⚡️(backend) add UPPER(email) index for case-insensitive user lookups

Case-insensitive user lookups during token issuance currently take
around 100 ms in production, accounting for roughly a third of the
total 300 ms token request trace.

Add an `UPPER(email)` index on the user table so these lookups can
use the index instead of scanning, cutting the dominant cost on
the token issuance path.

.codespellrc

@@ -0,0 +1,9 @@
+[codespell]
+# Files that are not English, or generated
+skip = ./.git,*.pdf,*.po,*.pot,*.json,*.lock,package-lock.json,
+  ./LICENSES,
+  ./src/summary/summary/core/locales,
+  ./src/summary/summary/core/prompt.py
+# Valid words in French (connexion) or in the code (statics)
+ignore-words-list = connexion,statics
+check-filenames = true

.github/.trivyignore

@@ -0,0 +1,20 @@
+# Debian 13 base image (python:3.14-slim): no fixed version available yet.
+# Review regularly and remove entries once Debian ships a fix.
+
+# util-linux
+CVE-2026-76642
+CVE-2026-78408
+CVE-2026-78409
+CVE-2026-78410
+
+# acl
+CVE-2026-54369
+
+# ncurses
+CVE-2025-69720
+
+# systemd
+CVE-2026-16742
+
+# perl-base (fix deferred by Debian)
+CVE-2026-9538

.github/workflows/changelog.yml

@@ -0,0 +1,19 @@
+name: Changelog Workflow
+
+on:
+  push:
+    branches:
+      - main
+  pull_request:
+    types: [opened, synchronize, reopened, labeled, unlabeled]
+
+permissions:
+  contents: read
+
+concurrency:
+  group: ${{ github.workflow }}-${{ github.ref }}-${{ github.event.pull_request.number || github.sha }}
+  cancel-in-progress: true
+
+jobs:
+  changelog:
+    uses: suitenumerique/ci/.github/workflows/_changelog.yml@ca6401ac83e981e5b0a94f06f68baaa6e6d0a436 # v0.0.1

.github/workflows/ci.yml

@@ -11,180 +11,30 @@ permissions:
   contents: read
 
 jobs:
-  lint-git:
-    runs-on: ubuntu-latest
-    if: github.event_name == 'pull_request' # Makes sense only for pull requests
-    permissions:
-      contents: read
-    steps:
-      - name: Checkout repository
-        uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6.1.0
-        with:
-          fetch-depth: 0
-      - name: show
-        run: git log
-      - name: Enforce absence of print statements in code
-        if: always()
-        run: |
-          ! git diff origin/${{ github.event.pull_request.base.ref }}..HEAD -- . ':(exclude).github/workflows/**' | grep "print("
-      - name: Check absence of fixup commits
-        if: always()
-        run: |
-          ! git log | grep 'fixup!'
-      - name: Install uv
-        if: always()
-        uses: astral-sh/setup-uv@37802adc94f370d6bfd71619e3f0bf239e1f3b78 # v7.6.0
-      - name: Lint commit messages added to main
-        if: always()
-        run: uvx --no-build --from gitlint-core==0.19.1 gitlint --commits origin/${{ github.event.pull_request.base.ref }}..HEAD
 
-  check-changelog:
-    runs-on: ubuntu-latest
-    if: |
-      contains(github.event.pull_request.labels.*.name, 'noChangeLog') == false &&
-      github.event_name == 'pull_request'
-    permissions:
-        contents: read
-    steps:
-      - name: Checkout repository
-        uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6.1.0
-        with:
-          fetch-depth: 50
-      - name: Check that the CHANGELOG has been modified in the current branch
-        run: git diff --name-only ${{ github.event.pull_request.base.sha }} ${{ github.event.after }} | grep 'CHANGELOG.md'
-
-  lint-changelog:
-    runs-on: ubuntu-latest
-    permissions:
-      contents: read
-    steps:
-      - name: Checkout repository
-        uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6.1.0
-      - name: Check CHANGELOG max line length
-        run: |
-          max_line_length=$(cat CHANGELOG.md | grep -Ev "^\[.*\]: https://github.com" | wc -L)
-          if [ $max_line_length -ge 80 ]; then
-            echo "ERROR: CHANGELOG has lines longer than 80 characters."
-            exit 1
-          fi
-
-  build-mails:
-    runs-on: ubuntu-latest
-    permissions:
-      contents: read
-    defaults:
-      run:
-        working-directory: src/mail
-    steps:
-      - name: Checkout repository
-        uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6.1.0
-
-      - name: Install Node.js
-        uses: actions/setup-node@249970729cb0ef3589644e2896645e5dc5ba9c38 # v6.5.0
-        with:
-          node-version: "22"
-
-      - name: Restore the mail templates
-        uses: actions/cache@caa296126883cff596d87d8935842f9db880ef25 # v5.1.0
-        id: mail-templates
-        with:
-          path: "src/backend/core/templates/mail"
-          key: mail-templates-${{ hashFiles('src/mail/mjml') }}
-
-      - name: Install yarn
-        if: steps.mail-templates.outputs.cache-hit != 'true'
-        run: npm install -g --ignore-scripts yarn@1.22.22
-
-      - name: Install node dependencies
-        if: steps.mail-templates.outputs.cache-hit != 'true'
-        run: yarn install --frozen-lockfile --ignore-scripts
-
-      - name: Build mails
-        if: steps.mail-templates.outputs.cache-hit != 'true'
-        run: yarn build
-
-      - name: Cache mail templates
-        if: steps.mail-templates.outputs.cache-hit != 'true'
-        uses: actions/cache@caa296126883cff596d87d8935842f9db880ef25 # v5.1.0
-        with:
-          path: "src/backend/core/templates/mail"
-          key: mail-templates-${{ hashFiles('src/mail/mjml') }}
-
-  lint-back:
-    runs-on: ubuntu-latest
-    permissions:
-      contents: read
-    defaults:
-      run:
-        working-directory: src/backend
-    steps:
-      - name: Checkout repository
-        uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6.1.0
-      - name: Install Python
-        uses: actions/setup-python@ece7cb06caefa5fff74198d8649806c4678c61a1 # v6.3.0
-        with:
-          python-version: "3.13"
-      - name: Install uv
-        uses: astral-sh/setup-uv@37802adc94f370d6bfd71619e3f0bf239e1f3b78 # v7.6.0
-      - name: Install the project
-        run: uv sync --locked --all-extras
-
-      - name: Check code formatting with ruff
-        run: uv run --no-sync --no-build ruff format . --diff
-      - name: Lint code with ruff
-        run: uv run --no-sync --no-build ruff check .
-      - name: Lint code with pylint
-        run: uv run --no-sync --no-build pylint meet demo core
-
-  lint-agents:
-    runs-on: ubuntu-latest
-    permissions:
-      contents: read
-    defaults:
-      run:
-        working-directory: src/agents
-    steps:
-      - name: Checkout repository
-        uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6.1.0
-      - name: Install Python
-        uses: actions/setup-python@ece7cb06caefa5fff74198d8649806c4678c61a1 # v6.3.0
-        with:
-          python-version: "3.13"
-      - name: Install uv
-        uses: astral-sh/setup-uv@37802adc94f370d6bfd71619e3f0bf239e1f3b78 # v7.6.0
-      - name: Install the project
-        run: uv sync --locked --all-extras --no-build
-      - name: Check code formatting with ruff
-        run: uv run --no-sync --no-build ruff format . --diff
-      - name: Lint code with ruff
-        run: uv run --no-sync --no-build ruff check .
-
-  lint-summary:
-    runs-on: ubuntu-latest
-    permissions:
-      contents: read
-    defaults:
-      run:
-        working-directory: src/summary
-    steps:
-      - name: Checkout repository
-        uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6.1.0
-      - name: Install Python
-        uses: actions/setup-python@ece7cb06caefa5fff74198d8649806c4678c61a1 # v6.3.0
-        with:
-          python-version: "3.13"
-      - name: Install uv
-        uses: astral-sh/setup-uv@37802adc94f370d6bfd71619e3f0bf239e1f3b78 # v7.6.0
-      - name: Install the project
-        run: uv sync --locked --all-extras
-      - name: Check code formatting with ruff
-        run: uv run --no-sync --no-build ruff format . --diff
-      - name: Lint code with ruff
-        run: uv run --no-sync --no-build ruff check .
+  lint-python:
+    name: lint ${{ matrix.service }}
+    strategy:
+      fail-fast: false
+      matrix:
+        include:
+          - service: backend
+            working_directory: src/backend
+            pylint_targets: meet demo core
+          - service: agents
+            working_directory: src/agents
+            pylint_targets: ""
+          - service: summary
+            working_directory: src/summary
+            pylint_targets: ""
+    uses: suitenumerique/ci/.github/workflows/_python-lint.yml@ca6401ac83e981e5b0a94f06f68baaa6e6d0a436 # v0.0.1
+    with:
+      working_directory: ${{ matrix.working_directory }}
+      python_version: "3.13"
+      pylint_targets: ${{ matrix.pylint_targets }}
 
   test-back:
     runs-on: ubuntu-latest
-    needs: build-mails
     permissions:
       contents: read
     defaults:
@@ -238,18 +88,16 @@ jobs:
     steps:
       - name: Checkout repository
         uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6.1.0
+        with:
+          persist-credentials: false
 
       - name: Create writable /data
         run: |
           sudo mkdir -p /data/media && \
           sudo mkdir -p /data/static
 
-      - name: Restore the mail templates
-        uses: actions/cache@caa296126883cff596d87d8935842f9db880ef25 # v5.1.0
-        id: mail-templates
-        with:
-          path: "src/backend/core/templates/mail"
-          key: mail-templates-${{ hashFiles('src/mail/mjml') }}
+      - name: Build or restore the mail templates
+        uses: suitenumerique/ci/actions/mail-templates@ca6401ac83e981e5b0a94f06f68baaa6e6d0a436 # v0.0.1
 
       # Creates the access key and the bucket on startup
       - name: Start Garage
@@ -313,6 +161,8 @@ jobs:
     steps:
       - name: Checkout repository
         uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6.1.0
+        with:
+          persist-credentials: false
 
       - name: Install ffmpeg
         run: |
@@ -340,6 +190,8 @@ jobs:
     steps:
       - name: Checkout repository
         uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6.1.0
+        with:
+          persist-credentials: false
 
       - name: Install dependencies
         run: cd src/frontend/ && npm ci --ignore-scripts
@@ -350,6 +202,27 @@ jobs:
       - name: Check format
         run: cd src/frontend/ && npm run check
 
+  test-front:
+    runs-on: ubuntu-latest
+    permissions:
+      contents: read
+    steps:
+      - name: Checkout repository
+        uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6.1.0
+        with:
+          persist-credentials: false
+
+      - name: Install Node.js
+        uses: actions/setup-node@249970729cb0ef3589644e2896645e5dc5ba9c38 # v6.5.0
+        with:
+          node-version: "24"
+
+      - name: Install dependencies
+        run: cd src/frontend/ && npm ci --ignore-scripts
+
+      - name: Run tests
+        run: cd src/frontend/ && npm test
+
   lint-sdk:
     runs-on: ubuntu-latest
     permissions:
@@ -360,6 +233,8 @@ jobs:
     steps:
       - name: Checkout repository
         uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6.1.0
+        with:
+          persist-credentials: false
 
       - name: Install dependencies
         run: npm ci --ignore-scripts
@@ -381,6 +256,8 @@ jobs:
     steps:
       - name: Checkout repository
         uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6.1.0
+        with:
+          persist-credentials: false
 
       - name: Install dependencies
         run: npm ci --ignore-scripts

.github/workflows/code-quality.yml

@@ -0,0 +1,14 @@
+name: Project quality Workflow
+
+on:
+  pull_request:
+
+permissions:
+  contents: read
+
+jobs:
+  quality:
+    uses: suitenumerique/ci/.github/workflows/_project-quality.yml@ca6401ac83e981e5b0a94f06f68baaa6e6d0a436 # v0.0.1
+    with:
+      print_check_paths: src/backend src/summary src/agents
+      codespell_ignore_words: "unsecure"

.github/workflows/crowdin-download.yml

@@ -1,33 +0,0 @@
-name: Download Crowdin translations
-
-on:
-  workflow_dispatch:
-    types: [file-fully-translated]
-
-permissions:
-  contents: write
-  pull-requests: write
-
-jobs:
-  crowdin:
-    runs-on: ubuntu-latest
-    steps:
-      - name: Checkout
-        uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6.1.0
-
-      - name: Download Crowdin files
-        uses: crowdin/github-action@c7af9bc98b01694653031fef2a0dc6c7888ce9bc # v2.17.0
-        with:
-          upload_sources: false
-          upload_translations: false
-          download_translations: true
-          localization_branch_name: l10n_crowdin_translations
-          create_pull_request: true
-          pull_request_title: "New Crowdin translations"
-          pull_request_body: "New Crowdin pull request with translations"
-          pull_request_base_branch_name: "main"
-        env:
-          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
-          CROWDIN_PROJECT_ID: ${{ secrets.CROWDIN_PROJECT_ID }}
-          CROWDIN_PERSONAL_TOKEN: ${{ secrets.CROWDIN_PERSONAL_TOKEN }}
-          CROWDIN_BASE_PATH: ${{ github.workspace }}

.github/workflows/docker-hub.yml

@@ -1,5 +1,5 @@
-name: Docker Hub Workflow
-run-name: Docker Hub Workflow
+name: Docker images
+run-name: Docker images
 
 on:
   workflow_dispatch:
@@ -15,265 +15,62 @@ on:
 permissions:
   contents: read
 
-env:
-  DOCKER_USER: 1001:127
-  DOCKER_CONTAINER_REGISTRY_HOSTNAME: docker.io
-  DOCKER_CONTAINER_REGISTRY_NAMESPACE: lasuite
-  IS_MULTI_PLATFORM_BUILD: ${{ startsWith(github.ref, 'refs/tags/v') }}
-  BUILD_PLATFORMS: ${{ startsWith(github.ref, 'refs/tags/v') && 'linux/amd64,linux/arm64' || 'linux/amd64' }}
-
 jobs:
-  build-and-push-backend:
-    runs-on: ubuntu-latest
-    permissions:
-      contents: read
-    steps:
-      -
-        name: Checkout repository
-        uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6.1.0
-      -
-        name: Set up QEMU
-        if: env.IS_MULTI_PLATFORM_BUILD == 'true'
-        uses: docker/setup-qemu-action@c7c53464625b32c7a7e944ae62b3e17d2b600130 # v3.7.0
-      -
-        name: Set up Docker Buildx
-        uses: docker/setup-buildx-action@8d2750c68a42422c14e847fe6c8ac0403b4cbd6f # v3.12.0
-      -
-        name: Docker meta
-        id: meta
-        uses: docker/metadata-action@c299e40c65443455700f0fdfc63efafe5b349051 # v5.10.0
-        with:
-          images: '${{ env.DOCKER_CONTAINER_REGISTRY_NAMESPACE }}/meet-backend'
-      -
-        name: Login to DockerHub
-        if: github.event_name != 'pull_request' || startsWith(github.head_ref, 'integration/')
-        uses: docker/login-action@c94ce9fb468520275223c153574b00df6fe4bcc9 # v3.7.0
-        with:
-          username: ${{ secrets.DOCKER_HUB_USER }}
-          password: ${{ secrets.DOCKER_HUB_PASSWORD }}
-      -
-        name: Run trivy scan
-        uses: numerique-gouv/action-trivy-cache@d6e94cfb488f03a0b3e8b8739aad94e74d24d8da # main
-        with:
-          docker-build-args: '--target backend-production -f Dockerfile'
-          docker-image-name: '${{ env.DOCKER_CONTAINER_REGISTRY_HOSTNAME }}/${{ env.DOCKER_CONTAINER_REGISTRY_NAMESPACE }}/meet-backend:${{ github.sha }}'
-      -
-        name: Build and push
-        uses: docker/build-push-action@10e90e3645eae34f1e60eeb005ba3a3d33f178e8 # v6.19.2
-        with:
-          context: .
-          target: backend-production
-          platforms: ${{ env.BUILD_PLATFORMS }}
-          build-args: DOCKER_USER=${{ env.DOCKER_USER }}:-1000
-          push: ${{ github.event_name != 'pull_request' || startsWith(github.head_ref, 'integration/') }}
-          tags: ${{ steps.meta.outputs.tags }}
-          labels: ${{ steps.meta.outputs.labels }}
-
-  build-and-push-frontend-generic:
-    runs-on: ubuntu-latest
-    permissions:
-      contents: read
-    steps:
-      -
-        name: Checkout repository
-        uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6.1.0
-      -
-        name: Set up QEMU
-        if: env.IS_MULTI_PLATFORM_BUILD == 'true'
-        uses: docker/setup-qemu-action@c7c53464625b32c7a7e944ae62b3e17d2b600130 # v3.7.0
-      -
-        name: Set up Docker Buildx
-        uses: docker/setup-buildx-action@8d2750c68a42422c14e847fe6c8ac0403b4cbd6f # v3.12.0
-      -
-        name: Docker meta
-        id: meta
-        uses: docker/metadata-action@c299e40c65443455700f0fdfc63efafe5b349051 # v5.10.0
-        with:
-          images: '${{ env.DOCKER_CONTAINER_REGISTRY_NAMESPACE }}/meet-frontend'
-      -
-        name: Login to DockerHub
-        if: github.event_name != 'pull_request' || startsWith(github.head_ref, 'integration/')
-        uses: docker/login-action@c94ce9fb468520275223c153574b00df6fe4bcc9 # v3.7.0
-        with:
-          username: ${{ secrets.DOCKER_HUB_USER }}
-          password: ${{ secrets.DOCKER_HUB_PASSWORD }}
-      -
-        name: Run trivy scan
-        uses: numerique-gouv/action-trivy-cache@d6e94cfb488f03a0b3e8b8739aad94e74d24d8da # main
-        with:
-          docker-build-args: '-f src/frontend/Dockerfile --target frontend-production'
-          docker-image-name: '${{ env.DOCKER_CONTAINER_REGISTRY_HOSTNAME }}/${{ env.DOCKER_CONTAINER_REGISTRY_NAMESPACE }}/meet-frontend:${{ github.sha }}'
-      -
-        name: Build and push
-        uses: docker/build-push-action@10e90e3645eae34f1e60eeb005ba3a3d33f178e8 # v6.19.2
-        with:
-          context: .
-          file: ./src/frontend/Dockerfile
-          target: frontend-production
-          platforms: ${{ env.BUILD_PLATFORMS }}
-          build-args: DOCKER_USER=${{ env.DOCKER_USER }}:-1000
-          push: ${{ github.event_name != 'pull_request' || startsWith(github.head_ref, 'integration/') }}
-          tags: ${{ steps.meta.outputs.tags }}
-          labels: ${{ steps.meta.outputs.labels }}
-
-  build-and-push-frontend-dinum:
-    runs-on: ubuntu-latest
-    permissions:
-      contents: read
-    steps:
-      -
-        name: Checkout repository
-        uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6.1.0
-      -
-        name: Set up QEMU
-        if: env.IS_MULTI_PLATFORM_BUILD == 'true'
-        uses: docker/setup-qemu-action@c7c53464625b32c7a7e944ae62b3e17d2b600130 # v3.7.0
-      -
-        name: Set up Docker Buildx
-        uses: docker/setup-buildx-action@8d2750c68a42422c14e847fe6c8ac0403b4cbd6f # v3.12.0
-      -
-        name: Docker meta
-        id: meta
-        uses: docker/metadata-action@c299e40c65443455700f0fdfc63efafe5b349051 # v5.10.0
-        with:
-          images: '${{ env.DOCKER_CONTAINER_REGISTRY_NAMESPACE }}/meet-frontend-dinum'
-      -
-        name: Login to DockerHub
-        if: github.event_name != 'pull_request' || startsWith(github.head_ref, 'integration/')
-        uses: docker/login-action@c94ce9fb468520275223c153574b00df6fe4bcc9 # v3.7.0
-        with:
-          username: ${{ secrets.DOCKER_HUB_USER }}
-          password: ${{ secrets.DOCKER_HUB_PASSWORD }}
-      -
-        name: Run trivy scan
-        uses: numerique-gouv/action-trivy-cache@d6e94cfb488f03a0b3e8b8739aad94e74d24d8da # main
-        with:
-          docker-build-args: '-f docker/dinum-frontend/Dockerfile --target frontend-production'
-          docker-image-name: '${{ env.DOCKER_CONTAINER_REGISTRY_HOSTNAME }}/${{ env.DOCKER_CONTAINER_REGISTRY_NAMESPACE }}/meet-frontend-dinum:${{ github.sha }}'
-      -
-        name: Build and push
-        uses: docker/build-push-action@10e90e3645eae34f1e60eeb005ba3a3d33f178e8 # v6.19.2
-        with:
-          context: .
-          file: ./docker/dinum-frontend/Dockerfile
-          target: frontend-production
-          platforms: ${{ env.BUILD_PLATFORMS }}
-          build-args: DOCKER_USER=${{ env.DOCKER_USER }}:-1000
-          push: ${{ github.event_name != 'pull_request' || startsWith(github.head_ref, 'integration/') }}
-          tags: ${{ steps.meta.outputs.tags }}
-          labels: ${{ steps.meta.outputs.labels }}
-
-  build-and-push-summary:
-    runs-on: ubuntu-latest
-    permissions:
-      contents: read
-    steps:
-      -
-        name: Checkout repository
-        uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6.1.0
-      -
-        name: Set up QEMU
-        if: env.IS_MULTI_PLATFORM_BUILD == 'true'
-        uses: docker/setup-qemu-action@c7c53464625b32c7a7e944ae62b3e17d2b600130 # v3.7.0
-      -
-        name: Set up Docker Buildx
-        uses: docker/setup-buildx-action@8d2750c68a42422c14e847fe6c8ac0403b4cbd6f # v3.12.0
-      -
-        name: Docker meta
-        id: meta
-        uses: docker/metadata-action@c299e40c65443455700f0fdfc63efafe5b349051 # v5.10.0
-        with:
-          images: '${{ env.DOCKER_CONTAINER_REGISTRY_NAMESPACE }}/meet-summary'
-      -
-        name: Login to DockerHub
-        if: github.event_name != 'pull_request' || startsWith(github.head_ref, 'integration/')
-        uses: docker/login-action@c94ce9fb468520275223c153574b00df6fe4bcc9 # v3.7.0
-        with:
-          username: ${{ secrets.DOCKER_HUB_USER }}
-          password: ${{ secrets.DOCKER_HUB_PASSWORD }}
-      -
-        name: Run trivy scan
-        uses: numerique-gouv/action-trivy-cache@d6e94cfb488f03a0b3e8b8739aad94e74d24d8da # main
-        continue-on-error: true
-        with:
-          docker-build-args: '-f src/summary/Dockerfile --target production'
-          docker-image-name: '${{ env.DOCKER_CONTAINER_REGISTRY_HOSTNAME }}/${{ env.DOCKER_CONTAINER_REGISTRY_NAMESPACE }}/meet-summary:${{ github.sha }}'
-          docker-context: './src/summary'
-      -
-        name: Build and push
-        uses: docker/build-push-action@10e90e3645eae34f1e60eeb005ba3a3d33f178e8 # v6.19.2
-        with:
-          context: ./src/summary
-          file: ./src/summary/Dockerfile
-          target: production
-          platforms: ${{ env.BUILD_PLATFORMS }}
-          build-args: DOCKER_USER=${{ env.DOCKER_USER }}:-1000
-          push: ${{ github.event_name != 'pull_request' || startsWith(github.head_ref, 'integration/') }}
-          tags: ${{ steps.meta.outputs.tags }}
-          labels: ${{ steps.meta.outputs.labels }}
-
-  build-and-push-agents:
-    runs-on: ubuntu-latest
-    permissions:
-      contents: read
-    steps:
-      -
-        name: Checkout repository
-        uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6.1.0
-      -
-        name: Set up QEMU
-        if: env.IS_MULTI_PLATFORM_BUILD == 'true'
-        uses: docker/setup-qemu-action@c7c53464625b32c7a7e944ae62b3e17d2b600130 # v3.7.0
-      -
-        name: Set up Docker Buildx
-        uses: docker/setup-buildx-action@8d2750c68a42422c14e847fe6c8ac0403b4cbd6f # v3.12.0
-      -
-        name: Docker meta
-        id: meta
-        uses: docker/metadata-action@c299e40c65443455700f0fdfc63efafe5b349051 # v5.10.0
-        with:
-          images: lasuite/meet-agents
-      -
-        name: Login to DockerHub
-        if: github.event_name != 'pull_request' || startsWith(github.head_ref, 'integration/')
-        uses: docker/login-action@c94ce9fb468520275223c153574b00df6fe4bcc9 # v3.7.0
-        with:
-          username: ${{ secrets.DOCKER_HUB_USER }}
-          password: ${{ secrets.DOCKER_HUB_PASSWORD }}
-      -
-        name: Run trivy scan
-        uses: numerique-gouv/action-trivy-cache@d6e94cfb488f03a0b3e8b8739aad94e74d24d8da # main
-        continue-on-error: true
-        with:
-          docker-build-args: '-f src/agents/Dockerfile --target production'
-          docker-image-name: '${{ env.DOCKER_CONTAINER_REGISTRY_HOSTNAME }}/${{ env.DOCKER_CONTAINER_REGISTRY_NAMESPACE }}/meet-agents:${{ github.sha }}'
-          docker-context: './src/agents'
-      -
-        name: Build and push
-        uses: docker/build-push-action@10e90e3645eae34f1e60eeb005ba3a3d33f178e8 # v6.19.2
-        with:
-          context: ./src/agents
-          file: ./src/agents/Dockerfile
-          target: production
-          platforms: ${{ env.BUILD_PLATFORMS }}
-          build-args: DOCKER_USER=${{ env.DOCKER_USER }}:-1000
-          push: ${{ github.event_name != 'pull_request' || startsWith(github.head_ref, 'integration/') }}
-          tags: ${{ steps.meta.outputs.tags }}
-          labels: ${{ steps.meta.outputs.labels }}
+  build-and-push:
+    name: ${{ matrix.service }}
+    strategy:
+      fail-fast: false
+      matrix:
+        include:
+          - service: backend
+            image_name: lasuite/meet-backend
+            context: .
+            file: ./Dockerfile
+            target: backend-production
+          - service: frontend
+            image_name: lasuite/meet-frontend
+            context: .
+            file: ./src/frontend/Dockerfile
+            target: frontend-production
+          - service: frontend-dinum
+            image_name: lasuite/meet-frontend-dinum
+            context: .
+            file: ./docker/dinum-frontend/Dockerfile
+            target: frontend-production
+          - service: summary
+            image_name: lasuite/meet-summary
+            context: ./src/summary
+            file: ./src/summary/Dockerfile
+            target: production
+          - service: agents
+            image_name: lasuite/meet-agents
+            context: ./src/agents
+            file: ./src/agents/Dockerfile
+            target: production
+    uses: suitenumerique/ci/.github/workflows/_docker-publish.yml@ca6401ac83e981e5b0a94f06f68baaa6e6d0a436 # v0.0.1
+    with:
+      image_name: ${{ matrix.image_name }}
+      context: ${{ matrix.context }}
+      file: ${{ matrix.file }}
+      target: ${{ matrix.target }}
+      docker_user: "1001:127"
+      is_multi_platform: ${{ startsWith(github.ref, 'refs/tags/v') }}
+      should_push: ${{ github.event_name != 'pull_request' || startsWith(github.head_ref, 'integration/') }}
+      trivy_scan: true
+      trivy_ignore_files: ./.github/.trivyignore
+    secrets:
+      DOCKER_HUB_USER: ${{ secrets.DOCKER_HUB_USER }}
+      DOCKER_HUB_PASSWORD: ${{ secrets.DOCKER_HUB_PASSWORD }}
 
   notify-argocd:
     permissions:
       contents: read
     needs:
-      - build-and-push-frontend-generic
-      - build-and-push-frontend-dinum
-      - build-and-push-backend
-      - build-and-push-summary
-      - build-and-push-agents
+      - build-and-push
     runs-on: ubuntu-latest
     if: github.event_name != 'pull_request'
     steps:
-      - uses: numerique-gouv/action-argocd-webhook-notification@cac2ee67896eb13e84e804f60c4271370424eaa8 # main
+      - uses: suitenumerique/ci/actions/argocd-webhook-notification@ca6401ac83e981e5b0a94f06f68baaa6e6d0a436 # v0.0.1
         id: notify
         with:
           deployment_repo_path: "${{ secrets.DEPLOYMENT_REPO_URL }}"

.github/workflows/release-helm-chart.yaml

@@ -1,33 +1,17 @@
-name: Release Chart
-run-name: Release Chart
+name: Release Helm chart
 
 on:
   push:
+    branches:
+      - main
     paths:
       - src/helm/meet/**
 
+permissions:
+  contents: read
+
 jobs:
   release:
     permissions:
       contents: write
-    runs-on: ubuntu-latest
-    steps:
-      - name: Checkout
-        uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6.1.0
-        with:
-          fetch-depth: 0
-
-      - name: Cleanup
-        run: rm -rf ./src/helm/extra
-
-      - name: Install Helm
-        uses: azure/setup-helm@1a275c3b69536ee54be43f2070a358922e12c8d4 # v4.3.1
-        env:
-          GITHUB_TOKEN: "${{ secrets.GITHUB_TOKEN }}"
-
-      - name: Publish Helm charts
-        uses: numerique-gouv/helm-gh-pages@2cf477ae49d7c70037ceb1685803f4f7bad9b981 # add-overwrite-option
-        with:
-          charts_dir: ./src/helm
-          linting: on
-          token: ${{ secrets.GITHUB_TOKEN }}
+    uses: suitenumerique/ci/.github/workflows/_release-helm-chart.yml@ca6401ac83e981e5b0a94f06f68baaa6e6d0a436 # v0.0.1

.github/workflows/security.yml

@@ -0,0 +1,21 @@
+name: Security analysis
+
+on:
+  push:
+    branches:
+      - main
+  pull_request:
+    branches:
+      - "**"
+
+permissions: {}
+
+jobs:
+  zizmor:
+    permissions:
+      contents: read
+      actions: read
+      security-events: write
+    uses: suitenumerique/ci/.github/workflows/_zizmor.yml@ca6401ac83e981e5b0a94f06f68baaa6e6d0a436 # v0.0.1
+    with:
+      config: .github/zizmor.yml

.github/zizmor.yml

@@ -0,0 +1,5 @@
+rules:
+  unpinned-uses:
+    config:
+      policies:
+        "suitenumerique/*": ref-pin

CHANGELOG.md

@@ -10,6 +10,52 @@ and this project adheres to
 
 ### Added
 
+- ⚡️(backend) add UPPER(email) index for case-insensitive user lookups
+
+### Changed
+
+- ⚡️(backend) hash application secrets with SHA-256
+
+### Fixed
+
+- 🔒️(backend) prevent editing client id and secret in Django admin
+
+## [1.34.0] - 2026-10-07
+
+### Added
+
+- ✨(helm) import environment variables from Secrets and ConfigMaps
+- 🔒(backend) throttle meeting link generation
+- 🔒️(backend) add a daily cap on room creation
+- 🔧(summary) add setting to control Sentry traces sampling rate
+- ✨(frontend) let signed-out visitors start a meeting
+- ✨(backend) expose `allow_unregistered_rooms` in the frontend configuration
+- ✅(frontend) add vitest so the frontend can carry unit tests
+- ♿️(frontend) make participant pagination readable and keyboard reachable #1775
+
+### Changed
+
+- ✨(frontend) warn users when the connection falls back to TURN
+- 🔧(backend) configure the technical documentation url
+
+### Fixed
+
+- 🐛(frontend) enforce recording-mode permissions on the checkboxes
+- 🔒️(agents) fix util-linux CVEs reported by Cyberwatch
+- 🔒️(backend) fix HIGH CVEs in Django and urllib3
+- 🔒️(agents) upgrade libpcre2-8-0 to fix CVE-2026-103111
+- 🔒️(frontend) upgrade pcre2 to fix CVE-2026-103111
+- 🐛(summary) disable default S3 checksums for GCS-compatible storage
+- 🔒️(summary) redact meeting content from Sentry events
+- 🐛(frontend) hide tooltips until they have a computed placement
+- 🐛(brevo) use django-lasuite for marketing management
+- ♿️(frontend) expose loading state to assistive technology
+- 🐛(frontend) honour Keep hand raised when picture-in-picture is open
+
+## [1.33.0] - 2026-09-30
+
+### Added
+
 - ✨(backend) purge rooms inactive for a configurable period
 - 🔨(makefile) add targets to list and download files stored in Garage
 
