices.OWNER)])
+
+    token = generate_test_token(user, [ApplicationScope.ROOMS_LIST])
+
+    client = APIClient()
+    client.credentials(HTTP_AUTHORIZATION=f"Bearer {token}")
+    response = client.get("/external-api/v1.0/rooms/")
+
+    assert response.status_code == 200
+    assert "url" not in set(response.data["results"][0].keys())
+
+
 def test_api_rooms_retrieve_requires_authentication():
     """Retrieving rooms without authentication should return 401."""
 
@@ -383,6 +489,7 @@ def test_api_rooms_retrieve_success(settings):
         "name": room.name,
         "slug": room.slug,
         "access_level": str(room.access_level),
+        "configuration": room.configuration,
         "url": f"http://your-application.com/{room.slug}",
         "telephony": {
             "enabled": True,
@@ -565,11 +672,40 @@ def test_api_rooms_create_success():
     assert "slug" in response.data
     assert "name" in response.data
     assert response.data["name"] == response.data["slug"]
+    assert response.data["configuration"] == {}
 
     # Verify room was created with user as owner
     room = Room.objects.get(id=response.data["id"])
     assert room.get_role(user) == RoleChoices.OWNER
     assert room.access_level == "trusted"
+    assert room.configuration == {}
+
+
+def test_api_rooms_create_with_configuration_success():
+    """Creating a room with a validated configuration should succeed."""
+
+    user = UserFactory()
+
+    token = generate_test_token(
+        user, [ApplicationScope.ROOMS_CREATE, ApplicationScope.ROOMS_LIST]
+    )
+
+    client = APIClient()
+    client.credentials(HTTP_AUTHORIZATION=f"Bearer {token}")
+    response = client.post(
+        "/external-api/v1.0/rooms/",
+        {
+            "access_level": RoomAccessLevel.RESTRICTED,
+            "configuration": {"can_publish_sources": ["camera"]},
+        },
+        format="json",
+    )
+
+    assert response.status_code == 201
+    room = Room.objects.get(id=response.data["id"])
+    assert room.access_level == RoomAccessLevel.RESTRICTED
+    assert room.configuration == {"can_publish_sources": ["camera"]}
+    assert response.data["configuration"] == {"can_publish_sources": ["camera"]}
 
 
 def test_api_rooms_create_readonly_enforcement():
@@ -587,7 +723,6 @@ def test_api_rooms_create_readonly_enforcement():
             "id": "fake-id",
             "slug": "fake-slug",
             "name": "fake-name",
-            "access_level": "public",
         },
         format="json",
     )
@@ -599,41 +734,150 @@ def test_api_rooms_create_readonly_enforcement():
     assert response.data["slug"] != "fake-slug"
     assert "id" in response.data
     assert response.data["name"] != "fake-name"
+    assert response.data["configuration"] == {}
 
     # Verify room was created with user as owner
     room = Room.objects.get(id=response.data["id"])
     assert room.get_role(user) == RoleChoices.OWNER
     assert room.access_level == "trusted"
+    assert room.configuration == {}
 
 
-def test_api_rooms_unknown_actions():
-    """Updating or deleting a room are not supported yet."""
+def test_api_rooms_create_rejects_invalid_configuration():
+    """Creating a room with unsupported configuration keys should fail."""
 
     user = UserFactory()
-    room = RoomFactory(users=[(user, RoleChoices.OWNER)])
+    token = generate_test_token(user, [ApplicationScope.ROOMS_CREATE])
 
-    token = generate_test_token(
-        user,
-        [
-            ApplicationScope.ROOMS_RETRIEVE,
-            ApplicationScope.ROOMS_DELETE,
-            ApplicationScope.ROOMS_UPDATE,
-        ],
+    client = APIClient()
+    client.credentials(HTTP_AUTHORIZATION=f"Bearer {token}")
+    response = client.post(
+        "/external-api/v1.0/rooms/",
+        {
+            "configuration": {
+                "unsupported_flag": True,
+            }
+        },
+        format="json",
     )
 
-    client = APIClient()
-    client.credentials(HTTP_AUTHORIZATION=f"Bearer {token}")
-    response = client.delete(f"/external-api/v1.0/rooms/{room.id}/")
+    assert response.status_code == 400
+    assert "extra inputs are not permitted" in str(response.data).lower()
 
-    assert response.status_code == 405
-    assert 'method "delete" not allowed.' in str(response.data).lower()
+
+@pytest.mark.parametrize(
+    "invalid_configuration",
+    [
+        {"can_publish_sources": ["invalid-source"]},
+        {"everyone_can_mute": "invalid-value"},
+    ],
+)
+def test_api_rooms_create_rejects_invalid_configuration_values(invalid_configuration):
+    """Creating a room with invalid configuration values should fail."""
+
+    user = UserFactory()
+    token = generate_test_token(user, [ApplicationScope.ROOMS_CREATE])
 
     client = APIClient()
     client.credentials(HTTP_AUTHORIZATION=f"Bearer {token}")
-    response = client.patch(f"/external-api/v1.0/rooms/{room.id}/")
+    response = client.post(
+        "/external-api/v1.0/rooms/",
+        {"configuration": invalid_configuration},
+        format="json",
+    )
 
-    assert response.status_code == 405
-    assert 'method "patch" not allowed.' in str(response.data).lower()
+    assert response.status_code == 400
+
+
+def test_api_rooms_create_public_access_disabled_by_default():
+    """Public rooms should be disabled for the external API by default."""
+
+    user = UserFactory()
+    token = generate_test_token(user, [ApplicationScope.ROOMS_CREATE])
+
+    client = APIClient()
+    client.credentials(HTTP_AUTHORIZATION=f"Bearer {token}")
+    response = client.post(
+        "/external-api/v1.0/rooms/",
+        {"access_level": RoomAccessLevel.PUBLIC},
+        format="json",
+    )
+
+    assert response.status_code == 400
+    assert "public rooms are disabled" in str(response.data).lower()
+
+
+def test_api_rooms_create_public_access_enabled_with_settings(settings):
+    """Public rooms should be creatable when explicitly enabled."""
+
+    settings.EXTERNAL_API_ALLOW_PUBLIC_ACCESS = True
+
+    user = UserFactory()
+    token = generate_test_token(user, [ApplicationScope.ROOMS_CREATE])
+
+    client = APIClient()
+    client.credentials(HTTP_AUTHORIZATION=f"Bearer {token}")
+    response = client.post(
+        "/external-api/v1.0/rooms/",
+        {"access_level": RoomAccessLevel.PUBLIC},
+        format="json",
+    )
+
+    assert response.status_code == 201
+    room = Room.objects.get(id=response.data["id"])
+    assert room.access_level == RoomAccessLevel.PUBLIC
+    assert response.data["access_level"] == RoomAccessLevel.PUBLIC
+
+
+def test_api_rooms_create_default_access_level_respects_settings(settings):
+    """Room creation should reflect the EXTERNAL_API_DEFAULT_ACCESS_LEVEL setting."""
+
+    user = UserFactory()
+    token = generate_test_token(user, [ApplicationScope.ROOMS_CREATE])
+
+    client = APIClient()
+    client.credentials(HTTP_AUTHORIZATION=f"Bearer {token}")
+    response = client.post(
+        "/external-api/v1.0/rooms/",
+        format="json",
+    )
+    assert response.status_code == 201
+    assert response.data["access_level"] == RoomAccessLevel.TRUSTED
+
+    settings.EXTERNAL_API_DEFAULT_ACCESS_LEVEL = "public"
+
+    response = client.post(
+        "/external-api/v1.0/rooms/",
+        format="json",
+    )
+    assert response.status_code == 201
+    assert response.data["access_level"] == RoomAccessLevel.PUBLIC
+
+
+def test_api_rooms_create_public_access_level_when_default_is_public(settings):
+    """Explicit public access_level is accepted when the default is already public."""
+    settings.EXTERNAL_API_ALLOW_PUBLIC_ACCESS = False
+    settings.EXTERNAL_API_DEFAULT_ACCESS_LEVEL = "public"
+
+    user = UserFactory()
+    token = generate_test_token(user, [ApplicationScope.ROOMS_CREATE])
+
+    client = APIClient()
+    client.credentials(HTTP_AUTHORIZATION=f"Bearer {token}")
+
+    # No access_level in body — default kicks in, public room is created.
+    response = client.post("/external-api/v1.0/rooms/", {}, format="json")
+    assert response.status_code == 201
+    assert response.data["access_level"] == RoomAccessLevel.PUBLIC
+
+    # Explicit access_level=public in body — still rejected.
+    response = client.post(
+        "/external-api/v1.0/rooms/",
+        {"access_level": RoomAccessLevel.PUBLIC},
+        format="json",
+    )
+    assert response.status_code == 201
+    assert response.data["access_level"] == RoomAccessLevel.PUBLIC
 
 
 def test_api_rooms_response_no_url(settings):

src/backend/core/tests/test_external_api_token.py

@@ -4,6 +4,8 @@ Tests for external API /token endpoint
 
 # pylint: disable=W0621
 
+from unittest import mock
+
 import jwt
 import pytest
 from freezegun import freeze_time
@@ -15,6 +17,7 @@ from core.factories import (
     UserFactory,
 )
 from core.models import ApplicationScope, User
+from core.services import provisional_user_service
 
 pytestmark = pytest.mark.django_db
 
@@ -436,3 +439,88 @@ def test_api_applications_token_existing_user(settings):
         "delegated": True,
         "scope": "rooms:list rooms:create",
     }
+
+
+@mock.patch.object(provisional_user_service.ProvisionalUserService, "_get_by_email")
+def test_api_applications_token_new_user_race_condition(mock_get_by_email, settings):
+    """Should handle race condition where two concurrent requests create the same user."""
+    settings.APPLICATION_ALLOW_USER_CREATION = True
+    settings.OIDC_FALLBACK_TO_EMAIL_FOR_IDENTIFICATION = True
+    settings.OIDC_USER_SUB_FIELD_IMMUTABLE = False
+
+    application = ApplicationFactory(
+        is_active=True, scopes=[ApplicationScope.ROOMS_LIST]
+    )
+    plain_secret = "test-secret-123"
+    application.client_secret = plain_secret
+    application.save()
+
+    email = "john.doe@example.com"
+
+    # First call: lie and say user doesn't exist, simulating the race window
+    # Second call (recovery path): return the real user
+    existing_user = UserFactory(sub=None, email=email)
+    mock_get_by_email.side_effect = [None, existing_user]
+
+    client = APIClient()
+    response = client.post(
+        "/external-api/v1.0/application/token/",
+        {
+            "client_id": application.client_id,
+            "client_secret": plain_secret,
+            "grant_type": "client_credentials",
+            "scope": email,
+        },
+        format="json",
+    )
+
+    assert response.status_code == 200
+    assert mock_get_by_email.call_count == 2
+
+    token = response.data["access_token"]
+    payload = jwt.decode(
+        token,
+        settings.APPLICATION_JWT_SECRET_KEY,
+        algorithms=[settings.APPLICATION_JWT_ALG],
+        issuer=settings.APPLICATION_JWT_ISSUER,
+        audience=settings.APPLICATION_JWT_AUDIENCE,
+    )
+    assert payload["user_id"] == str(existing_user.id)
+    assert User.objects.filter(email=email).count() == 1
+
+
+@mock.patch.object(
+    provisional_user_service.ProvisionalUserService,
+    "get_or_create",
+    side_effect=provisional_user_service.ProvisionalUserIntegrityError,
+)
+def test_api_applications_token_new_user_race_condition_unrecoverable(
+    mock_get_or_create, settings
+):
+    """Should return 500 when ProvisionalUserIntegrityError is raised."""
+
+    settings.APPLICATION_ALLOW_USER_CREATION = True
+    settings.OIDC_FALLBACK_TO_EMAIL_FOR_IDENTIFICATION = True
+    settings.OIDC_USER_SUB_FIELD_IMMUTABLE = False
+
+    application = ApplicationFactory(
+        is_active=True, scopes=[ApplicationScope.ROOMS_LIST]
+    )
+    plain_secret = "test-secret-123"
+    application.client_secret = plain_secret
+    application.save()
+
+    client = APIClient()
+    response = client.post(
+        "/external-api/v1.0/application/token/",
+        {
+            "client_id": application.client_id,
+            "client_secret": plain_secret,
+            "grant_type": "client_credentials",
+            "scope": "john.doe@example.com",
+        },
+        format="json",
+    )
+
+    assert response.status_code == 409
+    assert mock_get_or_create.call_count == 1

src/backend/core/tests/test_models_users.py

@@ -44,3 +44,73 @@ def test_models_users_send_mail_main_missing():
         user.email_user("my subject", "my message")
 
     assert str(excinfo.value) == "User has no email address."
+
+
+def test_models_users_email_unique_when_sub_is_null():
+    """Email should be unique among users with no sub (pending users)."""
+    user = factories.UserFactory(sub=None, email="test@example.com")
+    with pytest.raises(
+        ValidationError, match="Constraint “unique_email_when_sub_is_null” is violated."
+    ):
+        factories.UserFactory(sub=None, email=user.email)
+
+
+def test_models_users_email_unique_case_insensitive_when_sub_is_null():
+    """Email uniqueness should be case-insensitive among users with no sub (pending users)."""
+    factories.UserFactory(sub=None, email="Test@example.com")
+    with pytest.raises(
+        ValidationError, match="Constraint “unique_email_when_sub_is_null” is violated."
+    ):
+        factories.UserFactory(sub=None, email="test@example.com")
+
+
+def test_models_users_email_not_unique_when_sub_is_set():
+    """Email uniqueness should not be enforced when users have a sub."""
+    user = factories.UserFactory(sub="sub-1", email="test@example.com")
+    user2 = factories.UserFactory(sub="sub-2", email=user.email)
+    assert user2.email == user.email
+
+
+def test_models_users_email_not_unique_between_sub_null_and_sub_set():
+    """A user with a sub and a pending user (sub=None) can share the same email."""
+    user = factories.UserFactory(sub="sub-1", email="test@example.com")
+    user2 = factories.UserFactory(sub=None, email=user.email)
+    assert user2.email == user.email
+
+
+def test_models_users_email_unique_constraint_allows_multiple_null_emails():
+    """Multiple users with sub=None and email=None should be allowed."""
+    factories.UserFactory(sub=None, email=None)
+    factories.UserFactory(sub=None, email=None)
+
+
+def test_models_users_sub_null_email_null_does_not_prevent_creation():
+    """Multiple pending users (sub=None, email=None) can be created without conflict.
+
+    sub=None is not unique-constrained. email uniqueness is only enforced among
+    sub=None users with a non-null email, so email=None bypasses it (NULL != NULL in SQL).
+    """
+    # Ghost row can still appear from bad code path
+    u1 = factories.UserFactory(sub=None, email=None)
+    u2 = factories.UserFactory(sub=None, email=None)
+    assert u1.pk != u2.pk
+
+
+def test_models_users_sub_can_be_null():
+    """sub is nullable: pending users exist before OIDC activation."""
+    user = factories.UserFactory(sub=None)
+    user.refresh_from_db()
+    assert user.sub is None
+
+
+def test_models_users_sub_null_does_not_prevent_creation():
+    """Multiple users can be created with sub=None (pending state)."""
+    u1 = factories.UserFactory(sub=None)
+    u2 = factories.UserFactory(sub=None)
+    assert u1.pk != u2.pk
+
+
+def test_models_users_sub_blank_is_accepted():
+    """sub='' passes validation because blank=True; null is preferred but not enforced."""
+    user = factories.UserFactory.build(sub="")
+    user.full_clean()

