wip sign participant lobby

Only run the transit_code exchange flow when the app is loaded in an
embedded context (i.e. inside an iframe).

Combined with the CSP rules that will restrict which origins are
allowed to embed the app, this gives us a client-side lever to
control which integrations can actually use this authentication
path.

.github/workflows/ci.yml

@@ -252,13 +252,13 @@ jobs:
 
       - name: Start MinIO
         run: |
-          docker pull minio/minio
+          docker pull quay.io/minio/minio
           docker run -d --name minio \
             -p 9000:9000 \
             -e "MINIO_ACCESS_KEY=meet" \
             -e "MINIO_SECRET_KEY=password" \
             -v /data/media:/data \
-            minio/minio server --console-address :9001 /data
+            quay.io/minio/minio server --console-address :9001 /data
 
       # Tool to wait for a service to be ready
       - name: Install Dockerize

.gitignore

@@ -86,3 +86,6 @@ docker/livekit/rootCA.pem
 
 # Frontend rollup-plugin-visualizer
 /src/frontend/rollup-plugin-visualizer/*
+
+# NixOS
+.devenv

CHANGELOG.md

@@ -10,13 +10,59 @@ and this project adheres to
 
 ### Added
 
-- ✨(backend) add per-recording encoding quality presets to start-recording API
-
-## [1.30.0] - 2026-09-01
+- ✨(backend) make the LiveKit default video codec configurable
+- 🔧(dev) add support for Bureautix workstations
 
 ### Changed
 
-- ♿️(frontend) close side panel with Escape key #1507
+- 📈(frontend) include LiveKit SIDs in the connection analytics event
+- 🔇(backend) silence expected 401 warnings on /me
+- 🔇(backend) silence noisy request summary info logs
+- ⚡️(frontend) defer loading the Crisp script until idle
+- ⬆️(frontend) upgrade react-i18next from 17.0.10 to 17.0.12
+- ⬆️(frontend) upgrade posthog-js from 1.414.0 to 1.418.10
+- ⬆️(addons) upgrade i18next from 26.3.6 to 26.4.0
+- ⬆️(frontend) upgrade humanize-duration from 3.33.2 to 3.34.1
+
+### Fixed
+
+- 🐛(backend) report the app release to Sentry instead of "NA"
+- 🐛(frontend) play the waiting room notification sound on every arrival
+- 🐛(backend) acknowledge unknown LiveKit webhook events instead of 422
+- 🔒️(backend) enforce display name setting on rename API
+- 🔒️(backend) reject inactive users in resource server backend
+- 🐛(frontend) fix file permissions in the Docker image
+
+## [1.31.0] - 2026-09-08
+
+### Added
+
+- ✨(frontend) add 1080p sending resolution option #1660
+- ✨(backend) add Traefik support via configurable media-auth url header #1649
+- ✨(backend) update a room's attributes from the external API
+- 🔊(backend) log request duration in Gunicorn workers
+- 📈(frontend) track missing lobby participant on accept/reject
+- ✨(backend) sort waiting participants by their arrival time
+
+### Changed
+
+- ⬆️(dev) pin LiveKit server to v1.13.6
+- 🔒(frontend) upgrade base image to 1.30.4-alpine3.24
+
+### Fixed
+
+- 🐛(backend) allow any printable ASCII characters in user sub field #1673
+- 🐛(frontend) keep the sending resolution picked while the camera is off #1667
+- 🐛(frontend) restore automatic lower-hand on speaking
+- 🐛(frontend) center Avatar initials with a font-aware cap-height ratio
+- 🐛(frontend) keep feedback buttons on one line for fr/es/en
+- ⚡️(frontend) increase lobby polling interval on both sides
+- ⚡️(frontend) add trailing slash on the /me endpoint call
+- ⚡️(backend) refactor lobby storage to bound key lookups per room
+- ⚡️(backend) refactor presence cache to bound key lookups per room
+- 💄(frontend) position the login hint dynamically next to the button
+
+## [1.30.0] - 2026-09-01
 
 ### Added
 
@@ -33,6 +79,7 @@ and this project adheres to
 - ⬆️(frontend) upgrade @fontsource/opendyslexic from 5.2.5 to 5.3.0
 - ⬆️(addons) upgrade core-js from 3.49.0 to 3.50.0
 - ♻️(backend) factorize s3 client creation in utils
+- ♿️(frontend) close side panel with Escape key #1507
 
 ### Fixed
 

Makefile

@@ -292,7 +292,7 @@ shell: ## connect to database shell
 # -- Database
 
 dbshell: ## connect to database shell
-	docker compose exec app-dev python manage.py dbshell
+	@$(COMPOSE_EXEC_APP) python manage.py dbshell
 .PHONY: dbshell
 
 resetdb: FLUSH_ARGS ?=

UPGRADE.md

@@ -16,92 +16,6 @@ the following command inside your docker container:
 
 ## [Unreleased]
 
-### Recording encoding settings replaced by a resolution/profile model
-
-The `RECORDING_ENCODING_*` settings introduced in v1.16.0 exposed raw encoder
-values (width, height, framerate, bitrate). They are replaced by two named and configurable sets of
-dimensions, a **resolution** (default: `540p`, `720p`, `1080p`) and a **profile**
-(default: `talking_heads`, `text`, `mixed`, `full`), which are resolved to the width, height,
-fps and video bitrate.
-
-**The following environment variables are no longer read. If they are still set in
-your deployment they are silently ignored, and your recordings will be encoded with
-the new defaults instead of your tuned values.**
-
-| Removed variable                        | Replaced by                                                                                                   |
-| --------------------------------------- | ------------------------------------------------------------------------------------------------------------- |
-| `RECORDING_ENCODING_ENABLED`            | Nothing. A default encoding is now always built (see below). **Not** `RECORDING_CUSTOM_ENCODING_ENABLED`, which gates a different feature. |
-| `RECORDING_ENCODING_WIDTH`              | The `width` of the entry selected by `RECORDING_ENCODING_DEFAULT_RESOLUTION` in `RECORDING_ENCODING_AVAILABLE_RESOLUTIONS`. |
-| `RECORDING_ENCODING_HEIGHT`             | The `height` of that same entry.                                                                              |
-| `RECORDING_ENCODING_FRAMERATE`          | The `fps` of the profile selected by `RECORDING_ENCODING_DEFAULT_PROFILE` in `RECORDING_ENCODING_AVAILABLE_PROFILES`. |
-| `RECORDING_ENCODING_VIDEO_BITRATE_KBPS` | That profile's `kbps`.                                                                  |
-
-`RECORDING_ENCODING_AUDIO_BITRATE_KBPS` and `RECORDING_ENCODING_KEY_FRAME_INTERVAL_S`
-are unchanged and keep their values.
-
-#### If you never set `RECORDING_ENCODING_ENABLED=True`
-
-No action is required. The shipped defaults (`RECORDING_ENCODING_DEFAULT_PROFILE=full`,
-`RECORDING_ENCODING_DEFAULT_RESOLUTION=720p`) match LiveKit's built-in
-`H264_720P_30` preset: 1280×720, 30 fps, 3000 kbps H.264 MAIN, 128 kbps AAC.
-
-Note that these values are now sent explicitly as advanced `EncodingOptions`
-rather than relying on LiveKit's preset, so `RECORDING_ENCODING_AUDIO_BITRATE_KBPS`
-and `RECORDING_ENCODING_KEY_FRAME_INTERVAL_S` now apply to every recording. They
-previously applied only when `RECORDING_ENCODING_ENABLED` was `True`.
-
-To keep letting LiveKit pick the encoding instead, set either default to an empty
-value:
-
-```
-RECORDING_ENCODING_DEFAULT_RESOLUTION=
-RECORDING_ENCODING_DEFAULT_PROFILE=
-```
-
-#### If you had tuned `RECORDING_ENCODING_*` values
-
-Translate your old values into a default resolution and a default profile. Declare your own resolution and/or profile. Both maps are read from the
-environment as a single-line Python/JSON dict literal (parsed with
-`ast.literal_eval`, so use double-quoted keys and no trailing commas, and do not
-add outer quotes in `.env`-style files):
-
-```bash
-RECORDING_ENCODING_AVAILABLE_RESOLUTIONS={"540p": {"width": 960, "height": 540}, "720p": {"width": 1280, "height": 720}, "1080p": {"width": 1920, "height": 1080}}
-RECORDING_ENCODING_AVAILABLE_PROFILES={"my_old_profile": {"fps": 15, "kbps": {"540p": 350, "720p": 600, "1080p": 1100}}}
-RECORDING_ENCODING_DEFAULT_RESOLUTION=720p
-RECORDING_ENCODING_DEFAULT_PROFILE=my_old_profile
-```
-
-Two constraints are validated at startup and may raise a `ValueError`:
-
-- every profile in `RECORDING_ENCODING_AVAILABLE_PROFILES` must define a `kbps`
-  entry for **exactly** the keys of `RECORDING_ENCODING_AVAILABLE_RESOLUTIONS`;
-  overriding one of the two maps usually means overriding both;
-- `RECORDING_ENCODING_DEFAULT_RESOLUTION` and `RECORDING_ENCODING_DEFAULT_PROFILE`,
-  when non-empty, must be keys of their respective map.
-
-#### Optional: per-recording encoding
-
-`RECORDING_CUSTOM_ENCODING_ENABLED` (default `False`) toggles whether the
-start-recording API accepts an `encoding` object
-(`{"resolution": "720p", "profile": "talking_heads"}`, `profile` optional) that
-overrides the default for a single recording. It does not enable or disable the
-default encoding, which is built from the two `RECORDING_ENCODING_DEFAULT_*`
-settings either way. Leaving it at `False` preserves the previous behaviour, where
-every recording uses the server-side encoding: requests carrying
-`options.encoding` are rejected with a `400` before the recording is created, so
-nothing is persisted and no egress is started.
-
-Before enabling it:
-
-- clients can only pick keys you declared; there is no way to send a raw width or bitrate
-- as of this implementation, the frontend never sends `encoding`
-- `encoding` is accepted but ignored for `transcript` recordings, whose audio-only
-  egress has no video encoding to configure.
-
-See [docs/features/recording.md](docs/features/recording.md#tuning-recording-encoding)
-for the full setting reference, the shipped profile table and the tuning caveats.
-
 ## v1.30.0
 
 ### Removing S3 storage-event webhooks for recordings

bin/_config.sh

@@ -5,7 +5,7 @@ set -eo pipefail
 REPO_DIR="$(cd "$( dirname "${BASH_SOURCE[0]}" )/.." && pwd)"
 UNSET_USER=0
 
-COMPOSE_FILE="${REPO_DIR}/compose.yml"
+export COMPOSE_FILE="${COMPOSE_FILE:-${REPO_DIR}/compose.yml}"
 COMPOSE_PROJECT="meet"
 
 
@@ -42,7 +42,6 @@ function _docker_compose() {
     echo "🐳(compose) project: '${COMPOSE_PROJECT}' file: '${COMPOSE_FILE}'"
     docker compose \
         -p "${COMPOSE_PROJECT}" \
-        -f "${COMPOSE_FILE}" \
         --project-directory "${REPO_DIR}" \
         "$@"
 }

bin/compose

@@ -1,6 +0,0 @@
-#!/usr/bin/env bash
-
-# shellcheck source=bin/_config.sh
-source "$(dirname "${BASH_SOURCE[0]}")/_config.sh"
-
-_docker_compose "$@"

compose.yml

@@ -17,7 +17,7 @@ services:
 
   minio:
     user: ${DOCKER_USER:-1000}
-    image: minio/minio
+    image: quay.io/minio/minio
     environment:
       - MINIO_ROOT_USER=meet
       - MINIO_ROOT_PASSWORD=password
@@ -35,7 +35,7 @@ services:
       - ./data/media:/data
 
   createbuckets:
-    image: minio/mc
+    image: quay.io/minio/mc
     depends_on:
       minio:
         condition: service_healthy
@@ -207,12 +207,14 @@ services:
       - kc_postgresql
 
   livekit:
-    image: livekit/livekit-server
+    image: livekit/livekit-server:v1.13.6
     entrypoint: /livekit-server --dev --bind 0.0.0.0 --config ./config.yaml
     ports:
       - "7880:7880"
       - "7881:7881"
       - "7882:7882/udp"
+      - "3478:3478/udp"
+      - "30000-30100:30000-30100/udp"
     volumes:
       - ./docker/livekit/config/livekit-server.yaml:/config.yaml
     depends_on:

devenv.lock

@@ -0,0 +1,47 @@
+{
+  "nodes": {
+    "devenv": {
+      "locked": {
+        "dir": "src/modules",
+        "lastModified": 1778705847,
+        "narHash": "sha256-EQnZCy7r4VMO6KDoytxHBa0mFbM1D9g1kaDfs/s0YZA=",
+        "ref": "refs/tags/v2.1.2",
+        "rev": "ea3d94ac9d6bf6a1313773170122ca4e2ef5a0be",
+        "revCount": 6569,
+        "type": "git",
+        "url": "https://github.com/cachix/devenv"
+      },
+      "original": {
+        "dir": "src/modules",
+        "ref": "refs/tags/v2.1.2",
+        "type": "git",
+        "url": "https://github.com/cachix/devenv"
+      }
+    },
+    "nixpkgs": {
+      "locked": {
+        "lastModified": 1789542786,
+        "narHash": "sha256-ajQuqcxnj6RYnwCjA/9FTCnrdR2+BDzstE8UembXf60=",
+        "ref": "nixos-26.05",
+        "rev": "4c7870105e7f1fdf9c48688c8d7efc21abf0688a",
+        "shallow": true,
+        "type": "git",
+        "url": "https://github.com/NixOS/nixpkgs"
+      },
+      "original": {
+        "ref": "nixos-26.05",
+        "shallow": true,
+        "type": "git",
+        "url": "https://github.com/NixOS/nixpkgs"
+      }
+    },
+    "root": {
+      "inputs": {
+        "devenv": "devenv",
+        "nixpkgs": "nixpkgs"
+      }
+    }
+  },
+  "root": "root",
+  "version": 7
+}

devenv.nix

@@ -0,0 +1,265 @@
+# =============================================================================
+#  devenv.nix — La Suite Meet ("Visio") developer environment
+# =============================================================================
+{
+  pkgs,
+  lib,
+  config,
+  ...
+}:
+
+let
+  python = pkgs.python313;
+  nodejs = pkgs.nodejs_22;
+
+  backendDir = "src/backend";
+  agentsDir = "src/agents";
+  summaryDir = "src/summary";
+  frontendDir = "src/frontend";
+
+  readDotEnv =
+    file:
+    let
+      lines = lib.splitString "\n" (builtins.readFile file);
+      unquote =
+        v:
+        let
+          len = builtins.stringLength v;
+        in
+        if len >= 2 && lib.hasPrefix "\"" v && lib.hasSuffix "\"" v then
+          builtins.substring 1 (len - 2) v
+        else if len >= 2 && lib.hasPrefix "'" v && lib.hasSuffix "'" v then
+          builtins.substring 1 (len - 2) v
+        else
+          v;
+      parseLine =
+        line:
+        let
+          m = builtins.match "[ \t]*([A-Za-z_][A-Za-z0-9_]*)[ \t]*=[ \t]*(.*)" line;
+        in
+        if m == null then null else { name = builtins.elemAt m 0; value = unquote (builtins.elemAt m 1); };
+    in
+    builtins.listToAttrs (builtins.filter (x: x != null) (map parseLine lines));
+
+  # Reuse existing .env
+  dotEnv =
+    (readDotEnv ./env.d/development/common.dist)
+    // (readDotEnv ./env.d/development/postgresql.dist);
+
+  sharedEnv = builtins.removeAttrs dotEnv [ "PYTHONPATH" ]; # only makes sense inside the backend container.
+in
+{
+  options.meet = {
+    agents.enable = lib.mkEnableOption "tooling for the LiveKit agents in src/agents";
+    summary.enable = lib.mkEnableOption "tooling for the summary service in src/summary";
+    k8s.enable = lib.mkEnableOption "Kubernetes dev utilities";
+  };
+
+  config = {
+    # Profile can be activated with devenv --profile <profile> shell
+    profiles = {
+      agents.module = {
+        meet.agents.enable = true;
+      };
+      summary.module = {
+        meet.summary.enable = true;
+      };
+      k8s.module = {
+        meet.k8s.enable = true;
+      };
+    };
+    languages.python = {
+      enable = true;
+      package = python;
+      directory = backendDir;
+      manylinux.enable = pkgs.stdenv.hostPlatform.isLinux;
+
+      libraries = [
+        "${config.devenv.dotfile}/profile"
+        pkgs.file
+        pkgs.zlib
+        pkgs.libffi
+        pkgs.openssl
+      ];
+
+      uv.enable = true;
+      uv.sync.enable = false;
+      venv.enable = false;
+      lsp.enable = true;
+    };
+
+    languages.javascript = {
+      enable = true;
+      package = nodejs;
+      directory = frontendDir;
+
+      npm.enable = true;
+      yarn.enable = true;
+      corepack.enable = false;
+    };
+
+    languages.typescript.enable = false;
+    languages.nix.enable = true;
+
+    packages =
+      with pkgs;
+      [
+        gnumake
+        file
+        shared-mime-info
+        gettext
+        postgresql_16
+        git
+        curl
+        jq
+        podman
+        podman-compose
+        docker-client
+      ]
+
+      # -- LiveKit agents
+      ++ lib.optionals config.meet.agents.enable [
+        glib
+        portaudio
+        livekit-cli
+      ]
+
+      # -- summary service
+      ++ lib.optionals config.meet.summary.enable [
+        redis
+      ]
+
+      # -- Kubernetes tools
+      ++ lib.optionals config.meet.k8s.enable [
+        kubectl
+        kubernetes-helm
+        helmfile
+        tilt
+        kind
+        mkcert
+      ];
+
+    env = sharedEnv // {
+      UV_LINK_MODE = "copy";
+
+      PYTHONDONTWRITEBYTECODE = "1";
+      PYTHONUNBUFFERED = "1";
+
+      UV_PROJECT_ENVIRONMENT = lib.mkForce ".venv";
+
+      COMPOSE_PROJECT_NAME = "meet";
+
+      DJANGO_DATA_DIR = "${config.devenv.root}/data";
+
+      # Database / Pgsql
+      DB_HOST = "127.0.0.1";
+      DB_PORT = "15432";
+      PGHOST = "127.0.0.1";
+      PGPORT = "15432";
+      PGDATABASE = sharedEnv.DB_NAME;
+      PGUSER = sharedEnv.DB_USER;
+      PGPASSWORD = sharedEnv.DB_PASSWORD;
+
+      REDIS_URL = "redis://127.0.0.1:6379/1";
+      CELERY_BROKER_URL = "redis://127.0.0.1:6379/0";
+
+      # S3 / MinIO
+      AWS_S3_ENDPOINT_URL = "http://127.0.0.1:9000";
+
+      # OIDC
+      OIDC_OP_JWKS_ENDPOINT = "http://localhost:8083/realms/meet/protocol/openid-connect/certs";
+      OIDC_OP_TOKEN_ENDPOINT = "http://localhost:8083/realms/meet/protocol/openid-connect/token";
+      OIDC_OP_USER_ENDPOINT = "http://localhost:8083/realms/meet/protocol/openid-connect/userinfo";
+      OIDC_OP_INTROSPECTION_ENDPOINT = "http://localhost:8083/realms/meet/protocol/openid-connect/token/introspect";
+
+      # summary service
+      SUMMARY_SERVICE_ENDPOINT = "http://127.0.0.1:8001/api/v2/async-jobs/transcribe/";
+      SUMMARY_SERVICE_VERSION = "2";
+
+      # Mail
+      DJANGO_EMAIL_HOST = "127.0.0.1";
+    };
+
+    scripts = {
+
+      meet-venv = {
+        description = "Create/refresh meet uv virtualenvs for backend, agents and summary";
+        exec = ''
+          set -euo pipefail
+          cd "$DEVENV_ROOT"
+
+          echo "==> ${backendDir} (uv sync --locked, dependency-groups)"
+          ( cd "${backendDir}" && uv sync --locked --all-groups )
+
+          echo "==> ${agentsDir} (uv sync --locked --all-extras)"
+          ( cd "${agentsDir}" && uv sync --locked --all-extras )
+
+          echo "==> ${summaryDir} (uv sync --locked --all-extras)"
+          ( cd "${summaryDir}" && uv sync --locked --all-extras )
+
+          echo
+          echo "Synced the following virtualenvs successfully:"
+          echo "  ${backendDir}/.venv"
+          echo "  ${agentsDir}/.venv"
+          echo "  ${summaryDir}/.venv"
+        '';
+      };
+    };
+
+    enterShell = ''
+      # Make podman socket accessible in order to launch regular docker commands.
+      # Set MEET_PODMAN_SOCKET=0 to keep the DOCKER_HOST of the calling environment.
+      case "''${MEET_PODMAN_SOCKET:-1}" in
+        0|false|no|off) ;;
+        *)
+          _rundir="''${XDG_RUNTIME_DIR:-/run/user/$(id -u)}"
+          export DOCKER_HOST="unix://$_rundir/podman/podman.sock"
+          unset _rundir
+          ;;
+      esac
+
+      # Compose files to merge
+      _compose_dir="${config.devenv.root}/docker/compose.d"
+      _compose_files="${config.devenv.root}/compose.yml"
+
+      export DOCKER_USER="$(id -u):$(id -g)"
+
+      case "''${DOCKER_HOST:-}" in
+        *podman*)
+          _compose_files="$_compose_files:$_compose_dir/compose.podman.yml"
+
+          # Build images with Podman/Buildah rather than BuildKit. `docker
+          # compose build` otherwise has buildx boot a moby/buildkit container,
+          # and that container lands in its own network namespace with neither
+          # the proxy in its environment nor any route to it.
+          # Buildah has neither problem: base images are resolved by the Podman systemd
+          # service, which inherits the proxy from its systemd socket activated unit, and
+          # RUN steps execute in the *host* network namespace
+
+          export DOCKER_BUILDKIT=0
+          export COMPOSE_BAKE=false
+          ;;
+      esac
+
+
+      # Apply Bureautix override
+      if [ -n "''${http_proxy:-}" ]; then
+        _compose_files="$_compose_files:$_compose_dir/compose.bureautix.yml"
+      fi
+
+      export COMPOSE_FILE="$_compose_files"
+      unset _compose_dir _compose_files
+
+      # Make binaries accessible
+      for _d in \
+        "$DEVENV_ROOT/${backendDir}/.venv/bin" \
+        "$DEVENV_ROOT/${agentsDir}/.venv/bin" \
+        "$DEVENV_ROOT/${summaryDir}/.venv/bin" \
+        "$DEVENV_ROOT/${frontendDir}/node_modules/.bin"
+      do
+        [ -d "$_d" ] && export PATH="$_d:$PATH"
+      done
+      unset _d
+    '';
+  };
+}

devenv.yaml

@@ -0,0 +1,5 @@
+inputs:
+  nixpkgs:
+    url: git+https://github.com/NixOS/nixpkgs?ref=nixos-26.05&shallow=1
+  devenv:
+    url: git+https://github.com/cachix/devenv?ref=refs/tags/v2.1.2&dir=src/modules

docker/compose.d/compose.bureautix.yml

@@ -0,0 +1,48 @@
+# Bureautix proxy overrides
+#
+# Builds submitted through the Docker API of the Podman service get none of
+# the proxy variables in their RUN steps. We need to pass the http_proxy explicitely
+# otherwise all connections fail during the build.
+
+x-proxy-vars: &proxy-vars
+  http_proxy: ${http_proxy:-}
+  https_proxy: ${https_proxy:-}
+  no_proxy: ${no_proxy:-}
+
+services:
+  app:
+    build:
+      args:
+        <<: *proxy-vars
+  app-dev:
+    build:
+      args:
+        <<: *proxy-vars
+  frontend:
+    build:
+      args:
+        <<: *proxy-vars
+  metadata-collector-dev:
+    build:
+      args:
+        <<: *proxy-vars
+  multi-user-transcriber-dev:
+    build:
+      args:
+        <<: *proxy-vars
+  app-summary-dev:
+    build:
+      args:
+        <<: *proxy-vars
+  celery-summary-transcribe:
+    build:
+      args:
+        <<: *proxy-vars
+  celery-summary-summarize:
+    build:
+      args:
+        <<: *proxy-vars
+  # The local proxy listens on 8080 and collides with Keycloak's published admin port.
+  keycloak:
+    ports: !override
+      - "8081:8080"

docker/compose.d/compose.podman.yml

@@ -0,0 +1,33 @@
+# Rootless Podman override for compose.yml.
+#
+# Rootless Podman maps container UID 0 to the host user and every other
+# container UID to a subuid that owns nothing in the worktree. Meet compose.ymlruns
+# its containers as DOCKER_USER=$(id -u):$(id -g), which would land on such a
+# subuid and make every bind mount effectively read-only.
+#
+# `userns_mode: keep-id` maps the host user to the same UID and GID inside the
+# container instead, so DOCKER_USER keeps its Docker value and files written
+# through a bind mount are owned by the host user on both sides.
+#
+# Only the services that mount the worktree and run as DOCKER_USER are listed.
+
+x-keep-id: &keep-id
+  userns_mode: keep-id
+
+services:
+  app-dev:
+    <<: *keep-id
+  celery-dev:
+    <<: *keep-id
+  minio:
+    <<: *keep-id
+  node:
+    <<: *keep-id
+  crowdin:
+    <<: *keep-id
+  metadata-collector-dev:
+    <<: *keep-id
+  multi-user-transcriber-dev:
+    <<: *keep-id
+  app-summary-dev:
+    <<: *keep-id

docker/dinum-frontend/Dockerfile

@@ -54,18 +54,11 @@ RUN npx webpack --mode production
 
 
 # ---- Front-end image ----
-FROM nginxinc/nginx-unprivileged:1.30.3-alpine3.23 AS frontend-production
+FROM nginxinc/nginx-unprivileged:1.30.4-alpine3.24 AS frontend-production
 
 USER root
-
-# Security patches for known CVEs
-RUN apk update && apk upgrade  \
-    libcrypto3>=3.5.7-r0 \
-    libssl3>=3.5.7-r0 \
-    musl \
-    musl-utils \
-    zlib>=1.3.2-r0 \
-    && apk del curl
+RUN apk del curl
+USER nginx
 
 USER nginx
 

docker/dinum-frontend/dinum-styles.css

@@ -1,5 +1,6 @@
 :root {
     --fonts-sans: 'Marianne', ui-sans-serif, system-ui, sans-serif;
+    --avatar-cap-height: 0.7;
 }
 
 .Header-beforeLogo {

docker/files/usr/local/etc/gunicorn/meet.py

@@ -14,3 +14,4 @@ accesslog = "-"
 # Using '-' for the error log file makes gunicorn log errors to stderr
 errorlog = "-"
 loglevel = "info"
+access_log_format = '%(h)s %(l)s %(u)s %(t)s "%(r)s" %(s)s %(b)s "%(f)s" "%(a)s" %(M)s'

docker/livekit/Dockerfile

@@ -1,4 +1,4 @@
-FROM livekit/livekit-server:v1.9.4
+FROM livekit/livekit-server:v1.13.6
 
 # We inject the nip.io certificate manually because the livekit chart doesn't support volume mounting
 COPY rootCA.pem /etc/ssl/certs/

docker/livekit/config/livekit-server.yaml

@@ -8,3 +8,23 @@ webhook:
   api_key: devkey
   urls:
       - http://app-dev:8000/api/v1.0/rooms/webhooks-livekit/
+
+turn:
+  enabled: true
+  domain: turn.127.0.0.1.nip.io
+  udp_port: 3478
+  tls_port: 0
+  external_tls: false
+  relay_range_start: 30000
+  relay_range_end: 30100
+  allow_restricted_peer_cidrs:
+    - 192.168.0.0/16
+    - 172.16.0.0/12
+
+rtc:
+  node_ip: 127.0.0.1
+  advertise_internal_ip: true
+  udp_port: 7882
+  tcp_port: 7881
+  use_external_ip: false
+

docs/openapi.yaml

@@ -16,11 +16,11 @@ info:
     * `rooms:list` – List rooms accessible to the delegated user.
     * `rooms:retrieve` – Retrieve details of a specific room.
     * `rooms:create` – Create new rooms.
-    * `rooms:update` – **Coming soon** Update existing rooms, e.g., add attendees to a room.
+    * `rooms:update` – Update the access level and configuration of existing rooms.
     * `rooms:delete` – **Coming soon** Delete rooms generated by the application.
-    
+
     #### Upcoming Features
-    
+
     * **Add attendees to a room:** You will be able to update a room to include a list of attendees, allowing them to bypass the lobby system automatically.
     * **Delete application-generated rooms:** Rooms created via the application can be deleted when no longer needed.
 