@@ -394,7 +440,7 @@ and this project adheres to
 
 ### Fixed
 
-- ♿️(frontend) improve accessibilty of the Effects panel #1401
+- ♿️(frontend) improve accessibility of the Effects panel #1401
 
 ## [1.20.0] - 2026-06-12
 

Dockerfile

@@ -37,14 +37,13 @@ RUN --mount=type=cache,target=/root/.cache/uv \
   uv sync --locked --no-dev
 
 # ---- mails ----
-FROM node:22 AS mail-builder
+FROM node:22-alpine AS mail-builder
 
 COPY ./src/mail /mail/app
 
 WORKDIR /mail/app
 
-RUN yarn install --frozen-lockfile && \
-  yarn build
+RUN npm ci --ignore-scripts && npm run build
 
 
 # ---- static link collector ----

Makefile

@@ -169,7 +169,7 @@ run-summary: ## start only the summary application and all needed services
 	@$(COMPOSE) up --force-recreate -d celery-summary-summarize
 .PHONY: run-summary
 
-run-agents: ## start the multi-user-transcriber agent
+run-agents: ## start the LiveKit agents (opt-in, see docs/developping_locally.md)
 	@$(MAKE) run-agent-multi-user-transcriber
 	@$(MAKE) run-agent-metadata-collector
 .PHONY: run-agents
@@ -186,7 +186,6 @@ run:
 run: ## start the wsgi (production) and development server
 	@$(MAKE) run-backend
 	@$(MAKE) run-summary
-	@$(MAKE) run-agents
 	@$(COMPOSE) up --force-recreate -d frontend
 .PHONY: run
 
@@ -260,7 +259,8 @@ lint-pylint: ## lint back-end python sources with pylint only on changed files f
 test: ## run project tests; pass extra pytest args via ARGS, e.g. `make test ARGS="-vv"`
 	@args="$(ARGS) $(filter-out $@,$(MAKECMDGOALS))" && \
 	$(MAKE) test-back-parallel ARGS="$${args}" && \
-	$(MAKE) test-summary ARGS="$${args}"
+	$(MAKE) test-summary ARGS="$${args}" && \
+	$(MAKE) test-frontend
 .PHONY: test
 
 test-back: ## run back-end tests (pass extra pytest args via ARGS)
@@ -278,6 +278,10 @@ test-summary: ## run summary tests (pass extra pytest args via ARGS)
 	bin/pytest-summary $${args}
 .PHONY: test-summary
 
+test-frontend: ## run the frontend unit tests
+	cd $(PATH_FRONT) && npm test
+.PHONY: test-frontend
+
 makemigrations:  ## run django makemigrations for the Meet project.
 	@echo "$(BOLD)Running makemigrations$(RESET)"
 	@$(COMPOSE) up -d postgresql

README.md

@@ -11,7 +11,7 @@
   <img alt="GitHub commit activity" src="https://img.shields.io/github/commit-activity/m/suitenumerique/meet"/>
   <img alt="GitHub closed issues" src="https://img.shields.io/github/issues-closed/suitenumerique/meet"/>
   <a href="https://github.com/suitenumerique/meet/blob/main/LICENSE">
-    <img alt="GitHub closed issues" src="https://img.shields.io/github/license/suitenumerique/meet"/>
+    <img alt="GitHub license" src="https://img.shields.io/github/license/suitenumerique/meet"/>
   </a>
   <a href="https://digitalpublicgoods.net/r/la-suite-meet-simple-video-conferencing">
     <img src="https://img.shields.io/badge/Verified-DPG-3333AB?logo=data:image/svg%2bxml;base64,PHN2ZyB3aWR0aD0iMzEiIGhlaWdodD0iMzMiIHZpZXdCb3g9IjAgMCAzMSAzMyIgZmlsbD0ibm9uZSIgeG1sbnM9Imh0dHA6Ly93d3cudzMub3JnLzIwMDAvc3ZnIj4KPHBhdGggZD0iTTE0LjIwMDggMjEuMzY3OEwxMC4xNzM2IDE4LjAxMjRMMTEuNTIxOSAxNi40MDAzTDEzLjk5MjggMTguNDU5TDE5LjYyNjkgMTIuMjExMUwyMS4xOTA5IDEzLjYxNkwxNC4yMDA4IDIxLjM2NzhaTTI0LjYyNDEgOS4zNTEyN0wyNC44MDcxIDMuMDcyOTdMMTguODgxIDUuMTg2NjJMMTUuMzMxNCAtMi4zMzA4MmUtMDVMMTEuNzgyMSA1LjE4NjYyTDUuODU2MDEgMy4wNzI5N0w2LjAzOTA2IDkuMzUxMjdMMCAxMS4xMTc3TDMuODQ1MjEgMTYuMDg5NUwwIDIxLjA2MTJMNi4wMzkwNiAyMi44Mjc3TDUuODU2MDEgMjkuMTA2TDExLjc4MjEgMjYuOTkyM0wxNS4zMzE0IDMyLjE3OUwxOC44ODEgMjYuOTkyM0wyNC44MDcxIDI5LjEwNkwyNC42MjQxIDIyLjgyNzdMMzAuNjYzMSAyMS4wNjEyTDI2LjgxNzYgMTYuMDg5NUwzMC42NjMxIDExLjExNzdMMjQuNjI0MSA5LjM1MTI3WiIgZmlsbD0id2hpdGUiLz4KPC9zdmc+Cg==" alt="DPG Badge"/>
@@ -49,8 +49,8 @@ Powered by [LiveKit](https://livekit.io/), La Suite Meet offers Zoom-level perfo
 - Telephony integration
 - Secure participation with robust authentication and access control
 - Customizable frontend style
-- LiveKit Advances features including :
-  - speaker detection 
+- LiveKit advanced features including:
+  - speaker detection
   - simulcast 
   - end-to-end optimizations 
   - selective subscription

UPGRADE.md

@@ -16,43 +16,54 @@ the following command inside your docker container:
 
 ## [Unreleased]
 
-### Purging inactive rooms
+### Marketing / Brevo integration now uses `django-lasuite`
 
-Rooms now keep track of the last time they were started (`last_started_at`), fed by LiveKit's `room_started` webhook. A new `purge_inactive_rooms` management command permanently deletes the rooms that have not been started for `ROOM_INACTIVITY_DELETION_DAYS` days. See [the room purge documentation](docs/features/room-purge.md).
+The in-house marketing service (`core.services.marketing`) has been removed and
+replaced by the shared implementation from `django-lasuite`
+(`lasuite.marketing`). This fixes a bug where updating a user's contact on
+Brevo overwrote their list memberships, removing lists set by other
+La Suite products. Existing lists are now preserved and merged.
 
-- The feature is **disabled by default**: nothing is deleted unless you set `ROOM_INACTIVITY_DELETION_DAYS`.
-- The migration marks every existing room as started at the time of the upgrade, so no existing room can be purged before a full inactivity period has elapsed after upgrading.
-- Rooms holding a saved recording their users may still access are kept: any saved recording, or, when `RECORDING_EXPIRATION_DAYS` is set, a saved recording created within that window.
-- Inactivity is measured from LiveKit's `room_started` webhook: if it is not delivered to your backend, rooms in daily use look inactive and get purged.
-- When a room is purged, all it's configuration and access rights are also deleted. Its slug becomes available again and can be reused when a meeting is created from that same URL.
+**Celery worker required.** Newsletter signup on login
+(`SIGNUP_NEW_USER_TO_MARKETING_EMAIL=True`) is now dispatched as an
+asynchronous Celery task (`lasuite.marketing.tasks.create_or_update_contact`)
+instead of a synchronous call with a 1s timeout. Make sure a Celery worker is
+running alongside the backend, otherwise contacts will never be pushed to Brevo.
 
-* With `ALLOW_UNREGISTERED_ROOMS=false`, only an authenticated user can navigate to a previously existing link after the room has been purged. Doing so recreates the room in the database with a fresh configuration, with that user associated with it and granted admin rights.
-* With `ALLOW_UNREGISTERED_ROOMS=true`, any user can reopen the purged room by navigating to the same URL. In that case, the room is created dynamically and no corresponding room entry is persisted in the database.
+**Configuration changes.** The following environment variables / settings are
+**removed** and no longer read:
 
-### Local development: MinIO replaced by Garage
+- `MARKETING_SERVICE_CLASS`
+- `BREVO_API_KEY`
+- `BREVO_API_CONTACT_LIST_IDS`
+- `BREVO_API_CONTACT_ATTRIBUTES` (previous default: `{"VISIO_USER": True}`)
+- `BREVO_API_TIMEOUT`
 
-The development stacks now use [Garage](https://garagehq.deuxfleurs.fr/) instead of MinIO as S3 storage. Garage keeps its own format in `data/media/meta` and `data/media/data` and cannot read what MinIO left there, so local recordings and files will be lost.
+They are replaced by a single `LASUITE_MARKETING` setting, configured through:
 
-To migrate a local environment:
+| Variable                       | Default                                          | Description                                  |
+| ------------------------------ | ------------------------------------------------ | -------------------------------------------- |
+| `LASUITE_MARKETING_BACKEND`    | `lasuite.marketing.backends.dummy.DummyBackend`  | Backend class path                           |
+| `LASUITE_MARKETING_PARAMETERS` | `{}`                                             | Keyword arguments passed to the backend      |
 
-1. Stop the stack and remove its containers, including the former `minio` one: `docker compose down --remove-orphans`
-2. Optionally reclaim the space used by MinIO: `rm -rf data/media && make data/media`
-3. In your `env.d/development/*` files, replace `minio:9000` by `garage:9000`, the `meet` / `password` credentials by `meet-access-key` / `meet-secret-access-key`, and add `AWS_S3_REGION_NAME=local` (or delete these files and run `make create-env-files`)
-4. Run `make create-env-files` to generate `env.d/development/garage`, which holds a random RPC secret for Garage.
-5. Rebuild the images, since the summary and agent images now install boto3 instead of minio
+⚠️ The default backend is now a **dummy** (no-op). If you previously used
+Brevo, you must explicitly configure it, otherwise signups are silently dropped:
 
-### Summary service and metadata collector: boto3 replaces the minio client
+    LASUITE_MARKETING_BACKEND=lasuite.marketing.backends.brevo.BrevoBackend
+    LASUITE_MARKETING_PARAMETERS={"api_key": "<your-brevo-api-key>", "api_contact_list_ids": [1, 2], "api_contact_attributes": {"VISIO_USER": True}}
 
-The summary service and the metadata collector agent now talk to S3 through boto3 instead of the minio client, with the same settings.
-Requests are now signed for `AWS_S3_REGION_NAME` as-is. When it is not set, the region is no longer looked up from the bucket: boto3 falls back to `AWS_DEFAULT_REGION`, then to `us-east-1`. If you left `AWS_S3_REGION_NAME` unset, set it to your provider's region before upgrading, or providers that check the signing region will reject the transcripts, summaries and meeting metadata uploads, as well as their signed URLs.
+Migration mapping:
 
-Also:
-- Signed URLs to transcripts and summaries are now always path-style (`<endpoint>/<bucket>/<key>`), whereas the minio client used virtual-hosted-style URLs
-- The metadata collector now accepts `AWS_S3_ENDPOINT_URL` with or without a scheme, like the summary service: the scheme always follows `AWS_S3_SECURE_ACCESS`.
+- `BREVO_API_KEY` → `api_key`
+- `BREVO_API_CONTACT_LIST_IDS` → `api_contact_list_ids`
+- `BREVO_API_CONTACT_ATTRIBUTES` → `api_contact_attributes` (re-add
+  `{"VISIO_USER": True}` if you relied on the old default)
+- `BREVO_API_TIMEOUT` → no equivalent (the request runs in a background task)
 
-### Helm chart: media services default to Garage
+Note: `BREVO_API_KEY` used to support being read from a secret file; the API key
+now lives inside `LASUITE_MARKETING_PARAMETERS`, so adapt how you inject that
+secret (e.g. build the whole variable from your secret store).
 
-The `meet` chart now defaults `serviceMedia.host` and `serviceMediaFiles.host` to `garage.meet.svc.cluster.local`, and the `upstream-vhost` annotation of `ingressMedia` and `ingressMediaFiles` to `garage.meet.svc.cluster.local:9000`. If you relied on the former `minio.meet.svc.cluster.local` defaults, set these values explicitly to your S3 service before upgrading, or recordings and files stop being served under `/media`.
 ### Recording encoding settings replaced by a resolution/profile model
 
 The `RECORDING_ENCODING_*` settings introduced in v1.16.0 exposed raw encoder
@@ -175,6 +186,46 @@ Before enabling it:
 See [docs/features/recording.md](docs/features/recording.md#tuning-recording-encoding)
 for the full setting reference, the shipped profile table and the tuning caveats.
 
+## v1.33.0
+
+### Purging inactive rooms
+
+Rooms now keep track of the last time they were started (`last_started_at`), fed by LiveKit's `room_started` webhook. A new `purge_inactive_rooms` management command permanently deletes the rooms that have not been started for `ROOM_INACTIVITY_DELETION_DAYS` days. See [the room purge documentation](docs/features/room-purge.md).
+
+- The feature is **disabled by default**: nothing is deleted unless you set `ROOM_INACTIVITY_DELETION_DAYS`.
+- The migration marks every existing room as started at the time of the upgrade, so no existing room can be purged before a full inactivity period has elapsed after upgrading.
+- Rooms holding a saved recording their users may still access are kept: any saved recording, or, when `RECORDING_EXPIRATION_DAYS` is set, a saved recording created within that window.
+- Inactivity is measured from LiveKit's `room_started` webhook: if it is not delivered to your backend, rooms in daily use look inactive and get purged.
+- When a room is purged, all it's configuration and access rights are also deleted. Its slug becomes available again and can be reused when a meeting is created from that same URL.
+
+* With `ALLOW_UNREGISTERED_ROOMS=false`, only an authenticated user can navigate to a previously existing link after the room has been purged. Doing so recreates the room in the database with a fresh configuration, with that user associated with it and granted admin rights.
+* With `ALLOW_UNREGISTERED_ROOMS=true`, any user can reopen the purged room by navigating to the same URL. In that case, the room is created dynamically and no corresponding room entry is persisted in the database.
+
+### Local development: MinIO replaced by Garage
+
+The development stacks now use [Garage](https://garagehq.deuxfleurs.fr/) instead of MinIO as S3 storage. Garage keeps its own format in `data/media/meta` and `data/media/data` and cannot read what MinIO left there, so local recordings and files will be lost.
+
+To migrate a local environment:
+
+1. Stop the stack and remove its containers, including the former `minio` one: `docker compose down --remove-orphans`
+2. Optionally reclaim the space used by MinIO: `rm -rf data/media && make data/media`
+3. In your `env.d/development/*` files, replace `minio:9000` by `garage:9000`, the `meet` / `password` credentials by `meet-access-key` / `meet-secret-access-key`, and add `AWS_S3_REGION_NAME=local` (or delete these files and run `make create-env-files`)
+4. Run `make create-env-files` to generate `env.d/development/garage`, which holds a random RPC secret for Garage.
+5. Rebuild the images, since the summary and agent images now install boto3 instead of minio
+
+### Summary service and metadata collector: boto3 replaces the minio client
+
+The summary service and the metadata collector agent now talk to S3 through boto3 instead of the minio client, with the same settings.
+Requests are now signed for `AWS_S3_REGION_NAME` as-is. When it is not set, the region is no longer looked up from the bucket: boto3 falls back to `AWS_DEFAULT_REGION`. If you left `AWS_S3_REGION_NAME` unset, set it to your provider's region before upgrading, or providers that check the signing region will reject the transcripts, summaries and meeting metadata uploads, as well as their signed URLs.
+
+Also:
+- Signed URLs to transcripts and summaries are now always path-style (`<endpoint>/<bucket>/<key>`), whereas the minio client used virtual-hosted-style URLs
+- The metadata collector now accepts `AWS_S3_ENDPOINT_URL` with or without a scheme, like the summary service: the scheme always follows `AWS_S3_SECURE_ACCESS`.
+
+### Helm chart: media services default to Garage
+
+The `meet` chart now defaults `serviceMedia.host` and `serviceMediaFiles.host` to `garage.meet.svc.cluster.local`, and the `upstream-vhost` annotation of `ingressMedia` and `ingressMediaFiles` to `garage.meet.svc.cluster.local:9000`. If you relied on the former `minio.meet.svc.cluster.local` defaults, set these values explicitly to your S3 service before upgrading, or recordings and files stop being served under `/media`.
+
 ## v1.30.0
 
 ### Removing S3 storage-event webhooks for recordings

bin/Tiltfile

@@ -104,15 +104,16 @@ k8s_yaml(secret_yaml_generic(
 
 k8s_yaml(local('cd ../src/helm && helmfile -n meet -e ${DEV_ENV:-dev-keycloak} template .'))
 
-k8s_resource('garage-cors', resource_deps=['garage'])
-k8s_resource('meet-backend', resource_deps=['postgresql', 'garage-cors', 'redis', 'livekit-livekit-server'])
-k8s_resource('meet-celery-backend', resource_deps=['redis'])
-k8s_resource('meet-celery-summarize', resource_deps=['redis'])
-k8s_resource('meet-celery-summary-backend', resource_deps=['redis'])
-k8s_resource('meet-celery-transcribe-default', resource_deps=['redis'])
-k8s_resource('livekit-livekit-server', resource_deps=['redis'])
+k8s_resource('dev-backend-garage-cors', resource_deps=['dev-backend-garage'])
+k8s_resource('dev-backend-keycloak', resource_deps=['dev-backend-keycloak-pg'])
+k8s_resource('meet-backend', resource_deps=['dev-backend-postgres', 'dev-backend-garage-cors', 'dev-backend-redis', 'dev-backend-keycloak', 'livekit-livekit-server'])
+k8s_resource('meet-celery-backend', resource_deps=['dev-backend-redis'])
+k8s_resource('meet-celery-summarize', resource_deps=['dev-backend-redis'])
+k8s_resource('meet-celery-summary-backend', resource_deps=['dev-backend-redis'])
+k8s_resource('meet-celery-transcribe-default', resource_deps=['dev-backend-redis'])
+k8s_resource('livekit-livekit-server', resource_deps=['dev-backend-redis'])
 k8s_resource('livekit-livekit-server-test-connection', resource_deps=['livekit-livekit-server'])
-k8s_resource('keycloak', resource_deps=['kc-postgresql'])
+k8s_resource('livekit-egress', resource_deps=['livekit-livekit-server'])
 # Trigger once on launch
 k8s_resource(
     'meet-backend-createsuperuser',

bin/_config.sh

@@ -55,12 +55,12 @@ function _docker_compose() {
 function _dc_run() {
     _set_user
 
-    user_args="--user=$USER_ID"
-    if [ -z $USER_ID ]; then
-        user_args=""
+    user_args=()
+    if [ -n "$USER_ID" ]; then
+        user_args=("--user=$USER_ID")
     fi
 
-    _docker_compose run --rm $user_args "$@"
+    _docker_compose run --rm "${user_args[@]}" "$@"
 }
 
 # _dc_exec: wrap docker compose exec command
@@ -74,12 +74,12 @@ function _dc_exec() {
 
     echo "🐳(compose) exec command: '\$@'"
 
-    user_args="--user=$USER_ID"
-    if [ -z $USER_ID ]; then
-        user_args=""
+    user_args=()
+    if [ -n "$USER_ID" ]; then
+        user_args=("--user=$USER_ID")
     fi
 
-    _docker_compose exec $user_args "$@"
+    _docker_compose exec "${user_args[@]}" "$@"
 }
 
 # _django_manage: wrap django's manage.py command with docker compose

bin/buildpack_postfrontend.sh

@@ -40,7 +40,7 @@ if [ -n "$CUSTOM_LOGO_URL" ]; then
     [[ "$IS_SVG" == false ]] && echo "[custom-logo] ERROR: not a valid SVG file" >&2 && exit 1
 
     mv -f "$TMP_FILE" "$LOGO_FILE"
-    echo "[custom-logo] INFO: Custom logo downloaded successfuly"
+    echo "[custom-logo] INFO: Custom logo downloaded successfully"
 fi
 
 mv src/backend/* ./

bin/buildpack_start.sh

@@ -7,7 +7,7 @@ gunicorn -b 0.0.0.0:8000 meet.wsgi:application --log-file - &
 bin/run &
 
 # if the current shell is killed, also terminate all its children     
-trap "pkill SIGTERM -P $$" SIGTERM
+trap 'pkill -TERM -P $$' SIGTERM
 
 # wait for a single child to finish,
 wait -n

bin/install-external-secrets.sh

@@ -1,7 +1,6 @@
 #!/usr/bin/env bash
 set -o errexit
 
-CURRENT_DIR=$(pwd)
 NAMESPACE=${1:-meet}
 SECRET_NAME=${2:-bitwarden-cli-meet}
 TEMP_SECRET_FILE=$(mktemp)
@@ -30,10 +29,10 @@ check_secret_exists() {
 # Collect user input securely
 get_user_input() {
     echo "Please provide the following information:"
-    read -p "Enter your Vaultwarden email login: " LOGIN
-    read -s -p "Enter your Vaultwarden password: " PASSWORD
+    read -r -p "Enter your Vaultwarden email login: " LOGIN
+    read -r -s -p "Enter your Vaultwarden password: " PASSWORD
     echo
-    read -p "Enter your Vaultwarden server url: " URL
+    read -r -p "Enter your Vaultwarden server url: " URL
 }
 
 # Create and apply the secret
@@ -77,7 +76,7 @@ main() {
         exit 0
     fi
 
-    echo -e ${TEMP_SECRET_FILE}
+    echo -e "${TEMP_SECRET_FILE}"
 
     get_user_input
     echo -e "\nCreating Vaultwarden secret…"

bin/install-hooks.sh

@@ -3,7 +3,7 @@
 mkdir -p "$(dirname -- "${BASH_SOURCE[0]}")/../.git/hooks/"
 PRE_COMMIT_FILE="$(dirname -- "${BASH_SOURCE[0]}")/../.git/hooks/pre-commit"
 
-cat <<'EOF' >$PRE_COMMIT_FILE
+cat <<'EOF' >"$PRE_COMMIT_FILE"
 #!/bin/bash
 
 # directories containing potential secrets
@@ -27,4 +27,4 @@ for d in $DIRS; do
 done
 EOF
 
-chmod +x $PRE_COMMIT_FILE
+chmod +x "$PRE_COMMIT_FILE"

bin/prepare-release.sh

@@ -68,7 +68,7 @@ fi
 
 # Ask user for release version number
 echo ""
-read -p "Enter release version number (e.g., 1.2.3): " VERSION
+read -r -p "Enter release version number (e.g., 1.2.3): " VERSION
 
 # Validate version format (basic semver check)
 if ! [[ $VERSION =~ ^[0-9]+\.[0-9]+\.[0-9]+$ ]]; then

bin/update-git-submodule.sh

@@ -1,4 +1,5 @@
 #!/usr/bin/env bash
 
 git submodule update --init --recursive
+# shellcheck disable=SC2016
 git submodule foreach 'git fetch origin; git checkout $(git rev-parse --abbrev-ref HEAD); git reset --hard origin/$(git rev-parse --abbrev-ref HEAD); git submodule update --recursive; git clean -dfx'

bin/validate-helm-configuration.sh

@@ -8,6 +8,6 @@ environments=$(awk '/environments:/ {flag=1; next} flag && NF {print} !NF {flag=
 
 for env in $environments; do
 	echo "################### $env lint ###################"
-	helmfile -e $env -f src/helm/helmfile.yaml lint || exit 1
+	helmfile -e "$env" -f src/helm/helmfile.yaml lint || exit 1
 	echo -e "\n"
 done

compose.yml

@@ -9,6 +9,8 @@ services:
 
   redis:
     image: redis:5
+    ports:
+      - "6379:6379"
 
   mailcatcher:
     image: sj26/mailcatcher:latest
@@ -153,6 +155,7 @@ services:
       target: frontend-production
       args:
         VITE_API_BASE_URL: "http://localhost:8071"
+        VITE_MEDIA_BASE_URL: "http://localhost:8083"
         VITE_APP_TITLE: "LaSuite Meet"
     image: meet:frontend-development
     ports:
@@ -172,7 +175,7 @@ services:
     working_dir: /app
 
   node:
-    image: node:22
+    image: node:22-alpine
     user: "${DOCKER_USER:-1000}"
     environment:
       HOME: /tmp
@@ -270,11 +273,6 @@ services:
       - ./src/agents:/app
       - /app/.venv
 
-  redis-summary:
-    image: redis
-    ports:
-      - "6379:6379"
-
   app-summary-dev:
     build:
       context: src/summary
@@ -289,7 +287,7 @@ services:
     volumes:
       - ./src/summary:/app
     depends_on:
-        - redis-summary
+        - redis
 
   celery-summary-transcribe:
     container_name: celery-summary-transcribe
@@ -303,7 +301,7 @@ services:
     volumes:
       - ./src/summary:/app
     depends_on:
-      - redis-summary
+      - redis
       - app-summary-dev
       - garage
     develop:
@@ -323,7 +321,7 @@ services:
     volumes:
       - ./src/summary:/app
     depends_on:
-      - redis-summary
+      - redis
       - app-summary-dev
       - garage
     develop:

docker/compose.d/compose.bureautix.yml

@@ -1,7 +1,7 @@
 # Bureautix proxy overrides
 #
 # Builds submitted through the Docker API of the Podman service get none of
-# the proxy variables in their RUN steps. We need to pass the http_proxy explicitely
+# the proxy variables in their RUN steps. We need to pass the http_proxy explicitly
 # otherwise all connections fail during the build.
 
 x-proxy-vars: &proxy-vars

docker/dinum-frontend/Dockerfile

@@ -58,6 +58,7 @@ FROM nginxinc/nginx-unprivileged:1.30.4-alpine3.24 AS frontend-production
 
 USER root
 RUN apk upgrade --no-cache libexpat && \
+    apk add --no-cache --upgrade 'pcre2>=10.49-r0' && \
     apk del curl
 USER nginx
 

docker/files/etc/nginx/conf.d/default.conf

@@ -4,6 +4,36 @@ server {
     server_name localhost;
     charset utf-8;
 
+    # Proxy auth for recordings (authorized by the recordings viewset)
+    location /media/recordings/ {
+        auth_request /media-auth-recordings;
+        auth_request_set $authHeader $upstream_http_authorization;
+        auth_request_set $authDate $upstream_http_x_amz_date;
+        auth_request_set $authContentSha256 $upstream_http_x_amz_content_sha256;
+
+        proxy_set_header Authorization $authHeader;
+        proxy_set_header X-Amz-Date $authDate;
+        proxy_set_header X-Amz-Content-SHA256 $authContentSha256;
+
+        proxy_pass http://garage:9000/meet-media-storage/recordings/;
+        proxy_set_header Host garage:9000;
+        proxy_hide_header Content-Disposition;
+        add_header Content-Disposition "attachment";
+    }
+
+    location = /media-auth-recordings {
+        internal;
+        proxy_pass http://app-dev:8000/api/v1.0/recordings/media-auth/;
+        proxy_set_header Host $host;
+        proxy_set_header X-Real-IP $remote_addr;
+        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
+        proxy_set_header X-Original-URL $request_uri;
+
+        proxy_pass_request_body off;
+        proxy_set_header Content-Length "";
+        proxy_set_header X-Original-Method $request_method;
+    }
+
     # Proxy auth for media
     location /media/ {
         # Auth request configuration