src/backend/core/tests/test_utils_build_telephony_config.py

@@ -0,0 +1,58 @@
+"""
+Test utils.build_telephony_config
+"""
+
+import logging
+
+from core.utils import build_telephony_config
+
+
+def test_build_telephony_config_disabled(settings):
+    """Returns {"enabled": False} when telephony is disabled."""
+    settings.ROOM_TELEPHONY_ENABLED = False
+    config = build_telephony_config()
+    assert config == {"enabled": False}
+
+
+def test_build_telephony_config_enabled_with_valid_number(settings):
+    """Returns full config with country and international number when telephony is enabled."""
+    settings.ROOM_TELEPHONY_ENABLED = True
+    settings.ROOM_TELEPHONY_PHONE_NUMBER = "0123456789"
+    settings.ROOM_TELEPHONY_DEFAULT_COUNTRY = "FR"
+    config = build_telephony_config()
+    assert config == {
+        "enabled": True,
+        "default_country": "FR",
+        "international_phone_number": "+33 1 23 45 67 89",
+    }
+
+
+def test_build_telephony_config_enabled_with_invalid_number(settings):
+    """Returns {"enabled": False} when phone number cannot be parsed."""
+    settings.ROOM_TELEPHONY_ENABLED = True
+    settings.ROOM_TELEPHONY_PHONE_NUMBER = "not-a-number"
+    settings.ROOM_TELEPHONY_DEFAULT_COUNTRY = "FR"
+    config = build_telephony_config()
+    assert config == {"enabled": False}
+
+
+def test_build_telephony_config_enabled_with_missing_number(settings):
+    """Returns {"enabled": False} when phone number is not configured."""
+    settings.ROOM_TELEPHONY_ENABLED = True
+    settings.ROOM_TELEPHONY_PHONE_NUMBER = ""
+    settings.ROOM_TELEPHONY_DEFAULT_COUNTRY = "FR"
+    config = build_telephony_config()
+    assert config == {"enabled": False}
+
+
+def test_build_telephony_config_enabled_with_missing_number_warns(settings, caplog):
+    """Logs a warning when telephony is enabled but phone number is not configured."""
+
+    settings.ROOM_TELEPHONY_ENABLED = True
+    settings.ROOM_TELEPHONY_PHONE_NUMBER = ""
+    settings.ROOM_TELEPHONY_DEFAULT_COUNTRY = "FR"
+
+    with caplog.at_level(logging.WARNING):
+        build_telephony_config()
+
+    assert "ROOM_TELEPHONY_PHONE_NUMBER" in caplog.text

src/backend/core/tests/test_utils_format_telephony_phone_number.py

@@ -0,0 +1,102 @@
+"""
+Test utils._format_telephony_phone_number
+"""
+
+import logging
+
+import pytest
+
+from core.utils import _format_telephony_phone_number
+
+
+@pytest.fixture(autouse=True)
+def clear_lru_cache():
+    """Clear the lru_cache before each test to ensure isolation."""
+    _format_telephony_phone_number.cache_clear()
+    yield
+    _format_telephony_phone_number.cache_clear()
+
+
+def test_format_telephony_phone_number_missing_raw_number():
+    """Returns (None, None) when raw_number is empty."""
+    country, international = _format_telephony_phone_number("", "FR")
+    assert country is None
+    assert international is None
+
+
+def test_format_telephony_phone_number_none_raw_number():
+    """Returns (None, None) when raw_number is None."""
+    country, international = _format_telephony_phone_number(None, "FR")
+    assert country is None
+    assert international is None
+
+
+def test_format_telephony_phone_number_missing_default_country():
+    """Returns (None, None) when default_country is empty."""
+    country, international = _format_telephony_phone_number("+33123456789", "")
+    assert country is None
+    assert international is None
+
+
+def test_format_telephony_phone_number_none_default_country():
+    """Returns (None, None) when default_country is None."""
+    country, international = _format_telephony_phone_number("+33123456789", None)
+    assert country is None
+    assert international is None
+
+
+def test_format_telephony_phone_number_both_missing():
+    """Returns (None, None) when both inputs are missing."""
+    country, international = _format_telephony_phone_number(None, None)
+    assert country is None
+    assert international is None
+
+
+def test_format_telephony_phone_number_invalid_number(caplog):
+    """Returns (None, None) and logs a warning when the number cannot be parsed."""
+
+    with caplog.at_level(logging.WARNING):
+        country, international = _format_telephony_phone_number("not-a-number", "FR")
+
+    assert country is None
+    assert international is None
+    assert "not-a-number" in caplog.text
+    assert "FR" in caplog.text
+
+
+def test_format_telephony_phone_number_valid_french_number():
+    """Returns correct country and international format for a valid French number."""
+    country, international = _format_telephony_phone_number("0123456789", "FR")
+    assert country == "FR"
+    assert international == "+33 1 23 45 67 89"
+
+
+def test_format_telephony_phone_number_valid_e164_number():
+    """Returns correct result for an E.164-formatted number (no default country needed)."""
+    country, international = _format_telephony_phone_number("+33123456789", "US")
+    assert country == "FR"
+    assert international == "+33 1 23 45 67 89"
+
+
+def test_format_telephony_phone_number_valid_us_number():
+    """Returns correct country and international format for a valid US number."""
+    country, international = _format_telephony_phone_number("2025550123", "US")
+    assert country == "US"
+    assert international == "+1 202-555-0123"
+
+
+def test_format_telephony_phone_number_valid_german_number():
+    """Returns correct country and international format for a valid German number."""
+    country, international = _format_telephony_phone_number("03012345678", "DE")
+    assert country == "DE"
+    assert international == "+49 30 12345678"
+
+
+def test_format_telephony_phone_number_lru_cache():
+    """Results are cached: the same inputs return the same object."""
+    result1 = _format_telephony_phone_number("0123456789", "FR")
+    result2 = _format_telephony_phone_number("0123456789", "FR")
+    assert result1 is result2
+    # pylint: disable=no-value-for-parameter
+    cache_info = _format_telephony_phone_number.cache_info()
+    assert cache_info.hits >= 1

src/backend/core/utils.py

@@ -12,6 +12,7 @@ import mimetypes
 import random
 import secrets
 import string
+from functools import lru_cache
 from typing import List, Optional
 from uuid import uuid4
 
@@ -22,6 +23,7 @@ import aiohttp
 import boto3
 import botocore
 import magic
+import phonenumbers
 from asgiref.sync import async_to_sync
 from livekit.api import (  # pylint: disable=E0611
     AccessToken,
@@ -424,7 +426,7 @@ def generate_upload_policy(file):
         Originally taken from https://github.com/suitenumerique/drive/blob/564822d31f071c6dfacd112ef4b7146c73077cd9/src/backend/core/api/utils.py#L102  # pylint: disable=line-too-long
     """
 
-    key = file.file_key
+    key = file.temporary_file_key
 
     # This settings should be used if the backend application and the frontend application
     # can't connect to the object storage with the same domain. This is the case in the
@@ -457,36 +459,56 @@ def generate_upload_policy(file):
     return policy
 
 
-def generate_download_s3_file_url(
-    key, *, expires_in: int, override_domain: bool = True
-):
-    """
-    Generate a S3 signed download url for a given key.
-    """
+@lru_cache(maxsize=1)
+def _format_telephony_phone_number(raw_number, default_country):
+    """Parse a configured phone number and return (country, international_format).
 
-    # This settings should be used if the backend application and the frontend application
-    # can't connect to the object storage with the same domain. This is the case in the
-    # docker compose stack used in development. The frontend application will use localhost
-    # to connect to the object storage while the backend application will use the object storage
-    # service name declared in the docker compose stack.
-    # This is needed because the domain name is used to compute the signature. So it can't be
-    # changed dynamically by the frontend application.
-    if settings.AWS_S3_DOMAIN_REPLACE and override_domain:
-        s3_client = boto3.client(
-            "s3",
-            aws_access_key_id=settings.AWS_S3_ACCESS_KEY_ID,
-            aws_secret_access_key=settings.AWS_S3_SECRET_ACCESS_KEY,
-            endpoint_url=settings.AWS_S3_DOMAIN_REPLACE,
-            config=botocore.client.Config(
-                region_name=settings.AWS_S3_REGION_NAME,
-                signature_version=settings.AWS_S3_SIGNATURE_VERSION,
-            ),
+    Returns (None, None) if the inputs are missing or the number cannot be
+    parsed. Logs a warning on parse failure so operators see the misconfiguration.
+    """
+    if not raw_number or not default_country:
+        return None, None
+
+    try:
+        parsed = phonenumbers.parse(raw_number, default_country)
+    except phonenumbers.NumberParseException:
+        logger.warning(
+            "ROOM_TELEPHONY_PHONE_NUMBER %r is not a valid phone number for "
+            "default country %r; telephony block will be returned without "
+            "formatted number.",
+            raw_number,
+            default_country,
         )
-    else:
-        s3_client = default_storage.connection.meta.client
+        return None, None
 
-    return s3_client.generate_presigned_url(
-        ClientMethod="get_object",
-        Params={"Bucket": default_storage.bucket_name, "Key": key},
-        ExpiresIn=expires_in,
+    country = phonenumbers.region_code_for_number(parsed)
+    international = phonenumbers.format_number(
+        parsed, phonenumbers.PhoneNumberFormat.INTERNATIONAL
     )
+    return country, international
+
+
+def build_telephony_config():
+    """Build the telephony block of the frontend configuration."""
+    if not settings.ROOM_TELEPHONY_ENABLED:
+        return {"enabled": False}
+
+    country, international = _format_telephony_phone_number(
+        settings.ROOM_TELEPHONY_PHONE_NUMBER,
+        settings.ROOM_TELEPHONY_DEFAULT_COUNTRY,
+    )
+
+    if international is None:
+        logger.warning(
+            "Telephony is enabled but ROOM_TELEPHONY_PHONE_NUMBER %r with "
+            "default country %r could not be formatted; telephony will be disabled.",
+            settings.ROOM_TELEPHONY_PHONE_NUMBER,
+            settings.ROOM_TELEPHONY_DEFAULT_COUNTRY,
+        )
+        return {"enabled": False}
+
+    return {
+        "enabled": True,
+        "default_country": country,
+        "international_phone_number": international,
+    }

src/backend/locale/de_DE/LC_MESSAGES/django.po

@@ -8,7 +8,7 @@ msgid ""
 msgstr ""
 "Project-Id-Version: PACKAGE VERSION\n"
 "Report-Msgid-Bugs-To: \n"
-"POT-Creation-Date: 2026-05-26 16:20+0000\n"
+"POT-Creation-Date: 2026-04-21 14:09+0000\n"
 "PO-Revision-Date: YEAR-MO-DA HO:MI+ZONE\n"
 "Last-Translator: FULL NAME <EMAIL@ADDRESS>\n"
 "Language-Team: LANGUAGE <LL@li.org>\n"
@@ -88,17 +88,17 @@ msgstr "Scopes"
 msgid "Creator is me"
 msgstr "Ersteller bin ich"
 
-#: core/api/serializers.py:89
+#: core/api/serializers.py:88
 msgid "You must be administrator or owner of a room to add accesses to it."
 msgstr ""
 "Sie müssen Administrator oder Eigentümer eines Raums sein, um Zugriffe "
 "hinzuzufügen."
 
-#: core/api/serializers.py:534
+#: core/api/serializers.py:509
 msgid "This file extension is not allowed."
 msgstr "Diese Dateiendung ist nicht erlaubt."
 
-#: core/api/viewsets.py:1228
+#: core/api/viewsets.py:1090
 msgid "You have reached the maximum number of files for this type."
 msgstr "Sie haben die maximale Anzahl an Dateien dieses Typs erreicht."
 
@@ -146,59 +146,51 @@ msgstr "Stopp fehlgeschlagen"
 msgid "Notification succeeded"
 msgstr "Benachrichtigung erfolgreich"
 
-#: core/models.py:65
-msgid "External process successful"
-msgstr ""
-
-#: core/models.py:67
-msgid "External process failed"
-msgstr ""
-
-#: core/models.py:96
+#: core/models.py:89
 msgid "SCREEN_RECORDING"
 msgstr "BILDSCHIRMAUFZEICHNUNG"
 
-#: core/models.py:97
+#: core/models.py:90
 msgid "TRANSCRIPT"
 msgstr "TRANSKRIPT"
 
-#: core/models.py:103
+#: core/models.py:96
 msgid "Public Access"
 msgstr "Öffentlicher Zugriff"
 
-#: core/models.py:104
+#: core/models.py:97
 msgid "Trusted Access"
 msgstr "Vertrauenswürdiger Zugriff"
 
-#: core/models.py:105
+#: core/models.py:98
 msgid "Restricted Access"
 msgstr "Eingeschränkter Zugriff"
 
-#: core/models.py:117
+#: core/models.py:110
 msgid "id"
 msgstr "ID"
 
-#: core/models.py:118
+#: core/models.py:111
 msgid "primary key for the record as UUID"
 msgstr "Primärschlüssel des Eintrags als UUID"
 
-#: core/models.py:124
+#: core/models.py:117
 msgid "created on"
 msgstr "erstellt am"
 
-#: core/models.py:125
+#: core/models.py:118
 msgid "date and time at which a record was created"
 msgstr "Datum und Uhrzeit der Erstellung eines Eintrags"
 
-#: core/models.py:130
+#: core/models.py:123
 msgid "updated on"
 msgstr "aktualisiert am"
 
-#: core/models.py:131
+#: core/models.py:124
 msgid "date and time at which a record was last updated"
 msgstr "Datum und Uhrzeit der letzten Aktualisierung eines Eintrags"
 
-#: core/models.py:151
+#: core/models.py:144
 msgid ""
 "Enter a valid sub. This value may contain only letters, numbers, and @/./+/-/"
 "_ characters."
@@ -206,11 +198,11 @@ msgstr ""
 "Geben Sie einen gültigen Sub ein. Dieser Wert darf nur Buchstaben, Zahlen "
 "und die Zeichen @/./+/-/_ enthalten."
 
-#: core/models.py:157
+#: core/models.py:150
 msgid "sub"
 msgstr "Sub"
 
-#: core/models.py:159
+#: core/models.py:152
 msgid ""
 "Optional for pending users; required upon account activation. 255 characters "
 "or fewer. Letters, numbers, and @/./+/-/_ characters only."
@@ -218,55 +210,55 @@ msgstr ""
 "Optional für ausstehende Benutzer; erforderlich nach Kontoaktivierung. "
 "Maximal 255 Zeichen. Nur Buchstaben, Zahlen und @/./+/-/_ Zeichen erlaubt."
 
-#: core/models.py:168
+#: core/models.py:161
 msgid "identity email address"
 msgstr "Identitäts-E-Mail-Adresse"
 
-#: core/models.py:173
+#: core/models.py:166
 msgid "admin email address"
 msgstr "Administrator-E-Mail-Adresse"
 
-#: core/models.py:175
+#: core/models.py:168
 msgid "full name"
 msgstr "Vollständiger Name"
 
-#: core/models.py:177
+#: core/models.py:170
 msgid "short name"
 msgstr "Kurzname"
 
-#: core/models.py:183
+#: core/models.py:176
 msgid "language"
 msgstr "Sprache"
 
-#: core/models.py:184
+#: core/models.py:177
 msgid "The language in which the user wants to see the interface."
 msgstr "Die Sprache, in der der Benutzer die Oberfläche sehen möchte."
 
-#: core/models.py:190
+#: core/models.py:183
 msgid "The timezone in which the user wants to see times."
 msgstr "Die Zeitzone, in der der Benutzer die Zeiten sehen möchte."
 
-#: core/models.py:193
+#: core/models.py:186
 msgid "device"
 msgstr "Gerät"
 
-#: core/models.py:195
+#: core/models.py:188
 msgid "Whether the user is a device or a real user."
 msgstr "Ob es sich um ein Gerät oder einen echten Benutzer handelt."
 
-#: core/models.py:198
+#: core/models.py:191
 msgid "staff status"
 msgstr "Mitarbeiterstatus"
 
-#: core/models.py:200
+#: core/models.py:193
 msgid "Whether the user can log into this admin site."
 msgstr "Ob der Benutzer sich bei dieser Admin-Seite anmelden kann."
 
-#: core/models.py:203
+#: core/models.py:196
 msgid "active"
 msgstr "aktiv"
 
-#: core/models.py:206
+#: core/models.py:199
 msgid ""
 "Whether this user should be treated as active. Unselect this instead of "
 "deleting accounts."
@@ -274,66 +266,66 @@ msgstr ""
 "Ob dieser Benutzer als aktiv behandelt werden soll. Deaktivieren Sie dies "
 "anstelle des Löschens des Kontos."
 