@@ -310,6 +310,67 @@ paths:
         '404':
           $ref: '#/components/responses/RoomNotFoundError'
 
+    patch:
+      tags:
+        - Rooms
+      summary: Update a room
+      description: |
+        Partially updates a room. Only the delegated user's rooms where they are
+        administrator or owner can be updated; any other role gets a `403`.
+
+        **Updatable fields:** `access_level` and `configuration`. Every other field
+        (`id`, `name`, `slug`, `pin_code`) is read-only and silently ignored when sent.
+
+        `configuration` is replaced as a whole, it is not merged with the stored one.
+        Send the complete object you want the room to end up with.
+
+        Full replacement (`PUT`) is not supported. Use `PATCH` instead.
+      operationId: updateRoom
+      security:
+        - BearerAuth: [rooms:update]
+      parameters:
+        - name: id
+          in: path
+          required: true
+          description: Room UUID
+          schema:
+            type: string
+            format: uuid
+      requestBody:
+        required: true
+        content:
+          application/json:
+            schema:
+              $ref: '#/components/schemas/RoomUpdate'
+            examples:
+              accessLevelOnly:
+                summary: Change the access level
+                value:
+                  access_level: "restricted"
+              configurationOnly:
+                summary: Replace the room configuration
+                value:
+                  configuration:
+                    everyone_can_mute: true
+      responses:
+        '200':
+          description: Room updated successfully
+          content:
+            application/json:
+              schema:
+                $ref: '#/components/schemas/Room'
+        '400':
+          $ref: '#/components/responses/BadRequestError'
+        '401':
+          $ref: '#/components/responses/UnauthorizedError'
+        '403':
+          $ref: '#/components/responses/ForbiddenError'
+        '404':
+          $ref: '#/components/responses/RoomNotFoundError'
+        '405':
+          description: |
+            Method not allowed, `PUT` is not supported on this endpoint.
+
 components:
   securitySchemes:
     BearerAuth:
@@ -386,6 +447,17 @@ components:
         configuration:
           $ref: '#/components/schemas/RoomConfiguration'
 
+    RoomUpdate:
+      type: object
+      description: |
+        Fields that can be updated on an existing room. Both are optional, omitted
+        fields keep their current value.
+      properties:
+        access_level:
+          $ref: '#/components/schemas/RoomAccessLevel'
+        configuration:
+          $ref: '#/components/schemas/RoomConfiguration'
+
     RoomConfiguration:
       type: object
       description: |
@@ -427,6 +499,9 @@ components:
         - `public`: Anyone with the room link can join directly, no authentication required.
         - `trusted`: Authenticated users join directly. Unauthenticated users wait in the lobby for approval.
         - `restricted`: Only participants explicitly trusted by the owner bypass the lobby. Everyone else waits for approval regardless of authentication.
+
+        `public` is rejected with a `400` unless the deployment explicitly enables it
+        for this API. This applies both when creating a room and when updating one.
       example: "trusted"
 
     Room:

docs/resource_server.yaml

@@ -20,7 +20,7 @@ info:
     * `lasuite_visio:rooms:list` – List rooms accessible to the delegated user.
     * `lasuite_visio:rooms:retrieve` – Retrieve details of a specific room.
     * `lasuite_visio:rooms:create` – Create new rooms.
-    * `lasuite_visio:rooms:update` – **Coming soon** Update existing rooms, e.g., add attendees to a room.
+    * `lasuite_visio:rooms:update` – Update the access level and configuration of existing rooms.
     * `lasuite_visio:rooms:delete` – **Coming soon** Delete rooms generated by the application.
     
     #### Upcoming Features
@@ -206,6 +206,67 @@ paths:
         '404':
           $ref: '#/components/responses/RoomNotFoundError'
 
+    patch:
+      tags:
+        - Rooms
+      summary: Update a room
+      description: |
+        Partially updates a room. Only rooms where the user is administrator or
+        owner can be updated; any other role gets a `403`.
+
+        **Updatable fields:** `access_level` and `configuration`. Every other field
+        (`id`, `name`, `slug`, `pin_code`) is read-only and silently ignored when sent.
+
+        `configuration` is replaced as a whole, it is not merged with the stored one.
+        Send the complete object you want the room to end up with.
+
+        Full replacement (`PUT`) is not supported. Use `PATCH` instead.
+      operationId: updateRoom
+      security:
+        - BearerAuth: [rooms:update]
+      parameters:
+        - name: id
+          in: path
+          required: true
+          description: Room UUID
+          schema:
+            type: string
+            format: uuid
+      requestBody:
+        required: true
+        content:
+          application/json:
+            schema:
+              $ref: '#/components/schemas/RoomUpdate'
+            examples:
+              accessLevelOnly:
+                summary: Change the access level
+                value:
+                  access_level: "restricted"
+              configurationOnly:
+                summary: Replace the room configuration
+                value:
+                  configuration:
+                    everyone_can_mute: true
+      responses:
+        '200':
+          description: Room updated successfully
+          content:
+            application/json:
+              schema:
+                $ref: '#/components/schemas/Room'
+        '400':
+          $ref: '#/components/responses/BadRequestError'
+        '401':
+          $ref: '#/components/responses/UnauthorizedError'
+        '403':
+          $ref: '#/components/responses/ForbiddenError'
+        '404':
+          $ref: '#/components/responses/RoomNotFoundError'
+        '405':
+          description: |
+            Method not allowed, `PUT` is not supported on this endpoint.
+
 components:
   securitySchemes:
     BearerAuth:
@@ -227,6 +288,17 @@ components:
         configuration:
           $ref: '#/components/schemas/RoomConfiguration'
 
+    RoomUpdate:
+      type: object
+      description: |
+        Fields that can be updated on an existing room. Both are optional, omitted
+        fields keep their current value.
+      properties:
+        access_level:
+          $ref: '#/components/schemas/RoomAccessLevel'
+        configuration:
+          $ref: '#/components/schemas/RoomConfiguration'
+
     RoomConfiguration:
       type: object
       description: |
@@ -268,6 +340,9 @@ components:
         - `public`: Anyone with the room link can join directly, no authentication required.
         - `trusted`: Authenticated users join directly. Unauthenticated users wait in the lobby for approval.
         - `restricted`: Only participants explicitly trusted by the owner bypass the lobby. Everyone else waits for approval regardless of authentication.
+
+        `public` is rejected with a `400` unless the deployment explicitly enables it
+        for this API. This applies both when creating a room and when updating one.
       example: "trusted"
 
     Room:

docs/theming.md

@@ -34,6 +34,7 @@ Let's say you want to change the font of our application to a custom font. You c
 