docs/developping_locally.md

@@ -107,6 +107,37 @@ $ npm i
 $ npm run dev
 ```
 
+### LiveKit agents (optional)
+
+The LiveKit agents are not started by `make run`. Each one runs its own
+container and stays connected to LiveKit, which costs CPU and memory you
+don't need unless you work on the features they power. Start them only
+when you need them.
+
+| Agent | Feature | Make command | Setting in `env.d/development/common` |
+|---|---|---|---|
+| `metadata-collector-dev` | Recording metadata (used to identify speakers in transcripts) | `make run-agent-metadata-collector` | `METADATA_COLLECTOR_ENABLED=True` |
+| `multi-user-transcriber-dev` | Live subtitles | `make run-agent-multi-user-transcriber` | `ROOM_SUBTITLE_ENABLED=True` |
+
+To start both at once:
+```shellscript
+$ make run-agents
+```
+
+Then set the matching settings to `True` and restart the backend so it
+picks them up:
+```shellscript
+$ make run-backend
+```
+
+The multi-user transcriber also needs a speech-to-text provider. Configure
+`STT_PROVIDER` and its credentials in
+`env.d/development/multi_user_transcriber`.
+
+Keep the settings and the agents in sync: if a setting is `True` while its
+agent is stopped, the backend still dispatches jobs to it and the feature
+fails silently.
+
 ---
 
 ## Adding Content

docs/installation/kubernetes.md

@@ -14,7 +14,7 @@ This document is a step-by-step guide that describes how to install LaSuite Meet
 
 If you do not have a kubernetes test cluster, you can install everything on a local kind cluster. In this case, the simplest way is to use our script located in this repo under **bin/start-kind.sh**.
 
-IMPORTANT: The kind method will only deploy meet as a local instance(127.0.0.1) that can only be accessed from the device where it has been deployed. 
+IMPORTANT: The kind method will only deploy meet as a local instance(127.0.0.1) that can only be accessed from the device where it has been deployed.
 
 To be able to use the script, you will need to install the following components:
 
@@ -311,120 +311,123 @@ frontend:
 
 These are the environmental options available on meet backend.
 
-| Option                                          | Description                                                                                                                                                  | default                                                                                                                                                       |
-|-------------------------------------------------|--------------------------------------------------------------------------------------------------------------------------------------------------------------|---------------------------------------------------------------------------------------------------------------------------------------------------------------|
-| DATA_DIR                                        | Data directory location                                                                                                                                      | /data                                                                                                                                                         |
-| DJANGO_ALLOWED_HOSTS                            | Hosts that are allowed                                                                                                                                       | []                                                                                                                                                            |
-| DJANGO_SECRET_KEY                               | Secret key used for Django security                                                                                                                          |                                                                                                                                                               |
-| DJANGO_SILENCED_SYSTEM_CHECKS                   | Silence Django system checks                                                                                                                                 | []                                                                                                                                                            |
-| DJANGO_ALLOW_UNSECURE_USER_LISTING              | Allow unsecure user listing                                                                                                                                  | false                                                                                                                                                         |
-| DB_ENGINE                                       | Database engine used                                                                                                                                         | django.db.backends.postgresql_psycopg2                                                                                                                        |
-| DB_NAME                                         | Name of the database                                                                                                                                         | meet                                                                                                                                                          |
-| DB_USER                                         | User used to connect to database                                                                                                                             | dinum                                                                                                                                                         |
-| DB_PASSWORD                                     | Password used to connect to the database                                                                                                                     | pass                                                                                                                                                          |
-| DB_HOST                                         | Hostname of the database                                                                                                                                     | localhost                                                                                                                                                     |
-| DB_PORT                                         | Port to connect to database                                                                                                                                  | 5432                                                                                                                                                          |
-| STORAGES_STATICFILES_BACKEND                    | Static file serving engine                                                                                                                                   | whitenoise.storage.CompressedManifestStaticFilesStorage                                                                                                       |
-| AWS_S3_ENDPOINT_URL                             | S3 host endpoint                                                                                                                                             |                                                                                                                                                               |
-| AWS_S3_ACCESS_KEY_ID                            | S3 access key                                                                                                                                                |                                                                                                                                                               |
-| AWS_S3_SECRET_ACCESS_KEY                        | S3 secret key                                                                                                                                                |                                                                                                                                                               |
-| AWS_S3_REGION_NAME                              | S3 region                                                                                                                                                    |                                                                                                                                                               |
-| AWS_STORAGE_BUCKET_NAME                         | S3 bucket name                                                                                                                                               | meet-media-storage                                                                                                                                            |
-| DJANGO_LANGUAGE_CODE                            | Default language                                                                                                                                             | en-us                                                                                                                                                         |
-| REDIS_URL                                       | Redis endpoint                                                                                                                                               | redis://redis:6379/1                                                                                                                                          |
-| SESSION_COOKIE_AGE                              | Session cookie expiration in seconds                                                                                                                         | 43200 (12 hours)                                                                                                                                              |
-| REQUEST_ENTRY_THROTTLE_RATES                    | Entry request throttle rates                                                                                                                                 | 150/minute                                                                                                                                                    |
-| CREATION_CALLBACK_THROTTLE_RATES                | Creation callback throttle rates                                                                                                                             | 600/minute                                                                                                                                                    |
-| SPECTACULAR_SETTINGS_ENABLE_DJANGO_DEPLOY_CHECK | Enable Django deploy check                                                                                                                                   | false                                                                                                                                                         |
-| CSRF_TRUSTED_ORIGINS                            | CSRF trusted origins list                                                                                                                                    | []                                                                                                                                                            |
-| FRONTEND_CUSTOM_CSS_URL                         | URL of an additional CSS file to load in the frontend app. If set, a `<link>` tag with this URL as href is added to the `<head>` of the frontend app         |                                                                                                                                                               |
-| FRONTEND_ANALYTICS                              | Analytics information                                                                                                                                        | {}                                                                                                                                                            |
-| FRONTEND_SUPPORT                                | Crisp frontend support configuration, also you can pass help articles, with `help_article_transcript`, `help_article_recording`, `help_article_more_tools`   | {}                                                                                                                                                            |
-| FRONTEND_MANIFEST_LINK                          | Link to the "Learn more" button on the homepage                                                                                                              | {}                                                                                                                                                            |
-| FRONTEND_SILENCE_LIVEKIT_DEBUG                  | Silence LiveKit debug logs                                                                                                                                   | false                                                                                                                                                         |
-| FRONTEND_IS_SILENT_LOGIN_ENABLED                | Enable silent login feature                                                                                                                                  | true                                                                                                                                                          |
-| FRONTEND_FEEDBACK                               | Frontend feedback configuration                                                                                                                              | {}                                                                                                                                                            |
-| FRONTEND_DOCUMENTATION_URL                      | URL of the documentation opened from the room options menu. If unset, the documentation menu item is hidden                                                  |                                                                                                                                                               |
-| FRONTEND_USE_FRENCH_GOV_FOOTER                  | Show the French government footer in the homepage                                                                                                            | false                                                                                                                                                         |
-| FRONTEND_USE_PROCONNECT_BUTTON                  | Show a "Login with ProConnect" button in the homepage instead of a "Login" button                                                                            | false                                                                                                                                                         |
-| DJANGO_EMAIL_BACKEND                            | Email backend library                                                                                                                                        | django.core.mail.backends.smtp.EmailBackend                                                                                                                   |
-| DJANGO_EMAIL_HOST                               | Host of the email server                                                                                                                                     |                                                                                                                                                               |
-| DJANGO_EMAIL_HOST_USER                          | User to connect to the email server                                                                                                                          |                                                                                                                                                               |
-| DJANGO_EMAIL_HOST_PASSWORD                      | Password to connect to the email server                                                                                                                      |                                                                                                                                                               |
-| DJANGO_EMAIL_PORT                               | Port to connect to the email server                                                                                                                          |                                                                                                                                                               |
-| DJANGO_EMAIL_USE_TLS                            | Enable TLS on email connection                                                                                                                               | false                                                                                                                                                         |
-| DJANGO_EMAIL_USE_SSL                            | Enable SSL on email connection                                                                                                                               | false                                                                                                                                                         |
-| DJANGO_EMAIL_FROM                               | Email from account                                                                                                                                           | from@example.com                                                                                                                                              |
-| EMAIL_BRAND_NAME                                | Email branding name                                                                                                                                          |                                                                                                                                                               |
-| EMAIL_SUPPORT_EMAIL                             | Support email address                                                                                                                                        |                                                                                                                                                               |
-| EMAIL_LOGO_IMG                                  | Email logo image                                                                                                                                             |                                                                                                                                                               |
-| EMAIL_DOMAIN                                    | Email domain                                                                                                                                                 |                                                                                                                                                               |
-| EMAIL_APP_BASE_URL                              | Email app base URL                                                                                                                                           |                                                                                                                                                               |
-| DJANGO_CORS_ALLOW_ALL_ORIGINS                   | Allow all CORS origins                                                                                                                                       | false                                                                                                                                                         |
-| DJANGO_CORS_ALLOWED_ORIGINS                     | Origins to allow (string list)                                                                                                                               | []                                                                                                                                                            |
-| DJANGO_CORS_ALLOWED_ORIGIN_REGEXES              | Origins to allow (regex patterns)                                                                                                                            | []                                                                                                                                                            |
-| SENTRY_DSN                                      | Sentry server DSN                                                                                                                                            |                                                                                                                                                               |
-| DJANGO_CELERY_BROKER_URL                        | Celery broker host                                                                                                                                           | redis://redis:6379/0                                                                                                                                          |
-| DJANGO_CELERY_BROKER_TRANSPORT_OPTIONS          | Celery broker options                                                                                                                                        | {}                                                                                                                                                            |
-| OIDC_CREATE_USER                                | Create OIDC user if not exists                                                                                                                               | true                                                                                                                                                          |
-| OIDC_VERIFY_SSL                                 | Verify SSL for OIDC                                                                                                                                          | true                                                                                                                                                          |
-| OIDC_FALLBACK_TO_EMAIL_FOR_IDENTIFICATION       | Fallback to email for identification                                                                                                                         | false                                                                                                                                                         |
-| OIDC_RP_SIGN_ALGO                               | Token verification algorithm used by OIDC                                                                                                                    | RS256                                                                                                                                                         |
-| OIDC_RP_CLIENT_ID                               | OIDC client ID                                                                                                                                               | meet                                                                                                                                                          |
-| OIDC_RP_CLIENT_SECRET                           | OIDC client secret                                                                                                                                           |                                                                                                                                                               |
-| OIDC_OP_JWKS_ENDPOINT                           | OIDC endpoint for JWKS                                                                                                                                       |                                                                                                                                                               |
-| OIDC_OP_AUTHORIZATION_ENDPOINT                  | OIDC endpoint for authorization                                                                                                                              |                                                                                                                                                               |
-| OIDC_OP_TOKEN_ENDPOINT                          | OIDC endpoint for token                                                                                                                                      |                                                                                                                                                               |
-| OIDC_OP_USER_ENDPOINT                           | OIDC endpoint for user                                                                                                                                       |                                                                                                                                                               |
-| OIDC_OP_USER_ENDPOINT_FORMAT                    | OIDC endpoint format (AUTO, JWT, JSON)                                                                                                                       | AUTO                                                                                                                                                          |
-| OIDC_OP_LOGOUT_ENDPOINT                         | OIDC endpoint for logout                                                                                                                                     |                                                                                                                                                               |
-| OIDC_AUTH_REQUEST_EXTRA_PARAMS                  | Extra parameters for OIDC request                                                                                                                            | {}                                                                                                                                                            |
-| OIDC_RP_SCOPES                                  | OIDC scopes                                                                                                                                                  | openid email                                                                                                                                                  |
-| OIDC_USE_NONCE                                  | Use nonce for OIDC                                                                                                                                           | true                                                                                                                                                          |
-| OIDC_REDIRECT_REQUIRE_HTTPS                     | Require HTTPS for OIDC                                                                                                                                       | false                                                                                                                                                         |
-| OIDC_REDIRECT_ALLOWED_HOSTS                     | Allowed redirect hosts for OIDC                                                                                                                              | []                                                                                                                                                            |
-| OIDC_STORE_ID_TOKEN                             | Store OIDC ID token                                                                                                                                          | true                                                                                                                                                          |
-| OIDC_REDIRECT_FIELD_NAME                        | Redirect field for OIDC                                                                                                                                      | returnTo                                                                                                                                                      |
-| OIDC_USERINFO_FULLNAME_FIELDS                   | Full name claim from OIDC token                                                                                                                              | ["given_name", "usual_name"]                                                                                                                                  |
-| OIDC_USERINFO_SHORTNAME_FIELD                   | Short name claim from OIDC token                                                                                                                             | given_name                                                                                                                                                    |
-| OIDC_USERINFO_ESSENTIAL_CLAIMS                  | Required claims from OIDC token                                                                                                                              | []                                                                                                                                                            |
-| OIDC_USE_PKCE                                   | Enable the use of PKCE (Proof Key for Code Exchange) during the OAuth 2.0 authorization code flow. Recommended for enhanced security.                        | False                                                                                                                                                         |
-| OIDC_PKCE_CODE_CHALLENGE_METHOD                 | Method used to generate the PKCE code challenge. Common values include S256 and plain. Refer to the mozilla-django-oidc documentation for supported options. | S256                                                                                                                                                          |
-| OIDC_PKCE_CODE_VERIFIER_SIZE                    | Length of the random string used as the PKCE code verifier. Must be an integer between 43 and 128, inclusive.                                                | 64                                                                                                                                                            |
-| LOGIN_REDIRECT_URL                              | Login redirect URL                                                                                                                                           |                                                                                                                                                               |
-| LOGIN_REDIRECT_URL_FAILURE                      | Login redirect URL for failure                                                                                                                               |                                                                                                                                                               |
-| LOGOUT_REDIRECT_URL                             | URL to redirect to on logout                                                                                                                                 |                                                                                                                                                               |
-| ALLOW_LOGOUT_GET_METHOD                         | Allow logout through GET method                                                                                                                              | true                                                                                                                                                          |
-| LIVEKIT_API_KEY                                 | LiveKit API key                                                                                                                                              |                                                                                                                                                               |
-| LIVEKIT_API_SECRET                              | LiveKit API secret                                                                                                                                           |                                                                                                                                                               |
-| LIVEKIT_API_URL                                 | LiveKit API URL                                                                                                                                              |                                                                                                                                                               |
-| LIVEKIT_VERIFY_SSL                              | Verify SSL for LiveKit connections                                                                                                                           | true                                                                                                                                                          |
-| LIVEKIT_FORCE_WSS_PROTOCOL                      | Enables WSS protocol conversion for legacy browser compatibility (Firefox <124, Chrome <125, Edge <125) where HTTPS URLs fail in WebSocket() constructor.    | false                                                                                                                                                         |
-| LIVEKIT_ENABLE_FIREFOX_PROXY_WORKAROUND         | Firefox-only connection warmup: pre-calls WebSocket endpoint (expecting 401) to initialize cache, resolving proxy/network connectivity issues.               | false                                                                                                                                                         |
-| RESOURCE_DEFAULT_ACCESS_LEVEL                   | Default resource access level for rooms                                                                                                                      | public                                                                                                                                                        |
-| ALLOW_UNREGISTERED_ROOMS                        | Allow usage of unregistered rooms                                                                                                                            | true                                                                                                                                                          |
-| ROOM_INACTIVITY_DELETION_DAYS                   | Days without being started after which a room is purged. Unset to never purge                                                                                |                                                                                                                                                               |
-| RECORDING_ENABLE                                | Record meeting option                                                                                                                                        | false                                                                                                                                                         |
-| RECORDING_OUTPUT_FOLDER                         | Folder to store meetings                                                                                                                                     | recordings                                                                                                                                                    |
+| Option                                          | Description                                                                                                                                                  | default                                                                                                                                                      |
+|-------------------------------------------------|--------------------------------------------------------------------------------------------------------------------------------------------------------------|--------------------------------------------------------------------------------------------------------------------------------------------------------------|
+| DATA_DIR                                        | Data directory location                                                                                                                                      | /data                                                                                                                                                        |
+| DJANGO_ALLOWED_HOSTS                            | Hosts that are allowed                                                                                                                                       | []                                                                                                                                                           |
+| DJANGO_SECRET_KEY                               | Secret key used for Django security                                                                                                                          |                                                                                                                                                              |
+| DJANGO_SILENCED_SYSTEM_CHECKS                   | Silence Django system checks                                                                                                                                 | []                                                                                                                                                           |
+| DJANGO_ALLOW_UNSECURE_USER_LISTING              | Allow unsecure user listing                                                                                                                                  | false                                                                                                                                                        |
+| DB_ENGINE                                       | Database engine used                                                                                                                                         | django.db.backends.postgresql_psycopg2                                                                                                                       |