-#: core/models.py:219
+#: core/models.py:212
 msgid "user"
 msgstr "Benutzer"
 
-#: core/models.py:220
+#: core/models.py:213
 msgid "users"
 msgstr "Benutzer"
 
-#: core/models.py:279
+#: core/models.py:272
 msgid "Resource"
 msgstr "Ressource"
 
-#: core/models.py:280
+#: core/models.py:273
 msgid "Resources"
 msgstr "Ressourcen"
 
-#: core/models.py:338
+#: core/models.py:331
 msgid "Resource access"
 msgstr "Ressourcenzugriff"
 
-#: core/models.py:339
+#: core/models.py:332
 msgid "Resource accesses"
 msgstr "Ressourcenzugriffe"
 
-#: core/models.py:345
+#: core/models.py:338
 msgid "Resource access with this User and Resource already exists."
 msgstr ""
 "Ein Ressourcenzugriff mit diesem Benutzer und dieser Ressource existiert "
 "bereits."
 
-#: core/models.py:402
+#: core/models.py:394
 msgid "Visio room configuration"
 msgstr "Visio-Raumkonfiguration"
 
-#: core/models.py:403
+#: core/models.py:395
 msgid "Values for Visio parameters to configure the room."
 msgstr "Werte für Visio-Parameter zur Konfiguration des Raums."
 
-#: core/models.py:410
+#: core/models.py:402
 msgid "Room PIN code"
 msgstr "PIN-Code für den Raum"
 
-#: core/models.py:411
+#: core/models.py:403
 msgid "Unique n-digit code that identifies this room in telephony mode."
 msgstr ""
 "Eindeutiger n-stelliger Code, der diesen Raum im Telephonmodus identifiziert."
 
-#: core/models.py:417 core/models.py:571
+#: core/models.py:409 core/models.py:563
 msgid "Room"
 msgstr "Raum"
 
-#: core/models.py:418
+#: core/models.py:410
 msgid "Rooms"
 msgstr "Räume"
 
-#: core/models.py:582
+#: core/models.py:574
 msgid "Worker ID"
 msgstr "Worker-ID"
 
-#: core/models.py:584
+#: core/models.py:576
 msgid ""
 "Enter an identifier for the worker recording.This ID is retained even when "
 "the worker stops, allowing for easy tracking."
@@ -342,149 +334,141 @@ msgstr ""
 "erhalten, auch wenn der Worker stoppt, was ein einfaches Nachverfolgen "
 "ermöglicht."
 
-#: core/models.py:592
+#: core/models.py:584
 msgid "Recording mode"
 msgstr "Aufzeichnungsmodus"
 
-#: core/models.py:593
+#: core/models.py:585
 msgid "Defines the mode of recording being called."
 msgstr "Definiert den aufgerufenen Aufzeichnungsmodus."
 
-#: core/models.py:598 core/models.py:599
+#: core/models.py:590 core/models.py:591
 msgid "Recording options"
 msgstr "Aufnahmeoptionen"
 
-#: core/models.py:606
-msgid "External Process ID"
-msgstr ""
-
-#: core/models.py:607
-msgid "ID of the external process associated with the recording."
-msgstr ""
-
-#: core/models.py:613
+#: core/models.py:597
 msgid "Recording"
 msgstr "Aufzeichnung"
 
-#: core/models.py:614
+#: core/models.py:598
 msgid "Recordings"
 msgstr "Aufzeichnungen"
 
-#: core/models.py:724
+#: core/models.py:706
 msgid "Recording/user relation"
 msgstr "Beziehung Aufzeichnung/Benutzer"
 
-#: core/models.py:725
+#: core/models.py:707
 msgid "Recording/user relations"
 msgstr "Beziehungen Aufzeichnung/Benutzer"
 
-#: core/models.py:731
+#: core/models.py:713
 msgid "This user is already in this recording."
 msgstr "Dieser Benutzer ist bereits Teil dieser Aufzeichnung."
 
-#: core/models.py:737
+#: core/models.py:719
 msgid "This team is already in this recording."
 msgstr "Dieses Team ist bereits Teil dieser Aufzeichnung."
 
-#: core/models.py:743
+#: core/models.py:725
 msgid "Either user or team must be set, not both."
 msgstr "Entweder Benutzer oder Team muss festgelegt werden, nicht beides."
 
-#: core/models.py:760
+#: core/models.py:742
 msgid "Create rooms"
 msgstr "Räume erstellen"
 
-#: core/models.py:761
+#: core/models.py:743
 msgid "List rooms"
 msgstr "Räume auflisten"
 
-#: core/models.py:762
+#: core/models.py:744
 msgid "Retrieve room details"
 msgstr "Raumdetails abrufen"
 
-#: core/models.py:763
+#: core/models.py:745
 msgid "Update rooms"
 msgstr "Räume aktualisieren"
 
-#: core/models.py:764
+#: core/models.py:746
 msgid "Delete rooms"
 msgstr "Räume löschen"
 
-#: core/models.py:777
+#: core/models.py:759
 msgid "Application name"
 msgstr "Anwendungsname"
 
-#: core/models.py:778
+#: core/models.py:760
 msgid "Descriptive name for this application."
 msgstr "Beschreibender Name für diese Anwendung."
 
-#: core/models.py:788
+#: core/models.py:770
 msgid "Hashed on Save. Copy it now if this is a new secret."
 msgstr ""
 "Beim Speichern gehasht. Jetzt kopieren, wenn dies ein neues Geheimnis ist."
 
-#: core/models.py:799
+#: core/models.py:781
 msgid "Application"
 msgstr "Anwendung"
 
-#: core/models.py:800
+#: core/models.py:782
 msgid "Applications"
 msgstr "Anwendungen"
 
-#: core/models.py:823
+#: core/models.py:805
 msgid "Enter a valid domain"
 msgstr "Geben Sie eine gültige Domain ein"
 
-#: core/models.py:826
+#: core/models.py:808
 msgid "Domain"
 msgstr "Domain"
 
-#: core/models.py:827
+#: core/models.py:809
 msgid "Email domain this application can act on behalf of."
 msgstr "E-Mail-Domain, im Namen der diese Anwendung handeln kann."
 
-#: core/models.py:839
+#: core/models.py:821
 msgid "Application domain"
 msgstr "Anwendungsdomain"
 
-#: core/models.py:840
+#: core/models.py:822
 msgid "Application domains"
 msgstr "Anwendungsdomains"
 
-#: core/models.py:858
+#: core/models.py:840
 msgid "Pending"
 msgstr "Ausstehend"
 
-#: core/models.py:866
+#: core/models.py:848
 msgid "Ready"
 msgstr "Bereit"
 
-#: core/models.py:872
+#: core/models.py:854
 msgid "Background image"
 msgstr "Hintergrundbild"
 
-#: core/models.py:884
+#: core/models.py:866
 msgid "title"
 msgstr "Titel"
 
-#: core/models.py:908
+#: core/models.py:890
 msgid "Malware detection info when the analysis status is unsafe."
 msgstr ""
 "Informationen zur Malware-Erkennung, wenn der Analyse-Status unsicher ist."
 
-#: core/models.py:913
+#: core/models.py:895
 msgid "File"
 msgstr "Datei"
 
-#: core/models.py:914
+#: core/models.py:896
 msgid "Files"
 msgstr "Dateien"
 
-#: core/models.py:1018
+#: core/models.py:1000
 msgid "This file is already hard deleted."
 msgstr "Diese Datei wurde bereits endgültig gelöscht."
 
-#: core/models.py:1028
+#: core/models.py:1010
 #, fuzzy
 #| msgid "To hard delete a file, it must first be soft deleted."
 msgid "To hard delete a file, it must first be soft deleted."
@@ -492,7 +476,7 @@ msgstr ""
 "Um eine Datei endgültig zu löschen, muss sie zuvor weich gelöscht worden "
 "sein."
 
-#: core/recording/event/notification.py:124
+#: core/recording/event/notification.py:116
 msgid "Your recording is ready"
 msgstr "Ihre Aufzeichnung ist bereit"
 
@@ -592,9 +576,7 @@ msgstr "So speichern Sie diese Aufzeichnung dauerhaft:"
 
 #: core/templates/mail/html/screen_recording.html:208
 #: core/templates/mail/text/screen_recording.txt:13
-#, fuzzy
-#| msgid "Click the \"<a href=\"%(link)s\">Open</a>\" link below "
-msgid "Click the \"Open\" button below "
+msgid "Click the \"<a href=\"%(link)s\">Open</a>\" link below "
 msgstr "Klicken Sie auf den Link „<a href=\"%(link)s\">Öffnen</a>\" unten "
 
 #: core/templates/mail/html/screen_recording.html:209

src/backend/locale/en_US/LC_MESSAGES/django.po

@@ -8,7 +8,7 @@ msgid ""
 msgstr ""
 "Project-Id-Version: PACKAGE VERSION\n"
 "Report-Msgid-Bugs-To: \n"
-"POT-Creation-Date: 2026-05-26 16:20+0000\n"
+"POT-Creation-Date: 2026-04-21 14:09+0000\n"
 "PO-Revision-Date: YEAR-MO-DA HO:MI+ZONE\n"
 "Last-Translator: FULL NAME <EMAIL@ADDRESS>\n"
 "Language-Team: LANGUAGE <LL@li.org>\n"
@@ -88,15 +88,15 @@ msgstr "Scopes"
 msgid "Creator is me"
 msgstr "Creator is me"
 
-#: core/api/serializers.py:89
+#: core/api/serializers.py:88
 msgid "You must be administrator or owner of a room to add accesses to it."
 msgstr "You must be administrator or owner of a room to add accesses to it."
 
-#: core/api/serializers.py:534
+#: core/api/serializers.py:509
 msgid "This file extension is not allowed."
 msgstr "This file extension is not allowed."
 
-#: core/api/viewsets.py:1228
+#: core/api/viewsets.py:1090
 msgid "You have reached the maximum number of files for this type."
 msgstr "You have reached the maximum number of files for this type."
 
@@ -144,59 +144,51 @@ msgstr "Failed to Stop"
 msgid "Notification succeeded"
 msgstr "Notification succeeded"
 
-#: core/models.py:65
-msgid "External process successful"
-msgstr ""
-
-#: core/models.py:67
-msgid "External process failed"
-msgstr ""
-
-#: core/models.py:96
+#: core/models.py:89
 msgid "SCREEN_RECORDING"
 msgstr "SCREEN_RECORDING"
 
-#: core/models.py:97
+#: core/models.py:90
 msgid "TRANSCRIPT"
 msgstr "TRANSCRIPT"
 
-#: core/models.py:103
+#: core/models.py:96
 msgid "Public Access"
 msgstr "Public Access"
 
-#: core/models.py:104
+#: core/models.py:97
 msgid "Trusted Access"
 msgstr "Trusted Access"
 
-#: core/models.py:105
+#: core/models.py:98
 msgid "Restricted Access"
 msgstr "Restricted Access"
 
-#: core/models.py:117
+#: core/models.py:110
 msgid "id"
 msgstr "id"
 
-#: core/models.py:118
+#: core/models.py:111
 msgid "primary key for the record as UUID"
 msgstr "primary key for the record as UUID"
 
-#: core/models.py:124
+#: core/models.py:117
 msgid "created on"
 msgstr "created on"
 
-#: core/models.py:125
+#: core/models.py:118
 msgid "date and time at which a record was created"
 msgstr "date and time at which a record was created"
 
-#: core/models.py:130
+#: core/models.py:123
 msgid "updated on"
 msgstr "updated on"
 
-#: core/models.py:131
+#: core/models.py:124
 msgid "date and time at which a record was last updated"
 msgstr "date and time at which a record was last updated"
 
-#: core/models.py:151
+#: core/models.py:144
 msgid ""
 "Enter a valid sub. This value may contain only letters, numbers, and @/./+/-/"
 "_ characters."
@@ -204,11 +196,11 @@ msgstr ""
 "Enter a valid sub. This value may contain only letters, numbers, and @/./+/-/"
 "_ characters."
 
-#: core/models.py:157
+#: core/models.py:150
 msgid "sub"
 msgstr "sub"
 
-#: core/models.py:159
+#: core/models.py:152
 msgid ""
 "Optional for pending users; required upon account activation. 255 characters "
 "or fewer. Letters, numbers, and @/./+/-/_ characters only."
@@ -216,55 +208,55 @@ msgstr ""
 "Required. 255 characters or fewer. Letters, numbers, and @/./+/-/_ "
 "characters only."
 
-#: core/models.py:168
+#: core/models.py:161
 msgid "identity email address"
 msgstr "identity email address"
 
-#: core/models.py:173
+#: core/models.py:166
 msgid "admin email address"
 msgstr "admin email address"
 
-#: core/models.py:175
+#: core/models.py:168
 msgid "full name"
 msgstr "full name"
 
-#: core/models.py:177
+#: core/models.py:170
 msgid "short name"
 msgstr "short name"
 
-#: core/models.py:183
+#: core/models.py:176
 msgid "language"
 msgstr "language"
 
-#: core/models.py:184
+#: core/models.py:177
 msgid "The language in which the user wants to see the interface."
 msgstr "The language in which the user wants to see the interface."
 
-#: core/models.py:190
+#: core/models.py:183
 msgid "The timezone in which the user wants to see times."
 msgstr "The timezone in which the user wants to see times."
 
-#: core/models.py:193
+#: core/models.py:186
 msgid "device"
 msgstr "device"
 
-#: core/models.py:195
+#: core/models.py:188
 msgid "Whether the user is a device or a real user."
 msgstr "Whether the user is a device or a real user."
 
-#: core/models.py:198
+#: core/models.py:191
 msgid "staff status"
 msgstr "staff status"
 
-#: core/models.py:200
+#: core/models.py:193
 msgid "Whether the user can log into this admin site."
 msgstr "Whether the user can log into this admin site."
 
-#: core/models.py:203
+#: core/models.py:196
 msgid "active"
 msgstr "active"
 
-#: core/models.py:206
+#: core/models.py:199
 msgid ""
 "Whether this user should be treated as active. Unselect this instead of "
 "deleting accounts."
@@ -272,63 +264,63 @@ msgstr ""
 "Whether this user should be treated as active. Unselect this instead of "
 "deleting accounts."
 
-#: core/models.py:219
+#: core/models.py:212
 msgid "user"
 msgstr "user"
 
-#: core/models.py:220
+#: core/models.py:213
 msgid "users"
 msgstr "users"
 
-#: core/models.py:279
+#: core/models.py:272
 msgid "Resource"
 msgstr "Resource"
 
-#: core/models.py:280
+#: core/models.py:273
 msgid "Resources"
 msgstr "Resources"
 
-#: core/models.py:338
+#: core/models.py:331
 msgid "Resource access"
 msgstr "Resource access"
 
-#: core/models.py:339
+#: core/models.py:332
 msgid "Resource accesses"
 msgstr "Resource accesses"
 
-#: core/models.py:345
+#: core/models.py:338
 msgid "Resource access with this User and Resource already exists."
 msgstr "Resource access with this User and Resource already exists."
 
-#: core/models.py:402
+#: core/models.py:394
 msgid "Visio room configuration"
 msgstr "Visio room configuration"
 
-#: core/models.py:403
+#: core/models.py:395
 msgid "Values for Visio parameters to configure the room."
 msgstr "Values for Visio parameters to configure the room."
 
-#: core/models.py:410
+#: core/models.py:402
 msgid "Room PIN code"
 msgstr "Room PIN code"
 
-#: core/models.py:411
+#: core/models.py:403
 msgid "Unique n-digit code that identifies this room in telephony mode."
 msgstr "Unique n-digit code that identifies this room in telephony mode."
 