 :root {
   --fonts-sans: 'Roboto', ui-sans-serif, system-ui, sans-serif;
+  --avatar-cap-height: 0.7;
 }
 ```
 

env.d/development/common.dist

@@ -69,31 +69,17 @@ SUMMARY_SERVICE_WEBHOOK_API_TOKEN=webhook-password
 RECORDING_DOWNLOAD_BASE_URL=http://localhost:3000/recording
 
 # Recording encoding (LiveKit Egress advanced options).
-# Encoding is described by a named resolution (width/height) and a named profile
-# (framerate + video bitrate per resolution) instead of raw encoder values. The
-# start-recording API accepts a pair per recording, e.g.
-# options.encoding={"resolution": "720p", "profile": "talking_heads"}; only keys
-# declared in the two maps below are accepted, "profile" is optional.
-# Both maps are read as a one-line Python dict literal (ast.literal_eval): double
-# quoted keys, no outer quotes, no trailing comma. Every profile must define a
-# kbps entry for exactly the resolutions of the resolutions map, or startup fails.
-# RECORDING_ENCODING_AVAILABLE_RESOLUTIONS={"540p": {"width": 960, "height": 540}, "720p": {"width": 1280, "height": 720}, "1080p": {"width": 1920, "height": 1080}}
-# RECORDING_ENCODING_AVAILABLE_PROFILES={"talking_heads": {"fps": 15, "kbps": {"540p": 400, "720p": 700, "1080p": 1200}}, "text": {"fps": 15, "kbps": {"540p": 600, "720p": 1000, "1080p": 1800}}, "mixed": {"fps": 20, "kbps": {"540p": 900, "720p": 1500, "1080p": 2500}}, "full": {"fps": 30, "kbps": {"540p": 2000, "720p": 3000, "1080p": 4500}}}
-
-# Defaults for recordings that don't carry an encoding. Must be keys of the maps
-# above. Declared but not yet read by the recording code at this commit.
-# RECORDING_ENCODING_DEFAULT_RESOLUTION=720p
-# RECORDING_ENCODING_DEFAULT_PROFILE=full
-
-# Applied to every resolved encoding, independent of resolution and profile.
+# When RECORDING_ENCODING_ENABLED is False (default), LiveKit uses its built-in
+# H264_720P_30 preset (1280x720, 30fps, 3000 kbps). Enable and tune to reduce
+# file size and CPU load on the egress worker.
+# RECORDING_ENCODING_ENABLED=False
+# RECORDING_ENCODING_WIDTH=1280
+# RECORDING_ENCODING_HEIGHT=720
+# RECORDING_ENCODING_FRAMERATE=30
+# RECORDING_ENCODING_VIDEO_BITRATE_KBPS=3000
 # RECORDING_ENCODING_AUDIO_BITRATE_KBPS=128
 # RECORDING_ENCODING_KEY_FRAME_INTERVAL_S=4.0
 
-# Server-wide encoding used when a recording carries no encoding of its own.
-# Keep False: when True, the worker factory still reads RECORDING_ENCODING_WIDTH,
-# _HEIGHT, _FRAMERATE and _VIDEO_BITRATE_KBPS, which no longer exist.
-# RECORDING_ENCODING_ENABLED=False
-
 # Telephony
 ROOM_TELEPHONY_ENABLED=True
 

src/addons/outlook/package-lock.json

@@ -10,7 +10,7 @@
       "license": "MIT",
       "dependencies": {
         "core-js": "3.50.0",
-        "i18next": "26.3.6",
+        "i18next": "26.4.0",
         "i18next-browser-languagedetector": "8.2.1",
         "regenerator-runtime": "0.14.1"
       },
@@ -9367,9 +9367,9 @@
       }
     },
     "node_modules/i18next": {
-      "version": "26.3.6",
-      "resolved": "https://registry.npmjs.org/i18next/-/i18next-26.3.6.tgz",
-      "integrity": "sha512-Bu5Z2nAXgfVyM8xvW3jk9EKRIuX37PudsrBViThNFx7CR7aaYTpP01cxNB/E4c4UUzTDiAZRstEhsRfPOL/8xA==",
+      "version": "26.4.0",
+      "resolved": "https://registry.npmjs.org/i18next/-/i18next-26.4.0.tgz",
+      "integrity": "sha512-rsmK5bFqsD1AetSFSIa43wtNR4WpvvH4p0tLEsTxkC7QTrfdFm06nbQ95bh8Og4wwaCnUEcm9DVYL2cgxitiQg==",
       "funding": [
         {
           "type": "individual",

src/addons/outlook/package.json

@@ -27,7 +27,7 @@
   },
   "dependencies": {
     "core-js": "3.50.0",
-    "i18next": "26.3.6",
+    "i18next": "26.4.0",
     "i18next-browser-languagedetector": "8.2.1",
     "regenerator-runtime": "0.14.1"
   },

src/agents/Dockerfile

@@ -1,7 +1,8 @@
 FROM python:3.14.6-slim AS base
 
-# Install system dependencies required by LiveKit
-RUN apt-get update && apt-get install -y \
+# Install system dependencies required by LiveKit, fetching packages over HTTPS only for Bureautix proxy
+RUN sed -i "s|^URIs: http://|URIs: https://|" /etc/apt/sources.list.d/debian.sources \
+    && apt-get update && apt-get install -y --no-install-recommends  \
     libglib2.0-0 \
     libgobject-2.0-0 \
     && rm -rf /var/lib/apt/lists/*

src/agents/pyproject.toml

@@ -1,7 +1,7 @@
 
 [project]
 name = "agents"
-version = "1.29.0"
+version = "1.31.0"
 requires-python = ">=3.12"
 dependencies = [
     "livekit-agents==1.6.7",

src/agents/uv.lock

@@ -9,7 +9,7 @@ resolution-markers = [
 
 [[package]]
 name = "agents"
-version = "1.29.0"
+version = "1.31.0"
 source = { virtual = "." }
 dependencies = [
     { name = "httpx" },

src/backend/core/analytics/events.py

@@ -8,6 +8,7 @@ class AnalyticsEvent(StrEnum):
 
     # Rooms
     ROOM_CREATED = "room_created"
+    ROOM_UPDATED = "room_updated"
 
     # Roomkit (meeting-room SIP devices)
     ROOMKIT_JOINED = "roomkit_joined"

src/backend/core/api/__init__.py

@@ -71,6 +71,7 @@ def get_frontend_configuration(request):
             "force_wss_protocol": settings.LIVEKIT_FORCE_WSS_PROTOCOL,
             "enable_firefox_proxy_workaround": settings.LIVEKIT_ENABLE_FIREFOX_PROXY_WORKAROUND,
             "default_sources": settings.LIVEKIT_DEFAULT_SOURCES,
+            "default_video_codec": settings.LIVEKIT_DEFAULT_VIDEO_CODEC,
         },
         "authenticated_users_can_edit_display_name": (
             settings.AUTHENTICATED_PARTICIPANTS_CAN_EDIT_DISPLAY_NAME

src/backend/core/api/feature_flag.py

@@ -17,6 +17,7 @@ class FeatureFlag:
         "application": "APPLICATION_ENABLED",
         "roomkit": "ROOMKIT_ENABLED",
         "connection_test": "CONNECTION_TEST_ENABLED",
+        "user_access_token": "USER_ACCESS_TOKEN_ENABLED",
     }
 
     @classmethod

src/backend/core/api/serializers.py

@@ -7,18 +7,14 @@ from typing import Literal
 from urllib.parse import quote
 
 from django.conf import settings
+from django.core import signing
 from django.core.exceptions import SuspiciousOperation
 
 # pylint: disable=abstract-method,no-name-in-module
 from django.utils.translation import gettext_lazy as _
 
 from django_pydantic_field.rest_framework import SchemaField
-from pydantic import (
-    BaseModel,
-    Field,
-    field_serializer,
-    field_validator,
-)
+from pydantic import BaseModel, Field, field_serializer
 from pydantic import ValidationError as PydanticValidationError
 from rest_framework import serializers
 from rest_framework.exceptions import PermissionDenied
@@ -249,49 +245,6 @@ class BaseValidationOnlySerializer(serializers.Serializer):
         raise NotImplementedError(f"{self.__class__.__name__} is validation-only")
 
 
-class EncodingConfig(BaseModel):
-    """Configuration options for recording encoding.
-
-    The allowed `resolution` and `profile` values are derived at validation time
-    from ``settings.RECORDING_ENCODING_AVAILABLE_RESOLUTIONS`` and
-    ``settings.RECORDING_ENCODING_AVAILABLE_PROFILES``, so adding a resolution or profile
-    to those maps is enough to make it accepted here.
-
-    Attributes:
-        resolution: Target video resolution.
-        profile: Encoding profile to balance quality and CPU usage. When `None`,
-        LiveKit default framerate/bitrate are used for the resolution.
-    """
-
-    resolution: str
-    profile: str | None = None
-    model_config = {"extra": "forbid"}
-
-    @field_validator("resolution")
-    @classmethod
-    def _validate_resolution(cls, value):
-        """Reject resolutions absent from RECORDING_ENCODING_AVAILABLE_RESOLUTIONS."""
-        allowed = set(settings.RECORDING_ENCODING_AVAILABLE_RESOLUTIONS)
-        if value not in allowed:
-            raise ValueError(
-                f"Invalid resolution '{value}'. Choose from {sorted(allowed)}."
-            )
-        return value
-
-    @field_validator("profile")
-    @classmethod
-    def _validate_profile(cls, value):
-        """Reject profiles absent from RECORDING_ENCODING_AVAILABLE_PROFILES."""
-        if value is None:
-            return None
-        allowed = set(settings.RECORDING_ENCODING_AVAILABLE_PROFILES)
-        if value not in allowed:
-            raise ValueError(
-                f"Invalid profile '{value}'. Choose from {sorted(allowed)}."
-            )
-        return value
-
-
 class RecordingOptions(BaseModel):
     """Configuration options for recording.
 
@@ -312,7 +265,7 @@ class RecordingOptions(BaseModel):
     transcribe: bool | None = None
     collect_metadata: bool | None = None
     original_mode: Literal["screen_recording", "transcript"] | None = None
-    encoding: EncodingConfig | None = None
+
     model_config = {"extra": "forbid"}
 
 
@@ -340,6 +293,26 @@ class RequestEntrySerializer(BaseValidationOnlySerializer):
     """Validate request entry data."""
 
     username = serializers.CharField(required=True)
+    participant_id = serializers.CharField(
+        required=False, allow_null=True, max_length=128
+    )
+
+    @staticmethod
+    def sign_participant_id(participant_id):
+        """Sign with Django's SECRET_KEY and a lobby-specific namespace."""
+        return signing.Signer(salt="core.lobby.participant").sign(participant_id)
+
+    def validate_participant_id(self, value):
+        """Require a valid server signature before looking up a participant."""
+        if value is None:
+            return None
+        try:
+            participant_id = signing.Signer(salt="core.lobby.participant").unsign(value)
+        except signing.BadSignature as exc:
+            raise serializers.ValidationError(
+                "Invalid participant credential."
+            ) from exc
+        return str(serializers.UUIDField().run_validation(participant_id))
 
 
 class ParticipantEntrySerializer(BaseValidationOnlySerializer):
@@ -647,3 +620,20 @@ class ExternalProcessEventSerializer(BaseValidationOnlySerializer):
     # useless bad requests
     type = serializers.CharField(required=False, allow_null=True, allow_blank=True)
     status = serializers.CharField(required=False, allow_null=True, allow_blank=True)
+
+
+class TransitCodeSerializer(BaseValidationOnlySerializer):
+    """Validate the single-use transit code sent to the exchange endpoint."""
+
+    code = serializers.CharField(trim_whitespace=True)
+
+    def validate_code(self, value):
+        """Reject codes whose length cannot match a generated one."""
+
+        # Calculates urlsafe_b64encode length without padding
+        expected_length = (4 * settings.TRANSIT_CODE_NBYTES + 2) // 3
+
+        if len(value) != expected_length:
+            raise serializers.ValidationError("Invalid transit code format.")
+
+        return value

src/backend/core/api/throttling.py

@@ -1,11 +1,11 @@
 """Throttling modules for the API."""
 
-from django.conf import settings
-
 from lasuite.drf.throttling import MonitoredThrottleMixin
 from rest_framework.throttling import AnonRateThrottle, UserRateThrottle
 from sentry_sdk import capture_message
 
+from . import serializers
+
 
 def sentry_monitoring_throttle_failure(message):
     """Log when a failure occurs to detect rate limiting issues."""
@@ -42,13 +42,14 @@ class RequestEntryAnonRateThrottle(MonitoredAnonRateThrottle):
     def get_cache_key(self, request, view):
         """Use the lobby participant cookie ID as the throttle cache key.
 
-        Only throttle if a cookie is already set. If no cookie exists yet,
-        return None to skip throttling — the cookie will be set on the first
-        response, and throttling will apply from the second request onward.
+        Only throttle requests carrying a participant identifier. The
+        identifier is returned by the first request-entry response and
+        echoed back by the client from the second request onward, which is
+        when throttling starts applying.
 
-        Keying on the cookie rather than the IP address prevents penalising
-        multiple users behind the same NAT/proxy, and is consistent with how
-        LobbyService identifies participants.
+        Keying on the identifier rather than the IP address prevents
+        penalising multiple users behind the same NAT/proxy, and is
+        consistent with how the lobby identifies participants.
 
         Note: as per DRF documentation, application-level throttling is not a
         security measure against brute-force or DoS attacks. This throttle exists
@@ -58,10 +59,14 @@ class RequestEntryAnonRateThrottle(MonitoredAnonRateThrottle):
         if request.user and request.user.is_authenticated:
             return None  # Only throttle unauthenticated requests.
 
-        participant_id = request.COOKIES.get(settings.LOBBY_COOKIE_NAME)
+        serializer = serializers.RequestEntrySerializer(data=request.data)
+        if not serializer.is_valid():
+            return None
 
-        if participant_id is None:
-            return None  # No throttling for cookieless requests
+        participant_id = serializer.validated_data.get("participant_id")
+
+        if not participant_id:
+            return None  # No throttling for unidentified requests
 
         return self.cache_format % {
             "scope": self.scope,
@@ -97,3 +102,14 @@ class ConnectionTestAnonRateThrottle(MonitoredAnonRateThrottle):
     """Throttle anonymous users requesting connection test tokens."""
 
     scope = "connection_test"
+
+
+class ExchangeAccessTokenAnonRateThrottle(MonitoredAnonRateThrottle):
+    """Throttle anonymous transit code exchange attempts.
+
+    Abuse mitigation only, not a security boundary: DRF throttling is
+    best-effort. The security of the exchange rests on the codes'
+    entropy and single use.
+    """
+
+    scope = "exchange_access_token"

src/backend/core/api/viewsets.py

@@ -43,6 +43,7 @@ from rest_framework.settings import api_settings
 from core import analytics, enums, models, utils
 from core.api import throttling
 from core.api.filters import ListFileFilter
+from core.authentication.user_token import USER_ACCESS_TOKEN_TYPE_CLAIM
 from core.enums import MEDIA_STORAGE_URL_PATTERN
 from core.recording.enums import FileExtension
 from core.recording.event.authentication import RecordingProcessWebhookAuthentication
@@ -60,8 +61,8 @@ from core.recording.worker.factories import (
 from core.recording.worker.mediator import (
     WorkerServiceMediator,
 )
-from core.recording.worker.services import resolve_encoding_config
 from core.services.invitation import InvitationService
+from core.services.jwt_token import JwtTokenService
 from core.services.livekit_events import (
     LiveKitEventsService,
     LiveKitWebhookError,
@@ -76,16 +77,13 @@ from core.services.participants_management import (
     ParticipantsManagementException,
 )
 from core.services.room_creation import RoomCreation
-from core.services.room_management import (
-    RoomManagement,
-    RoomManagementException,
-    RoomNotFoundException,
-)
+from core.services.room_management import RoomManagement
 from core.services.room_roles import (
     RoomRoleError,
     RoomRoleService,
 )
 from core.services.subtitle import SubtitleException, SubtitleService
+from core.services.transit_code import TransitCodeService
 from core.tasks.connection_test import delete_connection_test_room
 from core.tasks.file import process_file_deletion
 from core.utils import generate_token
@@ -224,6 +222,96 @@ class UserViewSet(
             self.serializer_class(request.user, context=context).data
         )
 
+    @decorators.action(
+        detail=False,
+        methods=["post"],
+        url_path="exchange-access-token",
+        permission_classes=[],
+        throttle_classes=[throttling.ExchangeAccessTokenAnonRateThrottle],
+    )
+    @FeatureFlag.require("user_access_token")
+    def exchange_access_token(self, request):
+        """Exchange a single-use transit code for a user access token.
+
+        The endpoint is unauthenticated: the transit code itself, an opaque
+        random string obtained through the external API and delivered to
+        the embedded frontend via a URL fragment, is the credential. Each
+        code can be exchanged exactly once (consuming it deletes it from
+        the cache); replaying a consumed code is denied and logged.
+
+        The issued JWT authenticates the user the code was minted for on
+        the whole core API, exactly like a session cookie would (similar
+        to lib-jitsi-meet's token authentication), and never appears in
+        any URL. Role-based permissions apply unchanged.
+        """
+        if request.user and request.user.is_authenticated:
+            logger.warning(
+                "Transit code exchange refused: request is already "
+                "session-authenticated (user_id=%s)",
+                request.user.id,
+            )
+            raise drf_exceptions.PermissionDenied("Already authenticated.")
+
+        serializer = serializers.TransitCodeSerializer(data=request.data)
+        serializer.is_valid(raise_exception=True)
+
+        code_data = TransitCodeService().consume_code(serializer.validated_data["code"])
+
+        if code_data is None:
+            logger.warning("Invalid, expired or already used transit code")
+            raise drf_exceptions.PermissionDenied(
+                "Invalid, expired or already used transit code."
+            )
+
+        # Re-check the user at exchange time so that a deactivation after
+        # the transit code was minted is taken into account.
+        try:
+            user = models.User.objects.get(id=code_data["user_id"], is_active=True)
+        except models.User.DoesNotExist as excpt:
+            raise drf_exceptions.PermissionDenied(
+                "This account can no longer access the application."
+            ) from excpt
+
+        if not models.Application.has_active_scope(
+            code_data.get("client_id"), models.ApplicationScope.USERS_SESSION
+        ):
+            logger.warning(
+                "Transit code exchange refused: application '%s' no longer "
+                "holds the '%s' grant",
+                code_data.get("client_id"),
+                models.ApplicationScope.USERS_SESSION,
+            )
+            raise drf_exceptions.PermissionDenied(
+                "This application can no longer create user sessions."
+            )
+
+        token_service = JwtTokenService(
+            secret_key=settings.USER_ACCESS_TOKEN_SECRET_KEY,
+            algorithm=settings.USER_ACCESS_TOKEN_ALG,
+            issuer=settings.USER_ACCESS_TOKEN_ISSUER,
+            audience=settings.USER_ACCESS_TOKEN_AUDIENCE,
+            expiration_seconds=settings.USER_ACCESS_TOKEN_TTL,
+            token_type=settings.USER_ACCESS_TOKEN_TYPE,
+        )
+
+        data = token_service.generate_jwt(
+            user,
+            "user:access",
+            {
+                "client_id": code_data.get("client_id", "unknown"),
+                "token_type": USER_ACCESS_TOKEN_TYPE_CLAIM,
+            },
+        )
+
+        # Log for auditing
+        logger.info(
+            "User access token issued from transit code: user_id=%s, client_id=%s",
+            user.id,
+            code_data.get("client_id", "unknown"),
+        )
+
+        return drf_response.Response(data)
+
 
 class RoomViewSet(
     mixins.CreateModelMixin,
@@ -357,26 +445,7 @@ class RoomViewSet(
         ):
             return
 
-        metadata = {
-            "configuration": room.configuration,
-            "access_level": room.access_level,
-        }
-
-        try:
-            RoomManagement().update_metadata(
-                room_name=str(room.id),
-                metadata=metadata,
-            )
-        except RoomNotFoundException:
-            logger.info(
-                "LiveKit room %s does not exist yet, skipping metadata sync",
-                room.id,
-            )
-        except RoomManagementException:
-            logger.warning(
-                "Failed to sync metadata to LiveKit for room %s",
-                room.id,
-            )
+        RoomManagement.sync_room_metadata(room)
 
     @decorators.action(
         detail=True,
@@ -401,20 +470,12 @@ class RoomViewSet(
         options = serializer.validated_data.get("options")
         room = self.get_object()
 
-        options_data = options.model_dump(exclude_none=True) if options else {}
-        if options is not None and options.encoding is not None:
-            # Persist the resolved encoding (concrete width/height/framerate/
-            # bitrate) alongside the requested resolution/profile for traceability.
-            options_data["encoding"]["resolved"] = resolve_encoding_config(
-                options.encoding
-            )
-
         try:
             with transaction.atomic():
                 recording = models.Recording.objects.create(
                     room=room,
                     mode=mode,
-                    options=options_data,
+                    options=options.model_dump(exclude_none=True) if options else {},
                 )
                 models.RecordingAccess.objects.create(
                     user=self.request.user,
@@ -518,13 +579,18 @@ class RoomViewSet(
 
         participant, livekit = lobby_service.request_entry(
             room=room,
-            request=request,
+            user=request.user,
             **serializer.validated_data,
         )
-        response = drf_response.Response({**participant.to_dict(), "livekit": livekit})
-        lobby_service.prepare_response(response, participant.id)
-
-        return response
+        return drf_response.Response(
+            {
+                **participant.to_dict(),
+                "id": serializers.RequestEntrySerializer.sign_participant_id(
+                    participant.id
+                ),
+                "livekit": livekit,
+            }
+        )
 
     @decorators.action(
         detail=True,
@@ -941,6 +1007,15 @@ class RoomViewSet(
         """Rename the current participant in the room."""
         room = self.get_object()
 
+        if (
+            not settings.AUTHENTICATED_PARTICIPANTS_CAN_EDIT_DISPLAY_NAME
+            and request.user.is_authenticated
+        ):
+            return drf_response.Response(
+                {"error": "Authenticated participants cannot edit their display name"},
+                status=drf_status.HTTP_403_FORBIDDEN,
+            )
+
         serializer = serializers.RenameParticipantSerializer(data=request.data)
         serializer.is_valid(raise_exception=True)
 
@@ -1085,9 +1160,10 @@ class RecordingViewSet(
 
     def _auth_get_original_url(self, request):
         """
-        Extracts and parses the original URL from the "HTTP_X_ORIGINAL_URL" header.
+        Extracts and parses the original URL from the configured header.
         Raises PermissionDenied if the header is missing.
-        The original url is passed by nginx in the "HTTP_X_ORIGINAL_URL" header.
+        The original url is passed by the reverse proxy in the header named by the
+        MEDIA_AUTH_ORIGINAL_URL_HEADER setting, which defaults to "HTTP_X_ORIGINAL_URL".
         See corresponding ingress configuration in Helm chart and read about the
         nginx.ingress.kubernetes.io/auth-url annotation to understand how the Nginx ingress
         is configured to do this.
@@ -1097,9 +1173,13 @@ class RecordingViewSet(
         reasons.
         """
         # Extract the original URL from the request header
-        original_url = request.META.get("HTTP_X_ORIGINAL_URL")
+        original_url = request.META.get(settings.MEDIA_AUTH_ORIGINAL_URL_HEADER)
         if not original_url:
-            logger.warning("Missing HTTP_X_ORIGINAL_URL header in subrequest")
+            logger.warning(
+                "Missing %s header in subrequest. Set MEDIA_AUTH_ORIGINAL_URL_HEADER "
+                "to the header your reverse proxy sends.",
+                settings.MEDIA_AUTH_ORIGINAL_URL_HEADER,
+            )
             raise drf_exceptions.PermissionDenied()
 
         logger.debug("Original url: '%s'", original_url)
@@ -1424,7 +1504,8 @@ class FileViewSet(
         Authorize access based on the original URL of an Nginx subrequest
         and user permissions. Returns a dictionary of URL parameters if authorized.
 
-        The original url is passed by nginx in the "HTTP_X_ORIGINAL_URL" header.
+        The original url is passed by the reverse proxy in the header named by the
+        MEDIA_AUTH_ORIGINAL_URL_HEADER setting, which defaults to "HTTP_X_ORIGINAL_URL".
         See corresponding ingress configuration in Helm chart and read about the
         nginx.ingress.kubernetes.io/auth-url annotation to understand how the Nginx ingress
         is configured to do this.
@@ -1443,9 +1524,13 @@ class FileViewSet(
         - PermissionDenied if authorization fails.
         """
         # Extract the original URL from the request header
-        original_url = request.META.get("HTTP_X_ORIGINAL_URL")
+        original_url = request.META.get(settings.MEDIA_AUTH_ORIGINAL_URL_HEADER)
         if not original_url:
-            logger.warning("Missing HTTP_X_ORIGINAL_URL header in subrequest")
+            logger.warning(
+                "Missing %s header in subrequest. Set MEDIA_AUTH_ORIGINAL_URL_HEADER "
+                "to the header your reverse proxy sends.",
+                settings.MEDIA_AUTH_ORIGINAL_URL_HEADER,
+            )
             raise drf_exceptions.PermissionDenied()
 
         parsed_url = urlparse(original_url)

src/backend/core/authentication/backends.py

@@ -3,7 +3,11 @@
 import contextlib
 
 from django.conf import settings
-from django.core.exceptions import ImproperlyConfigured, SuspiciousOperation
+from django.core.exceptions import (
+    ImproperlyConfigured,
+    SuspiciousOperation,
+    ValidationError,
+)
 from django.utils.translation import gettext_lazy as _
 
 from lasuite.oidc_login.backends import (
@@ -17,6 +21,7 @@ from core.services.marketing import (
     ContactData,
     get_marketing_service,
 )
+from core.validators import sub_validator
 
 
 class OIDCAuthenticationBackend(LaSuiteOIDCAuthenticationBackend):
@@ -84,6 +89,19 @@ class OIDCAuthenticationBackend(LaSuiteOIDCAuthenticationBackend):
 
     def get_existing_user(self, sub, email):
         """Fetch existing user by sub or email."""
+
+        sub = str(sub)
+
+        try:
+            sub_validator(sub)
+        except ValidationError as err:
+            raise SuspiciousOperation(
+                "User info contained an invalid sub claim"
+            ) from err
+
+        if len(sub) > 255:
+            raise SuspiciousOperation("User info contained an invalid sub claim")
+
         try:
             return User.objects.get(sub=sub)
         except User.DoesNotExist:

src/backend/core/authentication/livekit.py

@@ -9,6 +9,8 @@ from rest_framework import authentication, exceptions
 
 UserModel = get_user_model()
 
+LIVEKIT_AUTH_SCHEME = "X-LiveKit-Token"
+
 
 class LiveKitTokenAuthentication(authentication.BaseAuthentication):
     """Authenticate using LiveKit token and load the associated Django user."""
@@ -20,9 +22,14 @@ class LiveKitTokenAuthentication(authentication.BaseAuthentication):
             return None  # No authentication attempted
 
         parts = auth_header.split()
-        if len(parts) != 2 or parts[0].lower() != "bearer":
+        if not parts or parts[0].lower() != LIVEKIT_AUTH_SCHEME.lower():
+            # Not our scheme (e.g. "Bearer <user access token>"): defer, another
+            # backend may recognize it.
+            return None
+
+        if len(parts) != 2:
             raise exceptions.AuthenticationFailed(
-                "Authorization header must be: Bearer <token>"
+                f"Authorization header must be: {LIVEKIT_AUTH_SCHEME} <token>"
             )
 
         token = parts[1]

src/backend/core/authentication/user_token.py

@@ -0,0 +1,82 @@
+"""User access JWT authentication for the Meet core API.
+
+Allows an embedded frontend (e.g. rendered in an iframe, where third-party
+session cookies are blocked) to authenticate requests on the core API with
+a JWT, obtained by exchanging a single-use transit code (see
+core.services.transit_code and the users exchange-access-token endpoint)
+and passed as a Bearer header. The JWT itself never appears in any URL.
+
+Similar to lib-jitsi-meet's token authentication, the token is bound to a
+user, not to a resource: once authenticated, the request is treated
+exactly like a session-authenticated one, and the existing role-based
+permissions apply unchanged.
+"""
+
+import logging
+
+from django.conf import settings
+
+from rest_framework import exceptions
+
+from core.external_api.authentication import BaseJWTAuthentication
+from core.models import Application, ApplicationScope
+
+logger = logging.getLogger(__name__)
+
+USER_ACCESS_TOKEN_TYPE_CLAIM = "user_access"  # noqa: S105
+
+
+class UserAccessJWTAuthentication(BaseJWTAuthentication):
+    """JWT authentication for user access tokens.
+
+    Validates user access tokens issued by the users exchange-access-token
+    endpoint and authenticates the user they were issued for. A bearer
+    token that does not verify against the user access token secret is
+    deferred to the next authentication backend; a token that does verify
+    but carries wrong claims is rejected.
+
+    When the feature is disabled (USER_ACCESS_TOKEN_ENABLED=False), the
+    backend is entirely inert: `BaseJWTAuthentication.authenticate`
+    returns None before reading the Authorization header, deferring every
+    request to the next authentication backend.
+    """
+
+    def __init__(self):
+        """Initialize the backend with user access token settings."""
+        super().__init__(
+            secret_key=settings.USER_ACCESS_TOKEN_SECRET_KEY,
+            algorithm=settings.USER_ACCESS_TOKEN_ALG,
+            issuer=settings.USER_ACCESS_TOKEN_ISSUER,
+            audience=settings.USER_ACCESS_TOKEN_AUDIENCE,
+            expiration_seconds=settings.USER_ACCESS_TOKEN_TTL,
+            token_type=settings.USER_ACCESS_TOKEN_TYPE,
+            is_enabled=settings.USER_ACCESS_TOKEN_ENABLED,
+        )
+
+    def validate_payload(self, payload):
+        """Validate the token type and the issuance-audit claim.
+
+        Raises:
+            AuthenticationFailed: If the token verified against the user
+                access token secret but does not carry the expected
+                claims, or if the issuing application lost its grant.
+        """
+
+        if payload.get("token_type") != USER_ACCESS_TOKEN_TYPE_CLAIM:
+            logger.warning("Wrong 'token_type' in user access token payload")
+            raise exceptions.AuthenticationFailed("Invalid token type.")
+
+        if not payload.get("client_id"):
+            logger.warning("Missing 'client_id' in user access token payload")
+            raise exceptions.AuthenticationFailed("Invalid token claims.")
+
+        if not Application.has_active_scope(
+            payload["client_id"], ApplicationScope.USERS_SESSION
+        ):
+            logger.warning(
+                "User access token refused: application '%s' no longer "
+                "holds the '%s' grant",
+                payload["client_id"],
+                ApplicationScope.USERS_SESSION,
+            )
+            raise exceptions.AuthenticationFailed("Application access revoked.")

src/backend/core/external_api/authentication.py

@@ -286,6 +286,10 @@ class ResourceServerBackend(LaSuiteBackend):
         if user is None and settings.OIDC_CREATE_USER:
             user = self.create_user(sub)
 
+        if user is not None and not user.is_active:
+            logger.warning("Inactive user attempted authentication: %s", user.pk)
+            raise SuspiciousOperation("User account is disabled.")
+
         return user
 
     def create_user(self, sub):

src/backend/core/external_api/permissions.py

@@ -20,8 +20,60 @@ class BaseScopePermission(permissions.BasePermission):
 
     scope_map: Dict[str, str] = {}
 
+    def get_required_scope(self, view):
+        """Return the scope required by the view's current action.
+
+        Returns:
+            The required scope, or None for an unsupported method so
+            DRF's router can answer 405.
+
+        Raises:
+            PermissionDenied: If the action is not in scope_map (deny by
+                default).
+        """
+        # Get the current action (e.g., 'list', 'create'), if None let DRF handle it
+        action = getattr(view, "action", None)
+        if not action:
+            # DRF routers return a 405 for unsupported methods
+            return None
+
+        required_scope = self.scope_map.get(action)
+        if not required_scope:
+            # Action not in scope_map, deny by default
+            raise exceptions.PermissionDenied(
+                f"Insufficient permissions. Required scope: {required_scope}"
+            )
+
+        return required_scope
+
+    def get_token_scopes(self, request):
+        """Extract and normalize the scopes claimed by the token."""
+        token_scopes = (request.auth or {}).get("scope")
+
+        if not token_scopes:
+            return []
+
+        # Ensure scopes is a list (handle both list and space-separated string)
+        if isinstance(token_scopes, str):