+| DB_NAME                                         | Name of the database                                                                                                                                         | meet                                                                                                                                                         |
+| DB_USER                                         | User used to connect to database                                                                                                                             | dinum                                                                                                                                                        |
+| DB_PASSWORD                                     | Password used to connect to the database                                                                                                                     | pass                                                                                                                                                         |
+| DB_HOST                                         | Hostname of the database                                                                                                                                     | localhost                                                                                                                                                    |
+| DB_PORT                                         | Port to connect to database                                                                                                                                  | 5432                                                                                                                                                         |
+| STORAGES_STATICFILES_BACKEND                    | Static file serving engine                                                                                                                                   | whitenoise.storage.CompressedManifestStaticFilesStorage                                                                                                      |
+| AWS_S3_ENDPOINT_URL                             | S3 host endpoint                                                                                                                                             |                                                                                                                                                              |
+| AWS_S3_ACCESS_KEY_ID                            | S3 access key                                                                                                                                                |                                                                                                                                                              |
+| AWS_S3_SECRET_ACCESS_KEY                        | S3 secret key                                                                                                                                                |                                                                                                                                                              |
+| AWS_S3_REGION_NAME                              | S3 region                                                                                                                                                    |                                                                                                                                                              |
+| AWS_STORAGE_BUCKET_NAME                         | S3 bucket name                                                                                                                                               | meet-media-storage                                                                                                                                           |
+| DJANGO_LANGUAGE_CODE                            | Default language                                                                                                                                             | en-us                                                                                                                                                        |
+| REDIS_URL                                       | Redis endpoint                                                                                                                                               | redis://redis:6379/1                                                                                                                                         |
+| SESSION_COOKIE_AGE                              | Session cookie expiration in seconds                                                                                                                         | 43200 (12 hours)                                                                                                                                             |
+| ROOM_CREATION_THROTTLE_RATES                    | Room creation throttle rate per authenticated user | 50/minute                                                                                               | 50/minute                                                                                                                                                    |
+| ROOM_CREATION_DAILY_THROTTLE_RATES              | Daily room creation cap per authenticated user                                                                                                               | 1000/day                                                                                                                                                     |
+| REQUEST_ENTRY_THROTTLE_RATES                    | Entry request throttle rates                                                                                                                                 | 150/minute                                                                                                                                                   |
+| CREATION_CALLBACK_THROTTLE_RATES                | Creation callback throttle rates                                                                                                                             | 600/minute                                                                                                                                                   |
+| SPECTACULAR_SETTINGS_ENABLE_DJANGO_DEPLOY_CHECK | Enable Django deploy check                                                                                                                                   | false                                                                                                                                                        |
+| CSRF_TRUSTED_ORIGINS                            | CSRF trusted origins list                                                                                                                                    | []                                                                                                                                                           |
+| FRONTEND_CUSTOM_CSS_URL                         | URL of an additional CSS file to load in the frontend app. If set, a `<link>` tag with this URL as href is added to the `<head>` of the frontend app         |                                                                                                                                                              |
+| FRONTEND_ANALYTICS                              | Analytics information                                                                                                                                        | {}                                                                                                                                                           |
+| FRONTEND_SUPPORT                                | Crisp frontend support configuration, also you can pass help articles, with `help_article_transcript`, `help_article_recording`, `help_article_more_tools`   | {}                                                                                                                                                           |
+| FRONTEND_MANIFEST_LINK                          | Link to the "Learn more" button on the homepage                                                                                                              | {}                                                                                                                                                           |
+| FRONTEND_SILENCE_LIVEKIT_DEBUG                  | Silence LiveKit debug logs                                                                                                                                   | false                                                                                                                                                        |
+| FRONTEND_IS_SILENT_LOGIN_ENABLED                | Enable silent login feature                                                                                                                                  | true                                                                                                                                                         |
+| FRONTEND_FEEDBACK                               | Frontend feedback configuration                                                                                                                              | {}                                                                                                                                                           |
+| FRONTEND_DOCUMENTATION_URL                      | URL of the documentation opened from the room options menu. If unset, the documentation menu item is hidden                                                  |                                                                                                                                                              |
+| FRONTEND_TECHNICAL_DOCUMENTATION_URL            | URL of the technical documentation (network prerequisites) linked from the footer and the connection test. If unset, both links are hidden                   |                                                                                                                                                              |
+| FRONTEND_USE_FRENCH_GOV_FOOTER                  | Show the French government footer in the homepage                                                                                                            | false                                                                                                                                                        |
+| FRONTEND_USE_PROCONNECT_BUTTON                  | Show a "Login with ProConnect" button in the homepage instead of a "Login" button                                                                            | false                                                                                                                                                        |
+| DJANGO_EMAIL_BACKEND                            | Email backend library                                                                                                                                        | django.core.mail.backends.smtp.EmailBackend                                                                                                                  |
+| DJANGO_EMAIL_HOST                               | Host of the email server                                                                                                                                     |                                                                                                                                                              |
+| DJANGO_EMAIL_HOST_USER                          | User to connect to the email server                                                                                                                          |                                                                                                                                                              |
+| DJANGO_EMAIL_HOST_PASSWORD                      | Password to connect to the email server                                                                                                                      |                                                                                                                                                              |
+| DJANGO_EMAIL_PORT                               | Port to connect to the email server                                                                                                                          |                                                                                                                                                              |
+| DJANGO_EMAIL_USE_TLS                            | Enable TLS on email connection                                                                                                                               | false                                                                                                                                                        |
+| DJANGO_EMAIL_USE_SSL                            | Enable SSL on email connection                                                                                                                               | false                                                                                                                                                        |
+| DJANGO_EMAIL_FROM                               | Email from account                                                                                                                                           | from@example.com                                                                                                                                             |
+| EMAIL_BRAND_NAME                                | Email branding name                                                                                                                                          |                                                                                                                                                              |
+| EMAIL_SUPPORT_EMAIL                             | Support email address                                                                                                                                        |                                                                                                                                                              |
+| EMAIL_LOGO_IMG                                  | Email logo image                                                                                                                                             |                                                                                                                                                              |
+| EMAIL_DOMAIN                                    | Email domain                                                                                                                                                 |                                                                                                                                                              |
+| EMAIL_APP_BASE_URL                              | Email app base URL                                                                                                                                           |                                                                                                                                                              |
+| DJANGO_CORS_ALLOW_ALL_ORIGINS                   | Allow all CORS origins                                                                                                                                       | false                                                                                                                                                        |
+| DJANGO_CORS_ALLOWED_ORIGINS                     | Origins to allow (string list)                                                                                                                               | []                                                                                                                                                           |
+| DJANGO_CORS_ALLOWED_ORIGIN_REGEXES              | Origins to allow (regex patterns)                                                                                                                            | []                                                                                                                                                           |
+| SENTRY_DSN                                      | Sentry server DSN                                                                                                                                            |                                                                                                                                                              |
+| DJANGO_CELERY_BROKER_URL                        | Celery broker host                                                                                                                                           | redis://redis:6379/0                                                                                                                                         |
+| DJANGO_CELERY_BROKER_TRANSPORT_OPTIONS          | Celery broker options                                                                                                                                        | {}                                                                                                                                                           |
+| OIDC_CREATE_USER                                | Create OIDC user if not exists                                                                                                                               | true                                                                                                                                                         |
+| OIDC_VERIFY_SSL                                 | Verify SSL for OIDC                                                                                                                                          | true                                                                                                                                                         |
+| OIDC_FALLBACK_TO_EMAIL_FOR_IDENTIFICATION       | Fallback to email for identification                                                                                                                         | false                                                                                                                                                        |
+| OIDC_RP_SIGN_ALGO                               | Token verification algorithm used by OIDC                                                                                                                    | RS256                                                                                                                                                        |
+| OIDC_RP_CLIENT_ID                               | OIDC client ID                                                                                                                                               | meet                                                                                                                                                         |
+| OIDC_RP_CLIENT_SECRET                           | OIDC client secret                                                                                                                                           |                                                                                                                                                              |
+| OIDC_OP_JWKS_ENDPOINT                           | OIDC endpoint for JWKS                                                                                                                                       |                                                                                                                                                              |
+| OIDC_OP_AUTHORIZATION_ENDPOINT                  | OIDC endpoint for authorization                                                                                                                              |                                                                                                                                                              |
+| OIDC_OP_TOKEN_ENDPOINT                          | OIDC endpoint for token                                                                                                                                      |                                                                                                                                                              |
+| OIDC_OP_USER_ENDPOINT                           | OIDC endpoint for user                                                                                                                                       |                                                                                                                                                              |
+| OIDC_OP_USER_ENDPOINT_FORMAT                    | OIDC endpoint format (AUTO, JWT, JSON)                                                                                                                       | AUTO                                                                                                                                                         |
+| OIDC_OP_LOGOUT_ENDPOINT                         | OIDC endpoint for logout                                                                                                                                     |                                                                                                                                                              |
+| OIDC_AUTH_REQUEST_EXTRA_PARAMS                  | Extra parameters for OIDC request                                                                                                                            | {}                                                                                                                                                           |
+| OIDC_RP_SCOPES                                  | OIDC scopes                                                                                                                                                  | openid email                                                                                                                                                 |
+| OIDC_USE_NONCE                                  | Use nonce for OIDC                                                                                                                                           | true                                                                                                                                                         |
+| OIDC_REDIRECT_REQUIRE_HTTPS                     | Require HTTPS for OIDC                                                                                                                                       | false                                                                                                                                                        |
+| OIDC_REDIRECT_ALLOWED_HOSTS                     | Allowed redirect hosts for OIDC                                                                                                                              | []                                                                                                                                                           |
+| OIDC_STORE_ID_TOKEN                             | Store OIDC ID token                                                                                                                                          | true                                                                                                                                                         |
+| OIDC_REDIRECT_FIELD_NAME                        | Redirect field for OIDC                                                                                                                                      | returnTo                                                                                                                                                     |
+| OIDC_USERINFO_FULLNAME_FIELDS                   | Full name claim from OIDC token                                                                                                                              | ["given_name", "usual_name"]                                                                                                                                 |
+| OIDC_USERINFO_SHORTNAME_FIELD                   | Short name claim from OIDC token                                                                                                                             | given_name                                                                                                                                                   |
+| OIDC_USERINFO_ESSENTIAL_CLAIMS                  | Required claims from OIDC token                                                                                                                              | []                                                                                                                                                           |
+| OIDC_USE_PKCE                                   | Enable the use of PKCE (Proof Key for Code Exchange) during the OAuth 2.0 authorization code flow. Recommended for enhanced security.                        | False                                                                                                                                                        |
+| OIDC_PKCE_CODE_CHALLENGE_METHOD                 | Method used to generate the PKCE code challenge. Common values include S256 and plain. Refer to the mozilla-django-oidc documentation for supported options. | S256                                                                                                                                                         |
+| OIDC_PKCE_CODE_VERIFIER_SIZE                    | Length of the random string used as the PKCE code verifier. Must be an integer between 43 and 128, inclusive.                                                | 64                                                                                                                                                           |
+| LOGIN_REDIRECT_URL                              | Login redirect URL                                                                                                                                           |                                                                                                                                                              |
+| LOGIN_REDIRECT_URL_FAILURE                      | Login redirect URL for failure                                                                                                                               |                                                                                                                                                              |
+| LOGOUT_REDIRECT_URL                             | URL to redirect to on logout                                                                                                                                 |                                                                                                                                                              |
+| ALLOW_LOGOUT_GET_METHOD                         | Allow logout through GET method                                                                                                                              | true                                                                                                                                                         |
+| LIVEKIT_API_KEY                                 | LiveKit API key                                                                                                                                              |                                                                                                                                                              |
+| LIVEKIT_API_SECRET                              | LiveKit API secret                                                                                                                                           |                                                                                                                                                              |
+| LIVEKIT_API_URL                                 | LiveKit API URL                                                                                                                                              |                                                                                                                                                              |
+| LIVEKIT_VERIFY_SSL                              | Verify SSL for LiveKit connections                                                                                                                           | true                                                                                                                                                         |
+| LIVEKIT_FORCE_WSS_PROTOCOL                      | Enables WSS protocol conversion for legacy browser compatibility (Firefox <124, Chrome <125, Edge <125) where HTTPS URLs fail in WebSocket() constructor.    | false                                                                                                                                                        |
+| LIVEKIT_ENABLE_FIREFOX_PROXY_WORKAROUND         | Firefox-only connection warmup: pre-calls WebSocket endpoint (expecting 401) to initialize cache, resolving proxy/network connectivity issues.               | false                                                                                                                                                        |
+| RESOURCE_DEFAULT_ACCESS_LEVEL                   | Default resource access level for rooms                                                                                                                      | public                                                                                                                                                       |
+| ALLOW_UNREGISTERED_ROOMS                        | Allow usage of unregistered rooms                                                                                                                            | true                                                                                                                                                         |
+| ROOM_INACTIVITY_DELETION_DAYS                   | Days without being started after which a room is purged. Unset to never purge                                                                                |                                                                                                                                                              |
+| RECORDING_ENABLE                                | Record meeting option                                                                                                                                        | false                                                                                                                                                        |
+| RECORDING_OUTPUT_FOLDER                         | Folder to store meetings                                                                                                                                     | recordings                                                                                                                                                   |
 | RECORDING_WORKER_CLASSES                        | Worker classes for recording                                                                                                                                 | {"screen_recording": "core.recording.worker.services.VideoCompositeEgressService","transcript": "core.recording.worker.services.AudioCompositeEgressService"} |
-| RECORDING_EXPIRATION_DAYS                       | Recording expiration in days                                                                                                                                 |                                                                                                                                                               |
-| RECORDING_MAX_DURATION                          | Maximum recording duration in milliseconds. Must match LiveKit Egress configuration exactly.                                                                 |                                                                                                                                                               |
-| SCREEN_RECORDING_BASE_URL                       | Screen recording base URL                                                                                                                                    |                                                                                                                                                               |
-| SUMMARY_SERVICE_ENDPOINT                        | Summary service endpoint                                                                                                                                     |                                                                                                                                                               |
-| SUMMARY_SERVICE_API_TOKEN                       | API token for summary service                                                                                                                                |                                                                                                                                                               |
-| SIGNUP_NEW_USER_TO_MARKETING_EMAIL              | Signup users to marketing emails                                                                                                                             | false                                                                                                                                                         |
-| MARKETING_SERVICE_CLASS                         | Marketing service class                                                                                                                                      | core.services.marketing.BrevoMarketingService                                                                                                                 |
-| BREVO_API_KEY                                   | Brevo API key for marketing emails                                                                                                                           |                                                                                                                                                               |
-| BREVO_API_CONTACT_LIST_IDS                      | Brevo API contact list IDs                                                                                                                                   | []                                                                                                                                                            |
-| DJANGO_BREVO_API_CONTACT_ATTRIBUTES             | Brevo contact attributes                                                                                                                                     | {"VISIO_USER": true}                                                                                                                                          |
-| BREVO_API_TIMEOUT                               | Brevo timeout in seconds                                                                                                                                     | 1                                                                                                                                                             |
-| LOBBY_KEY_PREFIX                                | Lobby key prefix                                                                                                                                             | room_lobby                                                                                                                                                    |
-| LOBBY_WAITING_TIMEOUT                           | Lobby waiting timeout in seconds                                                                                                                             | 3                                                                                                                                                             |
-| LOBBY_DENIED_TIMEOUT                            | Lobby deny timeout in seconds                                                                                                                                | 5                                                                                                                                                             |
-| LOBBY_ACCEPTED_TIMEOUT                          | Lobby accept timeout in seconds                                                                                                                              | 21600 (6 hours)                                                                                                                                               |
-| LOBBY_NOTIFICATION_TYPE                         | Lobby notification types                                                                                                                                     | participantWaiting                                                                                                                                            |
-| LOBBY_COOKIE_NAME                               | Lobby cookie name                                                                                                                                            | lobbyParticipantId                                                                                                                                            |
-| ROOM_CREATION_CALLBACK_CACHE_TIMEOUT            | Room creation callback cache timeout                                                                                                                         | 600 (10 minutes)                                                                                                                                              |