-#: core/models.py:417 core/models.py:571
+#: core/models.py:409 core/models.py:563
 msgid "Room"
 msgstr "Room"
 
-#: core/models.py:418
+#: core/models.py:410
 msgid "Rooms"
 msgstr "Rooms"
 
-#: core/models.py:582
+#: core/models.py:574
 msgid "Worker ID"
 msgstr "Worker ID"
 
-#: core/models.py:584
+#: core/models.py:576
 msgid ""
 "Enter an identifier for the worker recording.This ID is retained even when "
 "the worker stops, allowing for easy tracking."
@@ -336,159 +328,151 @@ msgstr ""
 "Enter an identifier for the worker recording.This ID is retained even when "
 "the worker stops, allowing for easy tracking."
 
-#: core/models.py:592
+#: core/models.py:584
 msgid "Recording mode"
 msgstr "Recording mode"
 
-#: core/models.py:593
+#: core/models.py:585
 msgid "Defines the mode of recording being called."
 msgstr "Defines the mode of recording being called."
 
-#: core/models.py:598 core/models.py:599
+#: core/models.py:590 core/models.py:591
 msgid "Recording options"
 msgstr "Recording options"
 
-#: core/models.py:606
-msgid "External Process ID"
-msgstr ""
-
-#: core/models.py:607
-msgid "ID of the external process associated with the recording."
-msgstr ""
-
-#: core/models.py:613
+#: core/models.py:597
 msgid "Recording"
 msgstr "Recording"
 
-#: core/models.py:614
+#: core/models.py:598
 msgid "Recordings"
 msgstr "Recordings"
 
-#: core/models.py:724
+#: core/models.py:706
 msgid "Recording/user relation"
 msgstr "Recording/user relation"
 
-#: core/models.py:725
+#: core/models.py:707
 msgid "Recording/user relations"
 msgstr "Recording/user relations"
 
-#: core/models.py:731
+#: core/models.py:713
 msgid "This user is already in this recording."
 msgstr "This user is already in this recording."
 
-#: core/models.py:737
+#: core/models.py:719
 msgid "This team is already in this recording."
 msgstr "This team is already in this recording."
 
-#: core/models.py:743
+#: core/models.py:725
 msgid "Either user or team must be set, not both."
 msgstr "Either user or team must be set, not both."
 
-#: core/models.py:760
+#: core/models.py:742
 #, fuzzy
 #| msgid "created on"
 msgid "Create rooms"
 msgstr "Create rooms"
 
-#: core/models.py:761
+#: core/models.py:743
 msgid "List rooms"
 msgstr "List rooms"
 
-#: core/models.py:762
+#: core/models.py:744
 msgid "Retrieve room details"
 msgstr "Retrieve room details"
 
-#: core/models.py:763
+#: core/models.py:745
 #, fuzzy
 #| msgid "updated on"
 msgid "Update rooms"
 msgstr "Update rooms"
 
-#: core/models.py:764
+#: core/models.py:746
 msgid "Delete rooms"
 msgstr "Delete rooms"
 
-#: core/models.py:777
+#: core/models.py:759
 msgid "Application name"
 msgstr "Application name"
 
-#: core/models.py:778
+#: core/models.py:760
 msgid "Descriptive name for this application."
 msgstr "Descriptive name for this application."
 
-#: core/models.py:788
+#: core/models.py:770
 msgid "Hashed on Save. Copy it now if this is a new secret."
 msgstr "Hashed on Save. Copy it now if this is a new secret."
 
-#: core/models.py:799
+#: core/models.py:781
 msgid "Application"
 msgstr "Application"
 
-#: core/models.py:800
+#: core/models.py:782
 msgid "Applications"
 msgstr "Applications"
 
-#: core/models.py:823
+#: core/models.py:805
 msgid "Enter a valid domain"
 msgstr "Enter a valid domain"
 
-#: core/models.py:826
+#: core/models.py:808
 msgid "Domain"
 msgstr "Domain"
 
-#: core/models.py:827
+#: core/models.py:809
 msgid "Email domain this application can act on behalf of."
 msgstr "Email domain this application can act on behalf of."
 
-#: core/models.py:839
+#: core/models.py:821
 msgid "Application domain"
 msgstr "Application domain"
 
-#: core/models.py:840
+#: core/models.py:822
 msgid "Application domains"
 msgstr "Application domains"
 
-#: core/models.py:858
+#: core/models.py:840
 #, fuzzy
 #| msgid "Recording"
 msgid "Pending"
 msgstr "Pending"
 
-#: core/models.py:866
+#: core/models.py:848
 msgid "Ready"
 msgstr "Ready"
 
-#: core/models.py:872
+#: core/models.py:854
 msgid "Background image"
 msgstr "Background image"
 
-#: core/models.py:884
+#: core/models.py:866
 msgid "title"
 msgstr "title"
 
-#: core/models.py:908
+#: core/models.py:890
 msgid "Malware detection info when the analysis status is unsafe."
 msgstr "Malware detection info when the analysis status is unsafe."
 
-#: core/models.py:913
+#: core/models.py:895
 msgid "File"
 msgstr "File"
 
-#: core/models.py:914
+#: core/models.py:896
 msgid "Files"
 msgstr "Files"
 
-#: core/models.py:1018
+#: core/models.py:1000
 #, fuzzy
 #| msgid "This user is already in this recording."
 msgid "This file is already hard deleted."
 msgstr "This file is already hard deleted."
 
-#: core/models.py:1028
+#: core/models.py:1010
 msgid "To hard delete a file, it must first be soft deleted."
 msgstr "To hard delete a file, it must first be soft deleted."
 
-#: core/recording/event/notification.py:124
+#: core/recording/event/notification.py:116
 msgid "Your recording is ready"
 msgstr "Your recording is ready"
 
@@ -588,9 +572,7 @@ msgstr "To keep this recording permanently:"
 
 #: core/templates/mail/html/screen_recording.html:208
 #: core/templates/mail/text/screen_recording.txt:13
-#, fuzzy
-#| msgid "Click the \"<a href=\"%(link)s\">Open</a>\" link below "
-msgid "Click the \"Open\" button below "
+msgid "Click the \"<a href=\"%(link)s\">Open</a>\" link below "
 msgstr "Click the \"<a href=\"%(link)s\">Open</a>\" link below "
 
 #: core/templates/mail/html/screen_recording.html:209

src/backend/locale/fr_FR/LC_MESSAGES/django.po

@@ -8,7 +8,7 @@ msgid ""
 msgstr ""
 "Project-Id-Version: PACKAGE VERSION\n"
 "Report-Msgid-Bugs-To: \n"
-"POT-Creation-Date: 2026-05-26 16:20+0000\n"
+"POT-Creation-Date: 2026-04-21 14:09+0000\n"
 "PO-Revision-Date: YEAR-MO-DA HO:MI+ZONE\n"
 "Last-Translator: antoine.lebaud@mail.numerique.gouv.fr\n"
 "Language-Team: LANGUAGE <LL@li.org>\n"
@@ -89,17 +89,17 @@ msgstr "Scopes"
 msgid "Creator is me"
 msgstr "Je suis le créateur"
 
-#: core/api/serializers.py:89
+#: core/api/serializers.py:88
 msgid "You must be administrator or owner of a room to add accesses to it."
 msgstr ""
 "Vous devez être administrateur ou propriétaire d'une salle pour y ajouter "
 "des accès."
 
-#: core/api/serializers.py:534
+#: core/api/serializers.py:509
 msgid "This file extension is not allowed."
 msgstr "Cette extension n'est pas autorisée"
 
-#: core/api/viewsets.py:1228
+#: core/api/viewsets.py:1090
 msgid "You have reached the maximum number of files for this type."
 msgstr "Vous avez atteint le nombre maximum de fichiers de ce type"
 
@@ -147,61 +147,53 @@ msgstr "Échec à l'arrêt"
 msgid "Notification succeeded"
 msgstr "Notification réussie"
 
-#: core/models.py:65
-msgid "External process successful"
-msgstr ""
-
-#: core/models.py:67
-msgid "External process failed"
-msgstr ""
-
-#: core/models.py:96
+#: core/models.py:89
 msgid "SCREEN_RECORDING"
 msgstr "ENREGISTREMENT_ÉCRAN"
 
-#: core/models.py:97
+#: core/models.py:90
 msgid "TRANSCRIPT"
 msgstr "TRANSCRIPTION"
 
-#: core/models.py:103
+#: core/models.py:96
 msgid "Public Access"
 msgstr "Accès public"
 
-#: core/models.py:104
+#: core/models.py:97
 msgid "Trusted Access"
 msgstr "Accès de confiance"
 
-#: core/models.py:105
+#: core/models.py:98
 msgid "Restricted Access"
 msgstr "Accès restreint"
 
-#: core/models.py:117
+#: core/models.py:110
 msgid "id"
 msgstr "id"
 
-#: core/models.py:118
+#: core/models.py:111
 msgid "primary key for the record as UUID"
 msgstr "clé primaire pour l'enregistrement sous forme d'UUID"
 
-#: core/models.py:124
+#: core/models.py:117
 msgid "created on"
 msgstr "créé le"
 
-#: core/models.py:125
+#: core/models.py:118
 msgid "date and time at which a record was created"
 msgstr "date et heure auxquelles un enregistrement a été créé"
 
-#: core/models.py:130
+#: core/models.py:123
 msgid "updated on"
 msgstr "mis à jour le"
 
-#: core/models.py:131
+#: core/models.py:124
 msgid "date and time at which a record was last updated"
 msgstr ""
 "date et heure auxquelles un enregistrement a été mis à jour pour la dernière "
 "fois"
 
-#: core/models.py:151
+#: core/models.py:144
 msgid ""
 "Enter a valid sub. This value may contain only letters, numbers, and @/./+/-/"
 "_ characters."
@@ -209,11 +201,11 @@ msgstr ""
 "Entrez un sub valide. Cette valeur ne peut contenir que des lettres, des "
 "chiffres et les caractères @/./+/-/_."
 
-#: core/models.py:157
+#: core/models.py:150
 msgid "sub"
 msgstr "sub"
 
-#: core/models.py:159
+#: core/models.py:152
 msgid ""
 "Optional for pending users; required upon account activation. 255 characters "
 "or fewer. Letters, numbers, and @/./+/-/_ characters only."
@@ -221,55 +213,55 @@ msgstr ""
 "Optionnel pour les utilisateurs en attente ; requis lors de l'activation du "
 "compte. 255 caractères maximum. Lettres, chiffres et @/./+/-/_ uniquement."
 
-#: core/models.py:168
+#: core/models.py:161
 msgid "identity email address"
 msgstr "adresse e-mail d'identité"
 
-#: core/models.py:173
+#: core/models.py:166
 msgid "admin email address"
 msgstr "adresse e-mail d'administrateur"
 
-#: core/models.py:175
+#: core/models.py:168
 msgid "full name"
 msgstr "nom complet"
 
-#: core/models.py:177
+#: core/models.py:170
 msgid "short name"
 msgstr "nom court"
 
-#: core/models.py:183
+#: core/models.py:176
 msgid "language"
 msgstr "langue"
 
-#: core/models.py:184
+#: core/models.py:177
 msgid "The language in which the user wants to see the interface."
 msgstr "La langue dans laquelle l'utilisateur souhaite voir l'interface."
 
-#: core/models.py:190
+#: core/models.py:183
 msgid "The timezone in which the user wants to see times."
 msgstr "Le fuseau horaire dans lequel l'utilisateur souhaite voir les heures."
 
-#: core/models.py:193
+#: core/models.py:186
 msgid "device"
 msgstr "appareil"
 
-#: core/models.py:195
+#: core/models.py:188
 msgid "Whether the user is a device or a real user."
 msgstr "Si l'utilisateur est un appareil ou un utilisateur réel."
 
-#: core/models.py:198
+#: core/models.py:191
 msgid "staff status"
 msgstr "statut du personnel"
 
-#: core/models.py:200
+#: core/models.py:193
 msgid "Whether the user can log into this admin site."
 msgstr "Si l'utilisateur peut se connecter à ce site d'administration."
 
-#: core/models.py:203
+#: core/models.py:196
 msgid "active"
 msgstr "actif"
 
-#: core/models.py:206
+#: core/models.py:199
 msgid ""
 "Whether this user should be treated as active. Unselect this instead of "
 "deleting accounts."
@@ -277,65 +269,65 @@ msgstr ""
 "Si cet utilisateur doit être traité comme actif. Désélectionnez cette option "
 "au lieu de supprimer des comptes."
 
-#: core/models.py:219
+#: core/models.py:212
 msgid "user"
 msgstr "utilisateur"
 
-#: core/models.py:220
+#: core/models.py:213
 msgid "users"
 msgstr "utilisateurs"
 
-#: core/models.py:279
+#: core/models.py:272
 msgid "Resource"
 msgstr "Ressource"
 
-#: core/models.py:280
+#: core/models.py:273
 msgid "Resources"
 msgstr "Ressources"
 
-#: core/models.py:338
+#: core/models.py:331
 msgid "Resource access"
 msgstr "Accès aux ressources"
 
-#: core/models.py:339
+#: core/models.py:332
 msgid "Resource accesses"
 msgstr "Accès aux ressources"
 
-#: core/models.py:345
+#: core/models.py:338
 msgid "Resource access with this User and Resource already exists."
 msgstr ""
 "L'accès à la ressource avec cet utilisateur et cette ressource existe déjà."
 
-#: core/models.py:402
+#: core/models.py:394
 msgid "Visio room configuration"
 msgstr "Configuration de la salle de visioconférence"
 
-#: core/models.py:403
+#: core/models.py:395
 msgid "Values for Visio parameters to configure the room."
 msgstr "Valeurs des paramètres de visioconférence pour configurer la salle."
 
-#: core/models.py:410
+#: core/models.py:402
 msgid "Room PIN code"
 msgstr "Code PIN de la salle"
 
-#: core/models.py:411
+#: core/models.py:403
 msgid "Unique n-digit code that identifies this room in telephony mode."
 msgstr ""
 "Code unique à n chiffres qui identifie cette salle en mode téléphonique."
 
-#: core/models.py:417 core/models.py:571
+#: core/models.py:409 core/models.py:563
 msgid "Room"
 msgstr "Salle"
 
-#: core/models.py:418
+#: core/models.py:410
 msgid "Rooms"
 msgstr "Salles"
 
-#: core/models.py:582
+#: core/models.py:574
 msgid "Worker ID"
 msgstr "ID du Worker"
 
-#: core/models.py:584
+#: core/models.py:576
 msgid ""
 "Enter an identifier for the worker recording.This ID is retained even when "
 "the worker stops, allowing for easy tracking."
@@ -343,158 +335,150 @@ msgstr ""
 "Entrez un identifiant pour l'enregistrement du Worker. Cet identifiant est "
 "conservé même lorsque le Worker s'arrête, permettant un suivi facile."
 
-#: core/models.py:592
+#: core/models.py:584
 msgid "Recording mode"
 msgstr "Mode d'enregistrement"
 
-#: core/models.py:593
+#: core/models.py:585
 msgid "Defines the mode of recording being called."
 msgstr "Définit le mode d'enregistrement appelé."
 
-#: core/models.py:598 core/models.py:599
+#: core/models.py:590 core/models.py:591
 msgid "Recording options"
 msgstr "Options d'enregistrement"
 
-#: core/models.py:606
-msgid "External Process ID"
-msgstr ""
-
-#: core/models.py:607
-msgid "ID of the external process associated with the recording."
-msgstr ""
-
-#: core/models.py:613
+#: core/models.py:597
 msgid "Recording"
 msgstr "Enregistrement"
 
-#: core/models.py:614
+#: core/models.py:598
 msgid "Recordings"
 msgstr "Enregistrements"
 
-#: core/models.py:724
+#: core/models.py:706
 msgid "Recording/user relation"
 msgstr "Relation enregistrement/utilisateur"
 
-#: core/models.py:725
+#: core/models.py:707
 msgid "Recording/user relations"
 msgstr "Relations enregistrement/utilisateur"
 
-#: core/models.py:731
+#: core/models.py:713
 msgid "This user is already in this recording."
 msgstr "Cet utilisateur est déjà dans cet enregistrement."
 
-#: core/models.py:737
+#: core/models.py:719
 msgid "This team is already in this recording."
 msgstr "Cette équipe est déjà dans cet enregistrement."
 