+            token_scopes = token_scopes.split()
+
+        # Ensure scopes is a deduplicated list (preserving order) and lowercase all scopes
+        token_scopes = list(dict.fromkeys(scope.lower() for scope in token_scopes))
+
+        return self.strip_scope_prefix(token_scopes)
+
+    @staticmethod
+    def strip_scope_prefix(token_scopes):
+        """Strip the OIDC resource server prefix, when configured."""
+        if settings.OIDC_RS_SCOPES_PREFIX:
+            return [
+                scope.removeprefix(f"{settings.OIDC_RS_SCOPES_PREFIX}:")
+                for scope in token_scopes
+            ]
+        return token_scopes
+
     def has_permission(self, request, view):
-        """Check if the JWT token contains the required scope for this action.
+        """Check if the token claims the scope required by this action.
 
         Args:
             request: DRF request object with authenticated user
@@ -33,38 +85,15 @@ class BaseScopePermission(permissions.BasePermission):
         Raises:
             PermissionDenied: If required scope is missing from token
         """
-        # Get the current action (e.g., 'list', 'create'), if None let DRF handle it
-        action = getattr(view, "action", None)
-        if not action:
-            # DRF routers return a 405 for unsupported methods
+        required_scope = self.get_required_scope(view)
+        if required_scope is None:
             return True
 
-        required_scope = self.scope_map.get(action)
-        if not required_scope:
-            # Action not in scope_map, deny by default
-            raise exceptions.PermissionDenied(
-                f"Insufficient permissions. Required scope: {required_scope}"
-            )
-
-        token_payload = request.auth
-        token_scopes = token_payload.get("scope")
+        token_scopes = self.get_token_scopes(request)
 
         if not token_scopes:
             raise exceptions.PermissionDenied("Insufficient permissions.")
 
-        # Ensure scopes is a list (handle both list and space-separated string)
-        if isinstance(token_scopes, str):
-            token_scopes = token_scopes.split()
-
-        # Ensure scopes is a deduplicated list (preserving order) and lowercase all scopes
-        token_scopes = list(dict.fromkeys(scope.lower() for scope in token_scopes))
-
-        if settings.OIDC_RS_SCOPES_PREFIX:
-            token_scopes = [
-                scope.removeprefix(f"{settings.OIDC_RS_SCOPES_PREFIX}:")
-                for scope in token_scopes
-            ]
-
         if required_scope not in token_scopes:
             raise exceptions.PermissionDenied(
                 f"Insufficient permissions. Required scope: {required_scope}"
@@ -73,6 +102,37 @@ class BaseScopePermission(permissions.BasePermission):
         return True
 
 
+class ApplicationScopePermission(BaseScopePermission):
+    """Scope-based permission for application-authenticated endpoints."""
+
+    @staticmethod
+    def strip_scope_prefix(token_scopes):
+        """Compare application scopes verbatim."""
+        return token_scopes
+
+    def has_permission(self, request, view):
+        """Check the scope claim, then the grant recorded in the database."""
+        granted = super().has_permission(request, view)
+
+        required_scope = self.get_required_scope(view)
+
+        if granted and required_scope:
+            client_id = (request.auth or {}).get("client_id")
+
+            if not models.Application.has_active_scope(client_id, required_scope):
+                logger.warning(
+                    "Application '%s' presented scope '%s' without a matching "
+                    "grant in database",
+                    client_id,
+                    required_scope,
+                )
+                raise exceptions.PermissionDenied(
+                    f"Application is not granted the required scope: {required_scope}"
+                )
+
+        return granted
+
+
 class HasRequiredRoomScope(BaseScopePermission):
     """Permission class for Room-related operations."""
 
@@ -86,6 +146,14 @@ class HasRequiredRoomScope(BaseScopePermission):
     }
 
 
+class HasRequiredUserScope(ApplicationScopePermission):
+    """Scope-based permissions for the external user endpoints."""
+
+    scope_map = {
+        "generate_transit_code": models.ApplicationScope.USERS_SESSION,
+    }
+
+
 class RoomPermissions(permissions.BasePermission):
     """Permissions applying to the room API endpoint."""
 

src/backend/core/external_api/viewsets.py

@@ -1,5 +1,6 @@
 """External API endpoints"""
 
+import copy
 from logging import getLogger
 
 from django.conf import settings
@@ -25,6 +26,8 @@ from rest_framework import (
 from core import analytics, api, models
 from core.api.feature_flag import FeatureFlag
 from core.services.jwt_token import JwtTokenService
+from core.services.room_management import RoomManagement
+from core.services.transit_code import TransitCodeService
 
 from ..services.provisional_user_service import (
     ProvisionalUserCreationDisabledError,
@@ -142,6 +145,7 @@ class RoomViewSet(
     mixins.CreateModelMixin,
     mixins.RetrieveModelMixin,
     mixins.ListModelMixin,
+    mixins.UpdateModelMixin,
     viewsets.GenericViewSet,
 ):
     """Application-delegated API for room management.
@@ -154,8 +158,12 @@ class RoomViewSet(
     - list: List rooms the user has access to (requires 'rooms:list' scope)
     - retrieve: Get room details (requires 'rooms:retrieve' scope)
     - create: Create a new room owned by the user (requires 'rooms:create' scope)
+    - partial_update: Update a room's access level and configuration, for
+      administrators and owners only (requires 'rooms:update' scope)
     """
 
+    http_method_names = ["get", "post", "patch", "head", "options"]
+
     authentication_classes = [
         authentication.ApplicationJWTAuthentication,
         authentication.AddonsJWTAuthentication,
@@ -189,7 +197,39 @@ class RoomViewSet(
         serializer = self.get_serializer(queryset, many=True)
         return drf_response.Response(serializer.data)
 
-    def perform_create(self, serializer):
+    def _track_room_event(self, room, event, **extra_properties):
+        """Log a room operation for auditing and forward it to analytics."""
+
+        auth_method = type(self.request.successful_authenticator).__name__
+        client_id = (self.request.auth or {}).get("client_id", "unknown")
+
+        # Log for auditing
+        details = "".join(f", {key}={value}" for key, value in extra_properties.items())
+        logger.info(
+            "Room %s via application: room_id=%s, user_id=%s, client_id=%s, auth_method=%s%s",
+            event.removeprefix("room_"),
+            room.id,
+            self.request.user.id,
+            client_id,
+            auth_method,
+            details,
+        )
+
+        analytics.capture(
+            self.request.user,
+            event,
+            {
+                "room_id": str(room.pk),
+                "access_level": room.access_level,
+                "client_id": client_id,
+                "external_api": True,
+                "auth_method": auth_method,
+                **extra_properties,
+                "$set": {"email": self.request.user.email},
+            },
+        )
+
+    def perform_create(self, serializer: serializers.RoomSerializer):
         """Set the current user as owner of the newly created room."""
         room = serializer.save()
         models.ResourceAccess.objects.create(
@@ -198,27 +238,87 @@ class RoomViewSet(
             role=models.RoleChoices.OWNER,
         )
 
-        auth_method = type(self.request.successful_authenticator).__name__
-        client_id = (self.request.auth or {}).get("client_id", "unknown")
+        self._track_room_event(room, analytics.AnalyticsEvent.ROOM_CREATED)
+
+    def perform_update(self, serializer: serializers.RoomSerializer):
+        """Persist the room update, sync it to LiveKit, then log and track it."""
+
+        previous_values = {
+            "access_level": serializer.instance.access_level,
+            "configuration": copy.deepcopy(serializer.instance.configuration),
+        }
+
+        room = serializer.save()
+
+        # Report the fields that actually changed, not the ones that were submitted.
+        updated_fields = sorted(
+            field
+            for field, previous_value in previous_values.items()
+            if getattr(room, field) != previous_value
+        )
+
+        if updated_fields:
+            RoomManagement.sync_room_metadata(room)
+
+        self._track_room_event(
+            room,
+            analytics.AnalyticsEvent.ROOM_UPDATED,
+            updated_fields=updated_fields,
+            previous_access_level=previous_values["access_level"],
+        )
+
+
+class UserViewSet(viewsets.GenericViewSet):
+    """Application-delegated API for user operations.
+
+    Provides JWT-authenticated access to user operations for external
+    applications acting on behalf of users. All operations are
+    scope-based. Meant to grow with the other user actions exposed to
+    third parties.
+
+    Supported operations:
+    - transit-code: Mint a single-use transit code for the delegated user
+      (requires 'users:session' scope)
+    """
+
+    authentication_classes = [
+        authentication.ApplicationJWTAuthentication,
+    ]
+    permission_classes = [
+        api.permissions.IsAuthenticated & permissions.HasRequiredUserScope
+    ]
+
+    @decorators.action(
+        detail=False,
+        methods=["post"],
+        url_path="transit-code",
+        url_name="transit-code",
+    )
+    @FeatureFlag.require("user_access_token")
+    def generate_transit_code(self, request):
+        """Mint a transit code for the delegated user.
+
+        Returns a short-lived, single-use opaque code to pass to an embedded
+        frontend (e.g. via a URL fragment when cookies are unavailable). The
+        frontend exchanges it once on
+        POST /api/v1.0/users/exchange-access-token/ for a JWT access token,
+        equivalent to session-cookie authentication and never exposed in a URL.
+        """
+        client_id = (request.auth or {}).get("client_id", "unknown")
+
+        code = TransitCodeService().create_code(request.user, client_id=client_id)
 
         # Log for auditing
         logger.info(
-            "Room created via application: room_id=%s, user_id=%s, client_id=%s, auth_method=%s",
-            room.id,
-            self.request.user.id,
+            "Transit code issued: user_id=%s, client_id=%s",
+            request.user.id,
             client_id,
-            auth_method,
         )
 
-        analytics.capture(
-            self.request.user,
-            analytics.AnalyticsEvent.ROOM_CREATED,
+        return drf_response.Response(
             {
-                "room_id": str(room.pk),
-                "access_level": room.access_level,
-                "client_id": client_id,
-                "external_api": True,
-                "auth_method": auth_method,
-                "$set": {"email": self.request.user.email},
+                "transit_code": code,
+                "expires_in": settings.TRANSIT_CODE_TTL,
             },
+            status=drf_status.HTTP_200_OK,
         )

src/backend/core/factories.py

@@ -48,8 +48,6 @@ class ResourceFactory(factory.django.DjangoModelFactory):
                 else:
                     UserResourceAccessFactory(resource=self, user=item[0], role=item[1])
 
-        self.save()
-
 
 class UserResourceAccessFactory(factory.django.DjangoModelFactory):
     """Create fake resource user accesses for testing."""
@@ -97,8 +95,6 @@ class RecordingFactory(factory.django.DjangoModelFactory):
                         recording=self, user=item[0], role=item[1]
                     )
 
-            self.save()
-
 
 class UserRecordingAccessFactory(factory.django.DjangoModelFactory):
     """Create fake recording user accesses for testing."""

src/backend/core/logging_filters.py

@@ -0,0 +1,25 @@
+"""Logging filters for the core application."""
+
+import logging
+
+from django.conf import settings
+
+
+class SilenceExpected401(logging.Filter):
+    """Drop the expected 401 from anonymous hits on the /me endpoint.
+
+    The frontend probes `/users/me/` to check authentication; a 401 for
+    anonymous users is normal, not a warning worth logging.
+    """
+
+    def filter(self, record):
+        """Return False for a 401 on a silenced path, True otherwise."""
+        if getattr(record, "status_code", None) != 401:
+            return True
+
+        request = getattr(record, "request", None)
+        path = getattr(request, "path", None)
+        if not path:
+            return True
+
+        return path not in settings.LOGGING_SILENCED_401_PATHS

src/backend/core/migrations/0001_initial.py

@@ -8,6 +8,8 @@ import uuid
 from django.conf import settings
 from django.db import migrations, models
 
+import core.validators
+
 
 class Migration(migrations.Migration):
 
@@ -41,7 +43,7 @@ class Migration(migrations.Migration):
                 ('id', models.UUIDField(default=uuid.uuid4, editable=False, help_text='primary key for the record as UUID', primary_key=True, serialize=False, verbose_name='id')),
                 ('created_at', models.DateTimeField(auto_now_add=True, help_text='date and time at which a record was created', verbose_name='created on')),
                 ('updated_at', models.DateTimeField(auto_now=True, help_text='date and time at which a record was last updated', verbose_name='updated on')),
-                ('sub', models.CharField(blank=True, help_text='Optional for pending users; required upon account activation. 255 characters or fewer. Letters, numbers, and @/./+/-/_ characters only.', max_length=255, null=True, unique=True, validators=[django.core.validators.RegexValidator(message='Enter a valid sub. This value may contain only letters, numbers, and @/./+/-/_ characters.', regex='^[\\w.@+-]+\\Z')], verbose_name='sub')),
+                ('sub', models.CharField(blank=True, help_text='Optional for pending users; required upon account activation. 255 characters or fewer. Printable ASCII characters only.', max_length=255, null=True, unique=True, validators=[core.validators.sub_validator], verbose_name='sub')),
                 ('email', models.EmailField(blank=True, max_length=254, null=True, verbose_name='identity email address')),
                 ('admin_email', models.EmailField(blank=True, max_length=254, null=True, unique=True, verbose_name='admin email address')),
                 ('language', models.CharField(choices=settings.LANGUAGES, default=settings.LANGUAGE_CODE, help_text='The language in which the user wants to see the interface.', max_length=10, verbose_name='language')),

src/backend/core/migrations/0022_alter_application_scopes.py

@@ -0,0 +1,19 @@
+# Generated by Django 5.2.14 on 2026-07-31 18:27
+
+import django.contrib.postgres.fields
+from django.db import migrations, models
+
+
+class Migration(migrations.Migration):
+
+    dependencies = [
+        ('core', '0021_recording_external_process_id_alter_recording_status'),
+    ]
+
+    operations = [
+        migrations.AlterField(
+            model_name='application',
+            name='scopes',
+            field=django.contrib.postgres.fields.ArrayField(base_field=models.CharField(choices=[('rooms:create', 'Create rooms'), ('rooms:list', 'List rooms'), ('rooms:retrieve', 'Retrieve room details'), ('rooms:update', 'Update rooms'), ('rooms:delete', 'Delete rooms'), ('users:session', 'Create user session tokens')], max_length=50), blank=True, default=list, size=None),
+        ),
+    ]

src/backend/core/migrations/0023_user_default_room_access_level_and_more.py

@@ -6,7 +6,7 @@ from django.db import migrations, models
 class Migration(migrations.Migration):
 
     dependencies = [
-        ('core', '0021_recording_external_process_id_alter_recording_status'),
+        ('core', '0022_alter_application_scopes'),
     ]
 
     operations = [

src/backend/core/models.py

@@ -27,6 +27,7 @@ from timezone_field import TimeZoneField
 
 from . import fields, utils
 from .recording.enums import FileExtension
+from .validators import sub_validator
 
 logger = getLogger(__name__)
 
@@ -145,19 +146,11 @@ class BaseModel(models.Model):
 class User(AbstractBaseUser, BaseModel, auth_models.PermissionsMixin):
     """User model to work with OIDC only authentication."""
 
-    sub_validator = validators.RegexValidator(
-        regex=r"^[\w.@+-]+\Z",
-        message=_(
-            "Enter a valid sub. This value may contain only letters, "
-            "numbers, and @/./+/-/_ characters."
-        ),
-    )
-
     sub = models.CharField(
         _("sub"),
         help_text=_(
             "Optional for pending users; required upon account activation. "
-            "255 characters or fewer. Letters, numbers, and @/./+/-/_ characters only."
+            "255 characters or fewer. Printable ASCII characters only."
         ),
         max_length=255,
         unique=True,
@@ -795,6 +788,7 @@ class ApplicationScope(models.TextChoices):
     ROOMS_RETRIEVE = "rooms:retrieve", _("Retrieve room details")
     ROOMS_UPDATE = "rooms:update", _("Update rooms")
     ROOMS_DELETE = "rooms:delete", _("Delete rooms")
+    USERS_SESSION = "users:session", _("Create user session tokens")
 
 
 class Application(BaseModel):
@@ -844,6 +838,18 @@ class Application(BaseModel):
         domain = get_domain_from_email(email)
         return self.allowed_domains.filter(domain__iexact=domain).exists()
 
+    @classmethod
+    def has_active_scope(cls, client_id, scope) -> bool:
+        """Check that an active application holds a scope."""
+        if not client_id or not scope:
+            return False
+
+        return cls.objects.filter(
+            client_id=client_id,
+            is_active=True,
+            scopes__contains=[scope],
+        ).exists()
+
 
 class ApplicationDomain(BaseModel):
     """Domain authorized for application delegation."""

src/backend/core/recording/services/recording_events.py

@@ -44,7 +44,7 @@ class RecordingEventsService:
         recording_status = status_mapping.get(egress_status)
         if recording_status:
             try:
-                RoomManagement().update_metadata(
+                RoomManagement.update_metadata(
                     room_name, {"recording_status": recording_status}
                 )
             except RoomNotFoundException:

src/backend/core/recording/worker/factories.py

@@ -22,37 +22,6 @@ _RECORDING_AUDIO_CODEC = livekit_api.AudioCodec.AAC
 _RECORDING_AUDIO_FREQUENCY_HZ = 48000
 
 
-def _build_default_encoding_options() -> Optional[Dict[str, Any]]:
-    """Build the server-wide EncodingOptions kwargs, or None to keep LiveKit's preset.
-
-    Operator-tunable values live in Django settings; the default resolution gives
-    width / height, the default profile gives framerate and video bitrate, while
-    codec and frequency are pinned constants. Either default left empty means we
-    use the livekit defaults.
-    """
-
-    resolution = settings.RECORDING_ENCODING_DEFAULT_RESOLUTION
-    profile = settings.RECORDING_ENCODING_DEFAULT_PROFILE
-
-    if not resolution or not profile:
-        return None
-
-    dimensions = settings.RECORDING_ENCODING_AVAILABLE_RESOLUTIONS[resolution]
-    profile_spec = settings.RECORDING_ENCODING_AVAILABLE_PROFILES[profile]
-
-    return {
-        "width": dimensions["width"],
-        "height": dimensions["height"],
-        "framerate": profile_spec["fps"],
-        "video_bitrate": profile_spec["kbps"][resolution],
-        "audio_bitrate": settings.RECORDING_ENCODING_AUDIO_BITRATE_KBPS,
-        "key_frame_interval": settings.RECORDING_ENCODING_KEY_FRAME_INTERVAL_S,
-        "video_codec": _RECORDING_VIDEO_CODEC,
-        "audio_codec": _RECORDING_AUDIO_CODEC,
-        "audio_frequency": _RECORDING_AUDIO_FREQUENCY_HZ,
-    }
-
-
 @dataclass(frozen=True)
 class WorkerServiceConfig:
     """Declare Worker Service common configurations"""
@@ -69,14 +38,22 @@ class WorkerServiceConfig:
 
         logger.debug("Loading WorkerServiceConfig from settings.")
 
-        # Single source of truth for the EncodingOptions kwargs; the services
-        # layer only unpacks this dict. Recordings carrying their own encoding
-        # resolve it per request and bypass this default.
-        encoding_options: Optional[Dict[str, Any]] = (
-            _build_default_encoding_options()
-            if settings.RECORDING_ENCODING_ENABLED
-            else None
-        )
+        encoding_options: Optional[Dict[str, Any]] = None
+        if settings.RECORDING_ENCODING_ENABLED:
+            # Single source of truth for the EncodingOptions kwargs:
+            # operator-tunable values live in Django settings, codec / frequency
+            # are pinned constants. The services layer only unpacks this dict.
+            encoding_options = {
+                "width": settings.RECORDING_ENCODING_WIDTH,
+                "height": settings.RECORDING_ENCODING_HEIGHT,
+                "framerate": settings.RECORDING_ENCODING_FRAMERATE,
+                "video_bitrate": settings.RECORDING_ENCODING_VIDEO_BITRATE_KBPS,
+                "audio_bitrate": settings.RECORDING_ENCODING_AUDIO_BITRATE_KBPS,
+                "key_frame_interval": settings.RECORDING_ENCODING_KEY_FRAME_INTERVAL_S,
+                "video_codec": _RECORDING_VIDEO_CODEC,
+                "audio_codec": _RECORDING_AUDIO_CODEC,
+                "audio_frequency": _RECORDING_AUDIO_FREQUENCY_HZ,
+            }
 
         return cls(
             output_folder=settings.RECORDING_OUTPUT_FOLDER,
@@ -101,12 +78,7 @@ class WorkerService(Protocol):
     def __init__(self, config: WorkerServiceConfig):
         """Initialize the service with the given configuration."""
 
-    def start(
-        self,
-        room_id: str,
-        recording_id: str,
-        encoding_options: Optional[Dict[str, Any]] = None,
-    ) -> str:
+    def start(self, room_id: str, recording_id: str) -> str:
         """Start a recording for a specified room."""
 
     def stop(self, worker_id: str) -> str:

src/backend/core/recording/worker/mediator.py

@@ -51,11 +51,8 @@ class WorkerServiceMediator:
             raise RecordingStartError()
 
         room_name = str(recording.room.id)
-        encoding_options = (recording.options.get("encoding") or {}).get("resolved")
         try:
-            worker_id = self._worker_service.start(
-                room_name, recording.id, encoding_options=encoding_options
-            )
+            worker_id = self._worker_service.start(room_name, recording.id)
         except (WorkerRequestError, WorkerConnectionError, WorkerResponseError) as e:
             logger.exception(
                 "Failed to start recording for room %s: %s", recording.room.slug, e
@@ -71,7 +68,7 @@ class WorkerServiceMediator:
         mode = recording.options.get("original_mode", None) or recording.mode
 
         try:
-            RoomManagement().update_metadata(
+            RoomManagement.update_metadata(
                 room_name, {"recording_mode": mode, "recording_status": "starting"}
             )
         except RoomNotFoundException:

src/backend/core/recording/worker/services.py

@@ -2,8 +2,6 @@
 
 # pylint: disable=no-member
 
-from django.conf import settings
-
 from asgiref.sync import async_to_sync
 from livekit import api as livekit_api
 
@@ -13,41 +11,6 @@ from .exceptions import WorkerConnectionError, WorkerResponseError
 from .factories import WorkerServiceConfig
 
 
-def resolve_encoding_config(encoding_config):
-    """Resolve a per-recording EncodingConfig to concrete encoding fields.
-
-    Returns a JSON-serializable dict of the LiveKit ``EncodingOptions`` kwargs
-    derived from the request's resolution / profile, or None when no
-    encoding_config is provided. This allows to derive width, height, fps, and
-    bitrate from (resolution, profile).
-
-    Only the fields that can actually be resolved are included: width/height
-    require a resolution, framerate/video_bitrate require both a resolution and a
-    profile.
-    """
-    if encoding_config is None:
-        return None
-
-    resolution = encoding_config.resolution
-    profile = encoding_config.profile
-
-    resolved = {
-        "key_frame_interval": settings.RECORDING_ENCODING_KEY_FRAME_INTERVAL_S,
-    }
-
-    if resolution:
-        dimensions = settings.RECORDING_ENCODING_AVAILABLE_RESOLUTIONS[resolution]
-        resolved["width"] = dimensions["width"]
-        resolved["height"] = dimensions["height"]
-
-    if resolution and profile:
-        profile_spec = settings.RECORDING_ENCODING_AVAILABLE_PROFILES[profile]
-        resolved["framerate"] = profile_spec["fps"]
-        resolved["video_bitrate"] = profile_spec["kbps"][resolution]
-
-    return resolved
-
-
 class BaseEgressService:
     """Base egress defining common methods to manage and interact with LiveKit egress processes."""
 
@@ -113,7 +76,7 @@ class BaseEgressService:
 
         return "FAILED_TO_STOP"
 
-    def start(self, room_name, recording_id, encoding_options=None):
+    def start(self, room_name, recording_id):
         """Start the egress process for a recording (not implemented in the base class).
         Each derived class must implement this method, providing the necessary parameters for
         its specific egress type (e.g. audio_only, streaming output).
@@ -136,24 +99,13 @@ class BaseEgressService:
 
         return livekit_api.EncodingOptions(**opts)
 
-    def _resolve_encoding_options(self, encoding_options):
-        """Build LiveKit EncodingOptions from a resolved per-recording dict, or None.
-
-        ``encoding_options`` is the dict persisted by the API in
-        ``recording.options["encoding"]["resolved"]``.
-        """
-        if not encoding_options:
-            return None
-
-        return livekit_api.EncodingOptions(**encoding_options)
-
 
 class VideoCompositeEgressService(BaseEgressService):
     """Record multiple participant video and audio tracks into a single output '.mp4' file."""
 
     hrid = "video-recording-composite-livekit-egress"
 
-    def start(self, room_name, recording_id, encoding_options=None):
+    def start(self, room_name, recording_id):
         """Start the video composite egress process for a recording."""
 
         # Save room's recording as a mp4 video file.
@@ -174,10 +126,7 @@ class VideoCompositeEgressService(BaseEgressService):
             "layout": "speaker-light",
         }
 
-        advanced = (
-            self._resolve_encoding_options(encoding_options)
-            or self._build_encoding_options()
-        )
+        advanced = self._build_encoding_options()
         if advanced is not None:
             request_kwargs["advanced"] = advanced
 
@@ -196,13 +145,8 @@ class AudioCompositeEgressService(BaseEgressService):
 
     hrid = "audio-recording-composite-livekit-egress"
 
-    def start(self, room_name, recording_id, encoding_options=None):
-        """Start the audio composite egress process for a recording.
-
-        ``encoding_options`` is accepted for signature compatibility with the
-        WorkerService protocol but ignored: audio-only egress has no
-        encoding to configure.
-        """
+    def start(self, room_name, recording_id):
+        """Start the audio composite egress process for a recording."""
 
         # Save room's recording as an ogg audio file.
         file_type = livekit_api.EncodedFileType.OGG

src/backend/core/services/livekit_events.py

@@ -52,12 +52,6 @@ class InvalidPayloadError(LiveKitWebhookError):
     status_code = 400
 
 
-class UnsupportedEventTypeError(LiveKitWebhookError):
-    """Unsupported event type."""
-
-    status_code = 422
-
-
 class ActionFailedError(LiveKitWebhookError):
     """Webhook action fails to process or complete."""
 
@@ -74,6 +68,7 @@ class LiveKitWebhookEventType(Enum):
     # Participant events
     PARTICIPANT_JOINED = "participant_joined"
     PARTICIPANT_LEFT = "participant_left"
+    PARTICIPANT_CONNECTION_ABORTED = "participant_connection_aborted"
 
     # Track events
     TRACK_PUBLISHED = "track_published"
@@ -153,10 +148,13 @@ class LiveKitEventsService:
 
         try:
             webhook_type = LiveKitWebhookEventType(data.event)
-        except ValueError as e:
-            raise UnsupportedEventTypeError(
-                f"Unknown webhook type: {data.event}"
-            ) from e
+        except ValueError:
+            logger.warning(
+                "Ignoring unknown LiveKit webhook event type '%s' for room '%s'",
+                data.event,
+                room_name,
+            )
+            return
 
         # Handle according to received webhook type
         handler = self._webhook_handlers.get(webhook_type.value)
@@ -192,7 +190,7 @@ class LiveKitEventsService:
 
         try:
             room_name = str(recording.room.id)
-            RoomManagement().update_metadata(
+            RoomManagement.update_metadata(
                 room_name, remove_keys=["recording_mode", "recording_status"]
             )
         except RoomNotFoundException:

src/backend/core/services/lobby.py

@@ -4,11 +4,12 @@ import logging
 import uuid
 from dataclasses import dataclass
 from enum import Enum
-from typing import Dict, List, Optional, Tuple
+from typing import Dict, FrozenSet, Optional, Sequence, Tuple
 from uuid import UUID
 
 from django.conf import settings
 from django.core.cache import cache
+from django.utils import timezone
 
 from core import models, utils
 
@@ -46,6 +47,7 @@ class LobbyParticipant:
     username: str
     color: str
     id: str
+    entered_at: str
 
     def to_dict(self) -> Dict[str, str]:
         """Serialize the participant object to a dict representation."""
@@ -54,6 +56,7 @@ class LobbyParticipant:
             "username": self.username,
             "id": self.id,
             "color": self.color,
+            "entered_at": self.entered_at,
         }
 
     @classmethod
@@ -68,6 +71,7 @@ class LobbyParticipant:
                 username=data["username"],
                 id=data["id"],
                 color=data["color"],
+                entered_at=data["entered_at"],
             )
         except (KeyError, ValueError) as e:
             logger.exception("Error creating Participant from dict:")
@@ -87,21 +91,45 @@ class LobbyService:
         return f"{settings.LOBBY_KEY_PREFIX}_{room_id!s}_{participant_id}"
 
     @staticmethod
-    def _get_or_create_participant_id(request) -> str:
-        """Extract unique participant identifier from the request."""
-        return request.COOKIES.get(settings.LOBBY_COOKIE_NAME, str(uuid.uuid4()))
+    def _get_index_key(room_id: UUID) -> str:
+        """Raw Redis key of the per-room participant index (a native SET)."""
+        return cache.client.make_key(f"{settings.LOBBY_KEY_PREFIX}-index_{room_id!s}")
 
     @staticmethod
-    def prepare_response(response, participant_id):
-        """Set participant cookie if needed."""
-        if not response.cookies.get(settings.LOBBY_COOKIE_NAME):
-            response.set_cookie(
-                key=settings.LOBBY_COOKIE_NAME,
-                value=participant_id,
-                httponly=True,
-                secure=True,
-                samesite="Lax",
-            )
+    def _redis(write: bool = True):
+        """Raw redis-py client.
+
+        SADD/SREM/SMEMBERS are not exposed by the Django cache API; this is
+        the documented django-redis escape hatch.
+        """
+        return cache.client.get_client(write=write)
+
+    def _index_add(self, room_id: UUID, participant_id: str) -> None:
+        """Record a participant id in the room index."""
+        index_key = self._get_index_key(room_id)
+        pipe = self._redis().pipeline(transaction=False)
+        pipe.sadd(index_key, participant_id)
+        pipe.expire(index_key, settings.LOBBY_ACCEPTED_TIMEOUT)
+        pipe.execute()
+
+    def _index_members(self, room_id: UUID) -> FrozenSet[str]:
+        """All participant ids currently indexed for the room."""
+        members = self._redis(write=False).smembers(self._get_index_key(room_id))
+        return frozenset(
+            member.decode() if isinstance(member, bytes) else member
+            for member in members
+        )
+
+    def _index_touch(self, room_id: UUID) -> None:
+        """Re-arm the room index backstop TTL."""
+        self._redis().expire(
+            self._get_index_key(room_id), settings.LOBBY_ACCEPTED_TIMEOUT
+        )
+
+    def _index_remove(self, room_id: UUID, *participant_ids: str) -> None:
+        """Drop participant ids from the room index."""
+        if participant_ids:
+            self._redis().srem(self._get_index_key(room_id), *participant_ids)
 
     @staticmethod
     def can_bypass_lobby(room, user, role) -> bool:
@@ -133,8 +161,9 @@ class LobbyService:
     def request_entry(
         self,
         room: models.Room,
-        request,
+        user,
         username: str,
+        participant_id: Optional[uuid.UUID] = None,
     ) -> Tuple[LobbyParticipant, Optional[Dict]]:
         """Request entry to a room for a participant.
 
@@ -149,51 +178,51 @@ class LobbyService:
         5. If denied, do nothing.
         """
 
-        participant_id = self._get_or_create_participant_id(request)
-        participant = self._get_participant(room.id, participant_id)
+        participant = None
+        if participant_id:
+            participant = self._get_participant(room.id, participant_id)
+
+        is_new_participant = participant is None
+        if is_new_participant:
+            participant = self._create_participant(username)
 
         room_id = str(room.id)
-        user_role = room.get_role(request.user)
+        user_role = room.get_role(user)
 
-        if self.can_bypass_lobby(room=room, user=request.user, role=user_role):
-            if participant is None:
-                participant = LobbyParticipant(
-                    status=LobbyParticipantStatus.ACCEPTED,
-                    username=username,
-                    id=participant_id,
-                    color=utils.generate_color(participant_id),
-                )
-            else:
-                participant.status = LobbyParticipantStatus.ACCEPTED
+        if self.can_bypass_lobby(room=room, user=user, role=user_role):
+            if not is_new_participant:
+                self.clear_participant_cache(room.id, participant.id)
+            participant.status = LobbyParticipantStatus.ACCEPTED
 
             livekit_config = utils.generate_livekit_config(
                 room_id=room_id,
-                user=request.user,
-                username=username,
+                user=user,
+                username=participant.username,
                 color=participant.color,
                 configuration=room.configuration,
-                participant_id=participant_id,
+                participant_id=participant.id,
                 role=user_role,
             )
             return participant, livekit_config
 
         livekit_config = None
 
-        if participant is None:
-            participant = self.enter(room.id, participant_id, username)
+        if is_new_participant:
+            self._save_participant(room.id, participant)
+            self._notify_entry_request(room_id)
 
         elif participant.status == LobbyParticipantStatus.WAITING:
-            self.refresh_waiting_status(room.id, participant_id)
+            self.refresh_waiting_status(room.id, participant.id)
 
         elif participant.status == LobbyParticipantStatus.ACCEPTED:
             # wrongly named, contains access token to join a room
             livekit_config = utils.generate_livekit_config(
                 room_id=room_id,
-                user=request.user,
-                username=username,
+                user=user,
+                username=participant.username,
                 color=participant.color,
                 configuration=room.configuration,
-                participant_id=participant_id,
+                participant_id=participant.id,
                 role=user_role,
             )
 
@@ -209,28 +238,37 @@ class LobbyService:
         cache.touch(
             self._get_cache_key(room_id, participant_id), settings.LOBBY_WAITING_TIMEOUT
         )
+        self._index_touch(room_id)
 
-    def enter(
-        self, room_id: UUID, participant_id: str, username: str
-    ) -> LobbyParticipant:
-        """Add participant to waiting lobby.
+    def _create_participant(self, username: str) -> LobbyParticipant:
+        """Create a new waiting participant without persisting it.
 
-        Create a new participant entry in waiting status and notify room
-        participants of the new entry request.
+        Participant identifiers are minted here, server-side, exclusively.
         """
-
-        color = utils.generate_color(participant_id)
-
+        participant_id = str(uuid.uuid4())
         participant = LobbyParticipant(
             status=LobbyParticipantStatus.WAITING,
             username=username,
             id=participant_id,
-            color=color,
+            entered_at=timezone.now().isoformat(),
+            color=utils.generate_color(participant_id),
         )
+        return participant
 
+    def _save_participant(self, room_id: UUID, participant: LobbyParticipant):
+        """Persist a participant in the room's lobby."""
+        cache.set(
+            self._get_cache_key(room_id, participant.id),
+            participant.to_dict(),
+            timeout=settings.LOBBY_WAITING_TIMEOUT,
+        )
+        self._index_add(room_id, participant.id)
+
+    def _notify_entry_request(self, room_id: str):
+        """Notify room participants of a new entry request."""
         try:
             utils.notify_participants(
-                room_name=str(room_id),
+                room_name=room_id,
                 notification_data={
                     "type": settings.LOBBY_NOTIFICATION_TYPE,
                 },
@@ -239,15 +277,6 @@ class LobbyService:
             # If room not created yet, there is no participants to notify
             logger.exception("Failed to notify room participants")
 
-        cache_key = self._get_cache_key(room_id, participant_id)
-        cache.set(
-            cache_key,
-            participant.to_dict(),
-            timeout=settings.LOBBY_WAITING_TIMEOUT,
-        )
-
-        return participant
-
     def _get_participant(
         self, room_id: UUID, participant_id: str
     ) -> Optional[LobbyParticipant]:
@@ -266,35 +295,49 @@ class LobbyService:
             cache.delete(cache_key)
             return None
 
-    def list_waiting_participants(self, room_id: UUID) -> List[dict]:
+    def list_waiting_participants(self, room_id: UUID) -> Sequence[dict]:
         """List all waiting participants for a room."""
 
-        pattern = self._get_cache_key(room_id, "*")
-        keys = list(cache.iter_keys(pattern, itersize=utils.CACHE_SCAN_ITERSIZE))
+        member_ids = self._index_members(room_id)
 
-        if not keys:
-            return []
+        if not member_ids:
+            return ()
 
-        data = cache.get_many(keys)
+        keys_by_id = {
+            participant_id: self._get_cache_key(room_id, participant_id)
+            for participant_id in member_ids
+        }
+        data = cache.get_many(list(keys_by_id.values()))
 
+        dead_ids = []
         waiting_participants = []
-        for cache_key, raw_participant in data.items():
+
+        for participant_id, cache_key in keys_by_id.items():
+            raw_participant = data.get(cache_key)
+            if raw_participant is None:
+                dead_ids.append(participant_id)
+                continue
             try:
                 participant = LobbyParticipant.from_dict(raw_participant)
             except LobbyParticipantParsingError:
                 cache.delete(cache_key)
+                dead_ids.append(participant_id)
                 continue
             if participant.status == LobbyParticipantStatus.WAITING:
                 waiting_participants.append(participant.to_dict())
 
-        return waiting_participants
+        self._index_remove(room_id, *dead_ids)
+
+        waiting_participants.sort(key=lambda p: p["entered_at"], reverse=True)
+
+        return tuple(waiting_participants)
 
     def handle_participant_entry(
         self,
         room_id: UUID,
         participant_id: str,
         allow_entry: bool,
-    ) -> None:
+    ) -> LobbyParticipant:
         """Handle decision on participant entry.
 
         Updates participant status based on allow_entry:
@@ -312,7 +355,7 @@ class LobbyService:
                 "timeout": settings.LOBBY_DENIED_TIMEOUT,
             }
 
-        self._update_participant_status(room_id, participant_id, **decision)
+        return self._update_participant_status(room_id, participant_id, **decision)
 
     def _update_participant_status(
         self,
@@ -320,7 +363,7 @@ class LobbyService:
         participant_id: str,
         status: LobbyParticipantStatus,
         timeout: int,
-    ) -> None:
+    ) -> LobbyParticipant:
         """Update participant status with appropriate timeout."""
 
         cache_key = self._get_cache_key(room_id, participant_id)
@@ -341,16 +384,26 @@ class LobbyService:
 
         participant.status = status
         cache.set(cache_key, participant.to_dict(), timeout=timeout)
+        self._index_touch(room_id)
+
+        return participant
 
     def clear_room_cache(self, room_id: UUID) -> None:
         """Clear all participant entries from the cache for a specific room."""
 
-        cache.delete_pattern(
-            self._get_cache_key(room_id, "*"), itersize=utils.CACHE_SCAN_ITERSIZE
-        )
+        member_ids = self._index_members(room_id)
+        if member_ids:
+            cache.delete_many(
+                [
+                    self._get_cache_key(room_id, participant_id)
+                    for participant_id in member_ids
+                ]
+            )
+        self._redis().delete(self._get_index_key(room_id))
 
     def clear_participant_cache(self, room_id: UUID, participant_id: str) -> None:
         """Clear a given participant entry from the cache for a specific room."""
 
         cache_key = self._get_cache_key(room_id, participant_id)
         cache.delete(cache_key)
+        self._index_remove(room_id, participant_id)

src/backend/core/services/presence.py

@@ -1,25 +1,11 @@
-"""Presence cache.
-
-Redis-backed memo of "this identity is currently connected to this room".
-
-This module is intentionally a *pure cache store* with no dependency on other
-services, so that `participants_management` (which talks to LiveKit) can
-import it without creating an import cycle. The composition of "check cache,
-fall back to LiveKit" lives in
-`ParticipantsManagement.check_if_in_meeting_cached`.
-
-Only positive answers are stored: a sticky negative would lock out someone
-who joins right after a miss for the whole TTL. The TTL is a safety net in
-case an invalidation webhook is lost.
-"""
+"""Presence cache."""
 
+from typing import FrozenSet
 from uuid import UUID
 
 from django.conf import settings
 from django.core.cache import cache
 
-from core.utils import CACHE_SCAN_ITERSIZE
-
 
 class PresenceCache:
     """Store and invalidate (room, identity) presence entries."""
@@ -29,24 +15,65 @@ class PresenceCache:
         """Cache key for a (room, identity) presence entry."""
         return f"{settings.PRESENCE_KEY_PREFIX}_{room_id!s}_{identity}"
 
+    @staticmethod
+    def _get_index_key(room_id: UUID | str) -> str:
+        """Raw Redis key of the per-room identity index (a native SET).
+
+        Built through django-redis' make_key so it lives under the same
+        KEY_PREFIX/version namespace as the presence entries.
+        """
+        return cache.client.make_key(
+            f"{settings.PRESENCE_KEY_PREFIX}-index_{room_id!s}"
+        )
+
+    @staticmethod
+    def _redis(write: bool = True):
+        """Raw redis-py client.
+
+        SADD/SREM/SMEMBERS are not exposed by the Django cache API; this is
+        the documented django-redis escape hatch.
+        """
+        return cache.client.get_client(write=write)
+
+    def _index_members(self, room_id: UUID | str) -> FrozenSet[str]:
+        """All identities currently indexed for the room."""
+        members = self._redis(write=False).smembers(self._get_index_key(room_id))
+        return frozenset(
+            member.decode() if isinstance(member, bytes) else member
+            for member in members
+        )
+
     def is_marked_present(self, room_id: UUID | str, identity: str) -> bool:
         """Return True if a positive presence entry exists in cache."""
         return bool(cache.get(self._get_cache_key(room_id, identity)))
 
     def mark_present(self, room_id: UUID | str, identity: str) -> None:
-        """Record that `identity` is in `room_id`."""
+        """Record that `identity` is in `room_id` and index it for the room."""
         cache.set(
             self._get_cache_key(room_id, identity),
             True,
             timeout=settings.PRESENCE_CACHE_TIMEOUT,
         )
+        index_key = self._get_index_key(room_id)
+        pipe = self._redis().pipeline(transaction=False)
+        pipe.sadd(index_key, identity)
+        pipe.expire(index_key, settings.PRESENCE_CACHE_TIMEOUT)
+        pipe.execute()
 
     def clear(self, room_id: UUID | str, identity: str) -> None:
         """Forget presence for one participant (e.g. on participant_left)."""
         cache.delete(self._get_cache_key(room_id, identity))
+        self._redis().srem(self._get_index_key(room_id), identity)
 
     def clear_room(self, room_id: UUID | str) -> None:
-        """Forget presence for every participant of a room (on room_finished)."""
-        cache.delete_pattern(
-            self._get_cache_key(room_id, "*"), itersize=CACHE_SCAN_ITERSIZE
-        )
+        """Forget presence for every participant of a room (on room_finished).
+
+        Deletes the indexed entries and the index itself with targeted
+        commands instead of a full-keyspace pattern scan.
+        """
+        identities = self._index_members(room_id)
+        if identities:
+            cache.delete_many(
+                [self._get_cache_key(room_id, identity) for identity in identities]
+            )
+        self._redis().delete(self._get_index_key(room_id))

src/backend/core/services/room_management.py

@@ -30,9 +30,10 @@ class RoomNotFoundException(RoomManagementException):
 class RoomManagement:
     """Service for managing LiveKit rooms."""
 
+    @classmethod
     @async_to_sync
     async def update_metadata(
-        self,
+        cls,
         room_name: str,
         metadata: Optional[Dict] = None,
         remove_keys: Optional[list[str]] = None,
@@ -90,8 +91,9 @@ class RoomManagement:
         finally:
             await lkapi.aclose()
 
+    @classmethod
     @async_to_sync
-    async def delete_room(self, room_name: str):
+    async def delete_room(cls, room_name: str):
         """Delete a LiveKit room and disconnect all participants.
 
         Raises:
@@ -116,3 +118,32 @@ class RoomManagement:
             raise RoomManagementException("Could not delete room") from e
         finally:
             await lkapi.aclose()
+
+    @classmethod
+    def sync_room_metadata(cls, room):
+        """Push a room's configuration and access level to its LiveKit room metadata.
+
+        Failures are swallowed: a room that is not live yet, or a LiveKit hiccup,
+        should never fail the request that triggered the update.
+        """
+
+        metadata = {
+            "configuration": room.configuration,
+            "access_level": room.access_level,
+        }
+
+        try:
+            cls.update_metadata(
+                room_name=str(room.id),
+                metadata=metadata,
+            )
+        except RoomNotFoundException:
+            logger.info(
+                "LiveKit room %s does not exist yet, skipping metadata sync",
+                room.id,
+            )
+        except RoomManagementException:
+            logger.warning(
+                "Failed to sync metadata to LiveKit for room %s",
+                room.id,
+            )

src/backend/core/services/transit_code.py

@@ -0,0 +1,74 @@
+"""Service handling the lifecycle of transit codes.
+
+A transit code is an opaque, cryptographically random, single-use code
+handed to an embedded frontend (through a URL fragment) so it can obtain a
+user access token on the core API without a session cookie. The code
+carries no information by itself: everything it references (user, client)
+is stored server-side in the cache, and consumed atomically on exchange.
+"""
+
+import hashlib
+import secrets
+
+from django.conf import settings
+from django.core.cache import cache
+
+
+class TransitCodeService:
+    """Create and consume single-use transit codes."""
+
+    @staticmethod
+    def _cache_key(code):
+        """Build the cache key for a code.
+
+        The code is hashed so that a dump of the cache never reveals
+        directly usable codes.
+        """
+        digest = hashlib.sha256(code.encode("utf-8")).hexdigest()
+        return f"{settings.TRANSIT_CODE_CACHE_PREFIX}:{digest}"
+
+    def create_code(self, user, client_id="unknown"):
+        """Generate a transit code for a user, and store it.
+
+        The code expires after TRANSIT_CODE_TTL seconds.
+
+        Returns:
+            str: The opaque code to hand to the client.
+        """
+        # Default 48 random bytes -> 64 url-safe characters, 384 bits of
+        # entropy: unguessable and safe to transit through a URL fragment.
+        code = secrets.token_urlsafe(settings.TRANSIT_CODE_NBYTES)
+
+        cache.set(
+            self._cache_key(code),
+            {
+                "user_id": str(user.id),
+                "client_id": client_id,
+            },
+            timeout=settings.TRANSIT_CODE_TTL,
+        )
+
+        return code
+
+    def consume_code(self, code):
+        """Consume a transit code, enforcing single use.
+
+        The code is deleted from the cache upon consumption. `cache.delete`
+        returns whether a key was actually deleted, so if two requests race
+        on the same code, only one of them wins.
+
+        Returns:
+            dict | None: The data stored at creation time ('user_id',
+                'client_id'), or None if the code is unknown, expired or
+                already consumed.
+        """
+        if not code:
+            return None
+
+        key = self._cache_key(code)
+        data = cache.get(key)
+
+        if data is None or not cache.delete(key):
+            return None
+
+        return data

src/backend/core/tasks/connection_test.py

@@ -31,7 +31,7 @@ def delete_connection_test_room(room_name: str):
         return
 
     try:
-        RoomManagement().delete_room(room_name)
+        RoomManagement.delete_room(room_name)
     except RoomNotFoundException:
         # Room may already be gone after empty/departure timeout.
         logger.info("Connection test room '%s' already gone.", room_name)

src/backend/core/tests/authentication/test_backends.py

@@ -40,6 +40,111 @@ def test_authentication_getter_existing_user(monkeypatch):
     assert user == db_user
 
 
+@pytest.mark.parametrize(
+    "sub",
+    [
+        # NUL (U+0000) passes str.isascii() but PostgreSQL text fields
+        # cannot store or compare it (DataError)
+        "auth0|abc\x00def",
+        # lone surrogates cannot be encoded to UTF-8 for the DB lookup
+        # (UnicodeEncodeError), which runs before any model validation
+        "bad\ud800sub",
+        # plainly invalid subs would otherwise escape as ValidationError
+        # on user creation, which mozilla-django-oidc does not catch
+        "\u00e9milie",
+        "a" * 256,
+        # ASCII control characters are rejected by policy
+        "tab\tsub",
+        "del\x7fsub",
+    ],
+)
+def test_authentication_getter_invalid_sub_rejected_cleanly(monkeypatch, sub):
+    """
+    Subs that can never be persisted should be rejected with
+    SuspiciousOperation (turned into a clean authentication failure by
+    mozilla-django-oidc) instead of leaking DataError, UnicodeEncodeError
+    or ValidationError as a server error.
+    """
+    klass = OIDCAuthenticationBackend()
+
+    def get_userinfo_mocked(*args):
+        return {"sub": sub, "email": "john@example.com"}
+
+    monkeypatch.setattr(OIDCAuthenticationBackend, "get_userinfo", get_userinfo_mocked)
+
+    with pytest.raises(
+        SuspiciousOperation,
+        match="User info contained an invalid sub claim",
+    ):
+        klass.get_or_create_user(access_token="test-token", id_token=None, payload=None)
+
+    assert models.User.objects.exists() is False
+
+
+def test_authentication_getter_numeric_sub(monkeypatch):
+    """
+    Some providers serialize the sub as a JSON number. It should keep working
+    (CharField coerces it to a string on save) and must not crash the early
+    sub checks in get_existing_user.
+    """
+    klass = OIDCAuthenticationBackend()
+
+    def get_userinfo_mocked(*args):
+        return {"sub": 12345, "email": "john@example.com"}
+
+    monkeypatch.setattr(OIDCAuthenticationBackend, "get_userinfo", get_userinfo_mocked)
+
+    user = klass.get_or_create_user(
+        access_token="test-token", id_token=None, payload=None
+    )
+
+    assert user.sub == "12345"
+    assert models.User.objects.count() == 1
+
+
+def test_authentication_getter_new_user_auth0_pipe_sub(monkeypatch):
+    """
+    A first login with an Auth0-style sub containing a pipe ("provider|user-id")
+    should create the user instead of raising a ValidationError.
+    Regression test for https://github.com/suitenumerique/meet/issues/[XXX].
+    """
+    klass = OIDCAuthenticationBackend()
+
+    def get_userinfo_mocked(*args):
+        return {"sub": "auth0|644c0bc8f1874ef6d339fb34", "email": "john@example.com"}
+
+    monkeypatch.setattr(OIDCAuthenticationBackend, "get_userinfo", get_userinfo_mocked)
+
+    user = klass.get_or_create_user(
+        access_token="test-token", id_token=None, payload=None
+    )
+
+    assert user.sub == "auth0|644c0bc8f1874ef6d339fb34"
+    assert user.email == "john@example.com"
+    assert models.User.objects.count() == 1
+
+
+def test_authentication_getter_existing_user_auth0_pipe_sub(monkeypatch):
+    """
+    A returning user with an Auth0-style pipe sub should be matched by sub,
+    not duplicated or rejected.
+    """
+    klass = OIDCAuthenticationBackend()
+    db_user = UserFactory(sub="auth0|644c0bc8f1874ef6d339fb34")
+
+    def get_userinfo_mocked(*args):
+        return {"sub": db_user.sub}
+
+    monkeypatch.setattr(OIDCAuthenticationBackend, "get_userinfo", get_userinfo_mocked)
+
+    user = klass.get_or_create_user(
+        access_token="test-token", id_token=None, payload=None
+    )
+
+    assert user == db_user
+    assert models.User.objects.count() == 1
+
+
 def test_authentication_getter_new_user_no_email(monkeypatch):
     """
     If no user matches, a user should be created.

src/backend/core/tests/files/test_api_files_media_auth.py

@@ -7,6 +7,7 @@ from urllib.parse import quote, urlparse
 
 from django.conf import settings
 from django.core.files.storage import default_storage
+from django.test import override_settings
 from django.utils import timezone
 
 import pytest
@@ -143,3 +144,59 @@ def test_api_files_media_auth_own_file_deleted():
     )
 
     assert response.status_code == 403
+
+
+@override_settings(MEDIA_AUTH_ORIGINAL_URL_HEADER="HTTP_X_FORWARDED_URI")
+def test_api_files_media_auth_custom_original_url_header():
+    """
+    Authorization should honour the configured original-url header.
+
+    Covers the attachment subrequest path, which resolves the header separately
+    from the recording one. Reverse proxies other than nginx-ingress use
+    different headers: Traefik's ForwardAuth sends X-Forwarded-Uri and cannot
+    emit X-Original-URL at all.
+    """
+    user = factories.UserFactory()
+
+    file = factories.FileFactory(
+        type=models.FileTypeChoices.BACKGROUND_IMAGE,
+        update_upload_state=models.FileUploadStateChoices.READY,
+        creator=user,
+    )
+
+    client = APIClient()
+    client.force_login(user)
+
+    default_storage.save(file.file_key, BytesIO(b"my prose"))
+
+    original_url = f"http://localhost/media/{file.file_key:s}"
+    response = client.get(
+        "/api/v1.0/files/media-auth/", HTTP_X_FORWARDED_URI=original_url
+    )
+
+    assert response.status_code == 200
+    assert "AWS4-HMAC-SHA256 Credential=" in response["Authorization"]
+
+
+@override_settings(MEDIA_AUTH_ORIGINAL_URL_HEADER="HTTP_X_FORWARDED_URI")
+def test_api_files_media_auth_default_header_ignored_when_reconfigured():
+    """
+    Only the configured header should be honoured, never a hardcoded fallback.
+    """
+    user = factories.UserFactory()
+
+    file = factories.FileFactory(
+        type=models.FileTypeChoices.BACKGROUND_IMAGE,
+        update_upload_state=models.FileUploadStateChoices.READY,
+        creator=user,
+    )
+
+    client = APIClient()
+    client.force_login(user)
+
+    original_url = f"http://localhost/media/{file.file_key:s}"
+    response = client.get(
+        "/api/v1.0/files/media-auth/", HTTP_X_ORIGINAL_URL=original_url
+    )
+
+    assert response.status_code == 403

src/backend/core/tests/recording/test_api_recordings_media_auth.py

@@ -8,6 +8,7 @@ from uuid import uuid4
 
 from django.conf import settings
 from django.core.files.storage import default_storage
+from django.test import override_settings
 from django.utils import timezone
 
 import pytest
@@ -282,3 +283,63 @@ def test_api_recordings_media_auth_success_administrator(mode):
         timeout=1,
     )
     assert response.content.decode("utf-8") == "my prose"
+
+
+def test_api_recordings_media_auth_missing_header():
+    """
+    Test that a subrequest without the configured original-url header is rejected.
+    """
+    user = UserFactory()
+
+    client = APIClient()
+    client.force_login(user)
+
+    response = client.get("/api/v1.0/recordings/media-auth/")
+
+    assert response.status_code == 403
+
+
+@override_settings(MEDIA_AUTH_ORIGINAL_URL_HEADER="HTTP_X_FORWARDED_URI")
+def test_api_recordings_media_auth_custom_original_url_header():
+    """
+    Test that the header carrying the original URL can be configured.
+
+    Reverse proxies other than nginx-ingress use different headers: Traefik's
+    ForwardAuth sends X-Forwarded-Uri and cannot emit X-Original-URL at all.
+    """
+    user = UserFactory()
+
+    client = APIClient()
+    client.force_login(user)
+
+    original_url = f"http://localhost/media/recordings/{uuid4()!s}.mp4"
+
+    response = client.get(
+        "/api/v1.0/recordings/media-auth/", HTTP_X_FORWARDED_URI=original_url
+    )
+
+    # The header was read and parsed: we get as far as looking the recording up,
+    # rather than being rejected for a missing header.
+    assert response.status_code == 404
+
+
+@override_settings(MEDIA_AUTH_ORIGINAL_URL_HEADER="HTTP_X_FORWARDED_URI")
+def test_api_recordings_media_auth_default_header_ignored_when_reconfigured():
+    """
+    Test that only the configured header is honoured.
+
+    Guards against the header being read from a hardcoded name in parallel with
+    the setting.
+    """
+    user = UserFactory()
+
+    client = APIClient()
+    client.force_login(user)
+
+    original_url = f"http://localhost/media/recordings/{uuid4()!s}.mp4"
+
+    response = client.get(
+        "/api/v1.0/recordings/media-auth/", HTTP_X_ORIGINAL_URL=original_url
+    )
+
+    assert response.status_code == 403

src/backend/core/tests/recording/worker/test_encoding_resolver.py

@@ -1,109 +0,0 @@
-"""Tests for the per-recording encoding resolution in BaseEgressService."""
-
-# pylint: disable=protected-access,redefined-outer-name,unused-argument
-
-from unittest.mock import Mock
-
-from django.conf import settings
-
-import pytest
-from pydantic import ValidationError as PydanticValidationError
-
-from core.api.serializers import EncodingConfig
-from core.recording.worker.services import (
-    VideoCompositeEgressService,
-    resolve_encoding_config,
-)
-
-
-def make_config():
-    """Build a minimal WorkerServiceConfig-like mock for service instantiation."""
-    config = Mock()
-    config.bucket_args = {
-        "endpoint": "https://s3.test.com",
-        "access_key": "test_key",
-        "secret": "test_secret",
-        "region": "test-region",
-        "bucket": "test-bucket",
-        "force_path_style": True,
-    }
-    config.encoding_options = None
-    return config
-
-
-@pytest.fixture
-def service():
-    """Return a VideoCompositeEgressService with mocked handle_request."""
-    svc = VideoCompositeEgressService(make_config())
-    svc._handle_request = Mock()
-    return svc
-
-
-# --- resolve_encoding_config ---
-
-
-def test_resolve_config_returns_none_without_config():
-    """Resolver should return None when no encoding config is provided."""
-    assert resolve_encoding_config(None) is None
-
-
-def test_resolve_config_without_profile_omits_profile_fields():
-    """A resolution-only config should resolve dimensions but no framerate/bitrate."""
-    resolved = resolve_encoding_config(EncodingConfig(resolution="720p"))
-
-    assert resolved == {
-        "key_frame_interval": settings.RECORDING_ENCODING_KEY_FRAME_INTERVAL_S,
-        "width": 1280,
-        "height": 720,
-    }
-
-
-def test_encoding_config_requires_resolution():
-    """A profile-only or empty encoding config should be rejected at validation."""
-    with pytest.raises(PydanticValidationError):
-        EncodingConfig(profile="mixed")
-    with pytest.raises(PydanticValidationError):
-        EncodingConfig()
-
-
-# --- _resolve_encoding_options ---
-
-
-@pytest.mark.parametrize("encoding_options", [None, {}])
-def test_resolve_options_returns_none_when_empty(service, encoding_options):
-    """Resolver should return None when the resolved dict is empty or missing."""
-    assert service._resolve_encoding_options(encoding_options) is None
-
-
-@pytest.mark.parametrize(
-    "resolution",
-    list(settings.RECORDING_ENCODING_AVAILABLE_RESOLUTIONS),
-)
-@pytest.mark.parametrize(
-    "profile",
-    list(settings.RECORDING_ENCODING_AVAILABLE_PROFILES),
-)
-def test_resolve_profile_resolution_combinations(service, profile, resolution):
-    """Every (profile, resolution) pair should resolve to the values from settings."""
-    dimensions = settings.RECORDING_ENCODING_AVAILABLE_RESOLUTIONS[resolution]
-    profile_spec = settings.RECORDING_ENCODING_AVAILABLE_PROFILES[profile]
-
-    resolved = resolve_encoding_config(
-        EncodingConfig(resolution=resolution, profile=profile)
-    )
-    result = service._resolve_encoding_options(resolved)
-
-    assert result.width == dimensions["width"]
-    assert result.height == dimensions["height"]
-    assert result.framerate == profile_spec["fps"]
-    assert result.video_bitrate == profile_spec["kbps"][resolution]
-
-
-def test_resolve_options_none_profile_uses_livekit_defaults(service):
-    """Missing profile should pass 0 fps/bitrate (LiveKit protobuf default)."""
-    resolved = resolve_encoding_config(EncodingConfig(resolution="720p"))
-    result = service._resolve_encoding_options(resolved)
-    assert result.width == 1280
-    assert result.height == 720
-    assert result.framerate == 0
-    assert result.video_bitrate == 0

src/backend/core/tests/recording/worker/test_factories.py

@@ -85,22 +85,18 @@ def test_config_immutability(default_config):
     AWS_S3_REGION_NAME="test-region",
     AWS_STORAGE_BUCKET_NAME="test-bucket",
     RECORDING_ENCODING_ENABLED=True,
-    RECORDING_ENCODING_AVAILABLE_RESOLUTIONS={
-        "720p": {"width": 1280, "height": 720},
-    },
-    RECORDING_ENCODING_AVAILABLE_PROFILES={
-        "talking_heads": {"fps": 15, "kbps": {"720p": 600}},
-    },
-    RECORDING_ENCODING_DEFAULT_RESOLUTION="720p",
-    RECORDING_ENCODING_DEFAULT_PROFILE="talking_heads",
+    RECORDING_ENCODING_WIDTH=1280,
+    RECORDING_ENCODING_HEIGHT=720,
+    RECORDING_ENCODING_FRAMERATE=15,
+    RECORDING_ENCODING_VIDEO_BITRATE_KBPS=600,
     RECORDING_ENCODING_AUDIO_BITRATE_KBPS=64,
     RECORDING_ENCODING_KEY_FRAME_INTERVAL_S=10.0,
 )
 def test_config_encoding_options_enabled():
     """When RECORDING_ENCODING_ENABLED is True, encoding options are populated.
 
-    The dict mixes values resolved from the default resolution / profile with
-    pinned codec / frequency constants, so the services layer can simply unpack it.
+    The dict mixes operator-tunable values from settings with pinned codec /
+    frequency constants, so the services layer can simply unpack it.
     """
 
     WorkerServiceConfig.from_settings.cache_clear()
@@ -119,27 +115,6 @@ def test_config_encoding_options_enabled():
     }
 
 
-@override_settings(
-    RECORDING_OUTPUT_FOLDER="/test/output",
-    LIVEKIT_CONFIGURATION={"server": "test.example.com"},
-    AWS_S3_ENDPOINT_URL="https://s3.test.com",
-    AWS_S3_ACCESS_KEY_ID="test_key",
-    AWS_S3_SECRET_ACCESS_KEY="test_secret",
-    AWS_S3_REGION_NAME="test-region",
-    AWS_STORAGE_BUCKET_NAME="test-bucket",
-    RECORDING_ENCODING_ENABLED=True,
-    RECORDING_ENCODING_DEFAULT_RESOLUTION="",
-    RECORDING_ENCODING_DEFAULT_PROFILE="",
-)
-def test_config_encoding_options_without_defaults():
-    """An empty default resolution or profile leaves the encoding to LiveKit."""
-
-    WorkerServiceConfig.from_settings.cache_clear()
-    config = WorkerServiceConfig.from_settings()
-
-    assert config.encoding_options is None
-
-
 @override_settings(
     RECORDING_OUTPUT_FOLDER="/test/output",
     LIVEKIT_CONFIGURATION={"server": "test.example.com"},

src/backend/core/tests/recording/worker/test_mediator.py

@@ -50,7 +50,7 @@ def test_start_recording_success(mock_update_metadata, mediator, mock_worker_ser
     # Verify worker service call
     expected_room_name = str(mock_recording.room.id)
     mock_worker_service.start.assert_called_once_with(
-        expected_room_name, mock_recording.id, encoding_options=None
+        expected_room_name, mock_recording.id
     )
 
     # Verify recording updates
@@ -64,38 +64,6 @@ def test_start_recording_success(mock_update_metadata, mediator, mock_worker_ser