-| ROOM_TELEPHONY_ENABLED                          | Enable SIP telephony feature                                                                                                                                 | false                                                                                                                                                         |
-| ROOM_TELEPHONY_PIN_LENGTH                       | Telephony PIN length                                                                                                                                         | 10                                                                                                                                                            |
-| ROOM_TELEPHONY_PIN_MAX_RETRIES                  | Telephony PIN maximum retries                                                                                                                                | 5                                                                                                                                                             |
+| RECORDING_EXPIRATION_DAYS                       | Recording expiration in days                                                                                                                                 |                                                                                                                                                              |
+| RECORDING_MAX_DURATION                          | Maximum recording duration in milliseconds. Must match LiveKit Egress configuration exactly.                                                                 |                                                                                                                                                              |
+| SCREEN_RECORDING_BASE_URL                       | Screen recording base URL                                                                                                                                    |                                                                                                                                                              |
+| SUMMARY_SERVICE_ENDPOINT                        | Summary service endpoint                                                                                                                                     |                                                                                                                                                              |
+| SUMMARY_SERVICE_API_TOKEN                       | API token for summary service                                                                                                                                |                                                                                                                                                              |
+| SIGNUP_NEW_USER_TO_MARKETING_EMAIL              | Signup users to marketing emails                                                                                                                             | false                                                                                                                                                        |
+| MARKETING_SERVICE_CLASS                         | Marketing service class                                                                                                                                      | core.services.marketing.BrevoMarketingService                                                                                                                |
+| BREVO_API_KEY                                   | Brevo API key for marketing emails                                                                                                                           |                                                                                                                                                              |
+| BREVO_API_CONTACT_LIST_IDS                      | Brevo API contact list IDs                                                                                                                                   | []                                                                                                                                                           |
+| DJANGO_BREVO_API_CONTACT_ATTRIBUTES             | Brevo contact attributes                                                                                                                                     | {"VISIO_USER": true}                                                                                                                                         |
+| BREVO_API_TIMEOUT                               | Brevo timeout in seconds                                                                                                                                     | 1                                                                                                                                                            |
+| LOBBY_KEY_PREFIX                                | Lobby key prefix                                                                                                                                             | room_lobby                                                                                                                                                   |
+| LOBBY_WAITING_TIMEOUT                           | Lobby waiting timeout in seconds                                                                                                                             | 3                                                                                                                                                            |
+| LOBBY_DENIED_TIMEOUT                            | Lobby deny timeout in seconds                                                                                                                                | 5                                                                                                                                                            |
+| LOBBY_ACCEPTED_TIMEOUT                          | Lobby accept timeout in seconds                                                                                                                              | 21600 (6 hours)                                                                                                                                              |
+| LOBBY_NOTIFICATION_TYPE                         | Lobby notification types                                                                                                                                     | participantWaiting                                                                                                                                           |
+| LOBBY_COOKIE_NAME                               | Lobby cookie name                                                                                                                                            | lobbyParticipantId                                                                                                                                           |
+| ROOM_CREATION_CALLBACK_CACHE_TIMEOUT            | Room creation callback cache timeout                                                                                                                         | 600 (10 minutes)                                                                                                                                             |
+| ROOM_TELEPHONY_ENABLED                          | Enable SIP telephony feature                                                                                                                                 | false                                                                                                                                                        |
+| ROOM_TELEPHONY_PIN_LENGTH                       | Telephony PIN length                                                                                                                                         | 10                                                                                                                                                           |
+| ROOM_TELEPHONY_PIN_MAX_RETRIES                  | Telephony PIN maximum retries                                                                                                                                | 5                                                                                                                                                            |

env.d/development/common.dist

@@ -88,7 +88,7 @@ RECORDING_DOWNLOAD_BASE_URL=http://localhost:3000/recording
 # RECORDING_ENCODING_DEFAULT_RESOLUTION=720p
 # RECORDING_ENCODING_DEFAULT_PROFILE=full
 
-# Default encoding values independant of resolution/profile
+# Default encoding values independent of resolution/profile
 # RECORDING_ENCODING_AUDIO_BITRATE_KBPS=128
 # RECORDING_ENCODING_KEY_FRAME_INTERVAL_S=4.0
 
@@ -104,10 +104,11 @@ ROOM_TELEPHONY_ENABLED=True
 # ROOMKIT_ENABLED = True
 # ROOMKIT_SERVER_TO_SERVER_API_TOKEN = ThisIsAnExampleKeyForDevPurposeOnly
 
-# Metadata
-METADATA_COLLECTOR_ENABLED=True
+# LiveKit agents (opt-in, start them with `make run-agents`)
+# Metadata (requires the metadata-collector agent)
+METADATA_COLLECTOR_ENABLED=False
 
-# Subtitle
+# Subtitle (requires the multi-user-transcriber agent)
 ROOM_SUBTITLE_ENABLED=False
 
 FRONTEND_USE_FRENCH_GOV_FOOTER=False

env.d/development/summary.dist

@@ -9,6 +9,10 @@ AWS_S3_ACCESS_KEY_ID="meet-access-key"
 AWS_S3_SECRET_ACCESS_KEY="meet-secret-access-key"
 AWS_S3_REGION_NAME="local"
 
+CELERY_BROKER_URL="redis://redis:6379/2"
+CELERY_RESULT_BACKEND="redis://redis:6379/2"
+TASK_TRACKER_REDIS_URL="redis://redis:6379/2"
+
 WHISPERX_BASE_URL="https://configure-your-url.com"
 WHISPERX_ASR_MODEL="large-v2"
 WHISPERX_API_KEY="your-secret-key"

renovate.json

@@ -1,5 +1,5 @@
 {
-  "extends": ["github>numerique-gouv/renovate-configuration"],
+  "extends": ["github>suitenumerique/ci//renovate/default"],
   "dependencyDashboard": true,
   "labels": ["dependencies", "noChangeLog"],
   "packageRules": [

src/addons/outlook/src/success/success.js

@@ -21,7 +21,7 @@ const { initI18n, translateUI } = require("../common/i18n");
         document.querySelector("#close-msg").style.display = "block";
       })
       .catch((e) => {
-        console.error(`Error occured: ${e}`);
+        console.error(`Error occurred: ${e}`);
       })
       .finally(() => {
         // NOTE: doesn't work with the desktop client — the browser considers

src/agents/Dockerfile

@@ -1,10 +1,11 @@
-FROM python:3.14.6-slim AS base
+FROM python:3.14.7-slim AS base
 
 # Install system dependencies required by LiveKit, fetching packages over HTTPS only for Bureautix proxy
 RUN sed -i "s|^URIs: http://|URIs: https://|" /etc/apt/sources.list.d/debian.sources \
     && apt-get update && apt-get install -y --no-install-recommends  \
     libglib2.0-0 \
     libgobject-2.0-0 \
+    libpcre2-8-0 \
     libssl3t64 \
     && rm -rf /var/lib/apt/lists/*
 

src/agents/pyproject.toml

@@ -1,7 +1,7 @@
 
 [project]
 name = "agents"
-version = "1.32.1"
+version = "1.34.0"
 requires-python = ">=3.12"
 dependencies = [
     "livekit-agents==1.7.0",

src/agents/uv.lock

@@ -9,7 +9,7 @@ resolution-markers = [
 
 [[package]]
 name = "agents"
-version = "1.32.1"
+version = "1.34.0"
 source = { virtual = "." }
 dependencies = [
     { name = "boto3" },

src/backend/core/admin.py

@@ -483,6 +483,11 @@ class ApplicationAdminForm(forms.ModelForm):
         if self.instance.pk and self.instance.scopes:
             self.fields["scopes"].initial = self.instance.scopes
 
+        # On creation: display generated credentials without allowing edits
+        for name in ("client_id", "client_secret"):
+            if name in self.fields:
+                self.fields[name].widget.attrs["readonly"] = True
+
 
 @admin.register(models.Application)
 class ApplicationAdmin(admin.ModelAdmin):

src/backend/core/api/__init__.py

@@ -73,6 +73,7 @@ def get_frontend_configuration(request):
             "default_sources": settings.LIVEKIT_DEFAULT_SOURCES,
             "default_video_codec": settings.LIVEKIT_DEFAULT_VIDEO_CODEC,
         },
+        "allow_unregistered_rooms": settings.ALLOW_UNREGISTERED_ROOMS,
         "authenticated_users_can_edit_display_name": (
             settings.AUTHENTICATED_PARTICIPANTS_CAN_EDIT_DISPLAY_NAME
         ),

src/backend/core/api/throttling.py

@@ -20,6 +20,33 @@ class MonitoredUserRateThrottle(MonitoredThrottleMixin, UserRateThrottle):
     """Throttle for the monitored scoped rate throttle."""
 
 
+class RoomCreationUserRateThrottle(MonitoredUserRateThrottle):
+    """Throttle room creation per authenticated user.
+
+    Can be declared at the viewset level: every action other than "create"
+    is left unthrottled, so the same class can be reused on any viewset
+    exposing a room creation endpoint.
+    """
+
+    scope = "room_creation"
+
+    def get_cache_key(self, request, view):
+        """Throttle only room creations."""
+        if getattr(view, "action", None) != "create":
+            return None
+        return super().get_cache_key(request, view)
+
+
+class RoomCreationDailyUserRateThrottle(RoomCreationUserRateThrottle):
+    """Cap room creation per authenticated user over a day.
+
+    Complements the short-term RoomCreationUserRateThrottle, which absorbs
+    bursts but lets a user steadily create rooms over hours or days.
+    """
+
+    scope = "room_creation_daily"
+
+
 class RequestEntryAuthenticatedUserRateThrottle(MonitoredUserRateThrottle):
     """Throttle authenticated user requesting room entry"""
 

src/backend/core/api/viewsets.py

@@ -181,6 +181,10 @@ class RoomViewSet(
     permission_classes = [permissions.RoomPermissions]
     queryset = models.Room.objects.all()
     serializer_class = serializers.RoomSerializer
+    throttle_classes = [
+        throttling.RoomCreationUserRateThrottle,
+        throttling.RoomCreationDailyUserRateThrottle,
+    ]
 
     def get_object(self):
         """Allow getting a room by its slug."""

src/backend/core/authentication/backends.py

@@ -1,26 +1,19 @@
 """Authentication Backends for the Meet core app."""
 
-import contextlib
-
 from django.conf import settings
 from django.core.exceptions import (
-    ImproperlyConfigured,
     SuspiciousOperation,
     ValidationError,
 )
 from django.utils.translation import gettext_lazy as _
 
+from lasuite.marketing.tasks import create_or_update_contact
 from lasuite.oidc_login.backends import (
     OIDCAuthenticationBackend as LaSuiteOIDCAuthenticationBackend,
 )
 from rest_framework.authentication import SessionAuthentication
 
 from core.models import User
-from core.services.marketing import (
-    ContactCreationError,
-    ContactData,
-    get_marketing_service,
-)
 from core.validators import sub_validator
 
 
@@ -67,25 +60,15 @@ class OIDCAuthenticationBackend(LaSuiteOIDCAuthenticationBackend):
 
     @staticmethod
     def signup_to_marketing_email(email):
-        """Pragmatic approach to newsletter signup during authentication flow.
+        """Add the user to the newsletter list on sign-in.
 
-        Details:
-        1. Uses a very short timeout (1s) to prevent blocking the auth process
-        2. Silently fails if the marketing service is down/slow to prioritize user experience
-        3. Trade-off: May miss some signups but ensures auth flow remains fast
-
-        Note: For a more robust solution, consider using Async task processing (Celery/Django-Q)
+        Uses the team's standard Brevo integration, dispatching the contact
+        creation/update as an asynchronous task to keep authentication fast.
         """
-        with contextlib.suppress(
-            ContactCreationError, ImproperlyConfigured, ImportError
-        ):
-            marketing_service = get_marketing_service()
-            contact_data = ContactData(
-                email=email, attributes={"VISIO_SOURCE": ["SIGNIN"]}
-            )
-            marketing_service.create_contact(
-                contact_data, timeout=settings.BREVO_API_TIMEOUT
-            )
+        create_or_update_contact.delay(
+            email=email,
+            attributes={"VISIO_SOURCE": ["SIGNIN"]},
+        )
 
     def get_existing_user(self, sub, email):
         """Fetch existing user by sub or email."""

src/backend/core/external_api/viewsets.py

@@ -4,7 +4,6 @@ import copy
 from logging import getLogger
 
 from django.conf import settings
-from django.contrib.auth.hashers import check_password
 from django.core.exceptions import ValidationError
 from django.core.validators import validate_email
 
@@ -74,7 +73,7 @@ class ApplicationViewSet(viewsets.ViewSet):
         except models.Application.DoesNotExist as e:
             raise drf_exceptions.AuthenticationFailed("Invalid credentials") from e
 
-        if not check_password(client_secret, application.client_secret):
+        if not application.check_client_secret(client_secret):
             raise drf_exceptions.AuthenticationFailed("Invalid credentials")
 
         if not application.is_active:

src/backend/core/fields.py

@@ -7,6 +7,8 @@ from logging import getLogger
 from django.contrib.auth.hashers import identify_hasher, make_password
 from django.db import models
 
+from .hashers import CLIENT_SECRET_HASH_PATTERN
+
 logger = getLogger(__name__)
 
 
@@ -24,6 +26,14 @@ class SecretField(models.CharField):
 
         secret = getattr(model_instance, self.attname)
 
+        if CLIENT_SECRET_HASH_PATTERN.fullmatch(secret):
+            logger.debug(
+                "%s: %s is already hashed with sha256.",
+                model_instance,
+                self.attname,
+            )
+            return secret
+
         try:
             hasher = identify_hasher(secret)
             logger.debug(

src/backend/core/hashers.py

@@ -0,0 +1,46 @@
+"""Application secrets only: keep fast hashing out of PASSWORD_HASHERS.
+
+Secrets must be securely randomly generated, not human-chosen.
+"""
+
+import hashlib
+import re
+
+from django.contrib.auth.hashers import check_password
+from django.utils.crypto import constant_time_compare
+from django.utils.encoding import force_bytes
+
+CLIENT_SECRET_HASH_ALGORITHM = "sha256"  # noqa: S105
+CLIENT_SECRET_HASH_VERSION = "v0"  # noqa: S105
+CLIENT_SECRET_HASH_PREFIX = (
+    f"{CLIENT_SECRET_HASH_ALGORITHM}${CLIENT_SECRET_HASH_VERSION}$"
+)
+
+# Accept only the versioned format: sha256$v0$<digest>.
+CLIENT_SECRET_HASH_PATTERN = re.compile(
+    rf"{re.escape(CLIENT_SECRET_HASH_PREFIX)}(?P<digest>[0-9a-f]{{64}})"
+)
+
+
+def _digest(raw_secret):
+    """Return the hex SHA-256 digest of a raw secret."""
+    return hashlib.sha256(force_bytes(raw_secret)).hexdigest()
+
+
+def hash_client_secret(raw_secret):
+    """Hash a machine-generated application secret without key stretching."""
+    return f"{CLIENT_SECRET_HASH_PREFIX}{_digest(raw_secret)}"
+
+
+def verify_client_secret(raw_secret, encoded):
+    """Verify the versioned application format or a legacy Django password hash."""
+    if raw_secret is None:
+        return False
+
+    match = CLIENT_SECRET_HASH_PATTERN.fullmatch(encoded)
+
+    # Legacy path
+    if not match:
+        return check_password(raw_secret, encoded)
+
+    return constant_time_compare(match["digest"], _digest(raw_secret))

src/backend/core/migrations/0025_application_client_secret_sha256.py

@@ -0,0 +1,19 @@
+"""Add a separate fast hash while preserving legacy credentials for rollback."""
+
+from django.db import migrations, models
+
+
+class Migration(migrations.Migration):
+    dependencies = [
+        ("core", "0024_room_last_started_at"),
+    ]
+
+    operations = [
+        migrations.AddField(
+            model_name="application",
+            name="client_secret_sha256",
+            field=models.CharField(
+                max_length=255, null=True, blank=True
+            ),
+        ),
+    ]

src/backend/core/migrations/0026_user_email_upper_idx.py

@@ -0,0 +1,23 @@
+# Generated by Django 5.2.14 on 2026-10-07 18:45
+
+from django.contrib.postgres.operations import AddIndexConcurrently
+from django.db import migrations, models
+from django.db.models.functions import Upper
+
+
+class Migration(migrations.Migration):
+    atomic = False
+
+    dependencies = [
+        ('core', '0025_application_client_secret_sha256'),
+    ]
+
+    operations = [
+        AddIndexConcurrently(
+            model_name="user",
+            index=models.Index(
+                Upper("email"),
+                name="user_email_upper_idx",
+            ),
+        ),
+    ]

src/backend/core/models.py

@@ -14,6 +14,7 @@ from typing import List, Optional
 from django.conf import settings
 from django.contrib.auth import models as auth_models
 from django.contrib.auth.base_user import AbstractBaseUser
+from django.contrib.auth.hashers import identify_hasher
 from django.contrib.postgres.fields import ArrayField
 from django.core import mail, validators
 from django.core.exceptions import PermissionDenied, ValidationError
@@ -25,7 +26,7 @@ from django.utils.translation import gettext_lazy as _
 from lasuite.tools.email import get_domain_from_email
 from timezone_field import TimeZoneField
 
-from . import fields, utils
+from . import fields, hashers, utils
 from .recording.enums import FileExtension
 from .validators import sub_validator
 
@@ -245,6 +246,9 @@ class User(AbstractBaseUser, BaseModel, auth_models.PermissionsMixin):
                 name="unique_email_when_sub_is_null",
             )
         ]
+        indexes = [
+            models.Index(models.functions.Upper("email"), name="user_email_upper_idx"),
+        ]
 
     def __str__(self):
         return self.email or self.admin_email or str(self.id)
@@ -824,6 +828,9 @@ class Application(BaseModel):
         default=utils.generate_client_secret,
         help_text=_("Hashed on Save. Copy it now if this is a new secret."),
     )
+    client_secret_sha256 = models.CharField(
+        max_length=255, null=True, blank=True, editable=False
+    )
     scopes = ArrayField(
         models.CharField(max_length=50, choices=ApplicationScope.choices),
         default=list,
@@ -839,6 +846,63 @@ class Application(BaseModel):
     def __str__(self):
         return f"{self.name!s}"
 
+    def save(self, *args, **kwargs):
+        """Populate the fast hash on creation when the raw secret is available."""
+        if self._state.adding:
+            # Prevent hashing an existing hash instead of the original secret
+            try:
+                if not hashers.CLIENT_SECRET_HASH_PATTERN.fullmatch(self.client_secret):
+                    identify_hasher(self.client_secret)
+            except ValueError:
+                # SecretField.pre_save hashes the legacy field after this method
+                self.client_secret_sha256 = hashers.hash_client_secret(
+                    self.client_secret
+                )
+
+        return super().save(*args, **kwargs)
+
+    def rotate_client_secret(self):
+        """Persist a new generated secret and return its raw value to the caller.
+
+        This is the only supported rotation path while both credential fields coexist.
+        Direct writes may leave a stale fast hash that still accepts the revoked secret,
+        while saving a stale instance may restore previous credentials.
+
+        This transitional risk is accepted until the legacy field is removed
+        and rotation writes only the fast hash.
+        """
+        secret = utils.generate_client_secret()
+        self.client_secret = secret
+        self.client_secret_sha256 = hashers.hash_client_secret(secret)
+        self.save(update_fields=["client_secret", "client_secret_sha256"])
+        return secret
+
+    def check_client_secret(self, raw_secret):
+        """Verify the secret and lazily populate its fast hash for future logins."""
+        if self.client_secret_sha256 is not None:
+            return hashers.verify_client_secret(raw_secret, self.client_secret_sha256)
+
+        original_hash = self.client_secret
+        if not hashers.verify_client_secret(raw_secret, original_hash):
+            return False
+
+        encoded = hashers.hash_client_secret(raw_secret)
+        updated = Application.objects.filter(
+            pk=self.pk, client_secret=original_hash, client_secret_sha256__isnull=True
+        ).update(client_secret_sha256=encoded)
+
+        if updated:
+            self.client_secret_sha256 = encoded
+            return True
+
+        try:
+            self.refresh_from_db()
+        except Application.DoesNotExist:
+            return False
+
+        current_hash = self.client_secret_sha256 or self.client_secret
+        return hashers.verify_client_secret(raw_secret, current_hash)
+
     def can_delegate_email(self, email):
         """Check if this application can delegate the given email."""
 

src/backend/core/recording/worker/services.py

@@ -24,7 +24,7 @@ class BaseEgressService:
 
     def _get_filepath(self, filename: str, extension: str) -> str:
         """Construct the file path for a given filename and extension.
-        Unsecure method, doesn't handle paths robustly and securely.
+        Insecure method, doesn't handle paths robustly and securely.
         """
         return f"{self._config.output_folder}/{filename}.{extension}"
 

src/backend/core/services/marketing.py

@@ -1,138 +0,0 @@
-"""Marketing service in charge of pushing data for marketing automation."""
-
-import logging
-from dataclasses import dataclass
-from functools import lru_cache
-from typing import Dict, List, Optional, Protocol
-
-from django.conf import settings
-from django.core.exceptions import ImproperlyConfigured
-from django.utils.module_loading import import_string
-
-import brevo_python
-import urllib3
-
-logger = logging.getLogger(__name__)
-
-
-class ContactCreationError(Exception):
-    """Raised when the contact creation fails."""
-
-
-@dataclass
-class ContactData:
-    """Contact data for marketing service integration."""
-
-    email: str
-    attributes: Optional[Dict[str, str]] = None
-    list_ids: Optional[List[int]] = None
-    update_enabled: bool = True
-
-
-class MarketingServiceProtocol(Protocol):
-    """Interface for marketing automation service integrations."""
-
-    def create_contact(
-        self, contact_data: ContactData, timeout: Optional[int] = None
-    ) -> dict:
-        """Create or update a contact.
-
-        Args:
-            contact_data: Contact information and attributes
-            timeout: API request timeout in seconds
-
-        Returns:
-            dict: Service response
-
-        Raises:
-            ContactCreationError: If contact creation fails
-        """
-
-
-class BrevoMarketingService:
-    """Brevo marketing automation integration.
-
-    Handles:
-    - Contact management and segmentation
-    - Marketing campaigns and automation
-    - Email communications
-
-    Configuration via Django settings:
-    - BREVO_API_KEY: API authentication
-    - BREVO_API_CONTACT_LIST_IDS: Default contact lists
-    - BREVO_API_CONTACT_ATTRIBUTES: Default contact attributes
-    """
-
-    def __init__(self):
-        """Initialize Brevo (ex-sendinblue) marketing service."""
-
-        if not settings.BREVO_API_KEY:
-            raise ImproperlyConfigured("Brevo API key is required")
-
-        configuration = brevo_python.Configuration()
-        configuration.api_key["api-key"] = settings.BREVO_API_KEY
-
-        self._api_client = brevo_python.ApiClient(configuration)
-
-    def create_contact(self, contact_data: ContactData, timeout=None) -> dict:
-        """Create or update a Brevo contact.
-
-        Args:
-            contact_data: Contact information and attributes
-            timeout: API request timeout in seconds
-
-        Returns:
-            dict: Brevo API response
-
-        Raises:
-            ContactCreationError: If contact creation fails
-            ImproperlyConfigured: If required settings are missing
-
-        Note:
-            Contact attributes must be pre-configured in Brevo.
-            Changes to attributes can impact existing workflows.
-        """
-
-        if not settings.BREVO_API_CONTACT_LIST_IDS:
-            raise ImproperlyConfigured(
-                "Default Brevo List IDs must be configured in settings."
-            )
-
-        contact_api = brevo_python.ContactsApi(self._api_client)
-
-        attributes = {
-            **settings.BREVO_API_CONTACT_ATTRIBUTES,
-            **(contact_data.attributes or {}),
-        }
-
-        list_ids = (contact_data.list_ids or []) + settings.BREVO_API_CONTACT_LIST_IDS
-
-        contact = brevo_python.CreateContact(
-            email=contact_data.email,
-            attributes=attributes,
-            list_ids=list_ids,
-            update_enabled=contact_data.update_enabled,
-        )
-
-        api_configurations = {}
-
-        if timeout is not None:
-            api_configurations["_request_timeout"] = timeout
-
-        try:
-            response = contact_api.create_contact(contact, **api_configurations)
-        except (
-            brevo_python.rest.ApiException,
-            urllib3.exceptions.ReadTimeoutError,
-        ) as err:
-            logger.warning("Failed to create contact in Brevo", exc_info=True)
-            raise ContactCreationError("Failed to create contact in Brevo") from err
-
-        return response
-
-
-@lru_cache(maxsize=1)
-def get_marketing_service() -> MarketingServiceProtocol:
-    """Return cached instance of configured marketing service."""
-    marketing_service_cls = import_string(settings.MARKETING_SERVICE_CLASS)
-    return marketing_service_cls()

src/backend/core/tests/authentication/test_backends.py

@@ -2,14 +2,14 @@
 
 from unittest import mock
 
-from django.core.exceptions import ImproperlyConfigured, SuspiciousOperation
+from django.core.exceptions import SuspiciousOperation
 
 import pytest
+from lasuite.marketing.tasks import create_or_update_contact
 
 from core import models
 from core.authentication.backends import OIDCAuthenticationBackend
 from core.factories import UserFactory
-from core.services import marketing
 
 pytestmark = pytest.mark.django_db
 
@@ -606,8 +606,8 @@ def test_marketing_signup_existing_user(
     mock_signup.assert_not_called()
 
 
-@mock.patch("core.authentication.backends.get_marketing_service")
-def test_signup_to_marketing_email_success(mock_marketing):
+@mock.patch.object(create_or_update_contact, "delay")
+def test_signup_to_marketing_email_success(mock_create_or_update_contact):
     """Test successful marketing signup."""
 
     email = "test@example.com"
@@ -616,46 +616,6 @@ def test_signup_to_marketing_email_success(mock_marketing):
     OIDCAuthenticationBackend.signup_to_marketing_email(email)
 
     # Verify service interaction
-    mock_service = mock_marketing.return_value
-    mock_service.create_contact.assert_called_once()
-
-
-@pytest.mark.parametrize(
-    "error",
-    [
-        ImportError,
-        ImproperlyConfigured,
-    ],
-)
-@mock.patch("core.authentication.backends.get_marketing_service")
-def test_marketing_signup_handles_service_initialization_errors(
-    mock_marketing, error, settings
-):
-    """Tests errors that occur when trying to get/initialize the marketing service."""
-    settings.SIGNUP_NEW_USER_TO_MARKETING_EMAIL = True
-
-    mock_marketing.side_effect = error
-
-    # Should not raise any exception
-    OIDCAuthenticationBackend.signup_to_marketing_email("test@example.com")
-
-
-@pytest.mark.parametrize(
-    "error",
-    [
-        marketing.ContactCreationError,
-        ImproperlyConfigured,
-        ImportError,
-    ],
-)
-@mock.patch("core.authentication.backends.get_marketing_service")
-def test_marketing_signup_handles_contact_creation_errors(
-    mock_marketing, error, settings
-):
-    """Tests errors that occur during the contact creation process."""
-
-    settings.SIGNUP_NEW_USER_TO_MARKETING_EMAIL = True
-    mock_marketing.return_value.create_contact.side_effect = error
-
-    # Should not raise any exception
-    OIDCAuthenticationBackend.signup_to_marketing_email("test@example.com")
+    mock_create_or_update_contact.assert_called_once_with(
+        email=email, attributes={"VISIO_SOURCE": ["SIGNIN"]}
+    )

src/backend/core/tests/files/test_api_files_list.py

@@ -27,7 +27,7 @@ def test_api_files_list_anonymous_not_allowed():
 
 def test_api_files_list_authentificated_user_allowed():
     """
-    Authentificated users should be allowed to list files
+    Authenticated users should be allowed to list files
     """
     user = factories.UserFactory()
     client = APIClient()

src/backend/core/tests/rooms/test_api_rooms_create.py

@@ -9,6 +9,10 @@ from django.core.cache import cache
 import pytest
 from rest_framework.test import APIClient
 
+from ...api.throttling import (
+    RoomCreationDailyUserRateThrottle,
+    RoomCreationUserRateThrottle,
+)
 from ...factories import RoomFactory, UserFactory
 from ...models import Room, RoomAccessLevel
 
@@ -312,3 +316,145 @@ def test_api_rooms_create_authenticated_blank_user_default_access_level():
     assert response.status_code == 201
     room = Room.objects.get()
     assert room.access_level == settings.RESOURCE_DEFAULT_ACCESS_LEVEL
+
+
+@pytest.fixture
+def room_creation_throttle(monkeypatch):
+    """Lower the room creation rate for the duration of a test."""
+    monkeypatch.setitem(
+        settings.REST_FRAMEWORK["DEFAULT_THROTTLE_RATES"], "room_creation", "2/minute"
+    )
+
+
+def test_api_rooms_create_throttled(room_creation_throttle):
+    """Excess requests are rejected and create no room."""
+
+    client = APIClient()
+    client.force_login(UserFactory())
+
+    for index in range(2):
+        response = client.post("/api/v1.0/rooms/", {"name": f"Room {index}"})
+        assert response.status_code == 201
+
+    response = client.post("/api/v1.0/rooms/", {"name": "Blocked room"})
+    assert response.status_code == 429
+    assert 0 < int(response["Retry-After"]) <= 60
+    assert Room.objects.count() == 2
+
+
+def test_api_rooms_create_throttle_per_user(room_creation_throttle):
+    """Users sharing an IP have independent creation limits."""
+
+    client = APIClient()
+    client.force_login(UserFactory())
+    for index in range(2):
+        response = client.post("/api/v1.0/rooms/", {"name": f"First user room {index}"})
+        assert response.status_code == 201
+
+    response = client.post("/api/v1.0/rooms/", {"name": "Blocked room"})
+    assert response.status_code == 429
+
+    client.force_login(UserFactory())
+    response = client.post("/api/v1.0/rooms/", {"name": "Second user room"})
+    assert response.status_code == 201
+
+
+def test_api_rooms_create_throttle_does_not_limit_other_actions(room_creation_throttle):
+    """Exhausting creation capacity leaves listing and updating available."""
+
+    client = APIClient()
+    client.force_login(UserFactory())
+    for index in range(2):
+        response = client.post("/api/v1.0/rooms/", {"name": f"Room {index}"})
+        assert response.status_code == 201
+    room_id = response.json()["id"]
+
+    assert client.post("/api/v1.0/rooms/", {"name": "Blocked room"}).status_code == 429
+    assert client.get("/api/v1.0/rooms/").status_code == 200
+    assert (
+        client.patch(
+            f"/api/v1.0/rooms/{room_id}/", {"name": "Renamed room"}
+        ).status_code
+        == 200
+    )
+
+
+@pytest.fixture
+def daily_room_creation_throttle(monkeypatch):
+    """Use a tiny daily cap, a loose burst limit and a controllable clock.
+
+    Rates are patched with monkeypatch.setitem so they are restored after the
+    test. Returns a one-item list holding the current fake timestamp.
+    """
+    rates = RoomCreationDailyUserRateThrottle.THROTTLE_RATES
+    monkeypatch.setitem(rates, "room_creation", "100/minute")
+    monkeypatch.setitem(rates, "room_creation_daily", "3/day")
+    now = [1_000_000.0]
+    monkeypatch.setattr(RoomCreationUserRateThrottle, "timer", lambda self: now[0])
+    return now
+
+
+def test_api_rooms_create_daily_throttled(daily_room_creation_throttle):
+    """The daily cap still applies once the short-term window has elapsed."""
+    now = daily_room_creation_throttle
+    client = APIClient()
+    client.force_login(UserFactory())
+
+    for index in range(3):
+        response = client.post("/api/v1.0/rooms/", {"name": f"Room {index}"})
+        assert response.status_code == 201
+        now[0] += 120  # Spread creations beyond the short-term window.
+
+    response = client.post("/api/v1.0/rooms/", {"name": "Blocked room"})
+    assert response.status_code == 429
+    assert int(response["Retry-After"]) > 60
+    assert Room.objects.count() == 3
+
+
+def test_api_rooms_create_daily_throttle_resets(daily_room_creation_throttle):
+    """Room creation is allowed again once a day has passed."""
+    now = daily_room_creation_throttle
+    client = APIClient()
+    client.force_login(UserFactory())
+
+    for index in range(3):
+        response = client.post("/api/v1.0/rooms/", {"name": f"Room {index}"})
+        assert response.status_code == 201
+
+    response = client.post("/api/v1.0/rooms/", {"name": "Blocked room"})
+    assert response.status_code == 429
+
+    now[0] += 24 * 60 * 60 + 1
+    response = client.post("/api/v1.0/rooms/", {"name": "Next day room"})
+    assert response.status_code == 201
+
+
+def test_api_rooms_create_daily_throttle_per_user(daily_room_creation_throttle):
+    """Each user has its own daily cap."""
+    client = APIClient()
+    client.force_login(UserFactory())
+    for index in range(3):
+        response = client.post("/api/v1.0/rooms/", {"name": f"Room {index}"})
+        assert response.status_code == 201
+    assert client.post("/api/v1.0/rooms/", {"name": "Blocked"}).status_code == 429
+
+    client.force_login(UserFactory())
+    response = client.post("/api/v1.0/rooms/", {"name": "Other user room"})
+    assert response.status_code == 201
+
+
+def test_api_rooms_create_daily_throttle_does_not_limit_other_actions(
+    daily_room_creation_throttle,
+):
+    """Reaching the daily cap leaves listing and updating available."""
+    client = APIClient()
+    client.force_login(UserFactory())
+    for index in range(3):
+        response = client.post("/api/v1.0/rooms/", {"name": f"Room {index}"})
+        assert response.status_code == 201
+    room_id = response.json()["id"]
+
+    assert client.post("/api/v1.0/rooms/", {"name": "Blocked"}).status_code == 429
+    assert client.get("/api/v1.0/rooms/").status_code == 200
+    response = client.patch(f"/api/v1.0/rooms/{room_id}/", {"name": "Renamed"})
+    assert response.status_code == 200

src/backend/core/tests/rooms/test_api_rooms_participants_management.py

@@ -458,7 +458,7 @@ def test_mute_participant_livekit_token_presence_check_twirp_error_forbidden(
     room = RoomFactory()
 
     mock_livekit_client.room.get_participant.side_effect = TwirpError(
-        msg="an error occured", code="not_found", status=500
+        msg="an error occurred", code="not_found", status=500
     )
 
     user = AnonymousUser()

src/backend/core/tests/services/test_marketing.py

@@ -1,212 +0,0 @@
-"""
-Test marketing services.
-"""
-
-# pylint: disable=W0621,W0613
-
-from unittest import mock
-
-from django.conf import settings
-from django.core.exceptions import ImproperlyConfigured
-
-import brevo_python
-import pytest
-import urllib3
-
-from core.services.marketing import (
-    BrevoMarketingService,
-    ContactCreationError,
-    ContactData,
-    get_marketing_service,
-)
-
-
-def test_init_missing_api_key(settings):
-    """Test initialization with missing API key."""
-    settings.BREVO_API_KEY = None
-    with pytest.raises(ImproperlyConfigured, match="Brevo API key is required"):
-        BrevoMarketingService()
-
-
-def test_create_contact_missing_list_ids(settings):
-    """Test contact creation with missing list IDs."""