-#: core/models.py:743
+#: core/models.py:725
 msgid "Either user or team must be set, not both."
 msgstr "Soit l'utilisateur, soit l'équipe doit être défini, pas les deux."
 
-#: core/models.py:760
+#: core/models.py:742
 msgid "Create rooms"
 msgstr "Créer des salles"
 
-#: core/models.py:761
+#: core/models.py:743
 msgid "List rooms"
 msgstr "Lister les salles"
 
-#: core/models.py:762
+#: core/models.py:744
 msgid "Retrieve room details"
 msgstr "Afficher les détails d’une salle"
 
-#: core/models.py:763
+#: core/models.py:745
 msgid "Update rooms"
 msgstr "Mettre à jour les salles"
 
-#: core/models.py:764
+#: core/models.py:746
 msgid "Delete rooms"
 msgstr "Supprimer les salles"
 
-#: core/models.py:777
+#: core/models.py:759
 msgid "Application name"
 msgstr "Nom de l’application"
 
-#: core/models.py:778
+#: core/models.py:760
 msgid "Descriptive name for this application."
 msgstr "Nom descriptif de cette application."
 
-#: core/models.py:788
+#: core/models.py:770
 msgid "Hashed on Save. Copy it now if this is a new secret."
 msgstr ""
 "Haché lors de l’enregistrement. Copiez-le maintenant s’il s’agit d’un "
 "nouveau secret."
 
-#: core/models.py:799
+#: core/models.py:781
 msgid "Application"
 msgstr "Application"
 
-#: core/models.py:800
+#: core/models.py:782
 msgid "Applications"
 msgstr "Applications"
 
-#: core/models.py:823
+#: core/models.py:805
 msgid "Enter a valid domain"
 msgstr "Saisissez un domaine valide"
 
-#: core/models.py:826
+#: core/models.py:808
 msgid "Domain"
 msgstr "Domaine"
 
-#: core/models.py:827
+#: core/models.py:809
 msgid "Email domain this application can act on behalf of."
 msgstr "Domaine de messagerie au nom duquel cette application peut agir."
 
-#: core/models.py:839
+#: core/models.py:821
 msgid "Application domain"
 msgstr "Domaine d’application"
 
-#: core/models.py:840
+#: core/models.py:822
 msgid "Application domains"
 msgstr "Domaines d’application"
 
-#: core/models.py:858
+#: core/models.py:840
 msgid "Pending"
 msgstr "En attente"
 
-#: core/models.py:866
+#: core/models.py:848
 msgid "Ready"
 msgstr "Prêt"
 
-#: core/models.py:872
+#: core/models.py:854
 msgid "Background image"
 msgstr "Image de fond"
 
-#: core/models.py:884
+#: core/models.py:866
 msgid "title"
 msgstr "Titre"
 
-#: core/models.py:908
+#: core/models.py:890
 msgid "Malware detection info when the analysis status is unsafe."
 msgstr ""
 "Information concernant la détection de Malware cand le statut n'est pas sain"
 
-#: core/models.py:913
+#: core/models.py:895
 msgid "File"
 msgstr "Fichier"
 
-#: core/models.py:914
+#: core/models.py:896
 msgid "Files"
 msgstr "Fichiers"
 
-#: core/models.py:1018
+#: core/models.py:1000
 #, fuzzy
 #| msgid "This user is already in this recording."
 msgid "This file is already hard deleted."
 msgstr "Ce fichier a été supprimé."
 
-#: core/models.py:1028
+#: core/models.py:1010
 msgid "To hard delete a file, it must first be soft deleted."
 msgstr ""
 "Pour supprimer définitivement un fichier il doit d'abord avoir été marqué "
 "comme supprimé (soft delete)"
 
-#: core/recording/event/notification.py:124
+#: core/recording/event/notification.py:116
 msgid "Your recording is ready"
 msgstr "Votre enregistrement est prêt"
 
@@ -594,9 +578,7 @@ msgstr "Pour conserver cet enregistrement de façon permanente :"
 
 #: core/templates/mail/html/screen_recording.html:208
 #: core/templates/mail/text/screen_recording.txt:13
-#, fuzzy
-#| msgid "Click the \"<a href=\"%(link)s\">Open</a>\" link below "
-msgid "Click the \"Open\" button below "
+msgid "Click the \"<a href=\"%(link)s\">Open</a>\" link below "
 msgstr "Cliquez sur le lien \"<a href=\"%(link)s\">Ouvrir</a>\" ci-dessous "
 
 #: core/templates/mail/html/screen_recording.html:209

src/backend/locale/nl_NL/LC_MESSAGES/django.po

@@ -8,7 +8,7 @@ msgid ""
 msgstr ""
 "Project-Id-Version: PACKAGE VERSION\n"
 "Report-Msgid-Bugs-To: \n"
-"POT-Creation-Date: 2026-05-26 16:20+0000\n"
+"POT-Creation-Date: 2026-04-21 14:09+0000\n"
 "PO-Revision-Date: YEAR-MO-DA HO:MI+ZONE\n"
 "Last-Translator: FULL NAME <EMAIL@ADDRESS>\n"
 "Language-Team: LANGUAGE <LL@li.org>\n"
@@ -88,16 +88,16 @@ msgstr "Scopes"
 msgid "Creator is me"
 msgstr "Maker ben ik"
 
-#: core/api/serializers.py:89
+#: core/api/serializers.py:88
 msgid "You must be administrator or owner of a room to add accesses to it."
 msgstr ""
 "Je moet beheerder of eigenaar van een ruimte zijn om toegang toe te voegen."
 
-#: core/api/serializers.py:534
+#: core/api/serializers.py:509
 msgid "This file extension is not allowed."
 msgstr "Deze bestandsextensie is niet toegestaan."
 
-#: core/api/viewsets.py:1228
+#: core/api/viewsets.py:1090
 msgid "You have reached the maximum number of files for this type."
 msgstr "Het maximale aantal bestanden voor dit type is bereikt."
 
@@ -145,59 +145,51 @@ msgstr "Stoppen mislukt"
 msgid "Notification succeeded"
 msgstr "Notificatie geslaagd"
 
-#: core/models.py:65
-msgid "External process successful"
-msgstr ""
-
-#: core/models.py:67
-msgid "External process failed"
-msgstr ""
-
-#: core/models.py:96
+#: core/models.py:89
 msgid "SCREEN_RECORDING"
 msgstr "SCHERM_OPNAME"
 
-#: core/models.py:97
+#: core/models.py:90
 msgid "TRANSCRIPT"
 msgstr "TRANSCRIPT"
 
-#: core/models.py:103
+#: core/models.py:96
 msgid "Public Access"
 msgstr "Openbare toegang"
 
-#: core/models.py:104
+#: core/models.py:97
 msgid "Trusted Access"
 msgstr "Vertrouwde toegang"
 
-#: core/models.py:105
+#: core/models.py:98
 msgid "Restricted Access"
 msgstr "Beperkte toegang"
 
-#: core/models.py:117
+#: core/models.py:110
 msgid "id"
 msgstr "id"
 
-#: core/models.py:118
+#: core/models.py:111
 msgid "primary key for the record as UUID"
 msgstr "primaire sleutel voor het record als UUID"
 
-#: core/models.py:124
+#: core/models.py:117
 msgid "created on"
 msgstr "aangemaakt op"
 
-#: core/models.py:125
+#: core/models.py:118
 msgid "date and time at which a record was created"
 msgstr "datum en tijd waarop een record werd aangemaakt"
 
-#: core/models.py:130
+#: core/models.py:123
 msgid "updated on"
 msgstr "bijgewerkt op"
 
-#: core/models.py:131
+#: core/models.py:124
 msgid "date and time at which a record was last updated"
 msgstr "datum en tijd waarop een record voor het laatst werd bijgewerkt"
 
-#: core/models.py:151
+#: core/models.py:144
 msgid ""
 "Enter a valid sub. This value may contain only letters, numbers, and @/./+/-/"
 "_ characters."
@@ -205,11 +197,11 @@ msgstr ""
 "Voer een geldige sub in. Deze waarde mag alleen letters, cijfers en @/./+/-/"
 "_ tekens bevatten."
 
-#: core/models.py:157
+#: core/models.py:150
 msgid "sub"
 msgstr "sub"
 
-#: core/models.py:159
+#: core/models.py:152
 msgid ""
 "Optional for pending users; required upon account activation. 255 characters "
 "or fewer. Letters, numbers, and @/./+/-/_ characters only."
@@ -217,55 +209,55 @@ msgstr ""
 "Optioneel voor gebruikers in afwachting; vereist bij accountactivering. "
 "Maximum 255 tekens. Alleen letters, cijfers en @/./+/-/_ toegestaan."
 
-#: core/models.py:168
+#: core/models.py:161
 msgid "identity email address"
 msgstr "identiteit e-mailadres"
 
-#: core/models.py:173
+#: core/models.py:166
 msgid "admin email address"
 msgstr "beheerder e-mailadres"
 
-#: core/models.py:175
+#: core/models.py:168
 msgid "full name"
 msgstr "volledige naam"
 
-#: core/models.py:177
+#: core/models.py:170
 msgid "short name"
 msgstr "korte naam"
 
-#: core/models.py:183
+#: core/models.py:176
 msgid "language"
 msgstr "taal"
 
-#: core/models.py:184
+#: core/models.py:177
 msgid "The language in which the user wants to see the interface."
 msgstr "De taal waarin de gebruiker de interface wil zien."
 
-#: core/models.py:190
+#: core/models.py:183
 msgid "The timezone in which the user wants to see times."
 msgstr "De tijdzone waarin de gebruiker tijden wil zien."
 
-#: core/models.py:193
+#: core/models.py:186
 msgid "device"
 msgstr "apparaat"
 
-#: core/models.py:195
+#: core/models.py:188
 msgid "Whether the user is a device or a real user."
 msgstr "Of de gebruiker een apparaat is of een echte gebruiker."
 
-#: core/models.py:198
+#: core/models.py:191
 msgid "staff status"
 msgstr "personeelsstatus"
 
-#: core/models.py:200
+#: core/models.py:193
 msgid "Whether the user can log into this admin site."
 msgstr "Of de gebruiker kan inloggen op deze beheersite."
 
-#: core/models.py:203
+#: core/models.py:196
 msgid "active"
 msgstr "actief"
 
-#: core/models.py:206
+#: core/models.py:199
 msgid ""
 "Whether this user should be treated as active. Unselect this instead of "
 "deleting accounts."
@@ -273,64 +265,64 @@ msgstr ""
 "Of deze gebruiker als actief moet worden behandeld. Deselecteer dit in "
 "plaats van accounts te verwijderen."
 
-#: core/models.py:219
+#: core/models.py:212
 msgid "user"
 msgstr "gebruiker"
 
-#: core/models.py:220
+#: core/models.py:213
 msgid "users"
 msgstr "gebruikers"
 
-#: core/models.py:279
+#: core/models.py:272
 msgid "Resource"
 msgstr "Bron"
 
-#: core/models.py:280
+#: core/models.py:273
 msgid "Resources"
 msgstr "Bronnen"
 
-#: core/models.py:338
+#: core/models.py:331
 msgid "Resource access"
 msgstr "Brontoegang"
 
-#: core/models.py:339
+#: core/models.py:332
 msgid "Resource accesses"
 msgstr "Brontoegangsrechten"
 
-#: core/models.py:345
+#: core/models.py:338
 msgid "Resource access with this User and Resource already exists."
 msgstr "Brontoegang met deze gebruiker en bron bestaat al."
 
-#: core/models.py:402
+#: core/models.py:394
 msgid "Visio room configuration"
 msgstr "Visio-ruimteconfiguratie"
 
-#: core/models.py:403
+#: core/models.py:395
 msgid "Values for Visio parameters to configure the room."
 msgstr "Waarden voor Visio-parameters om de ruimte te configureren."
 
-#: core/models.py:410
+#: core/models.py:402
 msgid "Room PIN code"
 msgstr "Pincode van de kamer"
 
-#: core/models.py:411
+#: core/models.py:403
 msgid "Unique n-digit code that identifies this room in telephony mode."
 msgstr ""
 "Unieke n-cijferige code die deze kamer identificeert in telefonie-modus."
 
-#: core/models.py:417 core/models.py:571
+#: core/models.py:409 core/models.py:563
 msgid "Room"
 msgstr "Ruimte"
 
-#: core/models.py:418
+#: core/models.py:410
 msgid "Rooms"
 msgstr "Ruimtes"
 
-#: core/models.py:582
+#: core/models.py:574
 msgid "Worker ID"
 msgstr "Worker ID"
 
-#: core/models.py:584
+#: core/models.py:576
 msgid ""
 "Enter an identifier for the worker recording.This ID is retained even when "
 "the worker stops, allowing for easy tracking."
@@ -338,148 +330,140 @@ msgstr ""
 "Voer een identificatie in voor de worker-opname. Deze ID blijft behouden, "
 "zelfs wanneer de worker stopt, waardoor eenvoudige tracking mogelijk is."
 
-#: core/models.py:592
+#: core/models.py:584
 msgid "Recording mode"
 msgstr "Opnamemodus"
 
-#: core/models.py:593
+#: core/models.py:585
 msgid "Defines the mode of recording being called."
 msgstr "Definieert de modus van opname die wordt aangeroepen."
 
-#: core/models.py:598 core/models.py:599
+#: core/models.py:590 core/models.py:591
 msgid "Recording options"
 msgstr "Opnameopties"
 
-#: core/models.py:606
-msgid "External Process ID"
-msgstr ""
-
-#: core/models.py:607
-msgid "ID of the external process associated with the recording."
-msgstr ""
-
-#: core/models.py:613
+#: core/models.py:597
 msgid "Recording"
 msgstr "Opname"
 
-#: core/models.py:614
+#: core/models.py:598
 msgid "Recordings"
 msgstr "Opnames"
 
-#: core/models.py:724
+#: core/models.py:706
 msgid "Recording/user relation"
 msgstr "Opname/gebruiker-relatie"
 
-#: core/models.py:725
+#: core/models.py:707
 msgid "Recording/user relations"
 msgstr "Opname/gebruiker-relaties"
 
-#: core/models.py:731
+#: core/models.py:713
 msgid "This user is already in this recording."
 msgstr "Deze gebruiker is al in deze opname."
 
-#: core/models.py:737
+#: core/models.py:719
 msgid "This team is already in this recording."
 msgstr "Dit team is al in deze opname."
 
-#: core/models.py:743
+#: core/models.py:725
 msgid "Either user or team must be set, not both."
 msgstr "Ofwel gebruiker of team moet worden ingesteld, niet beide."
 
-#: core/models.py:760
+#: core/models.py:742
 msgid "Create rooms"
 msgstr "Ruimtes aanmaken"
 
-#: core/models.py:761
+#: core/models.py:743
 msgid "List rooms"
 msgstr "Ruimtes weergeven"
 
-#: core/models.py:762
+#: core/models.py:744
 msgid "Retrieve room details"
 msgstr "Details van een ruimte ophalen"
 
-#: core/models.py:763
+#: core/models.py:745
 msgid "Update rooms"
 msgstr "Ruimtes bijwerken"
 
-#: core/models.py:764
+#: core/models.py:746
 msgid "Delete rooms"
 msgstr "Ruimtes verwijderen"
 
-#: core/models.py:777
+#: core/models.py:759
 msgid "Application name"
 msgstr "Naam van de applicatie"
 
-#: core/models.py:778
+#: core/models.py:760
 msgid "Descriptive name for this application."
 msgstr "Beschrijvende naam voor deze applicatie."
 
-#: core/models.py:788
+#: core/models.py:770
 msgid "Hashed on Save. Copy it now if this is a new secret."
 msgstr ""
 "Wordt gehasht bij het opslaan. Kopieer het nu als dit een nieuw geheim is."
 
-#: core/models.py:799
+#: core/models.py:781
 msgid "Application"
 msgstr "Applicatie"
 
-#: core/models.py:800
+#: core/models.py:782
 msgid "Applications"
 msgstr "Applicaties"
 
-#: core/models.py:823
+#: core/models.py:805
 msgid "Enter a valid domain"
 msgstr "Voer een geldig domein in"
 
-#: core/models.py:826
+#: core/models.py:808
 msgid "Domain"
 msgstr "Domein"
 
-#: core/models.py:827
+#: core/models.py:809
 msgid "Email domain this application can act on behalf of."
 msgstr "E-maildomein namens welke deze applicatie kan handelen."
 