     )
 
 
-@mock.patch("core.utils.update_room_metadata")
-def test_start_recording_passes_resolved_encoding(
-    mock_update_room_metadata, mediator, mock_worker_service
-):
-    """The resolved encoding persisted in recording.options reaches the worker."""
-    mock_worker_service.start.return_value = "test-worker-123"
-
-    resolved = {
-        "key_frame_interval": 4.0,
-        "width": 1280,
-        "height": 720,
-        "framerate": 15,
-        "video_bitrate": 700,
-    }
-    mock_recording = RecordingFactory(
-        status=RecordingStatusChoices.INITIATED,
-        worker_id=None,
-        options={
-            "encoding": {
-                "resolution": "720p",
-                "profile": "talking_heads",
-                "resolved": resolved,
-            }
-        },
-    )
-    mediator.start(mock_recording)
-
-    mock_worker_service.start.assert_called_once_with(
-        str(mock_recording.room.id), mock_recording.id, encoding_options=resolved
-    )
-
-
 @pytest.mark.parametrize(
     "error_class", [WorkerRequestError, WorkerConnectionError, WorkerResponseError]
 )

src/backend/core/tests/rooms/test_api_rooms_create.py

@@ -2,15 +2,18 @@
 Test rooms API endpoints in the Meet core app: create.
 """
 
+from datetime import datetime, timedelta, timezone
+
 # pylint: disable=redefined-outer-name,unused-argument
 from django.conf import settings
 from django.core.cache import cache
 
+import jwt
 import pytest
 from rest_framework.test import APIClient
 
-from ...factories import RoomFactory, UserFactory
-from ...models import Room, RoomAccessLevel
+from ...factories import ApplicationFactory, RoomFactory, UserFactory
+from ...models import ApplicationScope, Room, RoomAccessLevel
 
 pytestmark = pytest.mark.django_db
 
@@ -312,3 +315,39 @@ def test_api_rooms_create_authenticated_blank_user_default_access_level():
     assert response.status_code == 201
     room = Room.objects.get()
     assert room.access_level == settings.RESOURCE_DEFAULT_ACCESS_LEVEL
+
+
+def generate_user_access_token(user):
+    """Generate a valid user access JWT signed with the token secret."""
+    now = datetime.now(timezone.utc)
+    application = ApplicationFactory(scopes=[ApplicationScope.USERS_SESSION])
+
+    payload = {
+        "iss": settings.USER_ACCESS_TOKEN_ISSUER,
+        "aud": settings.USER_ACCESS_TOKEN_AUDIENCE,
+        "iat": now,
+        "exp": now + timedelta(seconds=settings.USER_ACCESS_TOKEN_TTL),
+        "user_id": str(user.id),
+        "token_type": "user_access",
+        "client_id": application.client_id,
+        "scope": "user:access",
+    }
+
+    return jwt.encode(
+        payload,
+        settings.USER_ACCESS_TOKEN_SECRET_KEY,
+        algorithm=settings.USER_ACCESS_TOKEN_ALG,
+    )
+
+
+def test_api_rooms_create_authenticated_with_user_access_token():
+    """A user access token should create a room exactly like a session would."""
+    user = UserFactory()
+
+    client = APIClient()
+    client.credentials(HTTP_AUTHORIZATION=f"Bearer {generate_user_access_token(user)}")
+    response = client.post("/api/v1.0/rooms/", {"name": "my room"})
+
+    assert response.status_code == 201
+    room = Room.objects.get()
+    assert room.accesses.filter(role="owner", user=user).exists()

src/backend/core/tests/rooms/test_api_rooms_list.py

@@ -2,14 +2,18 @@
 Test rooms API endpoints in the Meet core app: list.
 """
 
+from datetime import datetime, timedelta, timezone
 from unittest import mock
 
+from django.conf import settings as django_settings
+
+import jwt
 import pytest
 from rest_framework.pagination import PageNumberPagination
 from rest_framework.test import APIClient
 
-from ...factories import RoomFactory, UserFactory
-from ...models import RoomAccessLevel
+from ...factories import ApplicationFactory, RoomFactory, UserFactory
+from ...models import ApplicationScope, RoomAccessLevel
 
 pytestmark = pytest.mark.django_db
 
@@ -156,3 +160,41 @@ def test_api_rooms_list_pagination_page_size():
     assert len(content["results"]) == 3
     assert content["next"] == "http://testserver/api/v1.0/rooms/?page=2&page_size=3"
     assert content["previous"] is None
+
+
+def generate_user_access_token(user):
+    """Generate a valid user access JWT signed with the token secret."""
+    now = datetime.now(timezone.utc)
+    application = ApplicationFactory(scopes=[ApplicationScope.USERS_SESSION])
+
+    payload = {
+        "iss": django_settings.USER_ACCESS_TOKEN_ISSUER,
+        "aud": django_settings.USER_ACCESS_TOKEN_AUDIENCE,
+        "iat": now,
+        "exp": now + timedelta(seconds=django_settings.USER_ACCESS_TOKEN_TTL),
+        "user_id": str(user.id),
+        "token_type": "user_access",
+        "client_id": application.client_id,
+        "scope": "user:access",
+    }
+
+    return jwt.encode(
+        payload,
+        django_settings.USER_ACCESS_TOKEN_SECRET_KEY,
+        algorithm=django_settings.USER_ACCESS_TOKEN_ALG,
+    )
+
+
+def test_api_rooms_list_authenticated_with_user_access_token():
+    """A user access token should list rooms exactly like a session would."""
+    user = UserFactory()
+    room = RoomFactory(users=[(user, "owner")])
+    RoomFactory()  # another user's room, not listed
+
+    client = APIClient()
+    client.credentials(HTTP_AUTHORIZATION=f"Bearer {generate_user_access_token(user)}")
+    response = client.get("/api/v1.0/rooms/")
+
+    assert response.status_code == 200
+    assert response.data["count"] == 1
+    assert response.data["results"][0]["id"] == str(room.id)

src/backend/core/tests/rooms/test_api_rooms_lobby.py

@@ -6,30 +6,35 @@ Test rooms API endpoints in the Meet core app: lobby functionality.
 import uuid
 from unittest import mock
 
+from django.core import signing
 from django.core.cache import cache
 
 import pytest
+from freezegun import freeze_time
 from rest_framework.test import APIClient
 
 from ... import utils
 from ...factories import RoomFactory, UserFactory
 from ...models import RoomAccessLevel
-from ...services.lobby import (
-    LobbyService,
-)
+from ...services.lobby import LobbyService
 
 pytestmark = pytest.mark.django_db
 
 
+def _lobby_signer():
+    """Use the polling credential's dedicated signing namespace."""
+    return signing.Signer(salt="core.lobby.participant")
+
+
 # Tests for request_entry endpoint
 
 
+@freeze_time("2025-01-01 10:00:00")
 def test_request_entry_anonymous(settings):
     """Anonymous users should be allowed to request entry to a room."""
     room = RoomFactory(access_level=RoomAccessLevel.RESTRICTED)
     client = APIClient()
 
-    settings.LOBBY_COOKIE_NAME = "mocked-cookie"
     settings.LOBBY_KEY_PREFIX = "mocked-cache-prefix"
 
     # Lobby cache should be empty before the request
@@ -47,11 +52,10 @@ def test_request_entry_anonymous(settings):
 
     assert response.status_code == 200
 
-    # Verify the lobby cookie was properly set
-    cookie = response.cookies.get("mocked-cookie")
-    assert cookie is not None
-
-    participant_id = cookie.value
+    # The participant identifier is returned in the response body; no
+    # cookie is involved anymore
+    assert not response.cookies
+    participant_id = response.json()["id"]
 
     # Verify response content matches expected structure and values
     assert response.json() == {
@@ -59,6 +63,7 @@ def test_request_entry_anonymous(settings):
         "username": "test_user",
         "status": "waiting",
         "color": "mocked-color",
+        "entered_at": "2025-01-01T10:00:00+00:00",
         "livekit": None,
     }
 
@@ -67,10 +72,12 @@ def test_request_entry_anonymous(settings):
     assert len(lobby_keys) == 1
 
     # Verify participant data was correctly stored in cache
-    participant_data = cache.get(f"mocked-cache-prefix_{room.id!s}_{participant_id}")
+    raw_id = _lobby_signer().unsign(participant_id)
+    participant_data = cache.get(f"mocked-cache-prefix_{room.id!s}_{raw_id}")
     assert participant_data.get("username") == "test_user"
 
 
+@freeze_time("2025-01-01 10:00:00")
 def test_request_entry_authenticated_user(settings):
     """Authenticated users should be allowed to request entry."""
     room = RoomFactory(access_level=RoomAccessLevel.RESTRICTED)
@@ -78,7 +85,6 @@ def test_request_entry_authenticated_user(settings):
     client = APIClient()
     client.force_login(user)
 
-    settings.LOBBY_COOKIE_NAME = "mocked-cookie"
     settings.LOBBY_KEY_PREFIX = "mocked-cache-prefix"
 
     # Lobby cache should be empty before the request
@@ -96,11 +102,10 @@ def test_request_entry_authenticated_user(settings):
 
     assert response.status_code == 200
 
-    # Verify the lobby cookie was properly set
-    cookie = response.cookies.get("mocked-cookie")
-    assert cookie is not None
-
-    participant_id = cookie.value
+    # The participant identifier is returned in the response body; no
+    # cookie is involved anymore
+    assert not response.cookies
+    participant_id = response.json()["id"]
 
     # Verify response content matches expected structure and values
     assert response.json() == {
@@ -108,6 +113,7 @@ def test_request_entry_authenticated_user(settings):
         "username": "test_user",
         "status": "waiting",
         "color": "mocked-color",
+        "entered_at": "2025-01-01T10:00:00+00:00",
         "livekit": None,
     }
 
@@ -116,10 +122,12 @@ def test_request_entry_authenticated_user(settings):
     assert len(lobby_keys) == 1
 
     # Verify participant data was correctly stored in cache
-    participant_data = cache.get(f"mocked-cache-prefix_{room.id!s}_{participant_id}")
+    raw_id = _lobby_signer().unsign(participant_id)
+    participant_data = cache.get(f"mocked-cache-prefix_{room.id!s}_{raw_id}")
     assert participant_data.get("username") == "test_user"
 
 
+@freeze_time("2025-01-01 10:00:00")
 def test_request_entry_with_existing_participants(settings):
     """Anonymous users should be allowed to request entry to a room with existing participants."""
     # Create a restricted access room
@@ -127,7 +135,6 @@ def test_request_entry_with_existing_participants(settings):
     client = APIClient()
 
     # Configure test settings for cookies and cache
-    settings.LOBBY_COOKIE_NAME = "mocked-cookie"
     settings.LOBBY_KEY_PREFIX = "mocked-cache-prefix"
 
     # Add two participants already waiting in the lobby
@@ -138,6 +145,7 @@ def test_request_entry_with_existing_participants(settings):
             "username": "user1",
             "status": "waiting",
             "color": "#123456",
+            "entered_at": "2025-01-01T10:00:00+00:00",
         },
     )
     cache.set(
@@ -147,6 +155,7 @@ def test_request_entry_with_existing_participants(settings):
             "username": "user2",
             "status": "accepted",
             "color": "#654321",
+            "entered_at": "2025-01-01T10:00:00+00:00",
         },
     )
 
@@ -168,16 +177,16 @@ def test_request_entry_with_existing_participants(settings):
     # Verify successful response
     assert response.status_code == 200
 
-    # Verify the lobby cookie was properly set for the new participant
-    cookie = response.cookies.get("mocked-cookie")
-    assert cookie is not None
-
-    participant_id = cookie.value
+    # The participant identifier is returned in the response body; no
+    # cookie is involved anymore
+    assert not response.cookies
+    participant_id = response.json()["id"]
 
     # Verify response content matches expected structure and values
     assert response.json() == {
         "id": participant_id,
         "username": "test_user",
+        "entered_at": "2025-01-01T10:00:00+00:00",
         "status": "waiting",
         "color": "mocked-color",
         "livekit": None,
@@ -188,16 +197,17 @@ def test_request_entry_with_existing_participants(settings):
     assert len(lobby_keys) == 3
 
     # Verify the new participant data was correctly stored in cache
-    participant_data = cache.get(f"mocked-cache-prefix_{room.id!s}_{participant_id}")
+    raw_id = _lobby_signer().unsign(participant_id)
+    participant_data = cache.get(f"mocked-cache-prefix_{room.id!s}_{raw_id}")
     assert participant_data.get("username") == "test_user"
 
 
+@freeze_time("2025-01-01 10:00:00")
 def test_request_entry_public_room(settings):
     """Entry requests to public rooms should return ACCEPTED status with LiveKit config."""
     room = RoomFactory(access_level=RoomAccessLevel.PUBLIC)
     client = APIClient()
 
-    settings.LOBBY_COOKIE_NAME = "mocked-cookie"
     settings.LOBBY_KEY_PREFIX = "mocked-cache-prefix"
 
     # Lobby cache should be empty before the request
@@ -206,59 +216,8 @@ def test_request_entry_public_room(settings):
 
     with (
         mock.patch.object(utils, "notify_participants", return_value=None),
-        mock.patch.object(
-            LobbyService, "_get_or_create_participant_id", return_value="123"
-        ),
-        mock.patch.object(
-            utils, "generate_livekit_config", return_value={"token": "test-token"}
-        ),
-        mock.patch.object(utils, "generate_color", return_value="mocked-color"),
-    ):
-        response = client.post(
-            f"/api/v1.0/rooms/{room.id}/request-entry/",
-            {"username": "test_user"},
-        )
-
-    assert response.status_code == 200
-
-    # Verify the lobby cookie was set
-    cookie = response.cookies.get("mocked-cookie")
-    assert cookie is not None
-    assert cookie.value == "123"
-
-    # Verify response content matches expected structure and values
-    assert response.json() == {
-        "id": "123",
-        "username": "test_user",
-        "status": "accepted",
-        "color": "mocked-color",
-        "livekit": {"token": "test-token"},
-    }
-
-    # Verify lobby cache is still empty after the request
-    lobby_keys = cache.keys(f"mocked-cache-prefix_{room.id}_*")
-    assert not lobby_keys
-
-
-def test_request_entry_authenticated_user_public_room(settings):
-    """While authenticated, entry request to public rooms should get accepted."""
-    room = RoomFactory(access_level=RoomAccessLevel.PUBLIC)
-    user = UserFactory()
-    client = APIClient()
-    client.force_login(user)
-
-    settings.LOBBY_COOKIE_NAME = "mocked-cookie"
-    settings.LOBBY_KEY_PREFIX = "mocked-cache-prefix"
-
-    # Lobby cache should be empty before the request
-    lobby_keys = cache.keys(f"mocked-cache-prefix_{room.id}_*")
-    assert not lobby_keys
-
-    with (
-        mock.patch.object(utils, "notify_participants", return_value=None),
-        mock.patch.object(
-            LobbyService,
-            "_get_or_create_participant_id",
+        mock.patch(
+            "core.services.lobby.uuid.uuid4",
             return_value="2f7f162f-e7d1-421b-90e7-02bfbfbf8def",
         ),
         mock.patch.object(
@@ -273,31 +232,72 @@ def test_request_entry_authenticated_user_public_room(settings):
 
     assert response.status_code == 200
 
-    # Verify the lobby cookie was set
-    cookie = response.cookies.get("mocked-cookie")
-    assert cookie is not None
-    assert cookie.value == "2f7f162f-e7d1-421b-90e7-02bfbfbf8def"
-
     # Verify response content matches expected structure and values
     assert response.json() == {
-        "id": "2f7f162f-e7d1-421b-90e7-02bfbfbf8def",
+        "id": _lobby_signer().sign("2f7f162f-e7d1-421b-90e7-02bfbfbf8def"),
         "username": "test_user",
+        "entered_at": "2025-01-01T10:00:00+00:00",
         "status": "accepted",
         "color": "mocked-color",
         "livekit": {"token": "test-token"},
     }
 
-    # Verify lobby cache is still empty after the request
+    assert not cache.keys(f"mocked-cache-prefix_{room.id}_*")
+    assert not LobbyService()._index_members(room.id)
+
+
+@freeze_time("2025-01-01 10:00:00")
+def test_request_entry_authenticated_user_public_room(settings):
+    """While authenticated, entry request to public rooms should get accepted."""
+    room = RoomFactory(access_level=RoomAccessLevel.PUBLIC)
+    user = UserFactory()
+    client = APIClient()
+    client.force_login(user)
+
+    settings.LOBBY_KEY_PREFIX = "mocked-cache-prefix"
+
+    # Lobby cache should be empty before the request
     lobby_keys = cache.keys(f"mocked-cache-prefix_{room.id}_*")
     assert not lobby_keys
 
+    with (
+        mock.patch.object(utils, "notify_participants", return_value=None),
+        mock.patch(
+            "core.services.lobby.uuid.uuid4",
+            return_value="2f7f162f-e7d1-421b-90e7-02bfbfbf8def",
+        ),
+        mock.patch.object(
+            utils, "generate_livekit_config", return_value={"token": "test-token"}
+        ),
+        mock.patch.object(utils, "generate_color", return_value="mocked-color"),
+    ):
+        response = client.post(
+            f"/api/v1.0/rooms/{room.id}/request-entry/",
+            {"username": "test_user"},
+        )
 
+    assert response.status_code == 200
+
+    # Verify response content matches expected structure and values
+    assert response.json() == {
+        "id": _lobby_signer().sign("2f7f162f-e7d1-421b-90e7-02bfbfbf8def"),
+        "username": "test_user",
+        "entered_at": "2025-01-01T10:00:00+00:00",
+        "status": "accepted",
+        "color": "mocked-color",
+        "livekit": {"token": "test-token"},
+    }
+
+    assert not cache.keys(f"mocked-cache-prefix_{room.id}_*")
+    assert not LobbyService()._index_members(room.id)
+
+
+@freeze_time("2025-01-01 10:00:00")
 def test_request_entry_waiting_participant_public_room(settings):
     """While waiting, entry request to public rooms should get accepted."""
     room = RoomFactory(access_level=RoomAccessLevel.PUBLIC)
     client = APIClient()
 
-    settings.LOBBY_COOKIE_NAME = "mocked-cookie"
     settings.LOBBY_KEY_PREFIX = "mocked-cache-prefix"
 
     # Add a waiting participant to the room's lobby cache
@@ -308,12 +308,13 @@ def test_request_entry_waiting_participant_public_room(settings):
             "username": "user1",
             "status": "waiting",
             "color": "#123456",
+            "entered_at": "2025-01-01T10:00:00+00:00",
         },
     )
 
-    # Simulate a browser with existing participant cookie
-    client.cookies.load({"mocked-cookie": "2f7f162f-e7d1-421b-90e7-02bfbfbf8def"})
+    LobbyService()._index_add(room.id, "2f7f162f-e7d1-421b-90e7-02bfbfbf8def")
 
+    # Simulate a returning participant echoing its identifier
     with (
         mock.patch.object(utils, "notify_participants", return_value=None),
         mock.patch.object(
@@ -322,28 +323,28 @@ def test_request_entry_waiting_participant_public_room(settings):
     ):
         response = client.post(
             f"/api/v1.0/rooms/{room.id}/request-entry/",
-            {"username": "user1"},
+            {
+                "username": "user1",
+                "participant_id": _lobby_signer().sign(
+                    "2f7f162f-e7d1-421b-90e7-02bfbfbf8def"
+                ),
+            },
         )
 
     assert response.status_code == 200
 
-    # Verify the lobby cookie was set
-    cookie = response.cookies.get("mocked-cookie")
-    assert cookie is not None
-    assert cookie.value == "2f7f162f-e7d1-421b-90e7-02bfbfbf8def"
-
     # Verify response content matches expected structure and values
     assert response.json() == {
-        "id": "2f7f162f-e7d1-421b-90e7-02bfbfbf8def",
+        "id": _lobby_signer().sign("2f7f162f-e7d1-421b-90e7-02bfbfbf8def"),
         "username": "user1",
         "status": "accepted",
         "color": "#123456",
+        "entered_at": "2025-01-01T10:00:00+00:00",
         "livekit": {"token": "test-token"},
     }
 
-    # Verify participant remains in the lobby cache after acceptance
-    lobby_keys = cache.keys(f"mocked-cache-prefix_{room.id}_*")
-    assert len(lobby_keys) == 1
+    assert not cache.keys(f"mocked-cache-prefix_{room.id}_*")
+    assert not LobbyService()._index_members(room.id)
 
 
 def test_request_entry_invalid_data():
@@ -443,6 +444,7 @@ def test_allow_participant_to_enter_success(settings, allow_entry, updated_statu
             "status": "waiting",
             "username": "foo",
             "color": "123",
+            "entered_at": "2025-01-01T10:00:00+00:00",
         },
     )
 
@@ -578,6 +580,7 @@ def test_list_waiting_participants_success(settings):
             "username": "user1",
             "status": "waiting",
             "color": "#123456",
+            "entered_at": "2025-01-01T10:00:00+00:00",
         },
     )
     cache.set(
@@ -587,28 +590,35 @@ def test_list_waiting_participants_success(settings):
             "username": "user2",
             "status": "waiting",
             "color": "#654321",
+            "entered_at": "2025-01-01T10:05:00+00:00",
         },
     )
+    lobby_service = LobbyService()
+    lobby_service._index_add(room.id, "2f7f162f-e7d1-421b-90e7-02bfbfbf8def")
+    lobby_service._index_add(room.id, "f4ca3ab8a6c04ad88097b8da33f60f10")
 
     response = client.get(f"/api/v1.0/rooms/{room.id}/waiting-participants/")
 
     assert response.status_code == 200
 
-    participants = response.json().get("participants")
-    assert sorted(participants, key=lambda p: p["id"]) == [
-        {
-            "id": "2f7f162f-e7d1-421b-90e7-02bfbfbf8def",
-            "username": "user1",
-            "status": "waiting",
-            "color": "#123456",
-        },
-        {
-            "id": "f4ca3ab8a6c04ad88097b8da33f60f10",
-            "username": "user2",
-            "status": "waiting",
-            "color": "#654321",
-        },
-    ]
+    assert response.json() == {
+        "participants": [
+            {
+                "id": "f4ca3ab8a6c04ad88097b8da33f60f10",
+                "username": "user2",
+                "status": "waiting",
+                "color": "#654321",
+                "entered_at": "2025-01-01T10:05:00+00:00",
+            },
+            {
+                "id": "2f7f162f-e7d1-421b-90e7-02bfbfbf8def",
+                "username": "user1",
+                "status": "waiting",
+                "color": "#123456",
+                "entered_at": "2025-01-01T10:00:00+00:00",
+            },
+        ]
+    }
 
 
 def test_list_waiting_participants_empty(settings):
@@ -637,15 +647,14 @@ def test_list_waiting_participants_empty(settings):
 @mock.patch.object(
     utils, "generate_livekit_config", return_value={"token": "test-token"}
 )
-def test_request_entry_throttling_anonymous_without_cookie(
+def test_request_entry_throttling_anonymous_unidentified(
     mock_notify_participants, mock_generate_livekit_config, settings
 ):
-    """Anonymous users without a cookie should not be throttled."""
+    """Requests without a participant identifier should not be throttled."""
 
     room = RoomFactory(access_level=RoomAccessLevel.RESTRICTED)
     client = APIClient()
 
-    settings.LOBBY_COOKIE_NAME = "mocked-cookie"
     settings.REST_FRAMEWORK["DEFAULT_THROTTLE_RATES"]["request_entry"] = "1/minute"
 
     response = client.post(
@@ -654,9 +663,6 @@ def test_request_entry_throttling_anonymous_without_cookie(
     )
 
     assert response.status_code == 200
-    assert response.cookies.get("mocked-cookie") is not None
-
-    client.cookies.clear()  # Simulate a new cookieless request
 
     response = client.post(
         f"/api/v1.0/rooms/{room.id}/request-entry/",
@@ -670,34 +676,32 @@ def test_request_entry_throttling_anonymous_without_cookie(
 @mock.patch.object(
     utils, "generate_livekit_config", return_value={"token": "test-token"}
 )
-def test_request_entry_throttling_anonymous_with_cookie(
+def test_request_entry_throttling_anonymous_identified(
     mock_notify_participants, mock_generate_livekit_config, settings
 ):
-    """Anonymous users with a cookie should be throttled after exceeding the rate limit."""
+    """Identified requests should be throttled after exceeding the rate limit."""
     room = RoomFactory(access_level=RoomAccessLevel.RESTRICTED)
     client = APIClient()
 
-    settings.LOBBY_COOKIE_NAME = "mocked-cookie"
     settings.REST_FRAMEWORK["DEFAULT_THROTTLE_RATES"]["request_entry"] = "2/minute"
 
-    participant_id = str(uuid.uuid4())
-    client.cookies.load({"mocked-cookie": participant_id})
+    participant_id = _lobby_signer().sign(str(uuid.uuid4()))
 
     response = client.post(
         f"/api/v1.0/rooms/{room.id}/request-entry/",
-        {"username": "test_user"},
+        {"username": "test_user", "participant_id": participant_id},
     )
     assert response.status_code == 200
 
     response = client.post(
         f"/api/v1.0/rooms/{room.id}/request-entry/",
-        {"username": "test_user"},
+        {"username": "test_user", "participant_id": participant_id},
     )
     assert response.status_code == 200
 
     response = client.post(
         f"/api/v1.0/rooms/{room.id}/request-entry/",
-        {"username": "test_user"},
+        {"username": "test_user", "participant_id": participant_id},
     )
 
     assert response.status_code == 429
@@ -716,7 +720,6 @@ def test_request_entry_throttling_authenticated_user(
     client = APIClient()
     client.force_login(user)
 
-    settings.LOBBY_COOKIE_NAME = "mocked-cookie"
     settings.REST_FRAMEWORK["DEFAULT_THROTTLE_RATES"]["request_entry"] = "2/minute"
 
     response = client.post(
@@ -737,3 +740,237 @@ def test_request_entry_throttling_authenticated_user(
     )
 
     assert response.status_code == 429
+
+
+def test_request_entry_with_participant_id(settings):
+    """Echoing the previously issued identifier preserves the lobby identity across requests."""
+    room = RoomFactory(access_level=RoomAccessLevel.RESTRICTED)
+    client = APIClient()
+
+    settings.LOBBY_KEY_PREFIX = "mocked-cache-prefix"
+
+    with (
+        mock.patch.object(utils, "notify_participants", return_value=None),
+        mock.patch.object(utils, "generate_color", return_value="mocked-color"),
+    ):
+        response = client.post(
+            f"/api/v1.0/rooms/{room.id}/request-entry/",
+            {"username": "test_user"},
+        )
+
+        assert response.status_code == 200
+        participant_id = response.json()["id"]
+
+        # Echoing the identifier must be recognized as the same
+        # participant: no duplicate in the lobby
+        response = client.post(
+            f"/api/v1.0/rooms/{room.id}/request-entry/",
+            {"username": "test_user", "participant_id": participant_id},
+        )
+
+    assert response.status_code == 200
+    assert response.json()["id"] == participant_id
+    assert response.json()["status"] == "waiting"
+
+    lobby_keys = cache.keys(f"mocked-cache-prefix_{room.id}_*")
+    assert len(lobby_keys) == 1
+
+
+def test_request_entry_unknown_participant_id_not_seeded(settings):
+    """A valid signed credential with no cached record creates a new participant."""
+    room = RoomFactory(access_level=RoomAccessLevel.RESTRICTED)
+    client = APIClient()
+
+    settings.LOBBY_KEY_PREFIX = "mocked-cache-prefix"
+
+    forged_id = str(uuid.uuid4())
+
+    with (
+        mock.patch.object(utils, "notify_participants", return_value=None),
+        mock.patch.object(utils, "generate_color", return_value="mocked-color"),
+    ):
+        response = client.post(
+            f"/api/v1.0/rooms/{room.id}/request-entry/",
+            {
+                "username": "test_user",
+                "participant_id": _lobby_signer().sign(forged_id),
+            },
+        )
+
+    assert response.status_code == 200
+    assert _lobby_signer().unsign(response.json()["id"]) != forged_id
+
+    # Nothing was stored under the forged identifier
+    assert cache.get(f"mocked-cache-prefix_{room.id}_{forged_id}") is None
+
+
+def test_request_entry_participant_id_bound_to_room(settings):
+    """An identifier minted for one room must not be honored in another."""
+    room = RoomFactory(access_level=RoomAccessLevel.RESTRICTED)
+    other_room = RoomFactory(access_level=RoomAccessLevel.RESTRICTED)
+    client = APIClient()
+
+    with (
+        mock.patch.object(utils, "notify_participants", return_value=None),
+        mock.patch.object(utils, "generate_color", return_value="mocked-color"),
+    ):
+        response = client.post(
+            f"/api/v1.0/rooms/{room.id}/request-entry/",
+            {"username": "test_user"},
+        )
+        participant_id = response.json()["id"]
+
+        response = client.post(
+            f"/api/v1.0/rooms/{other_room.id}/request-entry/",
+            {"username": "test_user", "participant_id": participant_id},
+        )
+
+    assert response.status_code == 200
+    assert response.json()["id"] != participant_id
+
+
+def test_request_entry_legacy_cookie_ignored():
+    """The retired cookie channel must not be honored anymore."""
+    room = RoomFactory(access_level=RoomAccessLevel.RESTRICTED)
+    client = APIClient()
+
+    legacy_participant_id = str(uuid.uuid4())
+    client.cookies["lobbyParticipantId"] = legacy_participant_id
+
+    with (
+        mock.patch.object(utils, "notify_participants", return_value=None),
+        mock.patch.object(utils, "generate_color", return_value="mocked-color"),
+    ):
+        response = client.post(
+            f"/api/v1.0/rooms/{room.id}/request-entry/",
+            {"username": "test_user"},
+        )
+
+    assert response.status_code == 200
+    returned_id = response.json()["id"]
+    assert returned_id != legacy_participant_id
+    uuid.UUID(_lobby_signer().unsign(returned_id))
+
+
+def test_request_entry_malformed_participant_id(settings):
+    """A malformed polling credential is rejected with a 400."""
+    room = RoomFactory(access_level=RoomAccessLevel.RESTRICTED)
+    client = APIClient()
+
+    response = client.post(
+        f"/api/v1.0/rooms/{room.id}/request-entry/",
+        {"username": "test_user", "participant_id": "../../../evil-key"},
+    )
+
+    assert response.status_code == 400
+    assert "participant_id" in response.json()
+
+
+@mock.patch.object(utils, "notify_participants", return_value=None)
+@mock.patch.object(utils, "generate_livekit_config")
+def test_request_entry_rejects_unsigned_id(generate_config, _notify):
+    """Knowing the public UUID must not grant admission."""
+    room = RoomFactory(access_level=RoomAccessLevel.RESTRICTED)
+    client = APIClient()
+
+    response = client.post(
+        f"/api/v1.0/rooms/{room.id}/request-entry/", {"username": "Guest"}
+    )
+    assert response.status_code == 200
+    public_id = _lobby_signer().unsign(response.json()["id"])
+    LobbyService().handle_participant_entry(room.id, public_id, True)
+
+    response = APIClient().post(
+        f"/api/v1.0/rooms/{room.id}/request-entry/",
+        {"username": "Impersonator", "participant_id": public_id},
+    )
+
+    assert response.status_code == 400
+    assert "participant_id" in response.json()
+    generate_config.assert_not_called()
+
+
+@mock.patch.object(utils, "notify_participants", return_value=None)
+@mock.patch.object(utils, "generate_livekit_config")
+def test_request_entry_rejects_tampered_credential(generate_config, _notify):
+    """Modifying a signed credential must invalidate it."""
+    room = RoomFactory(access_level=RoomAccessLevel.RESTRICTED)
+    client = APIClient()
+
+    response = client.post(
+        f"/api/v1.0/rooms/{room.id}/request-entry/", {"username": "Guest"}
+    )
+    assert response.status_code == 200
+    credential = response.json()["id"]
+    public_id = _lobby_signer().unsign(credential)
+    LobbyService().handle_participant_entry(room.id, public_id, True)
+
+    response = APIClient().post(
+        f"/api/v1.0/rooms/{room.id}/request-entry/",
+        {"username": "Impersonator", "participant_id": credential + "x"},
+    )
+
+    assert response.status_code == 400
+    assert "participant_id" in response.json()
+    generate_config.assert_not_called()
+
+
+@mock.patch.object(utils, "notify_participants", return_value=None)
+@mock.patch.object(utils, "generate_livekit_config")
+def test_request_entry_rejects_wrong_signing_secret(generate_config, _notify):
+    """A credential signed with another secret must not grant admission."""
+    room = RoomFactory(access_level=RoomAccessLevel.RESTRICTED)
+    client = APIClient()
+
+    response = client.post(
+        f"/api/v1.0/rooms/{room.id}/request-entry/", {"username": "Guest"}
+    )
+    assert response.status_code == 200
+    public_id = _lobby_signer().unsign(response.json()["id"])
+    LobbyService().handle_participant_entry(room.id, public_id, True)
+
+    forged = signing.Signer(
+        key="incorrect-test-signing-secret",
+        salt="core.lobby.participant",
+        fallback_keys=[],
+    ).sign(public_id)
+
+    response = APIClient().post(
+        f"/api/v1.0/rooms/{room.id}/request-entry/",
+        {"username": "Impersonator", "participant_id": forged},
+    )
+
+    assert response.status_code == 400
+    assert "participant_id" in response.json()
+    generate_config.assert_not_called()
+
+
+@mock.patch.object(utils, "notify_participants", return_value=None)
+@mock.patch.object(
+    utils, "generate_livekit_config", return_value={"token": "test-token"}
+)
+def test_request_entry_accepts_signed_credential(generate_config, _notify):
+    """The signed credential grants admission using the public LiveKit UUID."""