-
-    settings.BREVO_API_KEY = "test-api-key"
-    settings.BREVO_API_CONTACT_LIST_IDS = None
-    settings.BREVO_API_CONTACT_ATTRIBUTES = {"source": "test"}
-
-    valid_contact_data = ContactData(
-        email="test@example.com",
-        attributes={"first_name": "Test"},
-        list_ids=[1, 2],
-        update_enabled=True,
-    )
-
-    brevo_service = BrevoMarketingService()
-
-    with pytest.raises(
-        ImproperlyConfigured, match="Default Brevo List IDs must be configured"
-    ):
-        brevo_service.create_contact(valid_contact_data)
-
-
-@mock.patch("brevo_python.ContactsApi")
-def test_create_contact_success(mock_contact_api):
-    """Test successful contact creation."""
-
-    mock_api = mock_contact_api.return_value
-
-    settings.BREVO_API_KEY = "test-api-key"
-    settings.BREVO_API_CONTACT_LIST_IDS = [1, 2, 3, 4]
-    settings.BREVO_API_CONTACT_ATTRIBUTES = {"source": "test"}
-
-    valid_contact_data = ContactData(
-        email="test@example.com",
-        attributes={"first_name": "Test"},
-        list_ids=[1, 2],
-        update_enabled=True,
-    )
-
-    brevo_service = BrevoMarketingService()
-
-    mock_api.create_contact.return_value = {"id": "test-id"}
-    response = brevo_service.create_contact(valid_contact_data)
-
-    assert response == {"id": "test-id"}
-
-    mock_api.create_contact.assert_called_once()
-    contact_arg = mock_api.create_contact.call_args[0][0]
-    assert contact_arg.email == "test@example.com"
-    assert contact_arg.attributes == {
-        **settings.BREVO_API_CONTACT_ATTRIBUTES,
-        **valid_contact_data.attributes,
-    }
-    assert set(contact_arg.list_ids) == {1, 2, 3, 4}
-    assert contact_arg.update_enabled is True
-
-
-@mock.patch("brevo_python.ContactsApi")
-def test_create_contact_with_timeout(mock_contact_api):
-    """Test contact creation with timeout."""
-
-    mock_api = mock_contact_api.return_value
-
-    settings.BREVO_API_KEY = "test-api-key"
-    settings.BREVO_API_CONTACT_LIST_IDS = [1, 2, 3, 4]
-    settings.BREVO_API_CONTACT_ATTRIBUTES = {"source": "test"}
-
-    valid_contact_data = ContactData(
-        email="test@example.com",
-        attributes={"first_name": "Test"},
-        list_ids=[1, 2],
-        update_enabled=True,
-    )
-
-    brevo_service = BrevoMarketingService()
-    brevo_service.create_contact(valid_contact_data, timeout=30)
-
-    mock_api.create_contact.assert_called_once()
-    assert mock_api.create_contact.call_args[1]["_request_timeout"] == 30
-
-
-@mock.patch("brevo_python.ContactsApi")
-def test_create_contact_api_error(mock_contact_api):
-    """Test contact creation API error handling."""
-
-    mock_api = mock_contact_api.return_value
-
-    settings.BREVO_API_KEY = "test-api-key"
-    settings.BREVO_API_CONTACT_LIST_IDS = [1, 2, 3, 4]
-    settings.BREVO_API_CONTACT_ATTRIBUTES = {"source": "test"}
-
-    valid_contact_data = ContactData(
-        email="test@example.com",
-        attributes={"first_name": "Test"},
-        list_ids=[1, 2],
-        update_enabled=True,
-    )
-
-    brevo_service = BrevoMarketingService()
-
-    mock_api.create_contact.side_effect = brevo_python.rest.ApiException()
-
-    with pytest.raises(ContactCreationError, match="Failed to create contact in Brevo"):
-        brevo_service.create_contact(valid_contact_data)
-
-
-@mock.patch("brevo_python.ContactsApi")
-def test_create_contact_timeout_error(mock_contact_api):
-    """Test contact creation timeout error handling."""
-
-    mock_api = mock_contact_api.return_value
-    settings.BREVO_API_KEY = "test-api-key"
-    settings.BREVO_API_CONTACT_LIST_IDS = [1, 2, 3, 4]
-    settings.BREVO_API_CONTACT_ATTRIBUTES = {"source": "test"}
-
-    valid_contact_data = ContactData(
-        email="test@example.com",
-        attributes={"first_name": "Test"},
-        list_ids=[1, 2],
-        update_enabled=True,
-    )
-
-    brevo_service = BrevoMarketingService()
-
-    mock_api.create_contact.side_effect = urllib3.exceptions.ReadTimeoutError(
-        pool=mock.Mock(),
-        url="https://api.brevo.com/v3/endpoint",
-        message="HTTPSConnectionPool(host='api.brevo.com', port=443): Read timed out.",
-    )
-
-    with pytest.raises(ContactCreationError, match="Failed to create contact in Brevo"):
-        brevo_service.create_contact(valid_contact_data)
-
-
-@pytest.fixture
-def clear_marketing_cache():
-    """Clear marketing service cache between tests."""
-    get_marketing_service.cache_clear()
-    yield
-    get_marketing_service.cache_clear()
-
-
-def test_get_marketing_service_caching(clear_marketing_cache):
-    """Test marketing service caching behavior."""
-    settings.BREVO_API_KEY = "test-api-key"
-    settings.MARKETING_SERVICE_CLASS = "core.services.marketing.BrevoMarketingService"
-
-    service1 = get_marketing_service()
-    service2 = get_marketing_service()
-
-    assert service1 is service2
-    assert isinstance(service1, BrevoMarketingService)
-
-
-def test_get_marketing_service_invalid_class(clear_marketing_cache):
-    """Test handling of invalid service class."""
-    settings.MARKETING_SERVICE_CLASS = "invalid.service.path"
-
-    with pytest.raises(ImportError):
-        get_marketing_service()
-
-
-@mock.patch("core.services.marketing.import_string")
-def test_service_instantiation_called_once(mock_import_string, clear_marketing_cache):
-    """Test service class is instantiated only once."""
-
-    settings.BREVO_API_KEY = "test-api-key"
-    settings.MARKETING_SERVICE_CLASS = "core.services.marketing.BrevoMarketingService"
-    get_marketing_service.cache_clear()
-
-    mock_service_cls = mock.Mock()
-    mock_service_instance = mock.Mock()
-    mock_service_cls.return_value = mock_service_instance
-    mock_import_string.return_value = mock_service_cls
-
-    service1 = get_marketing_service()
-    service2 = get_marketing_service()
-
-    mock_import_string.assert_called_once_with(settings.MARKETING_SERVICE_CLASS)
-    mock_service_cls.assert_called_once()
-    assert service1 is service2
-    assert service1 is mock_service_instance

src/backend/core/tests/services/test_sip_management.py

@@ -1,5 +1,5 @@
 """
-Test SIP mamagement service.
+Test SIP management service.
 """
 
 # pylint: disable=W0212

src/backend/core/tests/test_application_secret_hashers.py

@@ -0,0 +1,350 @@
+"""Application hashing and migration of existing credentials."""
+
+import hashlib
+from unittest import mock
+
+from django.contrib.auth.hashers import check_password, identify_hasher, make_password
+from django.db import connection
+from django.test.utils import CaptureQueriesContext
+from django.utils.crypto import get_random_string
+
+import pytest
+from rest_framework.test import APIClient
+
+from core import hashers
+from core.factories import ApplicationFactory, UserFactory
+from core.models import Application
+
+pytestmark = pytest.mark.django_db
+
+
+@pytest.mark.parametrize("secret", ["short", "a" * 128, b"byte-secret"])
+def test_application_hash(secret):
+    """Application hashes verify correctly but are not accepted for user passwords."""
+    encoded = hashers.hash_client_secret(secret)
+    raw = secret.encode() if isinstance(secret, str) else secret
+    algorithm, version, digest = encoded.split("$")
+    assert algorithm == "sha256"
+    assert version == "v0"
+    assert digest == hashlib.sha256(raw).hexdigest()
+    assert hashers.hash_client_secret(secret) == encoded
+    assert hashers.verify_client_secret(secret, encoded)
+    assert not hashers.verify_client_secret("wrong", encoded)
+    assert not hashers.verify_client_secret(None, encoded)
+    assert not hashers.verify_client_secret(secret, "sha256$invalid")
+    assert not hashers.verify_client_secret(secret, "sha256$v1$" + digest)
+    assert not check_password(secret, encoded)
+    with pytest.raises(ValueError):
+        identify_hasher(encoded)
+    assert not make_password(raw.decode()).startswith("sha256$")
+
+
+@pytest.mark.parametrize("algorithm", ["pbkdf2_sha256", "md5"])
+def test_token_migrates_legacy_secret_once(algorithm):
+    """The same client secret works before and after migration, with no later writes."""
+    secret = get_random_string(128)
+    user = UserFactory()
+    legacy = make_password(secret, hasher=algorithm)
+    app = ApplicationFactory(client_secret=legacy)
+    app.refresh_from_db()
+
+    assert app.client_secret == legacy
+    assert app.client_secret_sha256 is None
+    payload = {
+        "client_id": app.client_id,
+        "client_secret": secret,
+        "grant_type": "client_credentials",
+        "scope": user.email,
+    }
+    client = APIClient()
+    response = client.post(
+        "/external-api/v1.0/application/token/", payload, format="json"
+    )
+    assert response.status_code == 200
+    app.refresh_from_db()
+    migrated = app.client_secret_sha256
+    assert check_password(secret, app.client_secret)
+    assert hashers.CLIENT_SECRET_HASH_PATTERN.fullmatch(migrated)["digest"]
+    assert hashers.verify_client_secret(secret, migrated)
+    with CaptureQueriesContext(connection) as queries:
+        response = client.post(
+            "/external-api/v1.0/application/token/", payload, format="json"
+        )
+    assert response.status_code == 200
+    assert not any(q["sql"].lstrip().startswith("UPDATE") for q in queries)
+    app.refresh_from_db()
+    assert app.client_secret_sha256 == migrated
+    assert app.client_secret == legacy
+
+
+def test_wrong_secret_does_not_migrate():
+    """Failed authentication leaves a production PBKDF2 hash untouched."""
+    user = UserFactory()
+    legacy = make_password(get_random_string(128), hasher="pbkdf2_sha256")
+    app = ApplicationFactory(client_secret=legacy)
+    response = APIClient().post(
+        "/external-api/v1.0/application/token/",
+        {
+            "client_id": app.client_id,
+            "client_secret": "wrong",
+            "grant_type": "client_credentials",
+            "scope": user.email,
+        },
+        format="json",
+    )
+    assert response.status_code == 401
+    app.refresh_from_db()
+    assert app.client_secret == legacy
+    assert app.client_secret_sha256 is None
+
+
+def test_migration_preserves_concurrent_rotation():
+    """Migration must not restore a secret rotated after verification."""
+    secret = get_random_string(128)
+    app = ApplicationFactory(
+        client_secret=make_password(secret, hasher="pbkdf2_sha256")
+    )
+    replacement = make_password(get_random_string(128), hasher="pbkdf2_sha256")
+
+    def verify_then_rotate(raw, encoded):
+        verified = check_password(raw, encoded)
+        Application.objects.filter(pk=app.pk).update(client_secret=replacement)
+        return verified
+
+    with mock.patch.object(hashers, "check_password", side_effect=verify_then_rotate):
+        assert app.check_client_secret(secret) is False
+
+    app.refresh_from_db()
+    assert app.client_secret == replacement
+    assert app.client_secret_sha256 is None
+
+
+def test_migration_preserves_concurrent_migration():
+    """Authentication succeeds when another request migrates the same secret."""
+    secret = get_random_string(128)
+    app = ApplicationFactory(
+        client_secret=make_password(secret, hasher="pbkdf2_sha256")
+    )
+    migrated = hashers.hash_client_secret(secret)
+
+    def verify_then_migrate(raw, encoded):
+        verified = check_password(raw, encoded)
+        Application.objects.filter(pk=app.pk).update(client_secret_sha256=migrated)
+        return verified
+
+    with mock.patch.object(hashers, "check_password", side_effect=verify_then_migrate):
+        assert app.check_client_secret(secret) is True
+
+    app.refresh_from_db()
+    assert app.client_secret_sha256 == migrated
+
+
+def test_migration_preserves_concurrent_deletion():
+    """Authentication fails when the application is deleted after verification."""
+    secret = get_random_string(128)
+    app = ApplicationFactory(
+        client_secret=make_password(secret, hasher="pbkdf2_sha256")
+    )
+
+    def verify_then_delete(raw, encoded):
+        verified = check_password(raw, encoded)
+        Application.objects.filter(pk=app.pk).delete()
+        return verified
+
+    with mock.patch.object(hashers, "check_password", side_effect=verify_then_delete):
+        assert app.check_client_secret(secret) is False
+
+    assert not Application.objects.filter(pk=app.pk).exists()
+
+
+@pytest.mark.parametrize(
+    "secret",
+    [
+        "sha256$my-secret",
+        "sha256$" + "a" * 63,
+        "sha256$" + "a" * 64,
+        "sha256$" + "g" * 64,
+        "sha256$" + "a" * 64 + "\n",
+        "sha256$$" + "a" * 64,
+        "sha256$short$" + "a" * 64,
+        "sha256$" + "b" * 22 + "$" + "g" * 64,
+        "sha256$" + "b" * 22 + "$" + "a" * 64,
+        "sha256$v0$" + "g" * 64,
+        "sha256$v0$" + "a" * 63,
+        "sha256$v1$" + "a" * 64,
+    ],
+)
+def test_prefixed_plaintext_is_hashed(secret):
+    """A prefix alone must not cause a raw secret to bypass hashing."""
+    assert not hashers.CLIENT_SECRET_HASH_PATTERN.fullmatch(secret)
+    app = ApplicationFactory(client_secret=secret)
+    app.refresh_from_db()
+    encoded = app.client_secret_sha256
+    assert encoded != secret
+    assert hashers.CLIENT_SECRET_HASH_PATTERN.fullmatch(encoded)["digest"]
+    assert app.check_client_secret(secret)
+    app.name = "Updated application"
+    app.save()
+    app.refresh_from_db()
+    assert app.client_secret_sha256 == encoded
+
+
+def test_unsalted_secret_is_rejected():
+    """Only salted SHA-256 hashes are accepted."""
+    secret = get_random_string(128)
+    encoded = f"sha256${hashlib.sha256(secret.encode()).hexdigest()}"
+
+    assert hashers.CLIENT_SECRET_HASH_PATTERN.fullmatch(encoded) is None
+    assert not hashers.verify_client_secret(secret, encoded)
+
+
+def test_new_application_supports_legacy_verification(settings):
+    """A rollback can authenticate applications created by the new release."""
+    settings.PASSWORD_HASHERS = [
+        "django.contrib.auth.hashers.PBKDF2PasswordHasher",
+    ]
+    secret = get_random_string(128)
+    app = ApplicationFactory(client_secret=secret)
+    app.refresh_from_db()
+    assert app.client_secret.startswith("pbkdf2_sha256$")
+    assert check_password(secret, app.client_secret)
+    assert hashers.verify_client_secret(secret, app.client_secret_sha256)
+    with mock.patch.object(hashers, "check_password", side_effect=AssertionError):
+        assert app.check_client_secret(secret)
+        assert not app.check_client_secret("wrong")
+
+
+def test_unrelated_save_preserves_both_hashes():
+    """Saving an application's metadata does not change either credential hash."""
+    app = ApplicationFactory()
+    original = (app.client_secret, app.client_secret_sha256)
+    app.name = "Renamed"
+    app.save()
+    app.refresh_from_db()
+    assert (app.client_secret, app.client_secret_sha256) == original
+
+
+def test_creation_with_legacy_hash_defers_fast_hash_until_login():
+    """An imported Django hash is preserved, never treated as the raw secret."""
+    secret = get_random_string(128)
+    legacy = make_password(secret, hasher="pbkdf2_sha256")
+    app = ApplicationFactory(client_secret=legacy)
+    app.refresh_from_db()
+    assert app.client_secret == legacy
+    assert app.client_secret_sha256 is None
+    assert not app.check_client_secret(legacy)
+    assert app.check_client_secret(secret)
+    app.refresh_from_db()
+    assert app.client_secret == legacy
+    assert hashers.verify_client_secret(secret, app.client_secret_sha256)
+
+
+def test_metadata_only_save_does_not_rotate_secret():
+    """A secret excluded from update_fields must not change either stored hash."""
+    app = ApplicationFactory()
+    original = (app.client_secret, app.client_secret_sha256)
+    app.client_secret = get_random_string(128)
+    app.name = "Renamed"
+    app.save(update_fields=["name"])
+    app.refresh_from_db()
+    assert (app.client_secret, app.client_secret_sha256) == original
+
+
+def test_empty_update_fields_does_not_rotate_secret():
+    """Django's explicit no-op save must not update either credential field."""
+    app = ApplicationFactory()
+    original = (app.client_secret, app.client_secret_sha256)
+    app.client_secret = get_random_string(128)
+    with CaptureQueriesContext(connection) as queries:
+        app.save(update_fields=[])
+    assert not any(q["sql"].lstrip().startswith("UPDATE") for q in queries)
+    app.refresh_from_db()
+    assert (app.client_secret, app.client_secret_sha256) == original
+
+
+def test_creation_with_salted_hash_skips_fast_hash():
+    """An existing salted hash must not be hashed again as plaintext."""
+    encoded = hashers.hash_client_secret(get_random_string(128))
+    app = ApplicationFactory(client_secret=encoded)
+    app.refresh_from_db()
+    assert app.client_secret == encoded
+    assert app.client_secret_sha256 is None
+
+
+@pytest.mark.parametrize("legacy_only", [False, True])
+def test_rotate_client_secret_updates_both_hashes(legacy_only, settings):
+    """Rotation revokes the old secret for both current and rollback releases."""
+    settings.PASSWORD_HASHERS = [
+        "django.contrib.auth.hashers.PBKDF2PasswordHasher",
+    ]
+    secret = get_random_string(128)
+    app = ApplicationFactory(
+        client_secret=make_password(secret) if legacy_only else secret
+    )
+
+    replacement = app.rotate_client_secret()
+
+    assert replacement != secret
+    assert len(replacement) == settings.APPLICATION_CLIENT_SECRET_LENGTH
+    assert app.check_client_secret(replacement)
+    assert not app.check_client_secret(secret)
+    app.refresh_from_db()
+    assert app.client_secret.startswith("pbkdf2_sha256$")
+    assert check_password(replacement, app.client_secret)
+    assert not check_password(secret, app.client_secret)
+    assert hashers.verify_client_secret(replacement, app.client_secret_sha256)
+    assert not app.check_client_secret(secret)
+    assert app.client_secret != replacement
+    assert app.client_secret_sha256 != replacement
+
+
+def test_rotate_client_secret_preserves_metadata():
+    """Rotation persists only the credential fields, not other pending changes."""
+    app = ApplicationFactory()
+    original_name = app.name
+    original_client_id = app.client_id
+    app.name = "Unsaved metadata"
+
+    app.rotate_client_secret()
+
+    app.refresh_from_db()
+    assert app.name == original_name
+    assert app.client_id == original_client_id
+
+
+def test_rotate_client_secret_repeatedly_revokes_previous_secrets():
+    """Only the latest generated secret remains valid after successive rotations."""
+    original = get_random_string(128)
+    app = ApplicationFactory(client_secret=original)
+    first = app.rotate_client_secret()
+    second = app.rotate_client_secret()
+
+    app.refresh_from_db()
+    assert len({original, first, second}) == 3
+    assert app.check_client_secret(second)
+    assert check_password(second, app.client_secret)
+    for revoked in (original, first):
+        assert not app.check_client_secret(revoked)
+        assert not check_password(revoked, app.client_secret)
+
+
+def test_token_endpoint_rejects_rotated_secret():
+    """New token requests reject the revoked secret and accept its replacement."""
+    secret = get_random_string(128)
+    app = ApplicationFactory(client_secret=secret)
+    user = UserFactory()
+    client = APIClient()
+    payload = {
+        "client_id": app.client_id,
+        "client_secret": secret,
+        "grant_type": "client_credentials",
+        "scope": user.email,
+    }
+    endpoint = "/external-api/v1.0/application/token/"
+    assert client.post(endpoint, payload, format="json").status_code == 200
+
+    replacement = app.rotate_client_secret()
+
+    assert client.post(endpoint, payload, format="json").status_code == 401
+    payload["client_secret"] = replacement
+    assert client.post(endpoint, payload, format="json").status_code == 200

src/backend/core/tests/test_external_api_token.py

@@ -7,17 +7,20 @@ Tests for external API /token endpoint
 from unittest import mock
 from urllib.parse import urlencode
 
+from django.contrib.auth.hashers import check_password
+
 import jwt
 import pytest
 from freezegun import freeze_time
 from rest_framework.test import APIClient
 
+from core import hashers
 from core.factories import (
     ApplicationDomainFactory,
     ApplicationFactory,
     UserFactory,
 )
-from core.models import ApplicationScope, User
+from core.models import Application, ApplicationScope, User
 from core.services import provisional_user_service
 
 pytestmark = pytest.mark.django_db
@@ -28,15 +31,13 @@ def test_api_applications_generate_token_application_disabled(settings):
     settings.APPLICATION_ENABLED = False
 
     user = UserFactory(email="user@example.com")
+    plain_secret = "test-secret-123"
     application = ApplicationFactory(
+        client_secret=plain_secret,
         is_active=True,
         scopes=[ApplicationScope.ROOMS_LIST],
     )
 
-    plain_secret = "test-secret-123"
-    application.client_secret = plain_secret
-    application.save()
-
     client = APIClient()
     response = client.post(
         "/external-api/v1.0/application/token/",
@@ -55,16 +56,13 @@ def test_api_applications_generate_token_application_disabled(settings):
 def test_api_applications_generate_token_success(settings):
     """Valid credentials should return a JWT token."""
     UserFactory(email="User.Family@example.com")
+    plain_secret = "test-secret-123"
     application = ApplicationFactory(
+        client_secret=plain_secret,
         is_active=True,
         scopes=[ApplicationScope.ROOMS_LIST, ApplicationScope.ROOMS_CREATE],
     )
 
-    # Store plain secret before it's hashed
-    plain_secret = "test-secret-123"
-    application.client_secret = plain_secret
-    application.save()
-
     client = APIClient()
     response = client.post(
         "/external-api/v1.0/application/token/",
@@ -95,15 +93,13 @@ def test_api_applications_generate_token_form_urlencoded(settings):
     token endpoints, so that standard OAuth 2.0 client libraries work
     out of the box."""
     UserFactory(email="user@example.com")
+    plain_secret = "test-secret-123"
     application = ApplicationFactory(
+        client_secret=plain_secret,
         is_active=True,
         scopes=[ApplicationScope.ROOMS_LIST, ApplicationScope.ROOMS_CREATE],
     )
 
-    plain_secret = "test-secret-123"
-    application.client_secret = plain_secret
-    application.save()
-
     client = APIClient()
     response = client.post(
         "/external-api/v1.0/application/token/",
@@ -170,11 +166,8 @@ def test_api_applications_generate_token_form_urlencoded_missing_fields():
 def test_api_applications_generate_token_form_urlencoded_invalid_grant_type():
     """An unsupported grant_type sent as form-urlencoded should return 400."""
     user = UserFactory(email="user@example.com")
-    application = ApplicationFactory(is_active=True)
-
     plain_secret = "test-secret-123"
-    application.client_secret = plain_secret
-    application.save()
+    application = ApplicationFactory(client_secret=plain_secret, is_active=True)
 
     client = APIClient()
     response = client.post(
@@ -198,15 +191,13 @@ def test_api_applications_generate_token_form_urlencoded_special_characters():
     """Percent-encoded reserved characters ("&", "=", "+", "%") in the
     client_secret should survive form-urlencoded decoding."""
     UserFactory(email="user@example.com")
+    plain_secret = "s3cr3t&with=special+chars%42"
     application = ApplicationFactory(
+        client_secret=plain_secret,
         is_active=True,
         scopes=[ApplicationScope.ROOMS_LIST],
     )
 
-    plain_secret = "s3cr3t&with=special+chars%42"
-    application.client_secret = plain_secret
-    application.save()
-
     client = APIClient()
     response = client.post(
         "/external-api/v1.0/application/token/",
@@ -279,14 +270,54 @@ def test_api_applications_generate_token_invalid_client_secret():
     assert "Invalid credentials" in str(response.data)
 
 
+def test_token_unknown_client_id_with_valid_secret():
+    """A valid secret cannot authenticate an unknown client ID."""
+    secret = "application-a-secret"
+    ApplicationFactory(client_secret=secret)
+    user = UserFactory()
+
+    response = APIClient().post(
+        "/external-api/v1.0/application/token/",
+        {
+            "client_id": "unknown-client-id",
+            "client_secret": secret,
+            "grant_type": "client_credentials",
+            "scope": user.email,
+        },
+        format="json",
+    )
+
+    assert response.status_code == 401
+    assert "Invalid credentials" in str(response.data)
+
+
+def test_token_rejects_secret_owned_by_another_application():
+    """Application A's secret cannot authenticate application B."""
+    secret_a = "application-a-secret"
+    ApplicationFactory(client_secret=secret_a)
+    application_b = ApplicationFactory(client_secret="application-b-secret")
+    user = UserFactory()
+
+    response = APIClient().post(
+        "/external-api/v1.0/application/token/",
+        {
+            "client_id": application_b.client_id,
+            "client_secret": secret_a,
+            "grant_type": "client_credentials",
+            "scope": user.email,
+        },
+        format="json",
+    )
+
+    assert response.status_code == 401
+    assert "Invalid credentials" in str(response.data)
+
+
 def test_api_applications_generate_token_inactive_application():
     """Inactive application should return 401."""
     user = UserFactory(email="user@example.com")
-    application = ApplicationFactory(is_active=False)
-
     plain_secret = "test-secret-123"
-    application.client_secret = plain_secret
-    application.save()
+    application = ApplicationFactory(client_secret=plain_secret, is_active=False)
 
     client = APIClient()
     response = client.post(
@@ -328,11 +359,8 @@ def test_api_applications_generate_token_inactive_application_wrong_secret():
 
 def test_api_applications_generate_token_invalid_email_format():
     """Invalid email format should return 400."""
-    application = ApplicationFactory(is_active=True)
-
     plain_secret = "test-secret-123"
-    application.client_secret = plain_secret
-    application.save()
+    application = ApplicationFactory(client_secret=plain_secret, is_active=True)
 
     client = APIClient()
     response = client.post(
@@ -353,12 +381,9 @@ def test_api_applications_generate_token_invalid_email_format():
 def test_api_applications_generate_token_domain_not_authorized():
     """Application without domain authorization should return 403."""
     user = UserFactory(email="user@denied.com")
-    application = ApplicationFactory(is_active=True)
-    ApplicationDomainFactory(application=application, domain="allowed.com")
-
     plain_secret = "test-secret-123"
-    application.client_secret = plain_secret
-    application.save()
+    application = ApplicationFactory(client_secret=plain_secret, is_active=True)
+    ApplicationDomainFactory(application=application, domain="allowed.com")
 
     client = APIClient()
     response = client.post(
@@ -379,16 +404,14 @@ def test_api_applications_generate_token_domain_not_authorized():
 def test_api_applications_generate_token_domain_authorized():
     """Application with domain authorization should succeed."""
     user = UserFactory(email="user@allowed.com")
+    plain_secret = "test-secret-123"
     application = ApplicationFactory(
+        client_secret=plain_secret,
         is_active=True,
         scopes=[ApplicationScope.ROOMS_LIST],
     )
     ApplicationDomainFactory(application=application, domain="allowed.com")
 
-    plain_secret = "test-secret-123"
-    application.client_secret = plain_secret
-    application.save()
-
     client = APIClient()
     response = client.post(
         "/external-api/v1.0/application/token/",
@@ -407,11 +430,8 @@ def test_api_applications_generate_token_domain_authorized():
 
 def test_api_applications_generate_token_user_not_found():
     """Non-existent user should return 404."""
-    application = ApplicationFactory(is_active=True)
-
     plain_secret = "test-secret-123"
-    application.client_secret = plain_secret
-    application.save()
+    application = ApplicationFactory(client_secret=plain_secret, is_active=True)
 
     client = APIClient()
     response = client.post(
@@ -434,15 +454,13 @@ def test_api_applications_token_payload_structure(settings):
     """Generated token should have correct payload structure."""
     user = UserFactory(email="user@example.com")
 
+    plain_secret = "test-secret-123"
     application = ApplicationFactory(
+        client_secret=plain_secret,
         is_active=True,
         scopes=[ApplicationScope.ROOMS_LIST, ApplicationScope.ROOMS_CREATE],
     )
 
-    plain_secret = "test-secret-123"
-    application.client_secret = plain_secret
-    application.save()
-
     client = APIClient()
     response = client.post(
         "/external-api/v1.0/application/token/",
@@ -487,15 +505,13 @@ def test_api_applications_token_new_user(settings):
 
     assert len(User.objects.all()) == 0
 
+    plain_secret = "test-secret-123"
     application = ApplicationFactory(
+        client_secret=plain_secret,
         is_active=True,
         scopes=[ApplicationScope.ROOMS_LIST, ApplicationScope.ROOMS_CREATE],
     )
 
-    plain_secret = "test-secret-123"
-    application.client_secret = plain_secret
-    application.save()
-
     client = APIClient()
     response = client.post(
         "/external-api/v1.0/application/token/",
@@ -545,15 +561,13 @@ def test_api_applications_token_existing_user(settings):
 
     assert len(User.objects.all()) == 1
 
+    plain_secret = "test-secret-123"
     application = ApplicationFactory(
+        client_secret=plain_secret,
         is_active=True,
         scopes=[ApplicationScope.ROOMS_LIST, ApplicationScope.ROOMS_CREATE],
     )
 
-    plain_secret = "test-secret-123"
-    application.client_secret = plain_secret
-    application.save()
-
     client = APIClient()
     response = client.post(
         "/external-api/v1.0/application/token/",
@@ -598,12 +612,10 @@ def test_api_applications_token_new_user_race_condition(mock_get_by_email, setti
     settings.OIDC_FALLBACK_TO_EMAIL_FOR_IDENTIFICATION = True
     settings.OIDC_USER_SUB_FIELD_IMMUTABLE = False
 
-    application = ApplicationFactory(
-        is_active=True, scopes=[ApplicationScope.ROOMS_LIST]
-    )
     plain_secret = "test-secret-123"
-    application.client_secret = plain_secret
-    application.save()
+    application = ApplicationFactory(
+        client_secret=plain_secret, is_active=True, scopes=[ApplicationScope.ROOMS_LIST]
+    )
 
     email = "john.doe@example.com"
 
@@ -653,12 +665,10 @@ def test_api_applications_token_new_user_race_condition_unrecoverable(
     settings.OIDC_FALLBACK_TO_EMAIL_FOR_IDENTIFICATION = True
     settings.OIDC_USER_SUB_FIELD_IMMUTABLE = False
 
-    application = ApplicationFactory(
-        is_active=True, scopes=[ApplicationScope.ROOMS_LIST]
-    )
     plain_secret = "test-secret-123"
-    application.client_secret = plain_secret
-    application.save()
+    application = ApplicationFactory(
+        client_secret=plain_secret, is_active=True, scopes=[ApplicationScope.ROOMS_LIST]
+    )
 
     client = APIClient()
     response = client.post(
@@ -674,3 +684,183 @@ def test_api_applications_token_new_user_race_condition_unrecoverable(
 
     assert response.status_code == 409
     assert mock_get_or_create.call_count == 1
+
+
+def test_token_populates_fast_hash_and_stops_using_legacy_hash():
+    """First login migrates; subsequent logins use only the fast hash."""
+    secret = "application-secret"
+
+    application = ApplicationFactory(client_secret=secret)
+    Application.objects.filter(pk=application.pk).update(client_secret_sha256=None)
+    application.refresh_from_db()
+
+    original_hash = application.client_secret
+
+    user = UserFactory()
+    payload = {
+        "client_id": application.client_id,
+        "client_secret": secret,
+        "grant_type": "client_credentials",
+        "scope": user.email,
+    }
+    client = APIClient()
+
+    with mock.patch.object(
+        hashers, "check_password", wraps=hashers.check_password
+    ) as legacy_verifier:
+        response = client.post(
+            "/external-api/v1.0/application/token/", payload, format="json"
+        )
+
+    assert response.status_code == 200
+    legacy_verifier.assert_called_once_with(secret, original_hash)
+
+    application.refresh_from_db()
+
+    migrated_hash = application.client_secret_sha256
+    assert hashers.CLIENT_SECRET_HASH_PATTERN.fullmatch(migrated_hash)
+    assert hashers.verify_client_secret(secret, migrated_hash)
+    assert application.client_secret == original_hash
+
+    # Fail immediately if a subsequent login tries the legacy verifier.
+    with mock.patch.object(
+        hashers,
+        "check_password",
+        side_effect=AssertionError("Legacy hash must no longer be used"),
+    ):
+        response = client.post(
+            "/external-api/v1.0/application/token/", payload, format="json"
+        )
+
+    assert response.status_code == 200
+    application.refresh_from_db()
+    assert application.client_secret_sha256 == migrated_hash
+    assert application.client_secret == original_hash
+
+
+def test_token_failed_login_leaves_legacy_credentials_untouched():
+    """An incorrect secret neither migrates nor changes the legacy hash."""
+
+    application = ApplicationFactory(client_secret="application-secret")
+    Application.objects.filter(pk=application.pk).update(client_secret_sha256=None)
+    application.refresh_from_db()
+
+    original_hash = application.client_secret
+    user = UserFactory()
+
+    response = APIClient().post(
+        "/external-api/v1.0/application/token/",
+        {
+            "client_id": application.client_id,
+            "client_secret": "wrong-secret",
+            "grant_type": "client_credentials",
+            "scope": user.email,
+        },
+        format="json",
+    )
+
+    assert response.status_code == 401
+    application.refresh_from_db()
+    assert application.client_secret == original_hash
+    assert application.client_secret_sha256 is None
+
+
+def test_token_concurrent_successful_logins_preserve_first_migration():
+    """Both logins succeed; the later migration preserves the first hash."""
+    secret = "application-secret"
+    application = ApplicationFactory(client_secret=secret)
+    Application.objects.filter(pk=application.pk).update(client_secret_sha256=None)
+    application.refresh_from_db()
+
+    original_hash = application.client_secret
+    user = UserFactory()
+    payload = {
+        "client_id": application.client_id,
+        "client_secret": secret,
+        "grant_type": "client_credentials",
+        "scope": user.email,
+    }
+    legacy_verifier = hashers.check_password
+    winning_hashes = []
+
+    def verify_then_complete_other_login(raw_secret, encoded):
+        verified = legacy_verifier(raw_secret, encoded)
+
+        # Complete another login before this request writes its migration.
+        # Restore the real verifier to avoid recursively invoking this callback.
+        with mock.patch.object(hashers, "check_password", new=legacy_verifier):
+            other_response = APIClient().post(
+                "/external-api/v1.0/application/token/", payload, format="json"
+            )
+
+        assert other_response.status_code == 200
+        application.refresh_from_db()
+        winning_hashes.append(application.client_secret_sha256)
+        return verified
+
+    with mock.patch.object(
+        hashers, "check_password", side_effect=verify_then_complete_other_login
+    ) as verifier:
+        response = APIClient().post(
+            "/external-api/v1.0/application/token/", payload, format="json"
+        )
+
+    assert response.status_code == 200
+    verifier.assert_called_once_with(secret, original_hash)
+    application.refresh_from_db()
+    assert application.client_secret_sha256 == winning_hashes[0]
+    assert hashers.verify_client_secret(secret, application.client_secret_sha256)
+    assert application.client_secret == original_hash
+
+
+def test_token_authenticates_after_rollback():
+    """Legacy authentication still works after the fast hash is discarded."""
+    secret = "application-secret"
+    application = ApplicationFactory(client_secret=secret)
+    Application.objects.filter(pk=application.pk).update(client_secret_sha256=None)
+    application.refresh_from_db()
+
+    original_hash = application.client_secret
+
+    user = UserFactory()
+    payload = {
+        "client_id": application.client_id,
+        "client_secret": secret,
+        "grant_type": "client_credentials",
+        "scope": user.email,
+    }
+    client = APIClient()
+
+    # Authenticate with the new implementation and migrate the hash.
+    response = client.post(
+        "/external-api/v1.0/application/token/", payload, format="json"
+    )
+
+    assert response.status_code == 200
+
+    application.refresh_from_db()
+
+    assert hashers.verify_client_secret(secret, application.client_secret_sha256)
+    assert application.client_secret == original_hash
+
+    Application.objects.filter(pk=application.pk).update(client_secret_sha256=None)
+
+    def legacy_check(instance, raw_secret):
+        return check_password(raw_secret, instance.client_secret)
+
+    # Simulate the old release's verification using only the legacy field.
+    with mock.patch.object(
+        Application,
+        "check_client_secret",
+        autospec=True,
+        side_effect=legacy_check,
+    ) as verifier:
+        response = client.post(
+            "/external-api/v1.0/application/token/", payload, format="json"
+        )
+
+    assert response.status_code == 200
+    verifier.assert_called_once()
+    application.refresh_from_db()
+    assert application.client_secret == original_hash
+    assert application.client_secret_sha256 is None

src/backend/core/tests/test_models_applications.py

@@ -6,12 +6,12 @@ Unit tests for the Application and ApplicationDomain models
 
 from unittest import mock
 
-from django.contrib.auth.hashers import check_password
 from django.core.exceptions import ValidationError
 
 import pytest
 
 from core.factories import ApplicationDomainFactory, ApplicationFactory
+from core.hashers import verify_client_secret
 from core.models import Application, ApplicationDomain, ApplicationScope
 
 pytestmark = pytest.mark.django_db
@@ -98,8 +98,8 @@ def test_models_application_client_secret_hashed_on_save():
 
     # Secret should be hashed, not plain
     assert application.client_secret != plain_secret
-    # Should verify with check_password
-    assert check_password(plain_secret, application.client_secret) is True
+    # Should verify with the application credential policy
+    assert verify_client_secret(plain_secret, application.client_secret) is True
 
 
 def test_models_application_client_secret_preserves_existing_hash():

src/backend/meet/settings.py

@@ -384,6 +384,16 @@ class Base(Configuration):
         "DEFAULT_VERSIONING_CLASS": "rest_framework.versioning.URLPathVersioning",
         "DEFAULT_SCHEMA_CLASS": "drf_spectacular.openapi.AutoSchema",
         "DEFAULT_THROTTLE_RATES": {
+            "room_creation": values.Value(
+                default="50/minute",
+                environ_name="ROOM_CREATION_THROTTLE_RATES",
+                environ_prefix=None,
+            ),
+            "room_creation_daily": values.Value(
+                default="1000/day",
+                environ_name="ROOM_CREATION_DAILY_THROTTLE_RATES",
+                environ_prefix=None,
+            ),
             "request_entry": values.Value(
                 default="150/minute",
                 environ_name="REQUEST_ENTRY_THROTTLE_RATES",
@@ -456,6 +466,11 @@ class Base(Configuration):
         "documentation_url": values.Value(
             None, environ_name="FRONTEND_DOCUMENTATION_URL", environ_prefix=None
         ),
+        "technical_documentation_url": values.Value(
+            None,