-#: core/models.py:839
+#: core/models.py:821
 msgid "Application domain"
 msgstr "Applicatiedomein"
 
-#: core/models.py:840
+#: core/models.py:822
 msgid "Application domains"
 msgstr "Applicatiedomeinen"
 
-#: core/models.py:858
+#: core/models.py:840
 msgid "Pending"
 msgstr "In afwachting"
 
-#: core/models.py:866
+#: core/models.py:848
 msgid "Ready"
 msgstr "Klaar"
 
-#: core/models.py:872
+#: core/models.py:854
 msgid "Background image"
 msgstr "Achtergrondafbeelding"
 
-#: core/models.py:884
+#: core/models.py:866
 msgid "title"
 msgstr "Titel"
 
-#: core/models.py:908
+#: core/models.py:890
 msgid "Malware detection info when the analysis status is unsafe."
 msgstr "Informatie over malwaredetectie wanneer de analysestatus onveilig is."
 
-#: core/models.py:913
+#: core/models.py:895
 msgid "File"
 msgstr "Bestand"
 
-#: core/models.py:914
+#: core/models.py:896
 msgid "Files"
 msgstr "Bestanden"
 
-#: core/models.py:1018
+#: core/models.py:1000
 msgid "This file is already hard deleted."
 msgstr "Dit bestand is al definitief verwijderd."
 
-#: core/models.py:1028
+#: core/models.py:1010
 #, fuzzy
 #| msgid "To hard delete a file, it must first be soft deleted."
 msgid "To hard delete a file, it must first be soft deleted."
@@ -487,7 +471,7 @@ msgstr ""
 "Om een bestand definitief te verwijderen, moet het eerst zacht verwijderd "
 "zijn."
 
-#: core/recording/event/notification.py:124
+#: core/recording/event/notification.py:116
 msgid "Your recording is ready"
 msgstr "Je opname is klaar"
 
@@ -587,9 +571,7 @@ msgstr "Om deze opname permanent te bewaren:"
 
 #: core/templates/mail/html/screen_recording.html:208
 #: core/templates/mail/text/screen_recording.txt:13
-#, fuzzy
-#| msgid "Click the \"<a href=\"%(link)s\">Open</a>\" link below "
-msgid "Click the \"Open\" button below "
+msgid "Click the \"<a href=\"%(link)s\">Open</a>\" link below "
 msgstr "Klik op de \"<a href=\"%(link)s\">Openen</a>\"-link hieronder "
 
 #: core/templates/mail/html/screen_recording.html:209

src/backend/meet/settings.py

@@ -186,6 +186,9 @@ class Base(Configuration):
     FILE_UPLOAD_PATH = values.Value(
         "files", environ_name="FILE_UPLOAD_PATH", environ_prefix=None
     )
+    FILE_UPLOAD_TMP_PATH = values.Value(
+        "tmp/files", environ_name="FILE_UPLOAD_TMP_PATH", environ_prefix=None
+    )
 
     FILE_UPLOAD_APPLY_RESTRICTIONS = values.BooleanValue(
         default=True, environ_name="FILE_UPLOAD_APPLY_RESTRICTIONS", environ_prefix=None
@@ -744,9 +747,6 @@ class Base(Configuration):
     SUMMARY_SERVICE_API_TOKEN = SecretFileValue(
         None, environ_name="SUMMARY_SERVICE_API_TOKEN", environ_prefix=None
     )
-    SUMMARY_SERVICE_WEBHOOK_API_TOKEN = SecretFileValue(
-        None, environ_name="SUMMARY_SERVICE_WEBHOOK_API_TOKEN", environ_prefix=None
-    )
     SCREEN_RECORDING_BASE_URL = values.Value(
         None, environ_name="SCREEN_RECORDING_BASE_URL", environ_prefix=None
     )
@@ -911,6 +911,18 @@ class Base(Configuration):
         environ_name="APPLICATION_BASE_URL",
         environ_prefix=None,
     )
+    # Warning: EXTERNAL_API_ALLOW_PUBLIC_ACCESS is ignored when
+    # EXTERNAL_API_DEFAULT_ACCESS_LEVEL=public.
+    EXTERNAL_API_ALLOW_PUBLIC_ACCESS = values.BooleanValue(
+        False,
+        environ_name="EXTERNAL_API_ALLOW_PUBLIC_ACCESS",
+        environ_prefix=None,
+    )
+    EXTERNAL_API_DEFAULT_ACCESS_LEVEL = values.Value(
+        "trusted",
+        environ_name="EXTERNAL_API_DEFAULT_ACCESS_LEVEL",
+        environ_prefix=None,
+    )
     # Allows third-party platforms to create users with email-only identification.
     # Required for external integrations, but fragile due to deferred user reconciliation
     # on sub. Enable it with care /!\
@@ -1002,6 +1014,44 @@ class Base(Configuration):
         environ_prefix=None,
     )
 
+    # Logging
+    # We want to make it easy to log to console but by default we log production
+    # to Sentry and don't want to log to console.
+    LOGGING = {
+        "version": 1,
+        "disable_existing_loggers": False,
+        "formatters": {
+            "simple": {
+                "format": "{asctime} {name} {levelname} {message}",
+                "style": "{",
+            },
+        },
+        "handlers": {
+            "console": {
+                "class": "logging.StreamHandler",
+                "formatter": "simple",
+            },
+        },
+        # Override root logger to send it to console
+        "root": {
+            "handlers": ["console"],
+            "level": values.Value(
+                "INFO", environ_name="LOGGING_LEVEL_LOGGERS_ROOT", environ_prefix=None
+            ),
+        },
+        "loggers": {
+            "core": {
+                "handlers": ["console"],
+                "level": values.Value(
+                    "INFO",
+                    environ_name="LOGGING_LEVEL_LOGGERS_APP",
+                    environ_prefix=None,
+                ),
+                "propagate": False,
+            },
+        },
+    }
+
     # pylint: disable=invalid-name
     @property
     def ENVIRONMENT(self):
@@ -1040,6 +1090,11 @@ class Base(Configuration):
         """
         super().post_setup()
 
+        if cls.FILE_UPLOAD_TMP_PATH == cls.FILE_UPLOAD_PATH:
+            raise ValueError(
+                "FILE_UPLOAD_TMP_PATH cannot be the same as FILE_UPLOAD_PATH"
+            )
+
         # The SENTRY_DSN setting should be available to activate sentry for an environment
         if cls.SENTRY_DSN is not None:
             sentry_sdk.init(

src/backend/meet/urls.py

@@ -4,7 +4,7 @@ from django.conf import settings
 from django.conf.urls.static import static
 from django.contrib import admin
 from django.contrib.staticfiles.urls import staticfiles_urlpatterns
-from django.urls import include, path, re_path
+from django.urls import include, path
 
 from drf_spectacular.views import (
     SpectacularJSONAPIView,
@@ -29,7 +29,7 @@ if settings.DEBUG:
 if settings.USE_SWAGGER or settings.DEBUG:
     urlpatterns += [
         path(
-            f"{settings.API_VERSION}/swagger.json",
+            f"api/{settings.API_VERSION}/swagger.json",
             SpectacularJSONAPIView.as_view(
                 api_version=settings.API_VERSION,
                 urlconf="core.urls",
@@ -37,12 +37,12 @@ if settings.USE_SWAGGER or settings.DEBUG:
             name="client-api-schema",
         ),
         path(
-            f"{settings.API_VERSION}//swagger/",
+            f"api/{settings.API_VERSION}/swagger/",
             SpectacularSwaggerView.as_view(url_name="client-api-schema"),
             name="swagger-ui-schema",
         ),
-        re_path(
-            f"{settings.API_VERSION}//redoc/",
+        path(
+            f"api/{settings.API_VERSION}/redoc/",
             SpectacularRedocView.as_view(url_name="client-api-schema"),
             name="redoc-schema",
         ),

src/backend/pyproject.toml

@@ -7,7 +7,7 @@ build-backend = "uv_build"
 
 [project]
 name = "meet"
-version = "1.16.0"
+version = "1.18.0"
 authors = [{ "name" = "DINUM", "email" = "dev@mail.numerique.gouv.fr" }]
 classifiers = [
     "Development Status :: 5 - Production/Stable",
@@ -62,6 +62,7 @@ dependencies = [
     "livekit-api==1.1.0",
     "aiohttp==3.13.4",
     "urllib3==2.7.0",
+    "phonenumbers==9.0.30",
 ]
 
 [project.urls]

src/backend/uv.lock

@@ -1173,7 +1173,7 @@ wheels = [
 
 [[package]]
 name = "meet"
-version = "1.16.0"
+version = "1.18.0"
 source = { editable = "." }
 dependencies = [
     { name = "aiohttp" },
@@ -1204,6 +1204,7 @@ dependencies = [
     { name = "markdown" },
     { name = "mozilla-django-oidc" },
     { name = "nested-multipart-parser" },
+    { name = "phonenumbers" },
     { name = "psycopg", extra = ["binary"] },
     { name = "pydantic" },
     { name = "pyjwt" },
@@ -1266,6 +1267,7 @@ requires-dist = [
     { name = "markdown", specifier = "==3.10.2" },
     { name = "mozilla-django-oidc", specifier = "==5.0.2" },
     { name = "nested-multipart-parser", specifier = "==1.6.0" },
+    { name = "phonenumbers", specifier = "==9.0.30" },
     { name = "psycopg", extras = ["binary"], specifier = "==3.3.3" },
     { name = "pydantic", specifier = "==2.12.5" },
     { name = "pyjwt", specifier = "==2.12.1" },
@@ -1430,6 +1432,15 @@ wheels = [
     { url = "https://files.pythonhosted.org/packages/9e/c3/059298687310d527a58bb01f3b1965787ee3b40dce76752eda8b44e9a2c5/pexpect-4.9.0-py2.py3-none-any.whl", hash = "sha256:7236d1e080e4936be2dc3e326cec0af72acf9212a7e1d060210e70a47e253523", size = 63772, upload-time = "2023-11-25T06:56:14.81Z" },
 ]
 
+[[package]]
+name = "phonenumbers"
+version = "9.0.30"
+source = { registry = "https://pypi.org/simple" }
+sdist = { url = "https://files.pythonhosted.org/packages/a6/f1/249f843f4107c6a6ed17e5ece17620d75e532c2a355106e26d889a0c72c7/phonenumbers-9.0.30.tar.gz", hash = "sha256:d42d232ccde69c1af1bb5916a7e46f4edbcc72975b02759830f4ea1fba7b00c9", size = 2306521, upload-time = "2026-05-07T10:20:38.884Z" }
+wheels = [
+    { url = "https://files.pythonhosted.org/packages/83/22/e4442aabea04daf16fda50d89bce2ff585e44f204089986b2cc6679cae10/phonenumbers-9.0.30-py2.py3-none-any.whl", hash = "sha256:e0890d4cda206ef6ac18ef07e8f3ab225c31c7edce237ac870b4729d4c1d2520", size = 2595222, upload-time = "2026-05-07T10:20:35.387Z" },
+]
+
 [[package]]
 name = "pillow"
 version = "12.2.0"

src/frontend/index.html

@@ -6,22 +6,6 @@
     <link rel="icon" type="image/png" sizes="32x32" href="/favicon-32x32.png">
     <link rel="icon" type="image/png" sizes="16x16" href="/favicon-16x16.png">
     <link rel="manifest" href="/site.webmanifest">
-    <!-- Font URLs are resolved and replaced by Vite during the build process. Font loading failures will not break the application. -->
-    <link
-      rel="preload"
-      as="font"
-      crossorigin="anonymous"
-      href="/node_modules/@fontsource/material-icons-outlined/files/material-icons-outlined-latin-400-normal.woff2"
-      type="font/woff2"
-    />
-    <!-- Font URLs are resolved and replaced by Vite during the build process. Font loading failures will not break the application. -->
-    <link
-      rel="preload"
-      as="font"
-      crossorigin="anonymous"
-      href="/node_modules/@fontsource-variable/material-symbols-outlined/files/material-symbols-outlined-latin-wght-normal.woff2"
-      type="font/woff2"
-    />
     <meta name="viewport" content="width=device-width, initial-scale=1.0" />
     <title>%VITE_APP_TITLE%</title>
   </head>

src/frontend/package.json

@@ -1,11 +1,12 @@
 {
   "name": "meet",
   "private": true,
-  "version": "1.16.0",
+  "version": "1.18.0",
   "type": "module",
   "scripts": {
     "dev": "panda codegen && vite",
     "build": "panda codegen && tsc -b && vite build",
+    "build:debug": "VITE_ANALYZE=true npm run build -- --debug",
     "lint": "eslint . --ext ts,tsx --report-unused-disable-directives --max-warnings 0",
     "preview": "vite preview",
     "i18n:extract": "npx i18next -c i18next-parser.config.json",
@@ -15,8 +16,6 @@
   "dependencies": {
     "@fontsource-variable/atkinson-hyperlegible-next": "5.2.6",
     "@fontsource-variable/lexend": "5.2.11",
-    "@fontsource-variable/material-symbols-outlined": "5.2.34",
-    "@fontsource/material-icons-outlined": "5.2.6",
     "@fontsource/opendyslexic": "5.2.5",
     "@livekit/components-react": "2.9.19",
     "@livekit/components-styles": "1.2.0",
@@ -35,7 +34,6 @@
     "i18next-browser-languagedetector": "8.2.1",
     "i18next-parser": "9.3.0",
     "i18next-resources-to-backend": "1.2.1",
-    "libphonenumber-js": "1.12.10",
     "livekit-client": "2.17.1",
     "posthog-js": "1.342.1",
     "react": "18.3.1",
@@ -64,8 +62,10 @@
     "eslint-plugin-react-refresh": "0.4.20",
     "postcss": "8.5.14",
     "prettier": "3.8.1",
+    "rollup-plugin-visualizer": "7.0.1",
     "typescript": "5.8.3",
     "vite": "7.3.2",
+    "vite-plugin-svgr": "5.2.0",
     "vite-tsconfig-paths": "6.1.1"
   }
 }

src/frontend/src/App.tsx

@@ -1,4 +1,3 @@
-import '@livekit/components-styles'
 import '@/styles/index.css'
 import { Suspense } from 'react'
 import { ReactQueryDevtools } from '@tanstack/react-query-devtools'

src/frontend/src/api/useConfig.ts

@@ -2,8 +2,8 @@ import { fetchApi } from './fetchApi'
 import { keys } from './queryKeys'
 import { useQuery } from '@tanstack/react-query'
 import { RecordingMode } from '@/features/recording'
-import { Track } from 'livekit-client'
-import Source = Track.Source
+import type { Track } from 'livekit-client'
+type Source = Track.Source
 
 export interface ApiConfig {
   analytics?: {
@@ -44,7 +44,7 @@ export interface ApiConfig {
   }
   telephony: {
     enabled: boolean
-    phone_number?: string
+    international_phone_number?: string
     default_country?: string
   }
   manifest_link?: string

src/frontend/src/assets/icons/article.svg

@@ -0,0 +1 @@
+<svg xmlns="http://www.w3.org/2000/svg" height="24px" viewBox="0 -960 960 960" width="24px" fill="#1f1f1f"><path d="M280-280h280v-80H280v80Zm0-160h400v-80H280v80Zm0-160h400v-80H280v80Zm-80 480q-33 0-56.5-23.5T120-200v-560q0-33 23.5-56.5T200-840h560q33 0 56.5 23.5T840-760v560q0 33-23.5 56.5T760-120H200Zm0-80h560v-560H200v560Zm0-560v560-560Z"/></svg>

src/frontend/src/assets/icons/chevron_forward.svg

@@ -0,0 +1 @@
+<svg xmlns="http://www.w3.org/2000/svg" height="24px" viewBox="0 -960 960 960" width="24px" fill="#1f1f1f"><path d="M504-480 320-664l56-56 240 240-240 240-56-56 184-184Z"/></svg>