+    room = RoomFactory(access_level=RoomAccessLevel.RESTRICTED)
+    client = APIClient()
+
+    response = client.post(
+        f"/api/v1.0/rooms/{room.id}/request-entry/", {"username": "Guest"}
+    )
+    assert response.status_code == 200
+    credential = response.json()["id"]
+    public_id = _lobby_signer().unsign(credential)
+    assert credential != public_id
+    LobbyService().handle_participant_entry(room.id, public_id, True)
+
+    response = client.post(
+        f"/api/v1.0/rooms/{room.id}/request-entry/",
+        {"username": "Guest", "participant_id": credential},
+    )
+
+    assert response.status_code == 200
+    assert response.json()["status"] == "accepted"
+    assert response.json()["id"] == credential
+    assert response.json()["livekit"] == {"token": "test-token"}
+    generate_config.assert_called_once()
+    assert generate_config.call_args.kwargs["participant_id"] == public_id

src/backend/core/tests/rooms/test_api_rooms_participants_management.py

@@ -5,13 +5,16 @@ Test rooms API endpoints in the Meet core app: participants management.
 # pylint: disable=redefined-outer-name,unused-argument,protected-access,no-name-in-module,too-many-lines
 
 import random
+from datetime import datetime, timedelta, timezone
 from unittest import mock
 from uuid import uuid4
 
+from django.conf import settings as django_settings
 from django.contrib.auth.models import AnonymousUser
 from django.core.exceptions import SuspiciousOperation
 from django.urls import reverse
 
+import jwt
 import pytest
 from livekit.api import TwirpError, UpdateParticipantRequest
 from livekit.protocol.models import ParticipantInfo
@@ -19,8 +22,18 @@ from rest_framework import status
 from rest_framework.test import APIClient
 
 from core import utils
-from core.factories import RoomFactory, UserFactory, UserResourceAccessFactory
-from core.services.lobby import LobbyService
+from core.factories import (
+    ApplicationFactory,
+    RoomFactory,
+    UserFactory,
+    UserResourceAccessFactory,
+)
+from core.models import ApplicationScope
+from core.services.lobby import (
+    LobbyParticipant,
+    LobbyParticipantStatus,
+    LobbyService,
+)
 
 pytestmark = pytest.mark.django_db
 
@@ -87,7 +100,7 @@ def test_mute_participant_with_livekit_token_for_this_room(mock_livekit_client):
         url,
         {"participant_identity": str(uuid4()), "track_sid": "test-track-sid"},
         format="json",
-        HTTP_AUTHORIZATION=f"Bearer {token}",
+        HTTP_AUTHORIZATION=f"X-LiveKit-Token {token}",
     )
 
     assert response.status_code == status.HTTP_200_OK
@@ -113,7 +126,7 @@ def test_mute_participant_with_livekit_token_for_another_room_forbidden(
         url,
         {"participant_identity": str(uuid4()), "track_sid": "test-track-sid"},
         format="json",
-        HTTP_AUTHORIZATION=f"Bearer {token}",
+        HTTP_AUTHORIZATION=f"X-LiveKit-Token {token}",
     )
 
     assert response.status_code == status.HTTP_403_FORBIDDEN
@@ -153,7 +166,7 @@ def test_mute_participant_everyone_can_mute_disabled_blocks_non_admin(
         url,
         {"participant_identity": str(uuid4()), "track_sid": "test-track-sid"},
         format="json",
-        HTTP_AUTHORIZATION=f"Bearer {token}",
+        HTTP_AUTHORIZATION=f"X-LiveKit-Token {token}",
     )
 
     assert response.status_code == status.HTTP_403_FORBIDDEN
@@ -300,7 +313,7 @@ def test_mute_participant_admin_with_token_for_this_room(mock_livekit_client):
         url,
         {"participant_identity": str(uuid4()), "track_sid": "test-track-sid"},
         format="json",
-        HTTP_AUTHORIZATION=f"Bearer {token}",
+        HTTP_AUTHORIZATION=f"X-LiveKit-Token {token}",
     )
 
     assert response.status_code == status.HTTP_200_OK
@@ -330,7 +343,7 @@ def test_mute_participant_admin_with_token_for_another_room(mock_livekit_client)
         url,
         {"participant_identity": str(uuid4()), "track_sid": "test-track-sid"},
         format="json",
-        HTTP_AUTHORIZATION=f"Bearer {token}",
+        HTTP_AUTHORIZATION=f"X-LiveKit-Token {token}",
     )
 
     assert response.status_code == status.HTTP_403_FORBIDDEN
@@ -361,7 +374,7 @@ def test_mute_participant_admin_token_replayed_does_not_grant_admin(
         url,
         {"participant_identity": str(uuid4()), "track_sid": "test-track-sid"},
         format="json",
-        HTTP_AUTHORIZATION=f"Bearer {token}",
+        HTTP_AUTHORIZATION=f"X-LiveKit-Token {token}",
     )
 
     assert response.status_code == status.HTTP_403_FORBIDDEN
@@ -381,7 +394,7 @@ def test_mute_participant_livekit_token_triggers_presence_check(mock_livekit_cli
         url,
         {"participant_identity": str(uuid4()), "track_sid": "test-track-sid"},
         format="json",
-        HTTP_AUTHORIZATION=f"Bearer {token}",
+        HTTP_AUTHORIZATION=f"X-LiveKit-Token {token}",
     )
 
     assert response.status_code == status.HTTP_200_OK
@@ -412,7 +425,7 @@ def test_mute_participant_livekit_token_presence_check_returns_participant(
         url,
         {"participant_identity": str(uuid4()), "track_sid": "test-track-sid"},
         format="json",
-        HTTP_AUTHORIZATION=f"Bearer {token}",
+        HTTP_AUTHORIZATION=f"X-LiveKit-Token {token}",
     )
 
     assert response.status_code == status.HTTP_200_OK
@@ -440,7 +453,7 @@ def test_mute_participant_livekit_token_presence_check_participant_not_found(
         url,
         {"participant_identity": str(uuid4()), "track_sid": "test-track-sid"},
         format="json",
-        HTTP_AUTHORIZATION=f"Bearer {token}",
+        HTTP_AUTHORIZATION=f"X-LiveKit-Token {token}",
     )
 
     assert response.status_code == status.HTTP_403_FORBIDDEN
@@ -469,7 +482,7 @@ def test_mute_participant_livekit_token_presence_check_twirp_error_forbidden(
         url,
         {"participant_identity": str(uuid4()), "track_sid": "test-track-sid"},
         format="json",
-        HTTP_AUTHORIZATION=f"Bearer {token}",
+        HTTP_AUTHORIZATION=f"X-LiveKit-Token {token}",
     )
 
     assert response.status_code == status.HTTP_403_FORBIDDEN
@@ -849,7 +862,16 @@ def test_remove_participant_success_lobby_cache(mock_livekit_client):
     participant_identity = str(uuid4())
 
     # Create participant in lobby cache first
-    LobbyService().enter(room.id, participant_identity, "John doe")
+    LobbyService()._save_participant(
+        room.id,
+        LobbyParticipant(
+            id=participant_identity,
+            username="John doe",
+            status=LobbyParticipantStatus.WAITING,
+            color="#123456",
+            entered_at="2025-01-01T10:00:00+00:00",
+        ),
+    )
 
     # Accept participant
     LobbyService().handle_participant_entry(room.id, participant_identity, True)
@@ -1020,3 +1042,142 @@ def test_remove_participant_not_found(mock_livekit_client):
     assert response.data == {"error": "Participant not found"}
 
     mock_livekit_client.aclose.assert_called_once()
+
+
+def generate_user_access_token(user):
+    """Generate a valid user access JWT signed with the token secret."""
+    now = datetime.now(timezone.utc)
+    application = ApplicationFactory(scopes=[ApplicationScope.USERS_SESSION])
+
+    payload = {
+        "iss": django_settings.USER_ACCESS_TOKEN_ISSUER,
+        "aud": django_settings.USER_ACCESS_TOKEN_AUDIENCE,
+        "iat": now,
+        "exp": now + timedelta(seconds=django_settings.USER_ACCESS_TOKEN_TTL),
+        "user_id": str(user.id),
+        "token_type": "user_access",
+        "client_id": application.client_id,
+        "scope": "user:access",
+    }
+
+    return jwt.encode(
+        payload,
+        django_settings.USER_ACCESS_TOKEN_SECRET_KEY,
+        algorithm=django_settings.USER_ACCESS_TOKEN_ALG,
+    )
+
+
+def test_mute_participant_bearer_scheme_defers_to_next_authentication(
+    mock_livekit_client,
+):
+    """Should defer a "Bearer" header to the next authentication backend.
+
+    The LiveKit backend only claims the "X-LiveKit-Token" scheme. Any other
+    scheme must be left untouched so the backends declared after it get a
+    chance to authenticate the request.
+    """
+    client = APIClient()
+    room = RoomFactory()
+    user = UserFactory()
+    UserResourceAccessFactory(
+        resource=room, user=user, role=random.choice(["administrator", "owner"])
+    )
+    client.credentials(HTTP_AUTHORIZATION=f"Bearer {generate_user_access_token(user)}")
+
+    url = reverse("rooms-mute-participant", kwargs={"pk": room.id})
+    response = client.post(
+        url,
+        {"participant_identity": str(uuid4()), "track_sid": "test-track-sid"},
+        format="json",
+    )
+
+    assert response.status_code == status.HTTP_200_OK
+    assert response.data == {"status": "success"}
+
+    mock_livekit_client.room.get_participant.assert_not_called()
+    mock_livekit_client.room.mute_published_track.assert_called_once()
+
+
+def test_mute_participant_bearer_scheme_defers_role_permissions_still_apply(
+    mock_livekit_client,
+):
+    """Should still enforce room privileges once another backend authenticated."""
+    client = APIClient()
+    room = RoomFactory(configuration={"everyone_can_mute": False})
+    user = UserFactory()  # no UserResourceAccess for this room
+    client.credentials(HTTP_AUTHORIZATION=f"Bearer {generate_user_access_token(user)}")
+
+    url = reverse("rooms-mute-participant", kwargs={"pk": room.id})
+    response = client.post(
+        url,
+        {"participant_identity": str(uuid4()), "track_sid": "test-track-sid"},
+        format="json",
+    )
+
+    assert response.status_code == status.HTTP_403_FORBIDDEN
+    mock_livekit_client.room.mute_published_track.assert_not_called()
+
+
+def test_mute_participant_unknown_scheme_defers_and_stays_anonymous(
+    mock_livekit_client,
+):
+    """Should leave the request unauthenticated when no backend claims the scheme."""
+    client = APIClient()
+    room = RoomFactory()
+
+    url = reverse("rooms-mute-participant", kwargs={"pk": room.id})
+    response = client.post(
+        url,
+        {"participant_identity": str(uuid4()), "track_sid": "test-track-sid"},
+        format="json",
+        HTTP_AUTHORIZATION="Basic dXNlcjpwYXNzd29yZA==",
+    )
+
+    assert response.status_code == status.HTTP_403_FORBIDDEN
+    mock_livekit_client.room.mute_published_track.assert_not_called()
+
+
+def test_mute_participant_livekit_scheme_is_case_insensitive(mock_livekit_client):
+    """Should claim the LiveKit scheme whatever its casing, and not defer it."""
+    client = APIClient()
+    room = RoomFactory()
+
+    token = utils.generate_token(str(room.id), AnonymousUser())
+
+    url = reverse("rooms-mute-participant", kwargs={"pk": room.id})
+    response = client.post(
+        url,
+        {"participant_identity": str(uuid4()), "track_sid": "test-track-sid"},
+        format="json",
+        HTTP_AUTHORIZATION=f"x-livekit-token {token}",
+    )
+
+    assert response.status_code == status.HTTP_200_OK
+    assert response.data == {"status": "success"}
+
+    mock_livekit_client.room.get_participant.assert_called_once()
+    mock_livekit_client.room.mute_published_track.assert_called_once()
+
+
+def test_mute_participant_livekit_scheme_malformed_header_is_rejected(
+    mock_livekit_client,
+):
+    """Should reject a malformed header once the LiveKit scheme is claimed."""
+    client = APIClient()
+    room = RoomFactory()
+
+    token = utils.generate_token(str(room.id), AnonymousUser())
+
+    url = reverse("rooms-mute-participant", kwargs={"pk": room.id})
+    response = client.post(
+        url,
+        {"participant_identity": str(uuid4()), "track_sid": "test-track-sid"},
+        format="json",
+        HTTP_AUTHORIZATION=f"X-LiveKit-Token {token} extra-part",
+    )
+
+    assert response.status_code == status.HTTP_403_FORBIDDEN
+    assert response.data == {
+        "detail": "Authorization header must be: X-LiveKit-Token <token>"
+    }
+    mock_livekit_client.room.mute_published_track.assert_not_called()

src/backend/core/tests/rooms/test_api_rooms_rename_toggle.py

@@ -4,12 +4,15 @@ Test rooms API endpoints: toggle hand and rename participant.
 
 # pylint: disable=redefined-outer-name,unused-argument,protected-access
 
+from datetime import datetime, timedelta, timezone
 from unittest import mock
 from uuid import uuid4
 
+from django.conf import settings as django_settings
 from django.contrib.auth.models import AnonymousUser
 from django.urls import reverse
 
+import jwt
 import pytest
 from freezegun import freeze_time
 from livekit.api import TwirpError
@@ -17,7 +20,13 @@ from rest_framework import status
 from rest_framework.test import APIClient
 
 from core import utils
-from core.factories import RoomFactory, UserFactory
+from core.factories import (
+    ApplicationFactory,
+    RoomFactory,
+    UserFactory,
+    UserResourceAccessFactory,
+)
+from core.models import ApplicationScope
 
 pytestmark = pytest.mark.django_db
 
@@ -69,7 +78,10 @@ def test_toggle_hand_raise_success(mock_livekit_client, room, token):
     client = APIClient()
     url = reverse("rooms-toggle-hand", kwargs={"pk": room.id})
     response = client.post(
-        url, {"raised": True}, format="json", HTTP_AUTHORIZATION=f"Bearer {token}"
+        url,
+        {"raised": True},
+        format="json",
+        HTTP_AUTHORIZATION=f"X-LiveKit-token {token}",
     )
 
     assert response.status_code == status.HTTP_200_OK
@@ -84,7 +96,10 @@ def test_toggle_hand_lower_success(mock_livekit_client, room, token):
     client = APIClient()
     url = reverse("rooms-toggle-hand", kwargs={"pk": room.id})
     response = client.post(
-        url, {"raised": False}, format="json", HTTP_AUTHORIZATION=f"Bearer {token}"
+        url,
+        {"raised": False},
+        format="json",
+        HTTP_AUTHORIZATION=f"X-LiveKit-Token {token}",
     )
 
     assert response.status_code == status.HTTP_200_OK
@@ -101,7 +116,10 @@ def test_toggle_hand_raise_sets_timestamp(mock_livekit_client, room, token):
     client = APIClient()
     url = reverse("rooms-toggle-hand", kwargs={"pk": room.id})
     response = client.post(
-        url, {"raised": True}, format="json", HTTP_AUTHORIZATION=f"Bearer {token}"
+        url,
+        {"raised": True},
+        format="json",
+        HTTP_AUTHORIZATION=f"X-LiveKit-Token {token}",
     )
 
     assert response.status_code == status.HTTP_200_OK
@@ -117,7 +135,10 @@ def test_toggle_hand_identity_derived_from_token(
     client = APIClient()
     url = reverse("rooms-toggle-hand", kwargs={"pk": room.id})
     client.post(
-        url, {"raised": True}, format="json", HTTP_AUTHORIZATION=f"Bearer {token}"
+        url,
+        {"raised": True},
+        format="json",
+        HTTP_AUTHORIZATION=f"X-LiveKit-Token {token}",
     )
 
     call_kwargs = mock_livekit_client.room.update_participant.call_args
@@ -128,7 +149,9 @@ def test_toggle_hand_missing_raised_field(room, token):
     """Test toggle hand with missing raised field returns 400."""
     client = APIClient()
     url = reverse("rooms-toggle-hand", kwargs={"pk": room.id})
-    response = client.post(url, {}, format="json", HTTP_AUTHORIZATION=f"Bearer {token}")
+    response = client.post(
+        url, {}, format="json", HTTP_AUTHORIZATION=f"X-LiveKit-Token {token}"
+    )
 
     assert response.status_code == status.HTTP_400_BAD_REQUEST
     assert "raised" in response.data
@@ -142,7 +165,7 @@ def test_toggle_hand_invalid_raised_field(room, token):
         url,
         {"raised": "not-a-boolean"},
         format="json",
-        HTTP_AUTHORIZATION=f"Bearer {token}",
+        HTTP_AUTHORIZATION=f"X-LiveKit-Token {token}",
     )
 
     assert response.status_code == status.HTTP_400_BAD_REQUEST
@@ -166,7 +189,10 @@ def test_toggle_hand_forbidden_token_for_wrong_room(user):
     client = APIClient()
     url = reverse("rooms-toggle-hand", kwargs={"pk": target_room.id})
     response = client.post(
-        url, {"raised": True}, format="json", HTTP_AUTHORIZATION=f"Bearer {wrong_token}"
+        url,
+        {"raised": True},
+        format="json",
+        HTTP_AUTHORIZATION=f"X-LiveKit-Token {wrong_token}",
     )
 
     assert response.status_code == status.HTTP_403_FORBIDDEN
@@ -181,7 +207,10 @@ def test_toggle_hand_unexpected_twirp_error(mock_livekit_client, room, token):
     client = APIClient()
     url = reverse("rooms-toggle-hand", kwargs={"pk": room.id})
     response = client.post(
-        url, {"raised": True}, format="json", HTTP_AUTHORIZATION=f"Bearer {token}"
+        url,
+        {"raised": True},
+        format="json",
+        HTTP_AUTHORIZATION=f"X-LiveKit-Token {token}",
     )
 
     assert response.status_code == status.HTTP_500_INTERNAL_SERVER_ERROR
@@ -200,7 +229,7 @@ def test_toggle_hand_raise_success_anonymous(
         url,
         {"raised": True},
         format="json",
-        HTTP_AUTHORIZATION=f"Bearer {anonymous_token}",
+        HTTP_AUTHORIZATION=f"X-LiveKit-Token {anonymous_token}",
     )
 
     assert response.status_code == status.HTTP_200_OK
@@ -220,7 +249,7 @@ def test_toggle_hand_lower_success_anonymous(
         url,
         {"raised": False},
         format="json",
-        HTTP_AUTHORIZATION=f"Bearer {anonymous_token}",
+        HTTP_AUTHORIZATION=f"X-LiveKit-Token {anonymous_token}",
     )
 
     assert response.status_code == status.HTTP_200_OK
@@ -240,7 +269,7 @@ def test_toggle_hand_identity_derived_from_token_anonymous(
         url,
         {"raised": True},
         format="json",
-        HTTP_AUTHORIZATION=f"Bearer {anonymous_token}",
+        HTTP_AUTHORIZATION=f"X-LiveKit-Token {anonymous_token}",
     )
 
     call_kwargs = mock_livekit_client.room.update_participant.call_args
@@ -257,7 +286,10 @@ def test_rename_participant_success(mock_livekit_client, room, token):
     client = APIClient()
     url = reverse("rooms-rename", kwargs={"pk": room.id})
     response = client.post(
-        url, {"name": "John Doe"}, format="json", HTTP_AUTHORIZATION=f"Bearer {token}"
+        url,
+        {"name": "John Doe"},
+        format="json",
+        HTTP_AUTHORIZATION=f"X-LiveKit-Token {token}",
     )
 
     assert response.status_code == status.HTTP_200_OK
@@ -272,7 +304,10 @@ def test_rename_participant_sets_correct_name(mock_livekit_client, room, token):
     client = APIClient()
     url = reverse("rooms-rename", kwargs={"pk": room.id})
     client.post(
-        url, {"name": "Jane Doe"}, format="json", HTTP_AUTHORIZATION=f"Bearer {token}"
+        url,
+        {"name": "Jane Doe"},
+        format="json",
+        HTTP_AUTHORIZATION=f"X-LiveKit-Token {token}",
     )
 
     call_kwargs = mock_livekit_client.room.update_participant.call_args
@@ -286,7 +321,10 @@ def test_rename_participant_uses_identity_from_token(
     client = APIClient()
     url = reverse("rooms-rename", kwargs={"pk": room.id})
     client.post(
-        url, {"name": "John Doe"}, format="json", HTTP_AUTHORIZATION=f"Bearer {token}"
+        url,
+        {"name": "John Doe"},
+        format="json",
+        HTTP_AUTHORIZATION=f"X-LiveKit-Token {token}",
     )
 
     call_kwargs = mock_livekit_client.room.update_participant.call_args
@@ -298,7 +336,7 @@ def test_rename_participant_empty_name(room, token):
     client = APIClient()
     url = reverse("rooms-rename", kwargs={"pk": room.id})
     response = client.post(
-        url, {"name": ""}, format="json", HTTP_AUTHORIZATION=f"Bearer {token}"
+        url, {"name": ""}, format="json", HTTP_AUTHORIZATION=f"X-LiveKit-Token {token}"
     )
 
     assert response.status_code == status.HTTP_400_BAD_REQUEST
@@ -309,7 +347,9 @@ def test_rename_participant_missing_name(room, token):
     """Test rename with missing name field returns 400."""
     client = APIClient()
     url = reverse("rooms-rename", kwargs={"pk": room.id})
-    response = client.post(url, {}, format="json", HTTP_AUTHORIZATION=f"Bearer {token}")
+    response = client.post(
+        url, {}, format="json", HTTP_AUTHORIZATION=f"X-LiveKit-Token {token}"
+    )
 
     assert response.status_code == status.HTTP_400_BAD_REQUEST
     assert "name" in response.data
@@ -320,7 +360,10 @@ def test_rename_participant_name_too_long(room, token):
     client = APIClient()
     url = reverse("rooms-rename", kwargs={"pk": room.id})
     response = client.post(
-        url, {"name": "a" * 256}, format="json", HTTP_AUTHORIZATION=f"Bearer {token}"
+        url,
+        {"name": "a" * 256},
+        format="json",
+        HTTP_AUTHORIZATION=f"X-LiveKit-Token {token}",
     )
 
     assert response.status_code == status.HTTP_400_BAD_REQUEST
@@ -348,7 +391,7 @@ def test_rename_participant_forbidden_token_for_wrong_room(user):
         url,
         {"name": "John Doe"},
         format="json",
-        HTTP_AUTHORIZATION=f"Bearer {wrong_token}",
+        HTTP_AUTHORIZATION=f"X-LiveKit-Token {wrong_token}",
     )
 
     assert response.status_code == status.HTTP_403_FORBIDDEN
@@ -363,7 +406,10 @@ def test_rename_participant_unexpected_twirp_error(mock_livekit_client, room, to
     client = APIClient()
     url = reverse("rooms-rename", kwargs={"pk": room.id})
     response = client.post(
-        url, {"name": "John Doe"}, format="json", HTTP_AUTHORIZATION=f"Bearer {token}"
+        url,
+        {"name": "John Doe"},
+        format="json",
+        HTTP_AUTHORIZATION=f"X-LiveKit-Token {token}",
     )
 
     assert response.status_code == status.HTTP_500_INTERNAL_SERVER_ERROR
@@ -372,6 +418,73 @@ def test_rename_participant_unexpected_twirp_error(mock_livekit_client, room, to
     mock_livekit_client.aclose.assert_called_once()
 
 
+@pytest.mark.parametrize("name", ["John Doe", "Admin", "Room Owner"])
+def test_rename_participant_forbidden_when_display_name_edit_disabled(
+    mock_livekit_client, settings, room, token, name
+):
+    """
+    Test rename is rejected for authenticated users when the self-hoster
+    disables AUTHENTICATED_PARTICIPANTS_CAN_EDIT_DISPLAY_NAME.
+    """
+    settings.AUTHENTICATED_PARTICIPANTS_CAN_EDIT_DISPLAY_NAME = False
+
+    client = APIClient()
+    url = reverse("rooms-rename", kwargs={"pk": room.id})
+    response = client.post(
+        url,
+        {"name": name},
+        format="json",
+        HTTP_AUTHORIZATION=f"X-LiveKit-Token {token}",
+    )
+
+    assert response.status_code == status.HTTP_403_FORBIDDEN
+    assert response.data == {
+        "error": "Authenticated participants cannot edit their display name"
+    }
+    mock_livekit_client.room.update_participant.assert_not_called()
+
+
+def test_rename_participant_allowed_when_display_name_edit_enabled(
+    mock_livekit_client, settings, room, token
+):
+    """Test rename still works for authenticated users when the setting is enabled."""
+    settings.AUTHENTICATED_PARTICIPANTS_CAN_EDIT_DISPLAY_NAME = True
+
+    client = APIClient()
+    url = reverse("rooms-rename", kwargs={"pk": room.id})
+    response = client.post(
+        url,
+        {"name": "John Doe"},
+        format="json",
+        HTTP_AUTHORIZATION=f"X-LiveKit-Token {token}",
+    )
+
+    assert response.status_code == status.HTTP_200_OK
+    mock_livekit_client.room.update_participant.assert_called_once()
+
+
+def test_rename_participant_anonymous_allowed_when_display_name_edit_disabled(
+    mock_livekit_client, settings, room, anonymous_token
+):
+    """
+    Test the setting only restricts authenticated users: anonymous participants
+    have no account name to fall back on and can still rename themselves.
+    """
+    settings.AUTHENTICATED_PARTICIPANTS_CAN_EDIT_DISPLAY_NAME = False
+
+    client = APIClient()
+    url = reverse("rooms-rename", kwargs={"pk": room.id})
+    response = client.post(
+        url,
+        {"name": "Guest User"},
+        format="json",
+        HTTP_AUTHORIZATION=f"X-LiveKit-Token {anonymous_token}",
+    )
+
+    assert response.status_code == status.HTTP_200_OK
+    mock_livekit_client.room.update_participant.assert_called_once()
+
+
 def test_rename_participant_success_anonymous(
     mock_livekit_client, room, anonymous_token
 ):
@@ -382,7 +495,7 @@ def test_rename_participant_success_anonymous(
         url,
         {"name": "Guest User"},
         format="json",
-        HTTP_AUTHORIZATION=f"Bearer {anonymous_token}",
+        HTTP_AUTHORIZATION=f"X-LiveKit-Token {anonymous_token}",
     )
 
     assert response.status_code == status.HTTP_200_OK
@@ -402,7 +515,7 @@ def test_rename_participant_uses_identity_from_token_anonymous(
         url,
         {"name": "Guest User"},
         format="json",
-        HTTP_AUTHORIZATION=f"Bearer {anonymous_token}",
+        HTTP_AUTHORIZATION=f"X-LiveKit-Token {anonymous_token}",
     )
 
     call_kwargs = mock_livekit_client.room.update_participant.call_args
@@ -419,7 +532,7 @@ def test_rename_participant_sets_correct_name_anonymous(
         url,
         {"name": "Guest User"},
         format="json",
-        HTTP_AUTHORIZATION=f"Bearer {anonymous_token}",
+        HTTP_AUTHORIZATION=f"X-LiveKit-Token {anonymous_token}",
     )
 
     call_kwargs = mock_livekit_client.room.update_participant.call_args
@@ -436,7 +549,7 @@ def test_rename_participant_forbidden_anonymous_token_for_wrong_room(anonymous_t
         url,
         {"name": "Guest User"},
         format="json",
-        HTTP_AUTHORIZATION=f"Bearer {anonymous_token}",
+        HTTP_AUTHORIZATION=f"X-LiveKit-Token {anonymous_token}",
     )
 
     assert response.status_code == status.HTTP_403_FORBIDDEN
@@ -462,7 +575,7 @@ def test_toggle_hand_expired_token(room, expired_token):
         url,
         {"raised": True},
         format="json",
-        HTTP_AUTHORIZATION=f"Bearer {expired_token}",
+        HTTP_AUTHORIZATION=f"X-LiveKit-Token {expired_token}",
     )
 
     assert response.status_code == status.HTTP_403_FORBIDDEN
@@ -476,7 +589,7 @@ def test_rename_participant_expired_token(room, expired_token):
         url,
         {"name": "John Doe"},
         format="json",
-        HTTP_AUTHORIZATION=f"Bearer {expired_token}",
+        HTTP_AUTHORIZATION=f"X-LiveKit-Token {expired_token}",
     )
 
     assert response.status_code == status.HTTP_403_FORBIDDEN
@@ -490,7 +603,7 @@ def test_toggle_hand_malformed_token(room):
         url,
         {"raised": True},
         format="json",
-        HTTP_AUTHORIZATION="Bearer this-is-not-a-valid-jwt",
+        HTTP_AUTHORIZATION="X-LiveKit-Token this-is-not-a-valid-jwt",
     )
 
     assert response.status_code == status.HTTP_403_FORBIDDEN
@@ -504,7 +617,10 @@ def test_toggle_hand_room_not_found(user):
     client = APIClient()
     url = reverse("rooms-toggle-hand", kwargs={"pk": non_existent_room_id})
     response = client.post(
-        url, {"raised": True}, format="json", HTTP_AUTHORIZATION=f"Bearer {token}"
+        url,
+        {"raised": True},
+        format="json",
+        HTTP_AUTHORIZATION=f"X-LiveKit-Token {token}",
     )
 
     assert response.status_code == status.HTTP_404_NOT_FOUND
@@ -519,7 +635,10 @@ def test_toggle_hand_participant_not_found(mock_livekit_client, room, token):
     client = APIClient()
     url = reverse("rooms-toggle-hand", kwargs={"pk": room.id})
     response = client.post(
-        url, {"raised": True}, format="json", HTTP_AUTHORIZATION=f"Bearer {token}"
+        url,
+        {"raised": True},
+        format="json",
+        HTTP_AUTHORIZATION=f"X-LiveKit-Token {token}",
     )
 
     assert response.status_code == status.HTTP_404_NOT_FOUND
@@ -536,7 +655,7 @@ def test_rename_participant_malformed_token(room):
         url,
         {"name": "John Doe"},
         format="json",
-        HTTP_AUTHORIZATION="Bearer this-is-not-a-valid-jwt",
+        HTTP_AUTHORIZATION="X-LiveKit-Token this-is-not-a-valid-jwt",
     )
 
     assert response.status_code == status.HTTP_403_FORBIDDEN
@@ -550,7 +669,10 @@ def test_rename_participant_room_not_found(user):
     client = APIClient()
     url = reverse("rooms-rename", kwargs={"pk": non_existent_room_id})
     response = client.post(
-        url, {"name": "John Doe"}, format="json", HTTP_AUTHORIZATION=f"Bearer {token}"
+        url,
+        {"name": "John Doe"},
+        format="json",
+        HTTP_AUTHORIZATION=f"X-LiveKit-Token {token}",
     )
 
     assert response.status_code == status.HTTP_404_NOT_FOUND
@@ -565,10 +687,206 @@ def test_rename_participant_not_found(mock_livekit_client, room, token):
     client = APIClient()
     url = reverse("rooms-rename", kwargs={"pk": room.id})
     response = client.post(
-        url, {"name": "John Doe"}, format="json", HTTP_AUTHORIZATION=f"Bearer {token}"
+        url,
+        {"name": "John Doe"},
+        format="json",
+        HTTP_AUTHORIZATION=f"X-LiveKit-Token {token}",
     )
 
     assert response.status_code == status.HTTP_404_NOT_FOUND
     assert response.data == {"error": "Participant not found"}
 
     mock_livekit_client.aclose.assert_called_once()
+
+
+@pytest.fixture
+def user_access_token(user):
+    """Generate a valid user access JWT, sent with the "X-LiveKit-Token" scheme."""
+    now = datetime.now(timezone.utc)
+    application = ApplicationFactory(scopes=[ApplicationScope.USERS_SESSION])
+
+    payload = {
+        "iss": django_settings.USER_ACCESS_TOKEN_ISSUER,
+        "aud": django_settings.USER_ACCESS_TOKEN_AUDIENCE,
+        "iat": now,
+        "exp": now + timedelta(seconds=django_settings.USER_ACCESS_TOKEN_TTL),
+        "user_id": str(user.id),
+        "token_type": "user_access",
+        "client_id": application.client_id,
+        "scope": "user:access",
+    }
+
+    return jwt.encode(
+        payload,
+        django_settings.USER_ACCESS_TOKEN_SECRET_KEY,
+        algorithm=django_settings.USER_ACCESS_TOKEN_ALG,
+    )
+
+
+def test_toggle_hand_bearer_scheme_defers_to_next_authentication(
+    mock_livekit_client, room, user, user_access_token
+):
+    """Test toggle hand defers a "Bearer" header instead of failing on it."""
+    UserResourceAccessFactory(resource=room, user=user, role="owner")
+
+    client = APIClient()
+    url = reverse("rooms-toggle-hand", kwargs={"pk": room.id})
+    response = client.post(
+        url,
+        {"raised": True},
+        format="json",
+        HTTP_AUTHORIZATION=f"Bearer {user_access_token}",
+    )
+
+    assert response.status_code == status.HTTP_403_FORBIDDEN
+    assert response.data == {"detail": "Authentication credentials were not provided."}
+
+    mock_livekit_client.room.update_participant.assert_not_called()
+
+
+def test_rename_participant_bearer_scheme_defers_to_next_authentication(
+    mock_livekit_client, room, user, user_access_token
+):
+    """Test rename defers a "Bearer" header instead of failing on it."""
+    UserResourceAccessFactory(resource=room, user=user, role="owner")
+
+    client = APIClient()
+    url = reverse("rooms-rename", kwargs={"pk": room.id})
+    response = client.post(
+        url,
+        {"name": "John Doe"},
+        format="json",
+        HTTP_AUTHORIZATION=f"Bearer {user_access_token}",
+    )
+
+    assert response.status_code == status.HTTP_403_FORBIDDEN
+    assert response.data == {"detail": "Authentication credentials were not provided."}
+
+    mock_livekit_client.room.update_participant.assert_not_called()
+
+
+def test_toggle_hand_unknown_scheme_defers(mock_livekit_client, room):
+    """Test toggle hand defers a scheme no backend recognizes."""
+    client = APIClient()
+    url = reverse("rooms-toggle-hand", kwargs={"pk": room.id})
+    response = client.post(
+        url,
+        {"raised": True},
+        format="json",
+        HTTP_AUTHORIZATION="Basic dXNlcjpwYXNzd29yZA==",
+    )
+
+    assert response.status_code == status.HTTP_403_FORBIDDEN
+    assert response.data == {"detail": "Authentication credentials were not provided."}
+
+    mock_livekit_client.room.update_participant.assert_not_called()
+
+
+def test_rename_participant_unknown_scheme_defers(mock_livekit_client, room):
+    """Test rename defers a scheme no backend recognizes."""
+    client = APIClient()
+    url = reverse("rooms-rename", kwargs={"pk": room.id})
+    response = client.post(
+        url,
+        {"name": "John Doe"},
+        format="json",
+        HTTP_AUTHORIZATION="Basic dXNlcjpwYXNzd29yZA==",
+    )
+
+    assert response.status_code == status.HTTP_403_FORBIDDEN
+    assert response.data == {"detail": "Authentication credentials were not provided."}
+
+    mock_livekit_client.room.update_participant.assert_not_called()
+
+
+def test_toggle_hand_session_authentication_is_not_accepted(
+    mock_livekit_client, room, user
+):
+    """Test toggle hand is not granted by a session, whatever the user's room role."""
+    UserResourceAccessFactory(resource=room, user=user, role="owner")
+
+    client = APIClient()
+    client.force_authenticate(user=user)
+
+    url = reverse("rooms-toggle-hand", kwargs={"pk": room.id})
+    response = client.post(url, {"raised": True}, format="json")
+
+    assert response.status_code == status.HTTP_403_FORBIDDEN
+    mock_livekit_client.room.update_participant.assert_not_called()
+
+
+def test_rename_participant_session_authentication_is_not_accepted(
+    mock_livekit_client, room, user
+):
+    """Test rename is not granted by a session, whatever the user's room role."""
+    UserResourceAccessFactory(resource=room, user=user, role="owner")
+