+            environ_name="FRONTEND_TECHNICAL_DOCUMENTATION_URL",
+            environ_prefix=None,
+        ),
         "external_home_url": values.Value(
             None, environ_name="FRONTEND_EXTERNAL_HOME_URL", environ_prefix=None
         ),
@@ -923,24 +938,18 @@ class Base(Configuration):
         environ_name="SIGNUP_NEW_USER_TO_MARKETING_EMAIL",
         environ_prefix=None,
     )
-    MARKETING_SERVICE_CLASS = values.Value(
-        "core.services.marketing.BrevoMarketingService",
-        environ_name="MARKETING_SERVICE_CLASS",
-        environ_prefix=None,
-    )
-    BREVO_API_KEY = SecretFileValue(
-        None, environ_name="BREVO_API_KEY", environ_prefix=None
-    )
-    BREVO_API_CONTACT_LIST_IDS = values.ListValue(
-        [],
-        environ_name="BREVO_API_CONTACT_LIST_IDS",
-        environ_prefix=None,
-        converter=int,
-    )
-    BREVO_API_CONTACT_ATTRIBUTES = values.DictValue({"VISIO_USER": True})
-    BREVO_API_TIMEOUT = values.PositiveIntegerValue(
-        1, environ_name="BREVO_API_TIMEOUT", environ_prefix=None
-    )
+    LASUITE_MARKETING = {
+        "BACKEND": values.Value(
+            "lasuite.marketing.backends.dummy.DummyBackend",
+            environ_name="LASUITE_MARKETING_BACKEND",
+            environ_prefix=None,
+        ),
+        "PARAMETERS": values.DictValue(
+            default={},
+            environ_name="LASUITE_MARKETING_PARAMETERS",
+            environ_prefix=None,
+        ),
+    }
 
     # Lobby configurations
     PRESENCE_KEY_PREFIX = values.Value(
@@ -1061,7 +1070,7 @@ class Base(Configuration):
         environ_prefix=None,
     )
     APPLICATION_CLIENT_SECRET_LENGTH = values.PositiveIntegerValue(
-        128,
+        50,
         environ_name="APPLICATION_CLIENT_SECRET_LENGTH",
         environ_prefix=None,
     )
@@ -1423,6 +1432,20 @@ class Base(Configuration):
                     stacklevel=2,
                 )
 
+        # Secrets use a 62-character alphanumeric charset (~5.95 bits/char).
+        # 43 characters provide at least 256 bits of entropy; 42 provide ~250 bits.
+        if cls.APPLICATION_CLIENT_SECRET_LENGTH < 43:
+            warnings.warn(
+                f"APPLICATION_CLIENT_SECRET_LENGTH={cls.APPLICATION_CLIENT_SECRET_LENGTH} "
+                "is below the recommended 43 characters (256 bits of entropy). "
+                "Application secrets use a fast hash and rely on high entropy to "
+                "resist offline guessing if the database leaks. "
+                "Please set APPLICATION_CLIENT_SECRET_LENGTH to at least 43.",
+                # We use UserWarning to make sure it shows up in production deployment
+                UserWarning,
+                stacklevel=2,
+            )
+
         # The SENTRY_DSN setting should be available to activate sentry for an environment
         if cls.SENTRY_DSN is not None:
             sentry_sdk.init(
@@ -1508,6 +1531,7 @@ class Test(Base):
     )
     PASSWORD_HASHERS = [
         "django.contrib.auth.hashers.MD5PasswordHasher",
+        "django.contrib.auth.hashers.PBKDF2PasswordHasher",
     ]
     USE_SWAGGER = True
     EXTERNAL_API_ENABLED = True

src/backend/pyproject.toml

@@ -7,7 +7,7 @@ build-backend = "uv_build"
 
 [project]
 name = "meet"
-version = "1.32.1"
+version = "1.34.0"
 authors = [{ "name" = "DINUM", "email" = "dev@mail.numerique.gouv.fr" }]
 classifiers = [
     "Development Status :: 5 - Production/Stable",
@@ -40,7 +40,7 @@ dependencies = [
     "django-storages[s3]==1.14.6",
     "django-timezone-field>=5.1",
     "django-pydantic-field==0.5.4",
-    "django==5.2.16",
+    "django==5.2.17",
     "djangorestframework==3.18.0",
     "drf_spectacular==0.30.0",
     "dockerflow==2026.3.4",
@@ -62,7 +62,7 @@ dependencies = [
     "mozilla-django-oidc==5.0.2",
     "livekit-api==1.2.0",
     "aiohttp==3.14.3",
-    "urllib3==2.7.0",
+    "urllib3==2.8.0",
     "phonenumbers==9.0.37",
     "cryptography==50.0.1", # CVE-2026-69247
 ]

src/backend/uv.lock

@@ -700,16 +700,16 @@ wheels = [
 
 [[package]]
 name = "django"
-version = "5.2.16"
+version = "5.2.17"
 source = { registry = "https://pypi.org/simple" }
 dependencies = [
     { name = "asgiref" },
     { name = "sqlparse" },
     { name = "tzdata", marker = "sys_platform == 'win32'" },
 ]
-sdist = { url = "https://files.pythonhosted.org/packages/a9/26/889449d521ae508b26de715954faecd8bcf3f740affb81b2d146a83b42a5/django-5.2.16.tar.gz", hash = "sha256:59ea02020c3136fce14bef0bbece21a10a4febef5eed1c51c22ae468efa22200", size = 10890894, upload-time = "2026-07-07T13:52:17.005Z" }
+sdist = { url = "https://files.pythonhosted.org/packages/d5/d8/43e9d000519adceb189620b6869ff88031e046df91c2e9da72f8f6918399/django-5.2.17.tar.gz", hash = "sha256:9d4d93be539a18ab80d058eb515900e10951e04c537c5a6b394fc49528d3251f", size = 10889740, upload-time = "2026-08-04T15:04:03.173Z" }
 wheels = [
-    { url = "https://files.pythonhosted.org/packages/4e/13/1e5e3e4c15dcecb04281b3cb2a46a4670e1cef131068e202f6040df19224/django-5.2.16-py3-none-any.whl", hash = "sha256:04f354bf9d807a86ad1a8392fe3808d362358a8eafc322848e0e43e59b24371d", size = 8311943, upload-time = "2026-07-07T13:52:11.223Z" },
+    { url = "https://files.pythonhosted.org/packages/df/f8/ce120525ca78f12b07daf65786679c5d0b54a75285a8958d3ae55e39da35/django-5.2.17-py3-none-any.whl", hash = "sha256:f04fb3b36ee119e1af4fa1d397d5fd6cf12700f49321e84d4f4c642c5b1973db", size = 8315563, upload-time = "2026-08-04T15:03:59.1Z" },
 ]
 
 [[package]]
@@ -1297,7 +1297,7 @@ wheels = [
 
 [[package]]
 name = "meet"
-version = "1.32.1"
+version = "1.34.0"
 source = { editable = "." }
 dependencies = [
     { name = "aiohttp" },
@@ -1372,7 +1372,7 @@ requires-dist = [
     { name = "celery", extras = ["redis"], specifier = "==5.6.3" },
     { name = "cryptography", specifier = "==50.0.1" },
     { name = "dj-database-url", specifier = "==3.1.2" },
-    { name = "django", specifier = "==5.2.16" },
+    { name = "django", specifier = "==5.2.17" },
     { name = "django-configurations", specifier = "==2.5.1" },
     { name = "django-cors-headers", specifier = "==4.9.0" },
     { name = "django-countries", specifier = "==9.0.0" },
@@ -1404,7 +1404,7 @@ requires-dist = [
     { name = "redis", specifier = "==5.2.1" },
     { name = "requests", specifier = "==2.34.2" },
     { name = "sentry-sdk", specifier = "==2.68.1" },
-    { name = "urllib3", specifier = "==2.7.0" },
+    { name = "urllib3", specifier = "==2.8.0" },
     { name = "whitenoise", specifier = "==6.12.0" },
 ]
 
@@ -2529,11 +2529,11 @@ wheels = [
 
 [[package]]
 name = "urllib3"
-version = "2.7.0"
+version = "2.8.0"
 source = { registry = "https://pypi.org/simple" }
-sdist = { url = "https://files.pythonhosted.org/packages/53/0c/06f8b233b8fd13b9e5ee11424ef85419ba0d8ba0b3138bf360be2ff56953/urllib3-2.7.0.tar.gz", hash = "sha256:231e0ec3b63ceb14667c67be60f2f2c40a518cb38b03af60abc813da26505f4c", size = 433602, upload-time = "2026-05-07T16:13:18.596Z" }
+sdist = { url = "https://files.pythonhosted.org/packages/e3/05/b17359e1cefb4f909b5e40b1b90a496d987258916dbbf88e842c729f510e/urllib3-2.8.0.tar.gz", hash = "sha256:63bf2ead4c879426ebf22ef2a781eeb4aa3b4ae798a0435506f8687fd5bb9b63", size = 458972, upload-time = "2026-09-15T19:29:36.253Z" }
 wheels = [
-    { url = "https://files.pythonhosted.org/packages/7f/3e/5db95bcf282c52709639744ca2a8b149baccf648e39c8cc87553df9eae0c/urllib3-2.7.0-py3-none-any.whl", hash = "sha256:9fb4c81ebbb1ce9531cce37674bbc6f1360472bc18ca9a553ede278ef7276897", size = 131087, upload-time = "2026-05-07T16:13:17.151Z" },
+    { url = "https://files.pythonhosted.org/packages/92/9d/c4e665119135114480843e7ab388fa94d8480650450e6f8e26b70d323a4c/urllib3-2.8.0-py3-none-any.whl", hash = "sha256:0cf3cae568d36aa9576b28dfb35f11328f1cb974ca7647d9475ebb86c75ac6e3", size = 135717, upload-time = "2026-09-15T19:29:34.577Z" },
 ]
 
 [[package]]

src/frontend/Dockerfile

@@ -39,6 +39,9 @@ ENV VITE_API_BASE_URL=${VITE_API_BASE_URL}
 ARG VITE_APP_TITLE
 ENV VITE_APP_TITLE=${VITE_APP_TITLE}
 
+ARG VITE_MEDIA_BASE_URL
+ENV VITE_MEDIA_BASE_URL=${VITE_MEDIA_BASE_URL}
+
 RUN npm run build
 
 # ---- Front-end image ----
@@ -46,6 +49,7 @@ FROM nginxinc/nginx-unprivileged:1.30.4-alpine3.24 AS frontend-production
 
 USER root
 RUN apk upgrade --no-cache libexpat && \
+    apk add --no-cache --upgrade 'pcre2>=10.49-r0' && \
     apk del curl
 USER nginx
 

src/frontend/package-lock.json

@@ -1,12 +1,12 @@
 {
   "name": "meet",
-  "version": "1.32.1",
+  "version": "1.34.0",
   "lockfileVersion": 3,
   "requires": true,
   "packages": {
     "": {
       "name": "meet",
-      "version": "1.32.1",
+      "version": "1.34.0",
       "dependencies": {
         "@fontsource-variable/atkinson-hyperlegible-next": "5.3.0",
         "@fontsource-variable/lexend": "5.3.0",
@@ -31,11 +31,11 @@
         "livekit-client": "2.21.0",
         "posthog-js": "1.418.10",
         "react": "18.3.1",
-        "react-aria": "3.50.0",
-        "react-aria-components": "1.19.0",
+        "react-aria": "3.51.0",
+        "react-aria-components": "1.20.0",
         "react-dom": "18.3.1",
         "react-i18next": "17.0.12",
-        "react-stately": "3.48.0",
+        "react-stately": "3.49.0",
         "use-sound": "5.0.0",
         "valtio": "2.3.2",
         "wouter": "3.10.0"
@@ -64,7 +64,8 @@
         "typescript-eslint": "8.60.1",
         "vite": "8.0.14",
         "vite-plugin-static-copy": "4.1.1",
-        "vite-plugin-svgr": "5.2.0"
+        "vite-plugin-svgr": "5.2.0",
+        "vitest": "5.0.2"
       }
     },
     "node_modules/@adobe/react-spectrum": {
@@ -883,9 +884,9 @@
       }
     },
     "node_modules/@internationalized/date": {
-      "version": "3.12.2",
-      "resolved": "https://registry.npmjs.org/@internationalized/date/-/date-3.12.2.tgz",
-      "integrity": "sha512-FY1Y+H64NDs+HAF6omlnWxm3mEpfgaCSWtL5l551ZZfImA+kGjPFgrnJrGjH6lfmLL0g8Z/mBu1R3kufeCp6Jw==",
+      "version": "3.12.3",
+      "resolved": "https://registry.npmjs.org/@internationalized/date/-/date-3.12.3.tgz",
+      "integrity": "sha512-fuLX+3ZKLsxI73y8b01EG/WjHb6gE6weCqlfawPO27kBWGMh9G1yH6Csv1uU7/cac9H2GHmOMt6CjmuQ1aia4Q==",
       "license": "Apache-2.0",
       "dependencies": {
         "@swc/helpers": "^0.5.0"
@@ -901,9 +902,9 @@
       }
     },
     "node_modules/@internationalized/string": {
-      "version": "3.2.9",
-      "resolved": "https://registry.npmjs.org/@internationalized/string/-/string-3.2.9.tgz",
-      "integrity": "sha512-kzP/M/mbQxODlmOt4bIQZ2SBVUWUSqMLXooXixnX7noche8WHaQcA+nwFN1K2KCF/cp+LDUhcJsCicwkvhD1pg==",
+      "version": "3.2.10",
+      "resolved": "https://registry.npmjs.org/@internationalized/string/-/string-3.2.10.tgz",
+      "integrity": "sha512-PDx6//vHSpRnHfxqMqto11zQvhsaU74O3mKv2F/0eicGZcl9NLjQmGlbHz/LsJh5tLKp4A4L7ZVTzN1/MmMTvA==",
       "license": "Apache-2.0",
       "dependencies": {
         "@swc/helpers": "^0.5.0"
@@ -942,9 +943,9 @@
       }
     },
     "node_modules/@jridgewell/sourcemap-codec": {
-      "version": "1.5.5",
-      "resolved": "https://registry.npmjs.org/@jridgewell/sourcemap-codec/-/sourcemap-codec-1.5.5.tgz",
-      "integrity": "sha512-cYQ9310grqxueWbl+WuIUIaiUaDcj7WOq5fVhEljNVgRfOUhY9fy2zTvfoqWsnebh8Sl70VScFbICvJnLKB0Og==",
+      "version": "1.6.0",
+      "resolved": "https://registry.npmjs.org/@jridgewell/sourcemap-codec/-/sourcemap-codec-1.6.0.tgz",
+      "integrity": "sha512-T7jf+5zgsZHwNJ4lvQ7/aezbyk0nNX+zJVWpmHA7VYsEx7a7qr5Rg5IbtJFqkgze5Y2sruq1RUY8Q837Od7iFw==",
       "dev": true,
       "license": "MIT"
     },
@@ -1819,9 +1820,9 @@
       }
     },
     "node_modules/@react-types/shared": {
-      "version": "3.36.0",
-      "resolved": "https://registry.npmjs.org/@react-types/shared/-/shared-3.36.0.tgz",
-      "integrity": "sha512-DkP/H0C2YjjS7gZWKNqOmU8a16qHPjQNdzMwmTq9SzplM6Iw0kVMTZ0OIoe6FOgGqa+FwMsE2QbPjh/n3g/jXQ==",
+      "version": "3.36.1",
+      "resolved": "https://registry.npmjs.org/@react-types/shared/-/shared-3.36.1.tgz",
+      "integrity": "sha512-AzsuD9OfxTOZMMvTRhlN3oHBwOmFN7tDh27LzqmHt4+uOgPhJT7ZM7/kVs/8/o0WxayMUIk3hBmCFRHv1FUoag==",
       "license": "Apache-2.0",
       "peerDependencies": {
         "react": "^16.8.0 || ^17.0.0-rc.1 || ^18.0.0 || ^19.0.0-rc.1"
@@ -2506,6 +2507,24 @@
         "tslib": "^2.4.0"
       }
     },
+    "node_modules/@types/chai": {
+      "version": "5.2.3",
+      "resolved": "https://registry.npmjs.org/@types/chai/-/chai-5.2.3.tgz",
+      "integrity": "sha512-Mw558oeA9fFbv65/y4mHtXDs9bPnFMZAL/jxdPFUpOHHIXX91mcgEHbS5Lahr+pwZFR8A7GQleRWeI6cGFC2UA==",
+      "dev": true,
+      "license": "MIT",
+      "dependencies": {
+        "@types/deep-eql": "*",
+        "assertion-error": "^2.0.1"
+      }
+    },
+    "node_modules/@types/deep-eql": {
+      "version": "4.0.2",
+      "resolved": "https://registry.npmjs.org/@types/deep-eql/-/deep-eql-4.0.2.tgz",
+      "integrity": "sha512-c9h9dVVMigMPc4bwTvC5dxqtqJZwQPePsWjPlpSOnojbor6pGqdk541lfA7AqFQr5pB1BRdq0juY9db81BwyFw==",
+      "dev": true,
+      "license": "MIT"
+    },
     "node_modules/@types/dom-mediacapture-record": {
       "version": "1.0.22",
       "resolved": "https://registry.npmjs.org/@types/dom-mediacapture-record/-/dom-mediacapture-record-1.0.22.tgz",
@@ -2786,6 +2805,64 @@
         }
       }
     },
+    "node_modules/@vitest/mocker": {
+      "version": "5.0.2",
+      "resolved": "https://registry.npmjs.org/@vitest/mocker/-/mocker-5.0.2.tgz",
+      "integrity": "sha512-Z5FS00Q1SJHkB35xATsmWGdQ5WA1/0MV3CDjqyv7GavHv1OfOj145MNfHOlHk7QLes21dKFDHr8EO2zvL+9WGA==",
+      "dev": true,
+      "license": "MIT",
+      "dependencies": {
+        "@jridgewell/trace-mapping": "0.3.31",
+        "@vitest/spy": "5.0.2",
+        "estree-walker": "^3.0.3",
+        "magic-string": "^1.2.3"
+      },
+      "funding": {
+        "url": "https://opencollective.com/vitest"
+      },
+      "peerDependencies": {
+        "msw": "^2.4.9",
+        "vite": "^6.0.0 || ^7.0.0 || ^8.0.0"
+      },
+      "peerDependenciesMeta": {
+        "msw": {
+          "optional": true
+        },
+        "vite": {
+          "optional": true
+        }
+      }
+    },
+    "node_modules/@vitest/mocker/node_modules/estree-walker": {
+      "version": "3.0.3",
+      "resolved": "https://registry.npmjs.org/estree-walker/-/estree-walker-3.0.3.tgz",
+      "integrity": "sha512-7RUKfXgSMMkzt6ZuXmqapOurLGPPfgj6l9uRZ7lRGolvk0y2yocc35LdcxKC5PQZdn2DMqioAQ2NoWcrTKmm6g==",
+      "dev": true,
+      "license": "MIT",
+      "dependencies": {
+        "@types/estree": "^1.0.0"
+      }
+    },
+    "node_modules/@vitest/mocker/node_modules/magic-string": {
+      "version": "1.4.2",
+      "resolved": "https://registry.npmjs.org/magic-string/-/magic-string-1.4.2.tgz",
+      "integrity": "sha512-vG+rjFRj1PqdIBozIxAGMjPlOhaVe+GXpbttY/iSK7rGcJRMlwNJO7dcUwmUqkymsFLJiNGI06t4D7Fr7yRC9g==",
+      "dev": true,
+      "license": "MIT",
+      "dependencies": {
+        "@jridgewell/sourcemap-codec": "^1.6.0"
+      }
+    },
+    "node_modules/@vitest/spy": {
+      "version": "5.0.2",
+      "resolved": "https://registry.npmjs.org/@vitest/spy/-/spy-5.0.2.tgz",
+      "integrity": "sha512-Ijc7T1nT9efNb5LxvjaBrEqw3f/QwUv5EE0nKqZxgqsaV/FxAAZ8baGylA8X/Z2oS4Lp+K74Jr6dTJsDKxJDeg==",
+      "dev": true,
+      "license": "MIT",
+      "funding": {
+        "url": "https://opencollective.com/vitest"
+      }
+    },
     "node_modules/@vue/compiler-core": {
       "version": "3.5.25",
       "resolved": "https://registry.npmjs.org/@vue/compiler-core/-/compiler-core-3.5.25.tgz",
@@ -3151,6 +3228,16 @@
         "url": "https://github.com/sponsors/ljharb"
       }
     },
+    "node_modules/assertion-error": {
+      "version": "2.0.1",
+      "resolved": "https://registry.npmjs.org/assertion-error/-/assertion-error-2.0.1.tgz",
+      "integrity": "sha512-Izi8RQcffqCeNVgFigKli1ssklIbpHnCYc6AknXGYoB6grJqyeby7jv12JUQgmTAnIDnbck1uxksT4dzN3PWBA==",
+      "dev": true,
+      "license": "MIT",
+      "engines": {
+        "node": ">=12"
+      }
+    },
     "node_modules/ast-types-flow": {
       "version": "0.0.8",
       "resolved": "https://registry.npmjs.org/ast-types-flow/-/ast-types-flow-0.0.8.tgz",
@@ -4130,6 +4217,16 @@
       ],
       "license": "CC-BY-4.0"
     },
+    "node_modules/chai": {
+      "version": "6.2.2",
+      "resolved": "https://registry.npmjs.org/chai/-/chai-6.2.2.tgz",
+      "integrity": "sha512-NUPRluOfOiTKBKvWPtSD4PhFvWCqOi0BGStNWs57X9js7XGTprSmFoz5F0tWhR4WPjNeR9jXqdC7/UpSJTnlRg==",
+      "dev": true,
+      "license": "MIT",
+      "engines": {
+        "node": ">=18"
+      }
+    },
     "node_modules/chalk": {
       "version": "4.1.2",
       "resolved": "https://registry.npmjs.org/chalk/-/chalk-4.1.2.tgz",
@@ -5030,6 +5127,13 @@
         "node": ">= 0.4"
       }
     },
+    "node_modules/es-module-lexer": {
+      "version": "2.3.2",
+      "resolved": "https://registry.npmjs.org/es-module-lexer/-/es-module-lexer-2.3.2.tgz",
+      "integrity": "sha512-poHGpORABojJJucnV9KbOavETW8lBVnphkW77ER5/BQ5Fz7oXSoCNek7IH3vR5nRjdsEz926ibFYX8KtLQmdyw==",
+      "dev": true,
+      "license": "MIT"
+    },
     "node_modules/es-object-atoms": {
       "version": "1.1.1",
       "resolved": "https://registry.npmjs.org/es-object-atoms/-/es-object-atoms-1.1.1.tgz",
@@ -5532,6 +5636,16 @@
         "node": ">=18.0.0"
       }
     },
+    "node_modules/expect-type": {
+      "version": "1.4.0",
+      "resolved": "https://registry.npmjs.org/expect-type/-/expect-type-1.4.0.tgz",
+      "integrity": "sha512-KfYbmpRm0VbLjEvVa9yGwCi9GI34xvi7A/HXYWQO65CSD2u3MczUJSuwXKFIxlGsgBQizV9q5J9NHj4VG0n+pA==",
+      "dev": true,
+      "license": "Apache-2.0",
+      "engines": {
+        "node": ">=12.0.0"
+      }
+    },
     "node_modules/express": {
       "version": "5.2.1",
       "resolved": "https://registry.npmjs.org/express/-/express-5.2.1.tgz",
@@ -8647,6 +8761,20 @@
         "url": "https://github.com/sponsors/ljharb"
       }
     },
+    "node_modules/obug": {
+      "version": "2.2.1",
+      "resolved": "https://registry.npmjs.org/obug/-/obug-2.2.1.tgz",
+      "integrity": "sha512-XrsrhT5sybtKI6wakr2SPOlGZWWYbUXZ7a0jT8/QOeAPau+1X/bSegNe5YR75oJmEZQbKningirmGOEJCIk61Q==",
+      "dev": true,
+      "funding": [
+        "https://github.com/sponsors/sxzz",
+        "https://opencollective.com/debug"
+      ],
+      "license": "MIT",
+      "engines": {
+        "node": ">=12.20.0"
+      }
+    },
     "node_modules/on-finished": {
       "version": "2.4.1",
       "resolved": "https://registry.npmjs.org/on-finished/-/on-finished-2.4.1.tgz",
@@ -9384,19 +9512,19 @@
       }
     },
     "node_modules/react-aria": {
-      "version": "3.50.0",
-      "resolved": "https://registry.npmjs.org/react-aria/-/react-aria-3.50.0.tgz",
-      "integrity": "sha512-S0Os6QZk33fzUAKu1QLT9afoUaCBt1ZNdoiq0n2YMVgKIdNIQS8zxiZ8O9hYE6QyDkHKjD6q39LQZ+qaSAIgjw==",
+      "version": "3.51.0",
+      "resolved": "https://registry.npmjs.org/react-aria/-/react-aria-3.51.0.tgz",
+      "integrity": "sha512-AyWLw0XR38cFPwBu/ErgGaVrc5dupLEKmRlMXTGvFKOtbaGRQ2+yQJkjVhpdHhoRhU4+G+tJDFeHDTS8tK3bfQ==",
       "license": "Apache-2.0",
       "dependencies": {
-        "@internationalized/date": "^3.12.2",
+        "@internationalized/date": "^3.12.3",
         "@internationalized/number": "^3.6.7",
-        "@internationalized/string": "^3.2.9",
-        "@react-types/shared": "^3.36.0",
+        "@internationalized/string": "^3.2.10",
+        "@react-types/shared": "^3.36.1",
         "@swc/helpers": "^0.5.0",
         "aria-hidden": "^1.2.3",
         "clsx": "^2.0.0",
-        "react-stately": "3.48.0",
+        "react-stately": "3.49.0",
         "use-sync-external-store": "^1.6.0"
       },
       "peerDependencies": {
@@ -9405,17 +9533,18 @@
       }
     },
     "node_modules/react-aria-components": {
-      "version": "1.19.0",
-      "resolved": "https://registry.npmjs.org/react-aria-components/-/react-aria-components-1.19.0.tgz",
-      "integrity": "sha512-2smSS5nqJ8cGYMQezuUXveZm7eMyHCqTN6mDpylQBYLYbdF5dxCCuW1DHn1VKLe1DybSfPvX/cZtJlDmvFfn8A==",
+      "version": "1.20.0",
+      "resolved": "https://registry.npmjs.org/react-aria-components/-/react-aria-components-1.20.0.tgz",
+      "integrity": "sha512-BMbpIgoV9aELeBrB0Y120NgoigHb5OdcJwc+4e7uSnbTbamea6lo+gqcc4LAxzMaK3Jf+7LI1oCDE6yANsmxIQ==",
       "license": "Apache-2.0",
       "dependencies": {
-        "@internationalized/date": "^3.12.2",
-        "@react-types/shared": "^3.36.0",
+        "@internationalized/date": "^3.12.3",
+        "@internationalized/string": "^3.2.10",
+        "@react-types/shared": "^3.36.1",
         "@swc/helpers": "^0.5.0",
         "client-only": "^0.0.1",
-        "react-aria": "3.50.0",
-        "react-stately": "3.48.0"
+        "react-aria": "3.51.0",
+        "react-stately": "3.49.0"
       },
       "peerDependencies": {
         "react": "^16.8.0 || ^17.0.0-rc.1 || ^18.0.0 || ^19.0.0-rc.1",
@@ -9469,15 +9598,15 @@
       "license": "MIT"
     },
     "node_modules/react-stately": {
-      "version": "3.48.0",
-      "resolved": "https://registry.npmjs.org/react-stately/-/react-stately-3.48.0.tgz",
-      "integrity": "sha512-ImicSAG+lTotAe5izcs1fz49Zk48w7pDusqYg04WaPhCoej8BJ24soMu3iLXIrsi273s4P1gZrYGrqReMfgEEA==",
+      "version": "3.49.0",
+      "resolved": "https://registry.npmjs.org/react-stately/-/react-stately-3.49.0.tgz",
+      "integrity": "sha512-13iNq2KzBrRAzxRc+n53hgROfIistiYY/sPtIhCw1qUB7/kmo+X1xEU2uiS5zcCIrc55AUPwoHqOIIpKWSwB9A==",
       "license": "Apache-2.0",
       "dependencies": {
-        "@internationalized/date": "^3.12.2",
+        "@internationalized/date": "^3.12.3",
         "@internationalized/number": "^3.6.7",
-        "@internationalized/string": "^3.2.9",
-        "@react-types/shared": "^3.36.0",
+        "@internationalized/string": "^3.2.10",
+        "@react-types/shared": "^3.36.1",
         "@swc/helpers": "^0.5.0",
         "use-sync-external-store": "^1.6.0"
       },
@@ -10219,6 +10348,13 @@
         "node": ">= 0.8"
       }
     },
+    "node_modules/std-env": {
+      "version": "4.3.0",
+      "resolved": "https://registry.npmjs.org/std-env/-/std-env-4.3.0.tgz",
+      "integrity": "sha512-OtU/EgQ1kIm5KwqQpBC6ZEMXrZRui11w8zgfTWp8cdO9B8OaPsbA8bTHO2P+HNo1VlUTGMVBwPhydu6poeXiag==",
+      "dev": true,
+      "license": "MIT"
+    },
     "node_modules/stop-iteration-iterator": {
       "version": "1.1.0",
       "resolved": "https://registry.npmjs.org/stop-iteration-iterator/-/stop-iteration-iterator-1.1.0.tgz",
@@ -10525,6 +10661,26 @@
         "xtend": "~4.0.1"
       }
     },
+    "node_modules/tinybench": {
+      "version": "6.2.0",
+      "resolved": "https://registry.npmjs.org/tinybench/-/tinybench-6.2.0.tgz",
+      "integrity": "sha512-78U2TlB2CnVenajOFzf3BKSm0J6oz5L0NV7g32LCPccvYc0lbWvys4d3uUUCS2B1N8PAf2+aekR8i1KbC3HO7Q==",
+      "dev": true,
+      "license": "MIT",
+      "engines": {
+        "node": ">=20.0.0"
+      }
+    },
+    "node_modules/tinyexec": {
+      "version": "1.3.1",
+      "resolved": "https://registry.npmjs.org/tinyexec/-/tinyexec-1.3.1.tgz",
+      "integrity": "sha512-GCvB3aoys96IuDFBMcTB46JOR6mdMtAToqwiW8JlWhsoh1mhHi/xn9ss/Dg7N555GiJyEt2qzoG/NHCwM6h1EA==",
+      "dev": true,
+      "license": "MIT",
+      "engines": {
+        "node": ">=18"
+      }
+    },
     "node_modules/tinyglobby": {
       "version": "0.2.17",
       "resolved": "https://registry.npmjs.org/tinyglobby/-/tinyglobby-0.2.17.tgz",
@@ -11609,6 +11765,112 @@
         "url": "https://github.com/sponsors/jonschlinkert"
       }
     },
+    "node_modules/vitest": {
+      "version": "5.0.2",
+      "resolved": "https://registry.npmjs.org/vitest/-/vitest-5.0.2.tgz",
+      "integrity": "sha512-7MQrx9pDv5aHiUcovIb/70Ys3tgtkUVgCtledvKdCmEO+/1Dicq5ZqoSxOW034m03oqC+oHOKui2dM6qtMLoJg==",
+      "dev": true,
+      "license": "MIT",
+      "dependencies": {
+        "@types/chai": "^5.2.2",
+        "@vitest/mocker": "5.0.2",
+        "chai": "^6.2.2",
+        "es-module-lexer": "^2.3.2",
+        "expect-type": "^1.4.0",
+        "magic-string": "^1.2.3",
+        "obug": "^2.1.4",
+        "picomatch": "^4.0.7",
+        "std-env": "^4.2.0",
+        "tinybench": "^6.1.4",
+        "tinyexec": "^1.3.0",
+        "tinyglobby": "^0.2.17",
+        "why-is-node-running": "^3.2.1"
+      },
+      "bin": {
+        "vitest": "vitest.mjs"
+      },
+      "engines": {
+        "node": "^22.12.0 || ^24.0.0 || >=26.0.0"
+      },
+      "funding": {
+        "url": "https://opencollective.com/vitest"
+      },
+      "peerDependencies": {
+        "@edge-runtime/vm": "*",
+        "@opentelemetry/api": "^1.9.0",
+        "@types/node": "^22.0.0 || >=24.0.0",
+        "@vitest/browser-playwright": "5.0.2",
+        "@vitest/browser-preview": "5.0.2",
+        "@vitest/browser-webdriverio": "^5.0.0-beta.5 || >=5.0.0",
+        "@vitest/coverage-istanbul": "5.0.2",
+        "@vitest/coverage-v8": "5.0.2",
+        "@vitest/ui": "5.0.2",
+        "happy-dom": "*",
+        "jsdom": "*",
+        "vite": "^6.4.0 || ^7.0.0 || ^8.0.0"
+      },
+      "peerDependenciesMeta": {
+        "@edge-runtime/vm": {
+          "optional": true
+        },
+        "@opentelemetry/api": {
+          "optional": true
+        },
+        "@types/node": {
+          "optional": true
+        },
+        "@vitest/browser-playwright": {
+          "optional": true
+        },
+        "@vitest/browser-preview": {
+          "optional": true
+        },
+        "@vitest/browser-webdriverio": {
+          "optional": true
+        },
+        "@vitest/coverage-istanbul": {
+          "optional": true
+        },
+        "@vitest/coverage-v8": {
+          "optional": true
+        },
+        "@vitest/ui": {
+          "optional": true
+        },
+        "happy-dom": {
+          "optional": true
+        },
+        "jsdom": {
+          "optional": true
+        },
+        "vite": {
+          "optional": false
+        }
+      }
+    },
+    "node_modules/vitest/node_modules/magic-string": {
+      "version": "1.4.2",
+      "resolved": "https://registry.npmjs.org/magic-string/-/magic-string-1.4.2.tgz",
+      "integrity": "sha512-vG+rjFRj1PqdIBozIxAGMjPlOhaVe+GXpbttY/iSK7rGcJRMlwNJO7dcUwmUqkymsFLJiNGI06t4D7Fr7yRC9g==",
+      "dev": true,
+      "license": "MIT",
+      "dependencies": {
+        "@jridgewell/sourcemap-codec": "^1.6.0"
+      }
+    },
+    "node_modules/vitest/node_modules/picomatch": {
+      "version": "4.0.7",
+      "resolved": "https://registry.npmjs.org/picomatch/-/picomatch-4.0.7.tgz",
+      "integrity": "sha512-qcJu88Q2IWqJsDD529JKMdwGm/dvInW4HvQnRwiH9JtihJvzGOscDtHE3x1pBKeUOTysQ8kVmLnJ2kJu7yhcGA==",
+      "dev": true,
+      "license": "MIT",
+      "engines": {
+        "node": ">=12"
+      },
+      "funding": {
+        "url": "https://github.com/sponsors/jonschlinkert"
+      }
+    },
     "node_modules/walk-sync": {
       "version": "2.2.0",
       "resolved": "https://registry.npmjs.org/walk-sync/-/walk-sync-2.2.0.tgz",
@@ -11793,6 +12055,19 @@
         "url": "https://github.com/sponsors/ljharb"
       }
     },
+    "node_modules/why-is-node-running": {
+      "version": "3.2.2",
+      "resolved": "https://registry.npmjs.org/why-is-node-running/-/why-is-node-running-3.2.2.tgz",
+      "integrity": "sha512-NKUzAelcoCXhXL4dJzKIwXeR8iEVqsA0Lq6Vnd0UXvgaKbzVo4ZTHROF2Jidrv+SgxOQ03fMinnNhzZATxOD3A==",
+      "dev": true,
+      "license": "MIT",
+      "bin": {
+        "why-is-node-running": "cli.js"
+      },
+      "engines": {
+        "node": ">=20.11"
+      }
+    },
     "node_modules/word-wrap": {
       "version": "1.2.5",
       "resolved": "https://registry.npmjs.org/word-wrap/-/word-wrap-1.2.5.tgz",

src/frontend/package.json

@@ -1,12 +1,13 @@
 {
   "name": "meet",
   "private": true,
-  "version": "1.32.1",
+  "version": "1.34.0",
   "type": "module",
   "scripts": {
     "dev": "panda codegen && vite",
     "build": "panda codegen && tsc -b && vite build",
     "build:debug": "VITE_ANALYZE=true npm run build -- --debug",
+    "test": "panda codegen && vitest run",
     "lint": "eslint . --ext ts,tsx --report-unused-disable-directives --max-warnings 0",
     "lint:fix": "eslint . --fix",
     "preview": "vite preview",
@@ -38,11 +39,11 @@
     "livekit-client": "2.21.0",
     "posthog-js": "1.418.10",
     "react": "18.3.1",
-    "react-aria": "3.50.0",
-    "react-aria-components": "1.19.0",
+    "react-aria": "3.51.0",
+    "react-aria-components": "1.20.0",
     "react-dom": "18.3.1",
     "react-i18next": "17.0.12",
-    "react-stately": "3.48.0",
+    "react-stately": "3.49.0",
     "use-sound": "5.0.0",
     "valtio": "2.3.2",
     "wouter": "3.10.0"
@@ -71,6 +72,7 @@
     "typescript-eslint": "8.60.1",
     "vite": "8.0.14",
     "vite-plugin-static-copy": "4.1.1",
-    "vite-plugin-svgr": "5.2.0"
+    "vite-plugin-svgr": "5.2.0",
+    "vitest": "5.0.2"
   }
 }

src/frontend/panda.config.ts

@@ -121,7 +121,7 @@ const config: Config = {
     },
     tokens: defineTokens({
       /* we take a few things from the panda preset but for now we clear out some stuff.
-       * This way we'll only add the things we need step by step and prevent using lots of differents things.
+       * This way we'll only add the things we need step by step and prevent using lots of different things.
        */
       ...pandaPreset.theme.tokens,
       colors: defineTokens.colors({

src/frontend/src/api/mediaUrl.ts

@@ -1,6 +1,6 @@
 export const mediaUrl = (path: string) => {
   const origin =
-    import.meta.env.VITE_API_BASE_URL ||
+    import.meta.env.VITE_MEDIA_BASE_URL ||
     (typeof window !== 'undefined' ? window.location.origin : '')
 
   // Remove leading/trailing slashes from origin/path if it exists

src/frontend/src/api/useConfig.ts

@@ -22,12 +22,14 @@ export interface ApiConfig {
     url: string
   }
   documentation_url?: string
+  technical_documentation_url?: string
   external_home_url?: string
   silence_livekit_debug_logs?: boolean
   is_silent_login_enabled?: boolean
   custom_css_url?: string
   use_french_gov_footer?: boolean
   use_proconnect_button?: boolean
+  allow_unregistered_rooms?: boolean
   idle_disconnect_warning_delay?: number
   recording?: {
     is_enabled?: boolean

src/frontend/src/components/LoadingScreen.tsx

@@ -19,7 +19,9 @@ export const LoadingScreen = ({
       <Screen layout={layout} header={header} footer={footer}>
         <CenteredContent>
           <Center>
-            <p>{t('loading')}</p>
+            <p role="status" aria-live="polite">
+              {t('loading')}
+            </p>
           </Center>
         </CenteredContent>
       </Screen>

src/frontend/src/features/diagnostics/checks/selectedCandidate.ts

@@ -22,6 +22,12 @@ export type IceCandidateInfo = {
   port?: number
   /** Local candidates only, and not reported by every browser. */
   networkType?: string
+  /**
+   * For a local relay candidate, the TURN URL it was gathered from
+   * (e.g. `turns:turn.example.com:443?transport=tcp`). Used as a fallback
+   * when the browser does not report `relayProtocol`.
+   */
+  url?: string
 }
 
 export type IceCandidatePair = {
@@ -42,6 +48,57 @@ export type IceCandidateReport = {
   working: IceCandidatePair[]
 }
 
+const isObject = (value: unknown): value is Record<string, unknown> =>
+  typeof value === 'object' && value !== null
+
+/** Narrows the loosely typed `data` stored on a step result. */
+export const isIceCandidateReport = (
+  data: unknown
+): data is IceCandidateReport =>
+  isObject(data) &&
+  Array.isArray(data.working) &&
+  (data.selected === null ||
+    (isObject(data.selected) && isObject(data.selected.local)))
+
+/**
+ * Transport between the browser and the TURN server for a local relay
+ * candidate: udp, tcp or tls, or undefined when it cannot be determined.
+ *
+ * `protocol` is deliberately not used here: on a relay candidate it describes
+ * the TURN allocation (server to peer), which is UDP even when the client
+ * reaches the TURN server over TLS.
+ */
+export const getRelayTransport = (
+  candidate: IceCandidateInfo
+): string | undefined => {
+  if (candidate.relayProtocol) return candidate.relayProtocol.toLowerCase()
+  if (!candidate.url) return undefined
+
+  const url = candidate.url.toLowerCase()
+  if (url.startsWith('turns:')) return 'tls'
+  if (!url.startsWith('turn:')) return undefined
+  const transport = /[?&]transport=(udp|tcp)\b/.exec(url)?.[1]
+  // RFC 7065: a turn: URI without a transport parameter defaults to UDP.
+  return transport ?? 'udp'
+}
+
+/**
+ * True when the selected pair goes through a TURN relay reached over TCP or
+ * TLS. Media still flows, but TCP head-of-line blocking usually degrades
+ * audio and video under packet loss.
+ *
+ * Direct routes (host, srflx, prflx), including ICE-TCP to the SFU, are out of
+ * scope: the warning and its documentation are about TURN fallbacks.
+ * An undetermined transport is not evidence of a bad route.
+ */
+export const isRelayedOverTcp = (data: unknown): boolean => {
+  if (!isIceCandidateReport(data) || !data.selected) return false
+  const { local } = data.selected
+  if (local.type !== 'relay') return false
+  const transport = getRelayTransport(local)
+  return transport === 'tcp' || transport === 'tls'
+}
+
 const PROBE_WIDTH = 320
 const PROBE_HEIGHT = 180
 const PROBE_FPS = 15
@@ -57,6 +114,7 @@ const readCandidate = (stats?: Stats): IceCandidateInfo => {
     protocol: stats.protocol as string | undefined,
     relayProtocol: stats.relayProtocol as string | undefined,
     networkType: stats.networkType as string | undefined,
+    url: stats.url as string | undefined,
     ...(INCLUDE_CANDIDATE_ADDRESSES
       ? {
           address: stats.address as string | undefined,
@@ -67,7 +125,10 @@ const readCandidate = (stats?: Stats): IceCandidateInfo => {
 }
 
 const describeCandidate = (candidate: IceCandidateInfo) => {
-  const transport = candidate.relayProtocol ?? candidate.protocol ?? 'unknown'
+  const transport =
+    (candidate.type === 'relay' ? getRelayTransport(candidate) : undefined) ??
+    candidate.protocol ??
+    'unknown'
   const endpoint =
     candidate.address === undefined
       ? ''

src/frontend/src/features/diagnostics/components/ConnectionTestSummary.tsx

@@ -2,18 +2,44 @@ import type { ReactNode } from 'react'
 import { useTranslation } from 'react-i18next'
 import { ProgressBar } from 'react-aria-components'
 import { css, cx } from '@/styled-system/css'
+import { A } from '@/primitives'
+import { useConfig } from '@/api/useConfig'
 import type { ConnectionTestStats } from '../types'
 import { statusSquareClass } from './stepAppearance'
 
-type SummaryState = 'idle' | 'running' | 'passed' | 'partial' | 'failed'
+type SummaryState =
+  | 'idle'
+  | 'running'
+  | 'passed'
+  | 'partial'
+  | 'failed'
+  | 'warning'
 
-/** Only a failure earns a colour: everything else stays near-black. */
+/** Only a failure or a degraded route earns a colour: everything else stays near-black. */
 const stateColorClass: Record<SummaryState, string> = {
   idle: css({ color: 'greyscale.1000' }),
   running: css({ color: 'greyscale.1000' }),
   passed: css({ color: 'greyscale.1000' }),
   partial: css({ color: 'greyscale.1000' }),
   failed: css({ color: 'danger.600' }),
+  warning: css({ color: 'warning' }),
+}
+
+/**
+ * A hard failure still outranks a warning step; a warning outranks 'partial'
+ * because a measured degraded route matters more than skipped camera or
+ * microphone checks.
+ */
+const getSummaryState = (
+  stats: ConnectionTestStats,
+  isRunning: boolean
+): SummaryState => {
+  if (isRunning) return 'running'
+  if (!stats.hasStarted) return 'idle'
+  if (stats.failed > 0) return 'failed'
+  if (stats.warnings > 0) return 'warning'
+  if (stats.skipped > 0) return 'partial'
+  return 'passed'
 }
 
 const cardClass = css({
@@ -183,16 +209,15 @@ export const ConnectionTestSummary = ({
   children?: ReactNode
 }) => {
   const { t } = useTranslation('connectionTest')
+  const { data: config } = useConfig()
 
-  const state: SummaryState = isRunning
-    ? 'running'
-    : !stats.hasStarted
-      ? 'idle'
-      : stats.failed > 0
-        ? 'failed'
-        : stats.skipped > 0
-          ? 'partial'
-          : 'passed'
+  // Network prerequisites for the reader's IT department. Instance specific,
+  // so it comes from the backend; without it the warning shows no link.
+  const networkDocUrl = config?.technical_documentation_url
+
+  const state = getSummaryState(stats, isRunning)
+  // Skipped device checks still deserve their hint under a route warning.
+  const showPartialHint = state === 'warning' && stats.skipped > 0
 
   return (
     <section className={cardClass}>
@@ -206,7 +231,27 @@ export const ConnectionTestSummary = ({
             : t(`summary.${state}`)}
         </p>
 
-        <p className={hintClass}>{t(`summary.${state}Hint`)}</p>
+        <p className={hintClass}>
+          {t(`summary.${state}Hint`)}
+          {state === 'warning' && networkDocUrl && (
+            <>
+              {' '}
+              <A
+                href={networkDocUrl}
+                target="_blank"
+                rel="noopener noreferrer"
+                size="sm"
+                externalIcon
+                aria-label={t('summary.warningDocLinkAriaLabel')}
+              >
+                {t('summary.warningDocLink')}
+              </A>
+            </>
+          )}
+        </p>
+        {showPartialHint && (
+          <p className={hintClass}>{t('summary.partialHint')}</p>
+        )}
       </div>
 
       {stats.hasStarted && (
@@ -237,6 +282,13 @@ export const ConnectionTestSummary = ({
               value={stats.passed}
               label={t('counts.passed')}
             />
+            {stats.warnings > 0 && (
+              <Counter
+                squareClass={statusSquareClass.warning}
+                value={stats.warnings}
+                label={t('counts.warnings')}
+              />
+            )}
             <Counter
               squareClass={statusSquareClass.skipped}
               value={stats.skipped}

src/frontend/src/features/diagnostics/components/stepAppearance.ts

@@ -15,15 +15,20 @@ export const statusSquareClass: Record<ConnectionTestStepStatus, string> = {
     animation: 'pulse_background 1.2s ease-in-out infinite',
   }),
   success: css({ backgroundColor: 'success.600' }),
+  warning: css({ backgroundColor: 'warning' }),
   failed: css({ backgroundColor: 'danger.600' }),
   skipped: css({ backgroundColor: 'greyscale.300' }),
 }
 
-/** Colour is carried by the square; the label stays near-black except on failure. */
+/**
+ * Colour is carried by the square; the label stays near-black except on
+ * failure and warning.
+ */
 export const statusTextClass: Record<ConnectionTestStepStatus, string> = {
   pending: css({ color: 'greyscale.500' }),
   running: css({ color: 'greyscale.700' }),
   success: css({ color: 'greyscale.1000' }),
+  warning: css({ color: 'warning', fontWeight: 'medium' }),
   failed: css({ color: 'danger.600', fontWeight: 'medium' }),
   skipped: css({ color: 'greyscale.500' }),
 }

src/frontend/src/features/diagnostics/hooks/useConnectionTestRunner.ts

@@ -8,7 +8,10 @@ import {
   type CheckInfo,
 } from 'livekit-client'
 import { fetchConnectionTestDetails } from '../api/fetchConnectionTestDetails'
-import { SelectedCandidateCheck } from '../checks/selectedCandidate'
+import {
+  isRelayedOverTcp,
+  SelectedCandidateCheck,
+} from '../checks/selectedCandidate'
 import {
   createInitialSteps,
   type ConnectionTestLog,
@@ -49,10 +52,23 @@ const getErrorMessage = (error: unknown, fallback = 'Unknown error') =>
 const isPermissionError = (error: unknown) =>
   error instanceof Error && PERMISSION_ERROR_NAMES.has(error.name)
 
+const toStepStatus = (info: CheckInfo): ConnectionTestStepStatus => {
+  const status = CHECK_STATUS_TO_STEP[info.status] ?? 'failed'
+  return status === 'success' && isRelayedOverTcp(info.data)
+    ? 'warning'
+    : status
+}
+
 const fromCheckInfo = (info: CheckInfo): Partial<ConnectionTestStepResult> => ({
-  status: CHECK_STATUS_TO_STEP[info.status] ?? 'failed',
+  status: toStepStatus(info),
   summary: info.description,
   logs: info.logs,
+  // Only SelectedCandidateCheck sets `data` (the ICE candidate report).
+  // Consumers narrow it with a type guard (see isIceCandidateReport).