src/frontend/src/assets/icons/cloud_download.svg

@@ -0,0 +1 @@
+<svg xmlns="http://www.w3.org/2000/svg" height="24px" viewBox="0 -960 960 960" width="24px" fill="#1f1f1f"><path d="M260-160q-91 0-155.5-63T40-377q0-78 47-139t123-78q17-72 85-137t145-65q33 0 56.5 23.5T520-716v242l64-62 56 56-160 160-160-160 56-56 64 62v-242q-76 14-118 73.5T280-520h-20q-58 0-99 41t-41 99q0 58 41 99t99 41h480q42 0 71-29t29-71q0-42-29-71t-71-29h-60v-80q0-48-22-89.5T600-680v-93q74 35 117 103.5T760-520q69 8 114.5 59.5T920-340q0 75-52.5 127.5T740-160H260Zm220-358Z"/></svg>

src/frontend/src/assets/icons/language.svg

@@ -0,0 +1 @@
+<svg xmlns="http://www.w3.org/2000/svg" height="24px" viewBox="0 -960 960 960" width="24px" fill="#1f1f1f"><path d="M325-111.5q-73-31.5-127.5-86t-86-127.5Q80-398 80-480.5t31.5-155q31.5-72.5 86-127t127.5-86Q398-880 480.5-880t155 31.5q72.5 31.5 127 86t86 127Q880-563 880-480.5T848.5-325q-31.5 73-86 127.5t-127 86Q563-80 480.5-80T325-111.5ZM480-162q26-36 45-75t31-83H404q12 44 31 83t45 75Zm-104-16q-18-33-31.5-68.5T322-320H204q29 50 72.5 87t99.5 55Zm208 0q56-18 99.5-55t72.5-87H638q-9 38-22.5 73.5T584-178ZM170-400h136q-3-20-4.5-39.5T300-480q0-21 1.5-40.5T306-560H170q-5 20-7.5 39.5T160-480q0 21 2.5 40.5T170-400Zm216 0h188q3-20 4.5-39.5T580-480q0-21-1.5-40.5T574-560H386q-3 20-4.5 39.5T380-480q0 21 1.5 40.5T386-400Zm268 0h136q5-20 7.5-39.5T800-480q0-21-2.5-40.5T790-560H654q3 20 4.5 39.5T660-480q0 21-1.5 40.5T654-400Zm-16-240h118q-29-50-72.5-87T584-782q18 33 31.5 68.5T638-640Zm-234 0h152q-12-44-31-83t-45-75q-26 36-45 75t-31 83Zm-200 0h118q9-38 22.5-73.5T376-782q-56 18-99.5 55T204-640Z"/></svg>

src/frontend/src/assets/icons/login.svg

@@ -0,0 +1 @@
+<svg xmlns="http://www.w3.org/2000/svg" height="24px" viewBox="0 -960 960 960" width="24px" fill="#1f1f1f"><path d="M480-120v-80h280v-560H480v-80h280q33 0 56.5 23.5T840-760v560q0 33-23.5 56.5T760-120H480Zm-80-160-55-58 102-102H120v-80h327L345-622l55-58 200 200-200 200Z"/></svg>

src/frontend/src/assets/icons/mail.svg

@@ -0,0 +1 @@
+<svg xmlns="http://www.w3.org/2000/svg" height="24px" viewBox="0 -960 960 960" width="24px" fill="#1f1f1f"><path d="M160-160q-33 0-56.5-23.5T80-240v-480q0-33 23.5-56.5T160-800h640q33 0 56.5 23.5T880-720v480q0 33-23.5 56.5T800-160H160Zm320-280L160-640v400h640v-400L480-440Zm0-80 320-200H160l320 200ZM160-640v-80 480-400Z"/></svg>

src/frontend/src/assets/icons/mode_standby.svg

@@ -0,0 +1 @@
+<svg xmlns="http://www.w3.org/2000/svg" height="24px" viewBox="0 -960 960 960" width="24px" fill="#1f1f1f"><path d="M565-395q35-35 35-85t-35-85q-35-35-85-35t-85 35q-35 35-35 85t35 85q35 35 85 35t85-35ZM480-80q-83 0-156-31.5T197-197q-54-54-85.5-127T80-480q0-83 31.5-156T197-763q54-54 127-85.5T480-880q83 0 156 31.5T763-763q54 54 85.5 127T880-480q0 83-31.5 156T763-197q-54 54-127 85.5T480-80Zm0-80q134 0 227-93t93-227q0-134-93-227t-227-93q-134 0-227 93t-93 227q0 134 93 227t227 93Zm0-320Z"/></svg>

src/frontend/src/assets/icons/person_raised_hand.svg

@@ -0,0 +1 @@
+<svg xmlns="http://www.w3.org/2000/svg" height="24px" viewBox="0 -960 960 960" width="24px" fill="#1f1f1f"><path d="M80-40v-80h800v80H80Zm80-120v-240q-33-54-51-114.5T91-638q0-61 15.5-120T143-874q8-21 26-33.5t40-12.5q31 0 53 21t18 50l-11 91q-6 48 8.5 91t43.5 75.5q29 32.5 70 52t89 19.5q60 0 120.5 12.5T706-472q45 23 69.5 58.5T800-326v166H160Zm80-80h480v-86q0-24-12-42.5T674-398q-41-20-95-31t-99-11q-66 0-122.5-27t-96-72.5Q222-585 202-644.5T190-768q-10 30-14.5 64t-4.5 66q0 58 20.5 111.5T240-422v182Zm127-367q-47-47-47-113t47-113q47-47 113-47t113 47q47 47 47 113t-47 113q-47 47-113 47t-113-47Zm169.5-56.5Q560-687 560-720t-23.5-56.5Q513-800 480-800t-56.5 23.5Q400-753 400-720t23.5 56.5Q447-640 480-640t56.5-23.5ZM320-160v-37q0-67 46.5-115T480-360h160v80H480q-34 0-57 24.5T400-197v37h-80Zm160-80Zm0-480Z"/></svg>

src/frontend/src/assets/icons/screen_record.svg

@@ -0,0 +1 @@
+<svg xmlns="http://www.w3.org/2000/svg" height="24px" viewBox="0 -960 960 960" width="24px" fill="#1f1f1f"><path d="M158-242q-37-50-57.5-110.5T80-480q0-67 20-127t57-110l58 57q-26 38-40.5 83.5T160-480q0 51 14.5 97t40.5 84l-57 57ZM480-80q-67 0-127-20t-110-57l57-58q38 26 83.5 40.5T480-160q51 0 96.5-14.5T660-215l57 58q-50 37-110 57T480-80Zm322-162-57-57q26-38 40.5-84t14.5-97q0-51-14.5-96.5T745-660l58-57q37 50 57 110t20 127q0 67-20.5 127.5T802-242ZM299-745l-57-57q50-37 110.5-57.5T480-880q68 0 128 20.5T718-802l-57 57q-38-26-84-40.5T480-800q-51 0-97 14.5T299-745Zm181 465q-83 0-141.5-58.5T280-480q0-83 58.5-141.5T480-680q83 0 141.5 58.5T680-480q0 83-58.5 141.5T480-280Z"/></svg>

src/frontend/src/assets/icons/speech_to_text.svg

@@ -0,0 +1 @@
+<svg xmlns="http://www.w3.org/2000/svg" height="24px" viewBox="0 -960 960 960" width="24px" fill="#1f1f1f"><path d="M680-560q-33 0-56.5-23T600-640v-160q0-34 23.5-57t56.5-23q34 0 57 23t23 57v160q0 34-23 57t-57 23ZM200-80q-33 0-56.5-23.5T120-160v-640q0-33 23.5-56.5T200-880h320v80H200v640h440v-80h80v80q0 33-23.5 56.5T640-80H200Zm80-160v-80h280v80H280Zm0-120v-80h200v80H280Zm440 40h-80v-104q-77-14-128.5-74.5T460-640h80q0 58 41 99t99 41q59 0 99.5-41t40.5-99h80q0 81-51 141.5T720-424v104Z"/></svg>

src/frontend/src/components/AppInitialization.tsx

@@ -1,20 +1,14 @@
-import { silenceLiveKitLogs } from '@/utils/livekit'
 import { useConfig } from '@/api/useConfig'
 import { useAnalytics } from '@/features/analytics/hooks/useAnalytics'
 import { useSupport } from '@/features/support/hooks/useSupport'
-import { useSyncUserPreferencesWithBackend } from '@/features/auth'
+import { useSyncUserPreferencesWithBackend } from '@/features/auth/api/useSyncUserPreferencesWithBackend'
 import { useEffect } from 'react'
 
 export const AppInitialization = () => {
   const { data } = useConfig()
   useSyncUserPreferencesWithBackend()
 
-  const {
-    analytics = {},
-    support = {},
-    silence_livekit_debug_logs = false,
-    custom_css_url = '',
-  } = data ?? {}
+  const { analytics = {}, support = {}, custom_css_url = '' } = data ?? {}
 
   useAnalytics(analytics)
   useSupport(support)
@@ -29,7 +23,5 @@ export const AppInitialization = () => {
     }
   }, [custom_css_url])
 
-  silenceLiveKitLogs(silence_livekit_debug_logs)
-
   return null
 }

src/frontend/src/components/LoginButton.tsx

@@ -1,8 +1,8 @@
 import { LinkButton } from '@/primitives'
-import { authUrl } from '@/features/auth'
 import { useTranslation } from 'react-i18next'
 import { useConfig } from '@/api/useConfig'
 import { ProConnectButton } from './ProConnectButton'
+import { authUrl } from '@/features/auth/utils/authUrl'
 
 type LoginButtonProps = {
   proConnectHint?: boolean // Hide hint in layouts where space doesn't allow it.

src/frontend/src/features/analytics/hooks/useAnalytics.ts

@@ -1,17 +1,28 @@
 import { useEffect } from 'react'
 import { useLocation } from 'wouter'
-import posthog from 'posthog-js'
-import { ApiUser } from '@/features/auth/api/ApiUser'
+import { type PostHog } from 'posthog-js'
+import { type ApiUser } from '@/features/auth/api/ApiUser'
+import { useUser } from '@/features/auth/api/useUser'
 
-export const startAnalyticsSession = (data: ApiUser) => {
-  if (posthog._isIdentified()) return
-  const { id, email } = data
-  posthog.identify(id, { email })
+let posthog: PostHog | null = null
+
+const getPosthog = async () => {
+  if (!posthog) posthog = (await import('posthog-js')).default
+  return posthog
 }
 
-export const terminateAnalyticsSession = () => {
-  if (!posthog._isIdentified()) return
-  posthog.reset()
+export const startAnalyticsSession = (data: ApiUser) => {
+  getPosthog().then((ph) => {
+    if (ph._isIdentified()) return
+    const { id, email } = data
+    ph.identify(id, { email })
+  })
+}
+
+export const terminateAnalyticsSession = async () => {
+  const ph = await getPosthog()
+  if (!ph._isIdentified()) return
+  ph.reset()
 }
 
 export type useAnalyticsProps = {
@@ -22,18 +33,26 @@ export type useAnalyticsProps = {
 
 export const useAnalytics = ({ id, host, isDisabled }: useAnalyticsProps) => {
   const [location] = useLocation()
+  const { user } = useUser()
+
   useEffect(() => {
     if (!id || !host || isDisabled) return
-    if (posthog.__loaded) return
-    posthog.init(id, {
-      api_host: host,
-      person_profiles: 'always',
+    getPosthog().then((ph) => {
+      if (ph.__loaded) return
+      ph.init(id, { api_host: host, person_profiles: 'always' })
     })
   }, [id, host, isDisabled])
 
+  useEffect(() => {
+    if (!user) return
+    startAnalyticsSession(user)
+  }, [user])
+
   // From PostHog tutorial on PageView tracking in a Single Page Application (SPA) context.
   useEffect(() => {
-    posthog.capture('$pageview')
+    getPosthog().then((ph) => {
+      ph.capture('$pageview')
+    })
   }, [location])
 
   return null

src/frontend/src/features/auth/api/useUser.tsx

@@ -2,16 +2,7 @@ import { useQuery } from '@tanstack/react-query'
 import { keys } from '@/api/queryKeys'
 import { fetchUser } from './fetchUser'
 import { type ApiUser } from './ApiUser'
-import { useEffect, useMemo } from 'react'
-import {
-  startAnalyticsSession,
-  terminateAnalyticsSession,
-} from '@/features/analytics/hooks/useAnalytics'
-import {
-  initializeSupportSession,
-  terminateSupportSession,
-} from '@/features/support/hooks/useSupport'
-import { logoutUrl } from '../utils/logoutUrl'
+import { useMemo } from 'react'
 import { useConfig } from '@/api/useConfig'
 
 /**
@@ -45,19 +36,6 @@ export const useUser = (
     enabled: !isConfigLoading,
   })
 
-  useEffect(() => {
-    if (query?.data) {
-      startAnalyticsSession(query.data)
-      initializeSupportSession(query.data)
-    }
-  }, [query.data])
-
-  const logout = () => {
-    terminateAnalyticsSession()
-    terminateSupportSession()
-    window.location.href = logoutUrl()
-  }
-
   const isLoggedIn =
     query.status === 'success' ? query.data !== false : undefined
   const isLoggedOut = isLoggedIn === false
@@ -67,6 +45,5 @@ export const useUser = (
     user: isLoggedOut ? undefined : (query.data as ApiUser | undefined),
     isLoggedIn,
     isLoading: query.isLoading,
-    logout,
   }
 }

src/frontend/src/features/auth/components/UserAware.tsx

@@ -1,4 +1,4 @@
-import { useUser } from '@/features/auth'
+import { useUser } from '../api/useUser'
 import { LoadingScreen } from '@/components/LoadingScreen'
 
 /**

src/frontend/src/features/auth/index.ts

@@ -1,4 +0,0 @@
-export { useUser } from './api/useUser'
-export { useSyncUserPreferencesWithBackend } from './api/useSyncUserPreferencesWithBackend'
-export { authUrl } from './utils/authUrl'
-export { UserAware } from './components/UserAware'

src/frontend/src/features/auth/utils/logout.ts

@@ -0,0 +1,13 @@
+import { apiUrl } from '@/api/apiUrl'
+import { terminateSupportSession } from '@/features/support/hooks/useSupport'
+import { terminateAnalyticsSession } from '@/features/analytics/hooks/useAnalytics'
+
+const logoutUrl = () => {
+  return apiUrl('/logout')
+}
+
+export const logout = async () => {
+  await terminateAnalyticsSession()
+  terminateSupportSession()
+  window.location.href = logoutUrl()
+}

src/frontend/src/features/auth/utils/logoutUrl.ts

@@ -1,5 +0,0 @@
-import { apiUrl } from '@/api/apiUrl'
-
-export const logoutUrl = () => {
-  return apiUrl('/logout')
-}

src/frontend/src/features/auth/utils/silentLogin.ts

@@ -1,4 +1,4 @@
-import { authUrl } from '@/features/auth'
+import { authUrl } from './authUrl'
 
 const SILENT_LOGIN_RETRY_KEY = 'silent-login-retry'
 

src/frontend/src/features/files/api/listFiles.ts

@@ -6,7 +6,7 @@ import {
   ApiFileType,
   ApiFileUploadState,
 } from '@/features/files/api/types.ts'
-import { useUser } from '@/features/auth'
+import { useUser } from '@/features/auth/api/useUser'
 import { useConfig } from '@/api/useConfig.ts'
 
 type ListFilesResponse = {

src/frontend/src/features/home/components/CreateMeetingMenu.tsx

@@ -0,0 +1,62 @@
+import { useTranslation } from 'react-i18next'
+import { MenuItem, Menu as RACMenu } from 'react-aria-components'
+import { Button, Menu } from '@/primitives'
+import { navigateTo } from '@/navigation/navigateTo'
+import { generateRoomId, useCreateRoom } from '@/features/rooms'
+import { RiAddLine, RiLink } from '@remixicon/react'
+import { LaterMeetingDialog } from '@/features/home/components/LaterMeetingDialog'
+import { useState } from 'react'
+
+import { menuRecipe } from '@/primitives/menuRecipe'
+import { ApiRoom } from '@/features/rooms/api/ApiRoom'
+import { loadUserChoices } from '@livekit/components-core'
+
+export const CreateMeetingMenu = () => {
+  const { username } = loadUserChoices()
+
+  const { t } = useTranslation('home')
+  const { mutateAsync: createRoom } = useCreateRoom()
+  const [laterRoom, setLaterRoom] = useState<null | ApiRoom>(null)
+
+  return (
+    <>
+      <Menu>
+        <Button variant="primary" data-attr="create-meeting">
+          {t('createMeeting')}
+        </Button>
+        <RACMenu>
+          <MenuItem
+            className={menuRecipe({ icon: true, variant: 'light' }).item}
+            onAction={() => {
+              const slug = generateRoomId()
+              createRoom({ slug, username }).then((data) =>
+                navigateTo('room', data.slug, {
+                  state: { create: true, initialRoomData: data },
+                })
+              )
+            }}
+            data-attr="create-option-instant"
+          >
+            <RiAddLine size={18} />
+            {t('createMenu.instantOption')}
+          </MenuItem>
+          <MenuItem
+            className={menuRecipe({ icon: true, variant: 'light' }).item}
+            onAction={() => {
+              const slug = generateRoomId()
+              createRoom({ slug, username }).then(setLaterRoom)
+            }}
+            data-attr="create-option-later"
+          >
+            <RiLink size={18} />
+            {t('createMenu.laterOption')}
+          </MenuItem>
+        </RACMenu>
+      </Menu>
+      <LaterMeetingDialog
+        room={laterRoom}
+        onOpenChange={() => setLaterRoom(null)}
+      />
+    </>
+  )
+}

src/frontend/src/features/home/index.ts

@@ -1 +0,0 @@
-export { Home as HomeRoute } from './routes/Home'

src/frontend/src/features/home/routes/Home.tsx

@@ -1,24 +1,19 @@
 import { useTranslation } from 'react-i18next'
-import { DialogTrigger, MenuItem, Menu as RACMenu } from 'react-aria-components'
-import { Button, Menu } from '@/primitives'
+import { DialogTrigger } from 'react-aria-components'
+import { Button } from '@/primitives'
 import { styled } from '@/styled-system/jsx'
-import { navigateTo } from '@/navigation/navigateTo'
 import { Screen } from '@/layout/Screen'
-import { generateRoomId, useCreateRoom } from '@/features/rooms'
-import { useUser, UserAware } from '@/features/auth'
+import { UserAware } from '@/features/auth/components/UserAware'
+import { useUser } from '@/features/auth/api/useUser'
 import { JoinMeetingDialog } from '../components/JoinMeetingDialog'
-import { RiAddLine, RiLink } from '@remixicon/react'
-import { LaterMeetingDialog } from '@/features/home/components/LaterMeetingDialog'
-import { IntroSlider } from '@/features/home/components/IntroSlider'
-import { MoreLink } from '@/features/home/components/MoreLink'
+import { IntroSlider } from '../components/IntroSlider'
+import { MoreLink } from '../components/MoreLink'
+import { CreateMeetingMenu } from '../components/CreateMeetingMenu'
 import { ReactNode, useEffect, useState } from 'react'
 
 import { css } from '@/styled-system/css'
-import { menuRecipe } from '@/primitives/menuRecipe.ts'
-import { usePersistentUserChoices } from '@/features/rooms/livekit/hooks/usePersistentUserChoices'
 import { useConfig } from '@/api/useConfig'
 import { LoginButton } from '@/components/LoginButton'
-import { ApiRoom } from '@/features/rooms/api/ApiRoom'
 import { LoadingScreen } from '@/components/LoadingScreen'
 
 const Columns = ({ children }: { children?: ReactNode }) => {
@@ -146,18 +141,11 @@ const IntroText = styled('div', {
   },
 })
 
-export const Home = () => {
+const Home = () => {
   const { t } = useTranslation('home')
   const { isLoggedIn } = useUser()
 
-  const {
-    userChoices: { username },
-  } = usePersistentUserChoices()
-
-  const { mutateAsync: createRoom } = useCreateRoom()
-  const [laterRoom, setLaterRoom] = useState<null | ApiRoom>(null)
   const [redirectFailed, setRedirectFailed] = useState(false)
-
   const { data } = useConfig()
 
   useEffect(() => {
@@ -200,45 +188,7 @@ export const Home = () => {
               })}
             >
               {isLoggedIn ? (
-                <Menu>
-                  <Button variant="primary" data-attr="create-meeting">
-                    {t('createMeeting')}
-                  </Button>
-                  <RACMenu>
-                    <MenuItem
-                      className={
-                        menuRecipe({ icon: true, variant: 'light' }).item
-                      }
-                      onAction={async () => {
-                        const slug = generateRoomId()
-                        createRoom({ slug, username }).then((data) =>
-                          navigateTo('room', data.slug, {
-                            state: { create: true, initialRoomData: data },
-                          })
-                        )
-                      }}
-                      data-attr="create-option-instant"
-                    >
-                      <RiAddLine size={18} />
-                      {t('createMenu.instantOption')}
-                    </MenuItem>
-                    <MenuItem
-                      className={
-                        menuRecipe({ icon: true, variant: 'light' }).item
-                      }
-                      onAction={() => {
-                        const slug = generateRoomId()
-                        createRoom({ slug, username }).then((data) =>
-                          setLaterRoom(data)
-                        )
-                      }}
-                      data-attr="create-option-later"
-                    >
-                      <RiLink size={18} />
-                      {t('createMenu.laterOption')}
-                    </MenuItem>
-                  </RACMenu>
-                </Menu>
+                <CreateMeetingMenu />
               ) : (
                 <LoginButton proConnectHint={false} />
               )}
@@ -264,11 +214,9 @@ export const Home = () => {
             <IntroSlider />
           </RightColumn>
         </Columns>
-        <LaterMeetingDialog
-          room={laterRoom}
-          onOpenChange={() => setLaterRoom(null)}
-        />
       </Screen>
     </UserAware>
   )
 }
+
+export default Home

src/frontend/src/features/legalsTerms/Accessibility.tsx

@@ -3,7 +3,7 @@ import { H, P, A, Italic, Ul } from '@/primitives'
 import { HStack } from '@/styled-system/jsx'
 import { useTranslation } from 'react-i18next'
 
-export const AccessibilityRoute = () => {
+const AccessibilityRoute = () => {
   const { t } = useTranslation('accessibility', { keyPrefix: 'accessibility' })
 
   return (
@@ -78,3 +78,5 @@ export const AccessibilityRoute = () => {
     </Screen>
   )
 }
+
+export default AccessibilityRoute

src/frontend/src/features/legalsTerms/LegalTermsRoute.tsx

@@ -4,7 +4,7 @@ import { css } from '@/styled-system/css'
 import { HStack } from '@/styled-system/jsx'
 import { useTranslation } from 'react-i18next'
 
-export const LegalTermsRoute = () => {
+const LegalTermsRoute = () => {
   const { t } = useTranslation('legals')
 
   const indentedStyle = css({
@@ -72,3 +72,5 @@ export const LegalTermsRoute = () => {
     </Screen>
   )
 }
+
+export default LegalTermsRoute

src/frontend/src/features/legalsTerms/TermsOfService.tsx

@@ -12,7 +12,7 @@ const ensureArray = (value: any) => {
 }
 /* eslint-enable @typescript-eslint/no-explicit-any */
 
-export const TermsOfServiceRoute = () => {
+const TermsOfServiceRoute = () => {
   const { t } = useTranslation('termsOfService')
 
   return (
@@ -199,3 +199,5 @@ export const TermsOfServiceRoute = () => {
     </Screen>
   )
 }
+
+export default TermsOfServiceRoute

src/frontend/src/features/notifications/MainNotificationToast.tsx

@@ -1,7 +1,7 @@
 import { useCallback, useEffect } from 'react'
 import { useRoomContext } from '@livekit/components-react'
 import { Participant, RemoteParticipant, RoomEvent } from 'livekit-client'
-import { ChatMessage, isMobileBrowser } from '@livekit/components-core'
+import { type ChatMessage, isMobileBrowser } from '@livekit/components-core'
 import { useTranslation } from 'react-i18next'
 import { NotificationType } from './NotificationType'
 import { NotificationDuration } from './NotificationDuration'

src/frontend/src/features/notifications/NotificationPayload.ts

@@ -1,4 +1,4 @@
-import { NotificationType } from './NotificationType'
+import type { NotificationType } from './NotificationType'
 
 export interface NotificationPayload {
   type: NotificationType

src/frontend/src/features/notifications/components/Toast.tsx

@@ -1,10 +1,10 @@
 import { useToast } from '@react-aria/toast'
 import { Button } from '@/primitives'
 import { RiCloseLine } from '@remixicon/react'
-import { ToastState } from '@react-stately/toast'
 import { styled } from '@/styled-system/jsx'
 import { useRef } from 'react'
-import { ToastData } from './ToastProvider'
+import type { ToastState } from '@react-stately/toast'
+import type { ToastData } from './ToastProvider'
 import type { QueuedToast } from '@react-stately/toast'
 
 export const StyledToastContainer = styled('div', {

src/frontend/src/features/notifications/components/ToastAnyRecording.tsx

@@ -1,7 +1,7 @@
 import { useToast } from '@react-aria/toast'
 import { useMemo, useRef } from 'react'
 
-import { StyledToastContainer, ToastProps } from './Toast'
+import { StyledToastContainer, type ToastProps } from './Toast'
 import { HStack } from '@/styled-system/jsx'
 import { useTranslation } from 'react-i18next'
 import { NotificationType } from '../NotificationType'

src/frontend/src/features/notifications/components/ToastJoined.tsx

@@ -6,7 +6,7 @@ import Source = Track.Source
 
 import { useMaybeLayoutContext } from '@livekit/components-react'
 import { ParticipantTile } from '@/features/rooms/livekit/components/ParticipantTile'
-import { StyledToastContainer, ToastProps } from './Toast'
+import { StyledToastContainer, type ToastProps } from './Toast'
 import { HStack, styled } from '@/styled-system/jsx'
 import { Div } from '@/primitives'
 import { useTranslation } from 'react-i18next'

src/frontend/src/features/notifications/components/ToastLowerHand.tsx

@@ -1,7 +1,7 @@
 import { useToast } from '@react-aria/toast'
 import { useRef } from 'react'
 
-import { StyledToastContainer, ToastProps } from './Toast'
+import { StyledToastContainer, type ToastProps } from './Toast'
 import { HStack } from '@/styled-system/jsx'
 import { useTranslation } from 'react-i18next'
 import { Button } from '@/primitives'

src/frontend/src/features/notifications/components/ToastMessageReceived.tsx

@@ -1,7 +1,7 @@
 import { useToast } from '@react-aria/toast'
 import { useEffect, useRef } from 'react'
 
-import { StyledToastContainer, ToastProps } from './Toast'
+import { StyledToastContainer, type ToastProps } from './Toast'
 import { Text } from '@/primitives'
 import { RiMessage2Line } from '@remixicon/react'
 import { useSidePanel } from '@/features/rooms/livekit/hooks/useSidePanel'

src/frontend/src/features/notifications/components/ToastMuted.tsx

@@ -1,7 +1,7 @@
 import { useToast } from '@react-aria/toast'
 import { useRef } from 'react'
 
-import { StyledToastContainer, ToastProps } from './Toast'
+import { StyledToastContainer, type ToastProps } from './Toast'
 import { HStack } from '@/styled-system/jsx'
 import { useTranslation } from 'react-i18next'
 

src/frontend/src/features/notifications/components/ToastPermissionsRemoved.tsx

@@ -1,7 +1,7 @@
 import { useToast } from '@react-aria/toast'
 import { useMemo, useRef } from 'react'
 
-import { StyledToastContainer, ToastProps } from './Toast'
+import { StyledToastContainer, type ToastProps } from './Toast'
 import { HStack } from '@/styled-system/jsx'
 import { useTranslation } from 'react-i18next'
 

src/frontend/src/features/notifications/components/ToastProvider.tsx

@@ -2,7 +2,7 @@
 import { ToastQueue, useToastQueue } from '@react-stately/toast'
 import { ToastRegion } from './ToastRegion'
 import { Participant } from 'livekit-client'
-import { NotificationType } from '../NotificationType'
+import type { NotificationType } from '../NotificationType'
 
 export interface ToastData {
   participant?: Participant

src/frontend/src/features/notifications/components/ToastRaised.tsx

@@ -1,7 +1,7 @@
 import { useToast } from '@react-aria/toast'
 import { useRef } from 'react'
 
-import { StyledToastContainer, ToastProps } from './Toast'
+import { StyledToastContainer, type ToastProps } from './Toast'
 import { HStack } from '@/styled-system/jsx'
 import { Button, Div } from '@/primitives'
 import { useTranslation } from 'react-i18next'

src/frontend/src/features/notifications/components/ToastRecordingRequest.tsx

@@ -1,7 +1,7 @@
 import { useToast } from '@react-aria/toast'
 import { useMemo, useRef } from 'react'
 
-import { StyledToastContainer, ToastProps } from './Toast'
+import { StyledToastContainer, type ToastProps } from './Toast'
 import { HStack } from '@/styled-system/jsx'
 import { useTranslation } from 'react-i18next'
 import { NotificationType } from '../NotificationType'

src/frontend/src/features/notifications/components/ToastRecordingSaving.tsx

@@ -2,10 +2,10 @@ import { useToast } from '@react-aria/toast'
 import { useMemo, useRef } from 'react'
 import { Text } from '@/primitives'
 
-import { StyledToastContainer, ToastProps } from './Toast'
+import { StyledToastContainer, type ToastProps } from './Toast'
 import { HStack } from '@/styled-system/jsx'
 import { useTranslation } from 'react-i18next'
-import { useUser } from '@/features/auth'
+import { useUser } from '@/features/auth/api/useUser'
 import { css } from '@/styled-system/css'
 import { RecordingMode } from '@/features/recording'
 

src/frontend/src/features/notifications/hooks/useNotifyParticipants.ts

@@ -1,6 +1,6 @@
 import { useRoomContext } from '@livekit/components-react'
-import { NotificationType } from '../NotificationType'
-import { NotificationPayload } from '../NotificationPayload'
+import type { NotificationType } from '../NotificationType'
+import type { NotificationPayload } from '../NotificationPayload'
 
 export const useNotifyParticipants = () => {
   const room = useRoomContext()

src/frontend/src/features/notifications/hooks/useSoundNotification.tsx

@@ -1,7 +1,7 @@
 import useSound from 'use-sound'
 import { useSnapshot } from 'valtio'
 import { notificationsStore } from '@/stores/notifications'
-import { NotificationType } from '@/features/notifications/NotificationType'
+import type { NotificationType } from '@/features/notifications/NotificationType'
 
 // fixme - handle dynamic audio output changes
 export const useNotificationSound = () => {

src/frontend/src/features/notifications/utils.ts

@@ -1,9 +1,9 @@
 import { toastQueue } from './components/ToastProvider'
 import { NotificationType } from './NotificationType'
 import { NotificationDuration } from './NotificationDuration'
-import { Participant } from 'livekit-client'
-import { NotificationPayload } from './NotificationPayload'
-import { RecordingMode } from '@/features/recording'
+import type { Participant } from 'livekit-client'
+import type { NotificationPayload } from './NotificationPayload'
+import type { RecordingMode } from '@/features/recording'
 
 export const showLowerHandToast = (
   participant: Participant,

src/frontend/src/features/reactions/components/ReactionPortals.tsx

@@ -5,7 +5,7 @@ import { css } from '@/styled-system/css'
 import { useSnapshot } from 'valtio'
 import { reactionsStore } from '@/stores/reactions'
 import { useAnnounceReaction } from '../hooks/useAnnounceReaction'
-import { Reaction } from '../types'
+import type { Reaction } from '../types'
 import {
   ANIMATION_DISTANCE,
   ANIMATION_DURATION,