+  data:
+    typeof info.data === 'object' && info.data !== null
+      ? (info.data as Record<string, unknown>)
+      : undefined,
 })
 
 const groupDevicesByKind = (devices: MediaDeviceInfo[]) => {

src/frontend/src/features/diagnostics/types.ts

@@ -15,6 +15,7 @@ export type ConnectionTestStepStatus =
   | 'pending'
   | 'running'
   | 'success'
+  | 'warning'
   | 'failed'
   | 'skipped'
 
@@ -63,6 +64,7 @@ export type ConnectionTestStats = {
   total: number
   settled: number
   passed: number
+  warnings: number
   failed: number
   skipped: number
   hasStarted: boolean
@@ -77,24 +79,27 @@ export const summarizeSteps = (
   steps: ConnectionTestStepResult[]
 ): ConnectionTestStats => {
   let passed = 0
+  let warnings = 0
   let failed = 0
   let skipped = 0
   let pending = 0
 
   for (const step of steps) {
     if (step.status === 'success') passed += 1
+    else if (step.status === 'warning') warnings += 1
     else if (step.status === 'failed') failed += 1
     else if (step.status === 'skipped') skipped += 1
     else if (step.status === 'pending') pending += 1
   }
 
   const total = steps.length
-  const settled = passed + failed + skipped
+  const settled = passed + warnings + failed + skipped
 
   return {
     total,
     settled,
     passed,
+    warnings,
     failed,
     skipped,
     hasStarted: pending < total,

src/frontend/src/features/home/components/CreateUnregisteredMeetingButton.tsx

@@ -0,0 +1,19 @@
+import { useTranslation } from 'react-i18next'
+import { Button } from '@/primitives'
+import { navigateTo } from '@/navigation/navigateTo'
+import { generateRoomId } from '@/features/rooms'
+
+export const CreateUnregisteredMeetingButton = () => {
+  const { t } = useTranslation('home')
+  return (
+    <Button
+      variant="primary"
+      data-attr="create-unregistered-meeting"
+      onPress={() =>
+        navigateTo('room', generateRoomId(), { state: { create: true } })
+      }
+    >
+      {t('createMeeting')}
+    </Button>
+  )
+}

src/frontend/src/features/home/routes/Home.tsx

@@ -9,6 +9,7 @@ import { JoinMeetingDialog } from '../components/JoinMeetingDialog'
 import { IntroSlider } from '../components/IntroSlider'
 import { MoreLink } from '../components/MoreLink'
 import { CreateMeetingMenu } from '../components/CreateMeetingMenu'
+import { CreateUnregisteredMeetingButton } from '../components/CreateUnregisteredMeetingButton'
 import { ReactNode, useEffect, useState } from 'react'
 
 import { css } from '@/styled-system/css'
@@ -189,13 +190,19 @@ const Home = () => {
                 display: 'flex',
                 gap: 0.5,
                 flexDirection: { base: 'column', xsm: 'row' },
+                flexWrap: 'wrap',
                 alignItems: { base: 'center', xsm: 'items-start' },
               })}
             >
               {isLoggedIn ? (
                 <CreateMeetingMenu />
               ) : (
-                <LoginButton proConnectHint={false} />
+                <>
+                  {data?.allow_unregistered_rooms && (
+                    <CreateUnregisteredMeetingButton />
+                  )}
+                  <LoginButton proConnectHint={false} />
+                </>
               )}
               <DialogTrigger>
                 <Button

src/frontend/src/features/layout/components/GridLayout.tsx

@@ -7,7 +7,6 @@ import {
   useSwipe,
 } from '@livekit/components-react'
 import { mergeProps } from '@/utils/mergeProps'
-import { PaginationIndicator } from './PaginationIndicator'
 import { useGridLayout } from '../hooks/useGridLayout'
 import { PaginationControl } from './PaginationControl'
 import { useSpeakerPromotionTrigger } from '../hooks/useSpeakerPromotionTrigger'
@@ -62,13 +61,7 @@ export function GridLayout({ tracks, ...props }: GridLayoutProps) {
     >
       <TrackLoop tracks={pagination.tracks}>{props.children}</TrackLoop>
       {tracks.length > layout.maxTiles && (
-        <>
-          <PaginationIndicator
-            totalPageCount={pagination.totalPageCount}
-            currentPage={pagination.currentPage}
-          />
-          <PaginationControl pagesContainer={gridEl} {...pagination} />
-        </>
+        <PaginationControl {...pagination} focusShortcut />
       )}
     </div>
   )

src/frontend/src/features/layout/components/PaginationControl.tsx

@@ -1,99 +1,147 @@
-import * as React from 'react'
-import { createInteractingObservable } from '@livekit/components-core'
 import { RiArrowLeftSLine, RiArrowRightSLine } from '@remixicon/react'
 import { Button } from '@/primitives'
-import { useEffect, useState } from 'react'
 import { useTranslation } from 'react-i18next'
-import { css } from '@/styled-system/css'
+import { css, cva, type RecipeVariantProps } from '@/styled-system/css'
+import { useCallback, useRef } from 'react'
+import { useRegisterKeyboardShortcut } from '@/features/shortcuts/useRegisterKeyboardShortcut'
 
-export interface PaginationControlProps {
+const paginationToolbar = cva({
+  base: {
+    display: 'flex',
+    alignItems: 'center',
+    gap: '0.125rem',
+    backgroundColor: 'primaryDark.50',
+    borderRadius: '2rem',
+    border: '1px solid',
+    borderColor: 'primaryDark.200',
+    padding: '0.375rem',
+  },
+  variants: {
+    placement: {
+      overlay: {
+        position: 'absolute',
+        bottom: '1rem',
+        left: '50%',
+        zIndex: 2,
+        transform: 'translateX(-50%)',
+        boxShadow: '0 2px 10px rgba(0, 0, 0, 0.45)',
+      },
+      inline: {
+        alignSelf: 'center',
+        flexShrink: 0,
+        marginTop: '1rem',
+      },
+    },
+  },
+  defaultVariants: {
+    placement: 'overlay',
+  },
+})
+
+export type PaginationControlProps = RecipeVariantProps<
+  typeof paginationToolbar
+> & {
   totalPageCount: number
   nextPage: () => void
   prevPage: () => void
   currentPage: number
-  pagesContainer?: React.RefObject<HTMLElement>
+  // The shortcut listens on the main window only, so a single instance may own it.
+  focusShortcut?: boolean
 }
 
+const arrowButtonClass = css({
+  _disabled: {
+    cursor: 'default',
+    backgroundColor: 'transparent !important',
+    '& svg': {
+      opacity: 0.35,
+    },
+    _focusVisible: {
+      outline: '2px solid',
+      outlineColor: 'focusRing',
+      outlineOffset: '2px',
+    },
+  },
+})
+
 export function PaginationControl({
   totalPageCount,
   nextPage,
   prevPage,
   currentPage,
-  pagesContainer: connectedElement,
+  placement,
+  focusShortcut = false,
 }: PaginationControlProps) {
   const { t } = useTranslation('rooms', { keyPrefix: 'pagination' })
-  const [interactive, setInteractive] = useState(false)
+  const prevButtonRef = useRef<HTMLButtonElement>(null)
+  const nextButtonRef = useRef<HTMLButtonElement>(null)
+  const isSinglePage = totalPageCount <= 1
+  const isFirstPage = currentPage <= 1
+  const isLastPage = currentPage >= totalPageCount
 
-  useEffect(() => {
-    let subscription:
-      | ReturnType<ReturnType<typeof createInteractingObservable>['subscribe']>
-      | undefined
-    if (connectedElement) {
-      subscription = createInteractingObservable(
-        connectedElement.current,
-        2000
-      ).subscribe(setInteractive)
-    }
-    return () => {
-      if (subscription) {
-        subscription.unsubscribe()
-      }
-    }
-  }, [connectedElement])
+  const focusPagination = useCallback(() => {
+    const target = isLastPage ? prevButtonRef.current : nextButtonRef.current
+    target?.focus()
+  }, [isLastPage])
 
-  if (totalPageCount <= 1) return null
+  useRegisterKeyboardShortcut({
+    id: focusShortcut ? 'focus-pagination' : undefined,
+    handler: focusPagination,
+    isDisabled: isSinglePage,
+    unregisterOnUnmount: true,
+  })
+
+  if (isSinglePage) return null
+
+  const pageCount = t('count', { currentPage, totalPageCount })
 
   return (
-    <nav
-      aria-label={t('label')}
-      className={css({
-        position: 'absolute',
-        bottom: '1rem',
-        left: '50%',
-        transform: 'translateX(-50%)',
-        alignItems: 'stretch',
-        backgroundColor: 'var(--lk-control-bg)',
-        borderRadius: 'var(--lk-border-radius)',
-        transition: 'opacity ease-in-out .15s',
-        display: 'none',
-        border: '1px solid',
-        borderColor: 'primaryDark.100',
-        overflow: 'hidden',
-      })}
-      style={{
-        display: interactive ? 'flex' : 'none',
-      }}
-      data-lk-user-interaction={interactive}
+    <div
+      role="group"
+      aria-label={`${t('label')}, ${pageCount}`}
+      className={paginationToolbar({ placement })}
     >
       <Button
-        isDisabled={currentPage == 1}
-        onPress={prevPage}
-        size="xs"
-        variant="quaternaryText"
+        ref={prevButtonRef}
+        aria-disabled={isFirstPage}
+        onPress={isFirstPage ? undefined : prevPage}
+        size="sm"
+        square
+        variant="primaryTextDark"
+        className={arrowButtonClass}
         aria-label={t('previous')}
+        tooltip={t('previous')}
       >
-        <RiArrowLeftSLine />
+        <RiArrowLeftSLine size={20} />
       </Button>
       <span
         role="status"
         className={css({
-          padding: '0.25rem 0.5rem',
+          color: 'white',
+          fontSize: '0.8125rem',
+          fontWeight: 500,
+          minWidth: '3.5rem',
+          textAlign: 'center',
+          userSelect: 'none',
+          padding: '0 0.35rem',
+          whiteSpace: 'nowrap',
         })}
       >
-        {t('count', {
-          currentPage,
-          totalPageCount,
-        })}
+        {pageCount}
       </span>
       <Button
-        isDisabled={currentPage == totalPageCount}
-        onPress={nextPage}
-        size="xs"
-        variant="quaternaryText"
+        ref={nextButtonRef}
+        aria-disabled={isLastPage}
+        onPress={isLastPage ? undefined : nextPage}
+        size="sm"
+        square
+        variant="primaryTextDark"
+        className={arrowButtonClass}
         aria-label={t('next')}
+        tooltip={t('next')}
       >
-        <RiArrowRightSLine />
+        <RiArrowRightSLine size={20} />
       </Button>
-    </nav>
+    </div>
   )
 }

src/frontend/src/features/layout/components/PaginationIndicator.tsx

@@ -1,30 +0,0 @@
-import * as React from 'react'
-
-export interface PaginationIndicatorProps {
-  totalPageCount: number
-  currentPage: number
-}
-
-export const PaginationIndicator: (
-  props: PaginationIndicatorProps & React.RefAttributes<HTMLDivElement>
-) => React.ReactNode = /* @__PURE__ */ React.forwardRef<
-  HTMLDivElement,
-  PaginationIndicatorProps
->(function PaginationIndicator(
-  { totalPageCount, currentPage }: PaginationIndicatorProps,
-  ref
-) {
-  const bubbles = new Array(totalPageCount).fill('').map((_, index) => {
-    if (index + 1 === currentPage) {
-      return <span data-lk-active key={index} />
-    } else {
-      return <span key={index} />
-    }
-  })
-
-  return (
-    <div ref={ref} className="lk-pagination-indicator" aria-hidden="true">
-      {bubbles}
-    </div>
-  )
-})

src/frontend/src/features/pip/components/layout/PipPagination.tsx

@@ -1,96 +0,0 @@
-import { RiArrowLeftSLine, RiArrowRightSLine } from '@remixicon/react'
-import { useTranslation } from 'react-i18next'
-import { styled } from '@/styled-system/jsx'
-
-interface PipPaginationProps {
-  totalPageCount: number
-  currentPage: number
-  nextPage: () => void
-  prevPage: () => void
-}
-
-export const PipPagination = ({
-  totalPageCount,
-  currentPage,
-  nextPage,
-  prevPage,
-}: PipPaginationProps) => {
-  const { t } = useTranslation('rooms', { keyPrefix: 'pagination' })
-
-  if (totalPageCount <= 1) return null
-
-  return (
-    <Nav aria-label={t('label')}>
-      <ArrowButton
-        type="button"
-        onClick={prevPage}
-        disabled={currentPage === 1}
-        aria-label={t('previous')}
-      >
-        <RiArrowLeftSLine size={18} />
-      </ArrowButton>
-      <Counter role="status">
-        {t('count', { currentPage, totalPageCount })}
-      </Counter>
-      <ArrowButton
-        type="button"
-        onClick={nextPage}
-        disabled={currentPage === totalPageCount}
-        aria-label={t('next')}
-      >
-        <RiArrowRightSLine size={18} />
-      </ArrowButton>
-    </Nav>
-  )
-}
-
-const Nav = styled('nav', {
-  base: {
-    display: 'flex',
-    alignItems: 'center',
-    justifyContent: 'center',
-    gap: '0.25rem',
-    marginTop: '1rem',
-    flexShrink: 0,
-  },
-})
-
-const ArrowButton = styled('button', {
-  base: {
-    display: 'inline-flex',
-    alignItems: 'center',
-    justifyContent: 'center',
-    width: '1.75rem',
-    height: '1.75rem',
-    borderRadius: '4px',
-    border: 'none',
-    cursor: 'pointer',
-    color: 'white',
-    backgroundColor: 'primaryDark.100',
-    transition: 'opacity 0.15s, background-color 0.15s',
-    '&:hover:not(:disabled)': {
-      backgroundColor: 'primaryDark.75',
-    },
-    '&:focus-visible': {
-      outline: '2px solid',
-      outlineColor: 'white',
-      outlineOffset: '2px',
-    },
-    '&:disabled': {
-      opacity: 0.3,
-      cursor: 'default',
-    },
-  },
-})
-
-const Counter = styled('span', {
-  base: {
-    fontSize: '0.75rem',
-    color: 'white',
-    opacity: 0.8,
-    whiteSpace: 'nowrap',
-    padding: '0 0.25rem',
-    minWidth: '3rem',
-    textAlign: 'center',
-  },
-})

src/frontend/src/features/pip/components/layout/PipStage.tsx

@@ -4,7 +4,7 @@ import { RoomEvent, Track } from 'livekit-client'
 import { styled } from '@/styled-system/jsx'
 import { PipFocusLayout } from './PipFocusLayout'
 import { PipGridLayout } from './PipGridLayout'
-import { PipPagination } from './PipPagination'
+import { PaginationControl } from '@/features/layout/components/PaginationControl'
 import { PipScreenShareLayout } from './PipScreenShareLayout'
 import { StageFrame } from './StageFrame'
 import { MAX_PIP_TILES } from '../../utils/pipGrid'
@@ -120,12 +120,7 @@ const PaginatedStage = ({
 }) => (
   <StageWrapper>
     <StageFrame>{children}</StageFrame>
-    <PipPagination
-      totalPageCount={pagination.totalPageCount}
-      currentPage={pagination.currentPage}
-      nextPage={pagination.nextPage}
-      prevPage={pagination.prevPage}
-    />
+    <PaginationControl {...pagination} placement="inline" />
   </StageWrapper>
 )
 

src/frontend/src/features/recording/components/ScreenRecordingSidePanel.tsx

@@ -45,6 +45,10 @@ export const ScreenRecordingSidePanel = () => {
     FeatureFlags.ScreenRecording
   )
 
+  const hasTranscriptAccess = useHasRecordingAccess(
+    RecordingMode.Transcript,
+    FeatureFlags.Transcript
+  )
   const { notifyParticipants } = useNotifyParticipants()
   const { selectedLanguageKey, isLanguageSetToAuto } =
     useTranscriptionLanguage()
@@ -88,7 +92,7 @@ export const ScreenRecordingSidePanel = () => {
           ...(!isLanguageSetToAuto && {
             language: selectedLanguageKey,
           }),
-          ...(includeTranscript && { transcribe: true }),
+          ...(includeTranscript && hasTranscriptAccess && { transcribe: true }),
         }
 
         await startRecording({
@@ -182,24 +186,26 @@ export const ScreenRecordingSidePanel = () => {
         <RowWrapper iconName="mail" position="last">
           <Text variant="sm">{t('details.receiver')}</Text>
         </RowWrapper>
-
-        <div className={css({ height: '15px' })} />
-
-        <div
-          className={css({
-            width: '100%',
-            marginLeft: '20px',
-          })}
-        >
-          <Checkbox
-            size="sm"
-            isSelected={includeTranscript}
-            onChange={setIncludeTranscript}
-            isDisabled={statuses.isActive || isPendingToStart}
-          >
-            <Text variant="sm">{t('details.transcription')}</Text>
-          </Checkbox>
-        </div>
+        {hasTranscriptAccess && (
+          <>
+            <div className={css({ height: '15px' })} />
+            <div
+              className={css({
+                width: '100%',
+                marginLeft: '20px',
+              })}
+            >
+              <Checkbox
+                size="sm"
+                isSelected={includeTranscript}
+                onChange={setIncludeTranscript}
+                isDisabled={statuses.isActive || isPendingToStart}
+              >
+                <Text variant="sm">{t('details.transcription')}</Text>
+              </Checkbox>
+            </div>
+          </>
+        )}
       </VStack>
       <ControlsButton
         i18nKeyPrefix={keyPrefix}

src/frontend/src/features/recording/components/TranscriptSidePanel.tsx

@@ -53,6 +53,10 @@ export const TranscriptSidePanel = () => {
     FeatureFlags.Transcript
   )
 
+  const hasScreenRecordingAccess = useHasRecordingAccess(
+    RecordingMode.ScreenRecording,
+    FeatureFlags.ScreenRecording
+  )
   const hasFeatureWithoutAdminRights = useHasFeatureWithoutAdminRights(
     RecordingMode.Transcript,
     FeatureFlags.Transcript
@@ -97,7 +101,9 @@ export const TranscriptSidePanel = () => {
           room.localParticipant
         )
       } else {
-        const recordingMode = includeScreenRecording
+        const withScreenRecording =
+          includeScreenRecording && hasScreenRecordingAccess
+        const recordingMode = withScreenRecording
           ? RecordingMode.ScreenRecording
           : RecordingMode.Transcript
 
@@ -105,7 +111,7 @@ export const TranscriptSidePanel = () => {
           ...(!isLanguageSetToAuto && {
             language: selectedLanguageKey,
           }),
-          ...(includeScreenRecording && {
+          ...(withScreenRecording && {
             transcribe: true,
             original_mode: RecordingMode.Transcript,
           }),
@@ -122,7 +128,7 @@ export const TranscriptSidePanel = () => {
           type: NotificationType.TranscriptionStarted,
         })
         captureEvent('transcript-started', {
-          includeScreenRecording: includeScreenRecording,
+          includeScreenRecording: withScreenRecording,
           language: selectedLanguageKey,
         })
       }
@@ -234,22 +240,26 @@ export const TranscriptSidePanel = () => {
             </Button>
           </Text>
         </RowWrapper>
-        <div className={css({ height: '15px' })} />
-        <div
-          className={css({
-            width: '100%',
-            marginLeft: '20px',
-          })}
-        >
-          <Checkbox
-            size="sm"
-            isSelected={includeScreenRecording}
-            onChange={setIncludeScreenRecording}
-            isDisabled={statuses.isActive || isPendingToStart}
-          >
-            <Text variant="sm">{t('details.recording')}</Text>
-          </Checkbox>
-        </div>
+        {hasScreenRecordingAccess && (
+          <>
+            <div className={css({ height: '15px' })} />
+            <div
+              className={css({
+                width: '100%',
+                marginLeft: '20px',
+              })}
+            >
+              <Checkbox
+                size="sm"
+                isSelected={includeScreenRecording}
+                onChange={setIncludeScreenRecording}
+                isDisabled={statuses.isActive || isPendingToStart}
+              >
+                <Text variant="sm">{t('details.recording')}</Text>
+              </Checkbox>
+            </div>
+          </>
+        )}
       </VStack>
       <ControlsButton
         i18nKeyPrefix={keyPrefix}

src/frontend/src/features/rooms/components/Conference.tsx

@@ -158,7 +158,7 @@ export const Conference = ({
            *
            * Issue: On Firefox behind proxy configurations, WebSocket signaling fails to establish.
            * Symptom: Client receives HTTP 200 instead of expected 101 (Switching Protocols).
-           * Root Cause: Certificate/security issue where the initial request is considered unsecure.
+           * Root Cause: Certificate/security issue where the initial request is considered insecure.
            *
            * Solution: Pre-establish a WebSocket connection to the signaling server, which fails.
            * This "primes" the connection, allowing subsequent WebSocket establishments to work correctly.

src/frontend/src/features/rooms/components/InviteDialog.tsx

@@ -40,11 +40,15 @@ const StyledRACDialog = styled(Dialog, {
 })
 
 export const InviteDialog = ({ mode }: { mode: 'join' | 'create' }) => {
-  const [showInviteDialog, setShowInviteDialog] = useState(mode === 'create')
-
   const { t } = useTranslation('rooms', { keyPrefix: 'shareDialog' })
 
   const roomData = useRoomData()
+
+  const isCreatingUnregisteredRoom =
+    roomData?.id === null && !!history.state?.create
+  const [isDismissed, setIsDismissed] = useState(false)
+  const showInviteDialog =
+    !isDismissed && (mode === 'create' || isCreatingUnregisteredRoom)
   const roomUrl = roomData?.slug ? getRouteUrl('room', roomData.slug) : ''
 
   const telephony = useTelephony()
@@ -78,7 +82,7 @@ export const InviteDialog = ({ mode }: { mode: 'join' | 'create' }) => {
             variant="tertiaryText"
             size="xs"
             onPress={() => {
-              setShowInviteDialog(false)
+              setIsDismissed(true)
             }}
             aria-label={t('closeDialog')}
           >

src/frontend/src/features/rooms/livekit/components/LowerHandOnSpeaking.tsx

@@ -0,0 +1,43 @@
+import { useIsSpeaking, useRoomContext } from '@livekit/components-react'
+import { useEffect, useState } from 'react'
+import { useRaisedHand } from '@/features/rooms/livekit/hooks/useRaisedHand'
+import {
+  closeLowerHandToasts,
+  showLowerHandToast,
+} from '@/features/notifications/utils'
+
+const SPEAKING_DETECTION_DELAY = 3000
+
+/**
+ * Offers to lower the local participant's raised hand after
+ * SPEAKING_DETECTION_DELAY of speaking. Mount it once: each copy runs its own
+ * timer and shows its own toast.
+ */
+export const LowerHandOnSpeaking = () => {
+  const room = useRoomContext()
+  const { isHandRaised, lowerHand } = useRaisedHand({
+    participant: room.localParticipant,
+  })
+  const isSpeaking = useIsSpeaking(room.localParticipant)
+  const [hasOffered, setHasOffered] = useState(false)
+
+  useEffect(() => {
+    if (isHandRaised) return
+    setHasOffered(false)
+    closeLowerHandToasts()
+  }, [isHandRaised])
+
+  useEffect(() => {
+    if (!isSpeaking || !isHandRaised || hasOffered) return
+
+    const timer = setTimeout(() => {
+      setHasOffered(true)
+      showLowerHandToast(room.localParticipant, lowerHand)
+    }, SPEAKING_DETECTION_DELAY)
+
+    return () => clearTimeout(timer)
+    // eslint-disable-next-line react-hooks/exhaustive-deps
+  }, [isSpeaking, isHandRaised, hasOffered])
+
+  return null
+}

src/frontend/src/features/rooms/livekit/components/controls/HandToggle.tsx

@@ -2,19 +2,12 @@ import { useTranslation } from 'react-i18next'
 import { RiHand } from '@remixicon/react'
 import { ToggleButton } from '@/primitives'
 import { css } from '@/styled-system/css'
-import { useIsSpeaking, useRoomContext } from '@livekit/components-react'
+import { useRoomContext } from '@livekit/components-react'
 import { useRaisedHand } from '@/features/rooms/livekit/hooks/useRaisedHand'
-import { useEffect, useRef, useState } from 'react'
-import {
-  closeLowerHandToasts,
-  showLowerHandToast,
-} from '@/features/notifications/utils'
 import { useRegisterKeyboardShortcut } from '@/features/shortcuts/useRegisterKeyboardShortcut'
 import { type ButtonRecipeProps } from '@/primitives/buttonRecipe'
 import { ToggleButtonProps } from '@/primitives/ToggleButton'
 
-const SPEAKING_DETECTION_DELAY = 3000
-
 type Props = Pick<NonNullable<ButtonRecipeProps>, 'variant'> & ToggleButtonProps
 
 export const HandToggle = ({
@@ -25,64 +18,15 @@ export const HandToggle = ({
   const { t } = useTranslation('rooms', { keyPrefix: 'controls.hand' })
 
   const room = useRoomContext()
-  const { isHandRaised, toggleRaisedHand, lowerHand } = useRaisedHand({
+  const { isHandRaised, toggleRaisedHand } = useRaisedHand({
     participant: room.localParticipant,
   })
 
-  const isSpeaking = useIsSpeaking(room.localParticipant)
-  const speakingTimerRef = useRef<ReturnType<typeof setTimeout> | null>(null)
-  const [hasShownToast, setHasShownToast] = useState(false)
-
-  const resetToastState = () => {
-    setHasShownToast(false)
-  }
-
-  useEffect(() => {
-    if (isHandRaised) return
-    closeLowerHandToasts()
-  }, [isHandRaised])
-
-  const handleToggle = () => {
-    toggleRaisedHand()
-    resetToastState()
-  }
-
   useRegisterKeyboardShortcut({
     id: 'raise-hand',
-    handler: handleToggle,
+    handler: toggleRaisedHand,
   })
 
-  useEffect(() => {
-    const shouldShowToast = isSpeaking && isHandRaised && !hasShownToast
-
-    if (shouldShowToast && !speakingTimerRef.current) {
-      speakingTimerRef.current = setTimeout(() => {
-        speakingTimerRef.current = null
-        setHasShownToast(true)
-        const onClose = () => {
-          lowerHand()
-          resetToastState()
-        }
-        showLowerHandToast(room.localParticipant, onClose)
-      }, SPEAKING_DETECTION_DELAY)
-    }
-    if ((!isSpeaking || !isHandRaised) && speakingTimerRef.current) {
-      clearTimeout(speakingTimerRef.current)
-      speakingTimerRef.current = null
-    }
-    // eslint-disable-next-line react-hooks/exhaustive-deps
-  }, [isSpeaking, isHandRaised, hasShownToast, lowerHand])
-
-  // Clear any pending timer on unmount
-  useEffect(() => {
-    return () => {
-      if (speakingTimerRef.current) {
-        clearTimeout(speakingTimerRef.current)
-        speakingTimerRef.current = null
-      }
-    }
-  }, [])
-
   const tooltipLabel = isHandRaised ? 'lower' : 'raise'
 
   return (
@@ -100,7 +44,7 @@ export const HandToggle = ({
         tooltip={t(tooltipLabel)}
         isSelected={isHandRaised}
         onPress={(e) => {
-          handleToggle()
+          toggleRaisedHand()
           onPress?.(e)
         }}
         data-attr={`controls-hand-${tooltipLabel}`}

src/frontend/src/features/rooms/livekit/hooks/useSidePanel.ts

@@ -31,35 +31,20 @@ export const useSidePanel = () => {
   const isSidePanelOpen = !!activePanelId
   const isSubPanelOpen = !!activeSubPanelId
 
-  const toggleAdmin = () => {
-    layoutStore.activePanelId = isAdminOpen ? null : PanelId.ADMIN
-    if (layoutSnap.activeSubPanelId) layoutStore.activeSubPanelId = null
+  // Reads the live store, not the render snapshot: shortcut handlers outlive
+  // toggles that unmount (e.g. inside a closed overflow menu).
+  const togglePanel = (panelId: PanelId) => {
+    layoutStore.activePanelId =
+      layoutStore.activePanelId === panelId ? null : panelId
+    if (layoutStore.activeSubPanelId) layoutStore.activeSubPanelId = null
   }
 
-  const toggleParticipants = () => {
-    layoutStore.activePanelId = isParticipantsOpen ? null : PanelId.PARTICIPANTS
-    if (layoutSnap.activeSubPanelId) layoutStore.activeSubPanelId = null
-  }
-
-  const toggleChat = () => {
-    layoutStore.activePanelId = isChatOpen ? null : PanelId.CHAT
-    if (layoutSnap.activeSubPanelId) layoutStore.activeSubPanelId = null
-  }
-
-  const toggleEffects = () => {
-    layoutStore.activePanelId = isEffectsOpen ? null : PanelId.EFFECTS
-    if (layoutSnap.activeSubPanelId) layoutStore.activeSubPanelId = null
-  }
-
-  const toggleTools = () => {
-    layoutStore.activePanelId = isToolsOpen ? null : PanelId.TOOLS
-    if (layoutSnap.activeSubPanelId) layoutStore.activeSubPanelId = null
-  }
-
-  const toggleInfo = () => {
-    layoutStore.activePanelId = isInfoOpen ? null : PanelId.INFO
-    if (layoutSnap.activeSubPanelId) layoutStore.activeSubPanelId = null
-  }
+  const toggleAdmin = () => togglePanel(PanelId.ADMIN)
+  const toggleParticipants = () => togglePanel(PanelId.PARTICIPANTS)
+  const toggleChat = () => togglePanel(PanelId.CHAT)
+  const toggleEffects = () => togglePanel(PanelId.EFFECTS)
+  const toggleTools = () => togglePanel(PanelId.TOOLS)
+  const toggleInfo = () => togglePanel(PanelId.INFO)
 
   const openTranscript = () => {
     layoutStore.activeSubPanelId = SubPanelId.TRANSCRIPT

src/frontend/src/features/rooms/livekit/prefabs/VideoConference.tsx

@@ -31,6 +31,7 @@ import { PinAnnouncer } from '@/features/layout/components/PinAnnouncer'
 import { ChatProvider } from '@/features/chat/components/ChatProvider'
 import { SyncDevicePreferences } from '@/features/rooms/livekit/components/SyncDevicePreferences'
 import { RoomSilentMicDetector } from '@/features/rooms/components/SilentMicDetector'
+import { LowerHandOnSpeaking } from '@/features/rooms/livekit/components/LowerHandOnSpeaking'
 import { LobbyProvider } from '@/features/rooms/components/LobbyProvider'
 
 /**
@@ -119,6 +120,7 @@ export function VideoConference({ ...props }: VideoConferenceProps) {
       <ConnectionObserver />
       <SyncDevicePreferences />
       <RoomSilentMicDetector />
+      <LowerHandOnSpeaking />
       <MediaStateObserver />
       <ChatProvider />
       <LobbyProvider />

src/frontend/src/features/rooms/utils/isRoomValid.test.ts

@@ -0,0 +1,14 @@
+import { describe, expect, it } from 'vitest'
+import { normalizeRoomId } from './isRoomValid'
+
+describe('normalizeRoomId', () => {
+  it('lowercases and re-inserts the hyphens of a ten-letter id', () => {
+    expect(normalizeRoomId('ABCDEFGHIJ')).toBe('abc-defg-hij')
+    expect(normalizeRoomId('abc-defghij')).toBe('abc-defg-hij')
+  })
+
+  it('returns any other input unchanged', () => {
+    expect(normalizeRoomId('abc-def')).toBe('abc-def')
+    expect(normalizeRoomId('Not-A-Room')).toBe('Not-A-Room')
+  })
+})

src/frontend/src/features/shortcuts/catalog.ts

@@ -7,6 +7,7 @@ export type ShortcutCategory = 'navigation' | 'media' | 'interaction'
 export type ShortcutId =
   | 'open-shortcuts'
   | 'focus-toolbar'
+  | 'focus-pagination'
   | 'toggle-microphone'
   | 'toggle-camera'
   | 'push-to-talk'
@@ -44,6 +45,11 @@ export const shortcutCatalog: ShortcutDescriptor[] = [
     category: 'navigation',
     shortcut: { key: 'F2' },
   },
+  {
+    id: 'focus-pagination',
+    category: 'navigation',
+    shortcut: { key: 'G', ctrlKey: true, shiftKey: true },
+  },
   {
     id: 'toggle-microphone',
     category: 'media',

src/frontend/src/features/shortcuts/useRegisterKeyboardShortcut.ts

@@ -7,12 +7,16 @@ export type useRegisterKeyboardShortcutProps = {
   id?: ShortcutId
   handler: () => Promise<void | boolean | undefined> | void
   isDisabled?: boolean
+  // Opt-in: controls rendered inside menus unmount when the menu closes, and
+  // their shortcuts must keep working.
+  unregisterOnUnmount?: boolean
 }
 
 export const useRegisterKeyboardShortcut = ({
   id,
   handler,
   isDisabled = false,
+  unregisterOnUnmount = false,
 }: useRegisterKeyboardShortcutProps) => {
   useEffect(() => {
     if (!id) return
@@ -21,8 +25,14 @@ export const useRegisterKeyboardShortcut = ({
     const formattedKey = formatShortcutKey(descriptor.shortcut)
     if (isDisabled) {
       keyboardShortcutsStore.shortcuts.delete(formattedKey)
-    } else {
-      keyboardShortcutsStore.shortcuts.set(formattedKey, handler)
+      return
     }
-  }, [handler, id, isDisabled])
+    keyboardShortcutsStore.shortcuts.set(formattedKey, handler)
+    if (!unregisterOnUnmount) return
+    return () => {
+      if (keyboardShortcutsStore.shortcuts.get(formattedKey) === handler) {
+        keyboardShortcutsStore.shortcuts.delete(formattedKey)
+      }
+    }
+  }, [handler, id, isDisabled, unregisterOnUnmount])
 }

src/frontend/src/layout/Footer.tsx

@@ -126,6 +126,9 @@ export const Footer = () => {
     return null
   }
 
+  const isConnectionTestEnabled = !!data.diagnostics?.connection_test_enabled
+  const technicalDocumentationUrl = data.technical_documentation_url
+
   return (
     <footer
       className={css({
@@ -256,7 +259,9 @@ export const Footer = () => {
               {t('links.data')}
             </A>
           </StyledLi>
-          <StyledLi divider>
+          <StyledLi
+            divider={isConnectionTestEnabled || !!technicalDocumentationUrl}
+          >
             <Link
               underline={false}
               footer="minor"
@@ -266,8 +271,8 @@ export const Footer = () => {
               {t('links.accessibility')}
             </Link>
           </StyledLi>
-          {data?.diagnostics?.connection_test_enabled && (
-            <StyledLi divider>
+          {isConnectionTestEnabled && (
+            <StyledLi divider={!!technicalDocumentationUrl}>
               <Link
                 underline={false}
                 footer="minor"
@@ -278,19 +283,21 @@ export const Footer = () => {
               </Link>
             </StyledLi>
           )}
-          <StyledLi>
-            <A
-              externalIcon
-              underline={false}
-              footer="minor"
-              href="https://docs.numerique.gouv.fr/docs/f2baa1b9-f29e-4d58-959d-65d4376fc6b8/"
-              aria-label={
-                t('links.technicalDetails') + ' - ' + t('links.ariaLabel')
-              }
-            >
-              {t('links.technicalDetails')}
-            </A>
-          </StyledLi>
+          {technicalDocumentationUrl && (
+            <StyledLi>
+              <A
+                externalIcon
+                underline={false}
+                footer="minor"
+                href={technicalDocumentationUrl}
+                aria-label={
+                  t('links.technicalDetails') + ' - ' + t('links.ariaLabel')
+                }
+              >
+                {t('links.technicalDetails')}
+              </A>
+            </StyledLi>
+          )}
         </SecondRow>
         <ThirdRow>
           {t('mentions')}{' '}

src/frontend/src/locales/de/connectionTest.json

@@ -29,11 +29,13 @@
     "pending": "Ausstehend",
     "running": "Läuft…",
     "success": "Erfolgreich",
+    "warning": "Nicht optimal",
     "failed": "Fehlgeschlagen",
     "skipped": "Übersprungen"
   },
   "counts": {
     "passed": "erfolgreich",
+    "warnings": "nicht optimal",
     "failed": "fehlgeschlagen",
     "skipped": "übersprungen"
   },
@@ -46,6 +48,10 @@
     "passedHint": "Ihr Browser, Ihre Geräte und Ihr Netzwerk sind für eine Besprechung bereit.",
     "partial": "Teilweiser Test",
     "partialHint": "Einige Prüfungen wurden übersprungen. Erlauben Sie den Zugriff auf Ihre Kamera und Ihr Mikrofon, um diese zu testen.",
+    "warning": "Verbindung nicht optimal",
+    "warningHint": "Sie können an Ihren Besprechungen teilnehmen, aber die Bild- und Tonqualität kann aufgrund Ihrer Netzwerkeinstellungen beeinträchtigt sein. Ihre IT-Abteilung kann hier Abhilfe schaffen.",
+    "warningDocLink": "Netzwerkanforderungen für Ihre IT-Abteilung",
+    "warningDocLinkAriaLabel": "Netzwerkanforderungen für Ihre IT-Abteilung öffnen – öffnet in neuem Tab",
     "failed_one": "{{count}} Prüfung fehlgeschlagen",
     "failed_other": "{{count}} Prüfungen fehlgeschlagen",
     "failedHint": "Öffnen Sie die fehlgeschlagenen Prüfungen für weitere Details und senden Sie den Bericht an Ihre IT-Abteilung."

src/frontend/src/locales/de/rooms.json

@@ -784,6 +784,7 @@
     "actions": {
       "open-shortcuts": "Tastenkürzel-Hilfe öffnen",
       "focus-toolbar": "Fokus auf die untere Symbolleiste",
+      "focus-pagination": "Fokus auf die Teilnehmerseiten",
       "toggle-microphone": "Mikrofon umschalten",
       "toggle-camera": "Kamera umschalten",
       "push-to-talk": "Push-to-talk",

src/frontend/src/locales/en/connectionTest.json

@@ -29,11 +29,13 @@
     "pending": "Pending",
     "running": "Running…",
     "success": "Passed",
+    "warning": "Not optimal",
     "failed": "Failed",
     "skipped": "Skipped"
   },
   "counts": {
     "passed": "passed",
+    "warnings": "not optimal",
     "failed": "failed",
     "skipped": "skipped"
   },
@@ -46,6 +48,10 @@
     "passedHint": "Your browser, your devices and your network are ready for a meeting.",
     "partial": "Partially tested",
     "partialHint": "Some checks were skipped. Allow access to your camera and microphone to test them.",
+    "warning": "Suboptimal connection",
+    "warningHint": "You can join your meetings, but video and audio quality may be reduced because of your network settings. Your IT department can improve this.",
+    "warningDocLink": "Network requirements for your IT department",
+    "warningDocLinkAriaLabel": "Open the network requirements for your IT department - opens in new window",
     "failed_one": "{{count}} check failed",
     "failed_other": "{{count}} checks failed",
     "failedHint": "Open the failed checks below for details, then send the report to your IT department."

src/frontend/src/locales/en/rooms.json

@@ -784,6 +784,7 @@
     "actions": {
       "open-shortcuts": "Open shortcuts help",
       "focus-toolbar": "Focus bottom toolbar",
+      "focus-pagination": "Focus participant pagination",
       "toggle-microphone": "Toggle microphone",
       "toggle-camera": "Toggle camera",
       "push-to-talk": "Push-to-talk (hold to unmute)",

src/frontend/src/locales/es/connectionTest.json

@@ -29,11 +29,13 @@
     "pending": "En espera",
     "running": "En curso…",
     "success": "Correcto",
+    "warning": "No óptimo",
     "failed": "Error",
     "skipped": "Omitido"
   },
   "counts": {
     "passed": "correctas",
+    "warnings": "no óptimas",
     "failed": "con errores",
     "skipped": "omitidas"
   },
@@ -46,6 +48,10 @@
     "passedHint": "Tu navegador, tus dispositivos y tu red están listos para una reunión.",
     "partial": "Prueba parcial",
     "partialHint": "Se han omitido algunas comprobaciones. Autoriza el acceso a tu cámara y a tu micrófono para probarlos.",
+    "warning": "Conexión no óptima",
+    "warningHint": "Puedes participar en tus reuniones, pero la calidad de la imagen y del sonido puede verse reducida por la configuración de tu red. Tu servicio informático puede mejorar la situación.",
+    "warningDocLink": "Requisitos de red para tu servicio informático",
+    "warningDocLinkAriaLabel": "Abrir los requisitos de red para tu servicio informático - se abre en una nueva ventana",
     "failed_one": "{{count}} verificación en error",
     "failed_other": "{{count}} verificaciones en error",
     "failedHint": "Abre las verificaciones en error para ver el detalle y transmite después el informe a tu servicio informático."

src/frontend/src/locales/es/rooms.json

@@ -783,6 +783,7 @@
     "actions": {
       "open-shortcuts": "Abrir la ayuda de atajos",
       "focus-toolbar": "Poner el foco en la barra de herramientas inferior",
+      "focus-pagination": "Poner el foco en la paginación de participantes",
       "toggle-microphone": "Activar o desactivar el micrófono",
       "toggle-camera": "Activar o desactivar la cámara",
       "push-to-talk": "Pulsar para hablar (mantener para reactivar)",

src/frontend/src/locales/fr/connectionTest.json

@@ -29,11 +29,13 @@
     "pending": "En attente",
     "running": "En cours…",
     "success": "Réussi",
+    "warning": "Non optimal",
     "failed": "Échec",
     "skipped": "Ignoré"
   },
   "counts": {
     "passed": "réussis",
+    "warnings": "non optimaux",
     "failed": "en échec",
     "skipped": "ignorés"
   },
@@ -46,6 +48,10 @@
     "passedHint": "Votre navigateur, vos périphériques et votre réseau sont prêts pour une réunion.",
     "partial": "Test partiel",
     "partialHint": "Certaines vérifications ont été ignorées. Autorisez l'accès à votre caméra et à votre microphone pour les tester.",
+    "warning": "Connexion non optimale",
+    "warningHint": "Vous pouvez participer à vos réunions, mais la qualité de l'image et du son risque d'être réduite à cause des réglages de votre réseau. Votre service informatique peut améliorer la situation.",
+    "warningDocLink": "Prérequis réseau à transmettre à votre service informatique",
+    "warningDocLinkAriaLabel": "Ouvrir les prérequis réseau à transmettre à votre service informatique - ouvre dans une nouvelle fenêtre",
     "failed_one": "{{count}} vérification en échec",
     "failed_other": "{{count}} vérifications en échec",
     "failedHint": "Ouvrez les vérifications en échec pour voir le détail, puis transmettez le rapport à votre service informatique."