+    client = APIClient()
+    client.force_authenticate(user=user)
+
+    url = reverse("rooms-rename", kwargs={"pk": room.id})
+    response = client.post(url, {"name": "John Doe"}, format="json")
+
+    assert response.status_code == status.HTTP_403_FORBIDDEN
+    mock_livekit_client.room.update_participant.assert_not_called()
+
+
+def test_rename_participant_livekit_scheme_is_case_insensitive(
+    mock_livekit_client, room, token
+):
+    """Test rename claims the LiveKit scheme whatever its casing."""
+    client = APIClient()
+    url = reverse("rooms-rename", kwargs={"pk": room.id})
+    response = client.post(
+        url,
+        {"name": "John Doe"},
+        format="json",
+        HTTP_AUTHORIZATION=f"x-livekit-token {token}",
+    )
+
+    assert response.status_code == status.HTTP_200_OK
+    assert response.data == {"status": "success"}
+
+    mock_livekit_client.room.update_participant.assert_called_once()
+
+
+def test_toggle_hand_livekit_scheme_malformed_header_is_rejected(
+    mock_livekit_client, room, token
+):
+    """Test toggle hand rejects a malformed header once the LiveKit scheme is claimed."""
+    client = APIClient()
+    url = reverse("rooms-toggle-hand", kwargs={"pk": room.id})
+    response = client.post(
+        url,
+        {"raised": True},
+        format="json",
+        HTTP_AUTHORIZATION=f"X-LiveKit-Token {token} extra-part",
+    )
+
+    assert response.status_code == status.HTTP_403_FORBIDDEN
+    assert response.data == {
+        "detail": "Authorization header must be: X-LiveKit-Token <token>"
+    }
+
+    mock_livekit_client.room.update_participant.assert_not_called()
+
+
+def test_rename_participant_livekit_scheme_malformed_header_is_rejected(
+    mock_livekit_client, room, token
+):
+    """Test rename rejects a malformed header once the LiveKit scheme is claimed."""
+    client = APIClient()
+    url = reverse("rooms-rename", kwargs={"pk": room.id})
+    response = client.post(
+        url,
+        {"name": "John Doe"},
+        format="json",
+        HTTP_AUTHORIZATION=f"X-LiveKit-Token {token} extra-part",
+    )
+
+    assert response.status_code == status.HTTP_403_FORBIDDEN
+    assert response.data == {
+        "detail": "Authorization header must be: X-LiveKit-Token <token>"
+    }
+
+    mock_livekit_client.room.update_participant.assert_not_called()

src/backend/core/tests/rooms/test_api_rooms_retrieve.py

@@ -3,16 +3,24 @@ Test rooms API endpoints in the Meet core app: retrieve.
 """
 
 import random
+from datetime import datetime, timedelta, timezone
 from unittest import mock
 
+from django.conf import settings as django_settings
 from django.contrib.auth.models import AnonymousUser
 from django.test.utils import override_settings
 
+import jwt
 import pytest
 from rest_framework.test import APIClient
 
-from ...factories import RoomFactory, UserFactory, UserResourceAccessFactory
-from ...models import RoleChoices, RoomAccessLevel
+from ...factories import (
+    ApplicationFactory,
+    RoomFactory,
+    UserFactory,
+    UserResourceAccessFactory,
+)
+from ...models import ApplicationScope, RoleChoices, RoomAccessLevel
 
 pytestmark = pytest.mark.django_db
 
@@ -507,3 +515,41 @@ def test_api_rooms_retrieve_administrators(
         role=str(user_access.role),
         participant_id=None,
     )
+
+
+def generate_user_access_token(user):
+    """Generate a valid user access JWT signed with the token secret."""
+    now = datetime.now(timezone.utc)
+    application = ApplicationFactory(scopes=[ApplicationScope.USERS_SESSION])
+
+    payload = {
+        "iss": django_settings.USER_ACCESS_TOKEN_ISSUER,
+        "aud": django_settings.USER_ACCESS_TOKEN_AUDIENCE,
+        "iat": now,
+        "exp": now + timedelta(seconds=django_settings.USER_ACCESS_TOKEN_TTL),
+        "user_id": str(user.id),
+        "token_type": "user_access",
+        "client_id": application.client_id,
+        "scope": "user:access",
+    }
+
+    return jwt.encode(
+        payload,
+        django_settings.USER_ACCESS_TOKEN_SECRET_KEY,
+        algorithm=django_settings.USER_ACCESS_TOKEN_ALG,
+    )
+
+
+def test_api_rooms_retrieve_authenticated_with_user_access_token():
+    """A user access token should retrieve a room exactly like a session would."""
+    user = UserFactory()
+    room = RoomFactory(users=[(user, "owner")])
+
+    client = APIClient()
+    client.credentials(HTTP_AUTHORIZATION=f"Bearer {generate_user_access_token(user)}")
+    response = client.get(f"/api/v1.0/rooms/{room.id!s}/")
+
+    assert response.status_code == 200
+    assert response.data["id"] == str(room.id)
+    assert response.data["pin_code"] == room.pin_code
+    assert "accesses" in response.data

src/backend/core/tests/rooms/test_api_rooms_start_recording.py

@@ -470,160 +470,6 @@ def test_start_recording_options_unknown_field_rejected(settings):
     assert response.status_code == 400
 
 
-def test_start_recording_options_encoding_valid(
-    settings, mock_worker_service_factory, mock_worker_manager
-):
-    """Should accept a valid encoding configuration."""
-    settings.RECORDING_ENABLE = True
-    room = RoomFactory()
-    user = UserFactory()
-    room.accesses.create(user=user, role="owner")
-    client = APIClient()
-    client.force_login(user)
-
-    response = client.post(
-        f"/api/v1.0/rooms/{room.id}/start-recording/",
-        {
-            "mode": "screen_recording",
-            "options": {"encoding": {"resolution": "720p", "profile": "talking_heads"}},
-        },
-        format="json",
-    )
-
-    assert response.status_code == 201
-
-
-def test_start_recording_persists_resolved_encoding(
-    settings, mock_worker_service_factory, mock_worker_manager
-):
-    """The resolved encoding should be persisted in recording.options alongside
-    the requested resolution/profile for traceability."""
-    settings.RECORDING_ENABLE = True
-    room = RoomFactory()
-    user = UserFactory()
-    room.accesses.create(user=user, role="owner")
-    client = APIClient()
-    client.force_login(user)
-
-    response = client.post(
-        f"/api/v1.0/rooms/{room.id}/start-recording/",
-        {
-            "mode": "screen_recording",
-            "options": {"encoding": {"resolution": "720p", "profile": "talking_heads"}},
-        },
-        format="json",
-    )
-
-    assert response.status_code == 201
-    recording = Recording.objects.get(room=room)
-    assert recording.options["encoding"] == {
-        "resolution": "720p",
-        "profile": "talking_heads",
-        "resolved": {
-            "key_frame_interval": settings.RECORDING_ENCODING_KEY_FRAME_INTERVAL_S,
-            "width": 1280,
-            "height": 720,
-            "framerate": 15,
-            "video_bitrate": 700,
-        },
-    }
-
-
-def test_start_recording_forwards_resolved_encoding_to_worker(
-    settings, mock_worker_service, mock_worker_service_factory
-):
-    """The resolved encoding should passed on to the worker."""
-    settings.RECORDING_ENABLE = True
-    room = RoomFactory()
-    user = UserFactory()
-    room.accesses.create(user=user, role="owner")
-    client = APIClient()
-    client.force_login(user)
-
-    mock_worker_service.start.return_value = "egress-123"
-
-    with mock.patch("core.utils.update_room_metadata"):
-        response = client.post(
-            f"/api/v1.0/rooms/{room.id}/start-recording/",
-            {
-                "mode": "screen_recording",
-                "options": {
-                    "encoding": {"resolution": "720p", "profile": "talking_heads"}
-                },
-            },
-            format="json",
-        )
-
-    assert response.status_code == 201
-    recording = Recording.objects.get(room=room)
-    mock_worker_service.start.assert_called_once_with(
-        str(room.id),
-        recording.id,
-        encoding_options=recording.options["encoding"]["resolved"],
-    )
-
-
-def test_start_recording_options_encoding_invalid_resolution(settings):
-    """Should reject invalid encoding resolution values."""
-    settings.RECORDING_ENABLE = True
-    room = RoomFactory()
-    user = UserFactory()
-    room.accesses.create(user=user, role="owner")
-    client = APIClient()
-    client.force_login(user)
-
-    response = client.post(
-        f"/api/v1.0/rooms/{room.id}/start-recording/",
-        {"mode": "screen_recording", "options": {"encoding": {"resolution": "4K"}}},
-        format="json",
-    )
-
-    assert response.status_code == 400
-
-
-def test_start_recording_options_encoding_unknown_key_rejected(settings):
-    """Should reject unknown keys in encoding configuration."""
-    settings.RECORDING_ENABLE = True
-    room = RoomFactory()
-    user = UserFactory()
-    room.accesses.create(user=user, role="owner")
-    client = APIClient()
-    client.force_login(user)
-
-    response = client.post(
-        f"/api/v1.0/rooms/{room.id}/start-recording/",
-        {
-            "mode": "screen_recording",
-            "options": {"encoding": {"bitrate": 9000}},
-        },
-        format="json",
-    )
-
-    assert response.status_code == 400
-
-
-def test_start_recording_options_without_encoding_unchanged(
-    settings, mock_worker_service_factory, mock_worker_manager
-):
-    """Requests without encoding should keep existing options behavior."""
-    settings.RECORDING_ENABLE = True
-    room = RoomFactory()
-    user = UserFactory()
-    room.accesses.create(user=user, role="owner")
-    client = APIClient()
-    client.force_login(user)
-
-    response = client.post(
-        f"/api/v1.0/rooms/{room.id}/start-recording/",
-        {"mode": "screen_recording", "options": {"language": "fr"}},
-        format="json",
-    )
-
-    assert response.status_code == 201
-    recording = Recording.objects.get(room=room)
-    assert recording.options == {"language": "fr"}
-
-
 @pytest.mark.parametrize("value", ["foo", 12])
 def test_start_recording_options_invalid_transcribe_type(settings, value):
     """Should reject non-boolean transcribe values."""

src/backend/core/tests/rooms/test_api_rooms_subtitle.py

@@ -4,15 +4,18 @@ Test rooms API endpoints in the Meet core app: start subtitle.
 # pylint: disable=W0621
 
 import uuid
+from datetime import datetime, timedelta, timezone
 from unittest import mock
 
 from django.conf import settings
 
+import jwt
 import pytest
 from livekit.api import AccessToken, TwirpError, VideoGrants
 from rest_framework.test import APIClient
 
-from ...factories import RoomFactory, UserFactory
+from ...factories import ApplicationFactory, RoomFactory, UserFactory
+from ...models import ApplicationScope
 
 pytestmark = pytest.mark.django_db
 
@@ -110,16 +113,18 @@ def test_start_subtitle_invalid_token():
     response = client.post(
         f"/api/v1.0/rooms/{room.id}/start-subtitle/",
         {},
-        HTTP_AUTHORIZATION="Bearer invalid-token",
+        HTTP_AUTHORIZATION="X-LiveKit-Token invalid-token",
     )
 
     assert response.status_code == 403
     assert response.json() == {"detail": "Invalid LiveKit token: Not enough segments"}
 
 
-def test_start_subtitle_disabled_by_default(mock_livekit_token):
+def test_start_subtitle_disabled_by_default(mock_livekit_token, settings):
     """Test that subtitle functionality is disabled when feature flag is off."""
 
+    settings.ROOM_SUBTITLE_ENABLED = False
+
     room = RoomFactory()
     user = UserFactory()
     client = APIClient()
@@ -128,7 +133,7 @@ def test_start_subtitle_disabled_by_default(mock_livekit_token):
     response = client.post(
         f"/api/v1.0/rooms/{room.id}/start-subtitle/",
         {},
-        HTTP_AUTHORIZATION=f"Bearer {mock_livekit_token}",
+        HTTP_AUTHORIZATION=f"X-LiveKit-Token {mock_livekit_token}",
     )
 
     assert response.status_code == 404
@@ -148,7 +153,7 @@ def test_start_subtitle_valid_token(
     response = client.post(
         f"/api/v1.0/rooms/{room.id}/start-subtitle/",
         {},
-        HTTP_AUTHORIZATION=f"Bearer {mock_livekit_token}",
+        HTTP_AUTHORIZATION=f"X-LiveKit-Token {mock_livekit_token}",
     )
 
     assert response.status_code == 200
@@ -178,7 +183,7 @@ def test_start_subtitle_twirp_error(
     response = client.post(
         f"/api/v1.0/rooms/{room.id}/start-subtitle/",
         {},
-        HTTP_AUTHORIZATION=f"Bearer {mock_livekit_token}",
+        HTTP_AUTHORIZATION=f"X-LiveKit-Token {mock_livekit_token}",
     )
 
     assert response.status_code == 500
@@ -198,7 +203,7 @@ def test_start_subtitle_wrong_room(settings, mock_livekit_token):
     response = client.post(
         f"/api/v1.0/rooms/{room.id}/start-subtitle/",
         {},
-        HTTP_AUTHORIZATION=f"Bearer {mock_livekit_token}",
+        HTTP_AUTHORIZATION=f"X-LiveKit-Token {mock_livekit_token}",
     )
 
     assert response.status_code == 403
@@ -219,10 +224,133 @@ def test_start_subtitle_wrong_signature(settings, mock_livekit_token):
     response = client.post(
         f"/api/v1.0/rooms/{room.id}/start-subtitle/",
         {},
-        HTTP_AUTHORIZATION=f"Bearer {mock_livekit_token}",
+        HTTP_AUTHORIZATION=f"X-LiveKit-Token {mock_livekit_token}",
     )
 
     assert response.status_code == 403
     assert response.json() == {
         "detail": "Invalid LiveKit token: Signature verification failed"
     }
+
+
+@pytest.fixture
+def user_access_token():
+    """Generate a valid user access JWT, sent with the "Bearer" scheme."""
+    user = UserFactory()
+    now = datetime.now(timezone.utc)
+    application = ApplicationFactory(scopes=[ApplicationScope.USERS_SESSION])
+
+    payload = {
+        "iss": settings.USER_ACCESS_TOKEN_ISSUER,
+        "aud": settings.USER_ACCESS_TOKEN_AUDIENCE,
+        "iat": now,
+        "exp": now + timedelta(seconds=settings.USER_ACCESS_TOKEN_TTL),
+        "user_id": str(user.id),
+        "token_type": "user_access",
+        "client_id": application.client_id,
+        "scope": "user:access",
+    }
+
+    return jwt.encode(
+        payload,
+        settings.USER_ACCESS_TOKEN_SECRET_KEY,
+        algorithm=settings.USER_ACCESS_TOKEN_ALG,
+    )
+
+
+def test_start_subtitle_bearer_scheme_defers_to_next_authentication(
+    settings, mock_livekit_client, user_access_token
+):
+    """Test that a "Bearer" header is deferred instead of failing on the LiveKit backend.
+
+    The action declares LiveKitTokenAuthentication as its only backend, so a
+    scheme it does not own must be left to the next one. None follows, so the
+    request ends up unauthenticated: the body reports missing credentials
+    rather than an invalid LiveKit token.
+    """
+
+    settings.ROOM_SUBTITLE_ENABLED = True
+
+    room = RoomFactory()
+    client = APIClient()
+
+    response = client.post(
+        f"/api/v1.0/rooms/{room.id}/start-subtitle/",
+        {},
+        HTTP_AUTHORIZATION=f"Bearer {user_access_token}",
+    )
+
+    assert response.status_code == 403
+    assert response.json() == {
+        "detail": "Authentication credentials were not provided."
+    }
+
+    mock_livekit_client.agent_dispatch.create_dispatch.assert_not_called()
+
+
+def test_start_subtitle_unknown_scheme_defers(settings, mock_livekit_client):
+    """Test that a scheme no backend recognizes is deferred, not rejected."""
+
+    settings.ROOM_SUBTITLE_ENABLED = True
+
+    room = RoomFactory()
+    client = APIClient()
+
+    response = client.post(
+        f"/api/v1.0/rooms/{room.id}/start-subtitle/",
+        {},
+        HTTP_AUTHORIZATION="Basic dXNlcjpwYXNzd29yZA==",
+    )
+
+    assert response.status_code == 403
+    assert response.json() == {
+        "detail": "Authentication credentials were not provided."
+    }
+
+    mock_livekit_client.agent_dispatch.create_dispatch.assert_not_called()
+
+
+def test_start_subtitle_scheme_is_case_insensitive(
+    settings, mock_livekit_client, mock_livekit_token, mock_room_id
+):
+    """Test that the LiveKit scheme is claimed whatever its casing."""
+
+    settings.ROOM_SUBTITLE_ENABLED = True
+
+    room = RoomFactory(id=mock_room_id)
+    client = APIClient()
+
+    response = client.post(
+        f"/api/v1.0/rooms/{room.id}/start-subtitle/",
+        {},
+        HTTP_AUTHORIZATION=f"x-livekit-token {mock_livekit_token}",
+    )
+
+    assert response.status_code == 200
+    assert response.json() == {"status": "success"}
+
+    mock_livekit_client.agent_dispatch.create_dispatch.assert_called_once()
+
+
+def test_start_subtitle_malformed_header_is_rejected(
+    settings, mock_livekit_client, mock_livekit_token
+):
+    """Test that a malformed header is rejected once the LiveKit scheme is claimed."""
+
+    settings.ROOM_SUBTITLE_ENABLED = True
+
+    room = RoomFactory()
+    client = APIClient()
+
+    response = client.post(
+        f"/api/v1.0/rooms/{room.id}/start-subtitle/",
+        {},
+        HTTP_AUTHORIZATION=f"X-LiveKit-Token {mock_livekit_token} extra-part",
+    )
+
+    assert response.status_code == 403
+    assert response.json() == {
+        "detail": "Authorization header must be: X-LiveKit-Token <token>"
+    }
+
+    mock_livekit_client.agent_dispatch.create_dispatch.assert_not_called()

src/backend/core/tests/rooms/test_api_rooms_update.py

@@ -3,13 +3,17 @@ Test rooms API endpoints in the Meet core app: update.
 """
 
 import random
+from datetime import datetime, timedelta, timezone
 from unittest.mock import patch
 
+from django.conf import settings as django_settings
+
+import jwt
 import pytest
 from rest_framework.test import APIClient
 
-from ...factories import RoomFactory, UserFactory
-from ...models import RoomAccessLevel
+from ...factories import ApplicationFactory, RoomFactory, UserFactory
+from ...models import ApplicationScope, RoomAccessLevel
 from ...services.room_management import (
     RoomManagement,
     RoomManagementException,
@@ -381,38 +385,11 @@ def test_api_rooms_update_administrators_of_another():
     assert other_room.slug == "old-name"
 
 
-@patch.object(RoomManagement, "update_metadata", side_effect=RoomNotFoundException)
-def test_api_rooms_update_livekit_room_not_found(mock_update_metadata):
-    """Should not fail the API request when the LiveKit room does not exist yet."""
-    user = UserFactory()
-    room = RoomFactory(
-        users=[(user, random.choice(["administrator", "owner"]))],
-        configuration={},
-    )
-    client = APIClient()
-    client.force_login(user)
-
-    response = client.patch(
-        f"/api/v1.0/rooms/{room.id!s}/",
-        {"configuration": {"can_publish_sources": ["camera"]}},
-        format="json",
-    )
-    assert response.status_code == 200
-    room.refresh_from_db()
-    assert room.configuration == {"can_publish_sources": ["camera"]}
-
-    mock_update_metadata.assert_called_once_with(
-        room_name=str(room.id),
-        metadata={
-            "access_level": room.access_level,
-            "configuration": {"can_publish_sources": ["camera"]},
-        },
-    )
-
-
-@patch.object(RoomManagement, "update_metadata", side_effect=RoomManagementException)
-def test_api_rooms_update_livekit_sync_failure(mock_update_metadata):
+@pytest.mark.parametrize("exception", [RoomNotFoundException, RoomManagementException])
+@patch.object(RoomManagement, "update_metadata")
+def test_api_rooms_update_livekit_sync_failure(mock_update_metadata, exception):
     """Should not fail the API request when the LiveKit metadata sync fails."""
+    mock_update_metadata.side_effect = exception
     user = UserFactory()
     room = RoomFactory(
         users=[(user, random.choice(["administrator", "owner"]))],
@@ -437,3 +414,46 @@ def test_api_rooms_update_livekit_sync_failure(mock_update_metadata):
             "configuration": {"can_publish_sources": ["camera"]},
         },
     )
+
+
+def generate_user_access_token(user):
+    """Generate a valid user access JWT signed with the token secret."""
+    now = datetime.now(timezone.utc)
+    application = ApplicationFactory(scopes=[ApplicationScope.USERS_SESSION])
+
+    payload = {
+        "iss": django_settings.USER_ACCESS_TOKEN_ISSUER,
+        "aud": django_settings.USER_ACCESS_TOKEN_AUDIENCE,
+        "iat": now,
+        "exp": now + timedelta(seconds=django_settings.USER_ACCESS_TOKEN_TTL),
+        "user_id": str(user.id),
+        "token_type": "user_access",
+        "client_id": application.client_id,
+        "scope": "user:access",
+    }
+
+    return jwt.encode(
+        payload,
+        django_settings.USER_ACCESS_TOKEN_SECRET_KEY,
+        algorithm=django_settings.USER_ACCESS_TOKEN_ALG,
+    )
+
+
+def test_api_rooms_update_authenticated_with_user_access_token():
+    """Role-based permissions apply unchanged with a user access token."""
+    user = UserFactory()
+    room = RoomFactory(users=[(user, "member")])
+
+    client = APIClient()
+    client.credentials(HTTP_AUTHORIZATION=f"Bearer {generate_user_access_token(user)}")
+
+    # A simple member cannot update the room
+    response = client.patch(f"/api/v1.0/rooms/{room.id!s}/", {"name": "new name"})
+    assert response.status_code == 403
+
+    # An administrator can
+    room.accesses.filter(user=user).update(role="administrator")
+    response = client.patch(f"/api/v1.0/rooms/{room.id!s}/", {"name": "new name"})
+    assert response.status_code == 200
+    room.refresh_from_db()
+    assert room.name == "new name"

src/backend/core/tests/rooms/test_api_rooms_webhook.py

@@ -94,7 +94,7 @@ def test_invalid_payload(client, auth_token, mock_livekit_config):
 
 
 def test_unknown_event_type(client, mock_livekit_config):
-    """Should return 422 for unknown event type."""
+    """Should acknowledge (200) an unknown event type rather than reject it."""
     event_data = json.dumps({"event": "unknown_event_type"})
 
     # Generate auth token for this specific payload
@@ -112,10 +112,8 @@ def test_unknown_event_type(client, mock_livekit_config):
         HTTP_AUTHORIZATION=auth_token,
     )
 
-    assert response.status_code == 422
-    assert response.json() == {
-        "status": "error",
-    }
+    assert response.status_code == 200
+    assert response.json() == {"status": "success"}
 
 
 @mock.patch.object(LiveKitEventsService, "_handle_room_finished")

src/backend/core/tests/services/test_livekit_events.py

@@ -16,7 +16,6 @@ from core.services.livekit_events import (
     AuthenticationError,
     InvalidPayloadError,
     LiveKitEventsService,
-    UnsupportedEventTypeError,
     api,
 )
 from core.services.lobby import LobbyService
@@ -665,22 +664,27 @@ def test_receive_missing_auth(service):
 
 
 @mock.patch.object(api.WebhookReceiver, "receive")
-def test_receive_unsupported_event(mock_receive, service):
-    """Should raise LiveKitWebhookError for unsupported events."""
+def test_receive_unknown_event_is_acknowledged(mock_receive, service, caplog):
+    """Unknown event types are logged and ignored, not rejected.
+
+    LiveKit adds event types over time and does not retry 4xx responses, so
+    raising here would silently drop the event.
+    """
     mock_request = mock.MagicMock()
     mock_request.headers = {"Authorization": "test_token"}
     mock_request.body = b"{}"
 
-    # Mock returned data with unsupported event type
     mock_data = mock.MagicMock()
     mock_data.room.name = str(uuid.uuid4())
-    mock_data.event = "unsupported_event"
+    mock_data.event = "some_future_event"
     mock_receive.return_value = mock_data
 
-    with pytest.raises(
-        UnsupportedEventTypeError, match="Unknown webhook type: unsupported_event"
-    ):
-        service.receive(mock_request)
+    with caplog.at_level("WARNING", logger="core.services.livekit_events"):
+        service.receive(mock_request)  # must not raise
+
+    assert "Ignoring unknown LiveKit webhook event type 'some_future_event'" in (
+        caplog.text
+    )
 
 
 @mock.patch.object(api.WebhookReceiver, "receive")

src/backend/core/tests/services/test_presence.py

@@ -90,19 +90,18 @@ def test_presence_clear_and_clear_room():
     assert presence.is_marked_present(other_room, "a") is True
 
 
-def test_presence_clear_room_scans_in_pages():
-    """clear_room removes every match, even across several SCAN pages,
-    and only within the room."""
+def test_presence_clear_room_removes_many_entries_and_the_index():
+    """clear_room removes every entry of the room through the index — never
+    a keyspace scan — and leaves other rooms untouched."""
     room_id, other_room = str(uuid4()), str(uuid4())
     presence = PresenceCache()
     for i in range(7):
         presence.mark_present(room_id, f"user-{i}")
     presence.mark_present(other_room, "user-0")
 
-    # An itersize smaller than the match count forces delete_pattern to
-    # page through several SCAN cursors rather than finish in one pass.
-    with mock.patch("core.utils.CACHE_SCAN_ITERSIZE", 3):
-        presence.clear_room(room_id)
+    presence.clear_room(room_id)
 
     assert all(not presence.is_marked_present(room_id, f"user-{i}") for i in range(7))
     assert presence.is_marked_present(other_room, "user-0") is True
+    assert presence._index_members(room_id) == frozenset([])
+    assert presence._index_members(other_room) == frozenset(["user-0"])

src/backend/core/tests/services/test_room_management.py

@@ -5,6 +5,8 @@ from unittest import mock
 import pytest
 from livekit.api import TwirpError
 
+from core.factories import RoomFactory
+from core.models import RoomAccessLevel
 from core.services.room_management import (
     RoomManagement,
     RoomManagementException,
@@ -20,7 +22,7 @@ def test_delete_room_calls_livekit(mock_create_livekit_client):
     mock_api.aclose = mock.AsyncMock()
     mock_create_livekit_client.return_value = mock_api
 
-    RoomManagement().delete_room("room-abc")
+    RoomManagement.delete_room("room-abc")
 
     mock_api.room.delete_room.assert_awaited_once()
     request = mock_api.room.delete_room.await_args.args[0]
@@ -39,7 +41,7 @@ def test_delete_room_raises_not_found(mock_create_livekit_client):
     mock_create_livekit_client.return_value = mock_api
 
     with pytest.raises(RoomNotFoundException):
-        RoomManagement().delete_room("missing-room")
+        RoomManagement.delete_room("missing-room")
 
     mock_api.aclose.assert_awaited_once()
 
@@ -55,6 +57,25 @@ def test_delete_room_raises_management_exception(mock_create_livekit_client):
     mock_create_livekit_client.return_value = mock_api
 
     with pytest.raises(RoomManagementException):
-        RoomManagement().delete_room("room-abc")
+        RoomManagement.delete_room("room-abc")
 
     mock_api.aclose.assert_awaited_once()
+
+
+@mock.patch.object(RoomManagement, "update_metadata")
+def test_sync_room_metadata_pushes_configuration_and_access_level(mock_update_metadata):
+    """The room's configuration and access level are forwarded to LiveKit."""
+    room = RoomFactory.build(
+        access_level=RoomAccessLevel.RESTRICTED,
+        configuration={"everyone_can_mute": True},
+    )
+
+    RoomManagement.sync_room_metadata(room)
+
+    mock_update_metadata.assert_called_once_with(
+        room_name=str(room.id),
+        metadata={
+            "configuration": {"everyone_can_mute": True},
+            "access_level": RoomAccessLevel.RESTRICTED,
+        },
+    )

src/backend/core/tests/services/test_transit_code.py

@@ -0,0 +1,58 @@
+"""
+Unit tests for the TransitCodeService.
+"""
+
+from unittest.mock import patch
+
+import pytest
+
+from core.factories import UserFactory
+from core.services.transit_code import TransitCodeService
+
+pytestmark = pytest.mark.django_db
+
+
+def test_create_code_returns_unique_opaque_codes():
+    """Each created code should be a distinct high-entropy string."""
+    user = UserFactory()
+    service = TransitCodeService()
+
+    codes = {service.create_code(user) for _ in range(5)}
+
+    assert len(codes) == 5
+    for code in codes:
+        assert len(code) >= 43
+
+
+def test_consume_code_returns_stored_data_once():
+    """Consuming a code should return its data exactly once."""
+    user = UserFactory()
+    service = TransitCodeService()
+
+    code = service.create_code(user, client_id="my-app")
+
+    assert service.consume_code(code) == {
+        "user_id": str(user.id),
+        "client_id": "my-app",
+    }
+    # Single use: a second consumption fails
+    assert service.consume_code(code) is None
+
+
+def test_consume_code_unknown_or_empty():
+    """Unknown or empty codes should not be consumable."""
+    service = TransitCodeService()
+
+    assert service.consume_code("unknown-code") is None
+    assert service.consume_code("") is None
+    assert service.consume_code(None) is None
+
+
+@patch("core.services.transit_code.cache.delete", return_value=False)
+def test_consume_code_returns_none_when_delete_loses_the_race(mock_delete):
+    """If the code was already deleted by a concurrent request, consumption fails."""
+    user = UserFactory()
+    service = TransitCodeService()
+    code = service.create_code(user, client_id="my-app")
+    assert service.consume_code(code) is None
+    mock_delete.assert_called_once()

src/backend/core/tests/test_api_user_access_token_authentication.py

@@ -0,0 +1,270 @@
+"""
+Tests for user access JWT authentication on the core API.
+
+The token authenticates the user on the whole API, exactly like a session
+cookie would (similar to lib-jitsi-meet's token authentication): the
+existing role-based permissions apply unchanged. Room endpoint coverage
+with a user access token lives in the room test files.
+"""
+
+from datetime import datetime, timedelta, timezone
+
+from django.conf import settings as django_settings
+
+import jwt
+import pytest
+from rest_framework.test import APIClient
+
+from core.factories import ApplicationFactory, RoomFactory, UserFactory
+from core.models import ApplicationScope, RoleChoices
+
+pytestmark = pytest.mark.django_db
+
+
+def generate_user_access_token(user, application=None, **overrides):
+    """Generate a valid user access JWT signed with the token secret."""
+    now = datetime.now(timezone.utc)
+
+    if application is None:
+        application = ApplicationFactory(scopes=[ApplicationScope.USERS_SESSION])
+
+    payload = {
+        "iss": django_settings.USER_ACCESS_TOKEN_ISSUER,
+        "aud": django_settings.USER_ACCESS_TOKEN_AUDIENCE,
+        "iat": now,
+        "exp": now + timedelta(seconds=django_settings.USER_ACCESS_TOKEN_TTL),
+        "user_id": str(user.id),
+        "token_type": "user_access",
+        "client_id": application.client_id,
+        "scope": "user:access",
+    }
+    payload.update(overrides)
+    payload = {key: value for key, value in payload.items() if value is not None}
+
+    return jwt.encode(
+        payload,
+        django_settings.USER_ACCESS_TOKEN_SECRET_KEY,
+        algorithm=django_settings.USER_ACCESS_TOKEN_ALG,
+    )
+
+
+def test_user_access_token_users_me():
+    """A user access token should authenticate the user on /users/me/."""
+    user = UserFactory()
+
+    client = APIClient()
+    client.credentials(HTTP_AUTHORIZATION=f"Bearer {generate_user_access_token(user)}")
+
+    response = client.get("/api/v1.0/users/me/")
+
+    assert response.status_code == 200
+    assert response.data["email"] == user.email
+
+
+def test_user_access_token_expired():
+    """An expired user access token should be rejected."""
+    user = UserFactory()
+
+    now = datetime.now(timezone.utc)
+    token = generate_user_access_token(
+        user,
+        iat=now - timedelta(hours=3),
+        exp=now - timedelta(hours=1),
+    )
+    client = APIClient()
+    client.credentials(HTTP_AUTHORIZATION=f"Bearer {token}")
+
+    response = client.get("/api/v1.0/users/me/")
+
+    assert response.status_code == 401
+    assert "token expired" in str(response.data).lower()
+
+
+def test_user_access_token_wrong_token_type():
+    """A verified token with the wrong 'token_type' claim should be rejected."""
+    user = UserFactory()
+
+    token = generate_user_access_token(user, token_type="addons")
+    client = APIClient()
+    client.credentials(HTTP_AUTHORIZATION=f"Bearer {token}")
+
+    response = client.get("/api/v1.0/users/me/")
+
+    assert response.status_code == 401
+    assert "invalid token type" in str(response.data).lower()
+
+
+def test_user_access_token_invalid_signature():
+    """A token signed with the wrong key should defer and end unauthenticated."""
+    user = UserFactory()
+
+    now = datetime.now(timezone.utc)
+    token = jwt.encode(
+        {
+            "iss": django_settings.USER_ACCESS_TOKEN_ISSUER,
+            "aud": django_settings.USER_ACCESS_TOKEN_AUDIENCE,
+            "iat": now,
+            "exp": now + timedelta(seconds=600),
+            "user_id": str(user.id),
+            "token_type": "user_access",
+            "client_id": "test-app",
+        },
+        "wrong-secret-key-padded-for-minimum-len!",
+        algorithm=django_settings.USER_ACCESS_TOKEN_ALG,
+    )
+    client = APIClient()
+    client.credentials(HTTP_AUTHORIZATION=f"Bearer {token}")
+
+    # UserAccessJWTAuthentication defers, session auth finds no session
+    response = client.get("/api/v1.0/users/me/")
+
+    assert response.status_code == 401
+
+
+def test_user_access_token_missing_client_id_claim():
+    """A token without the issuance-audit claim should be rejected."""
+    user = UserFactory()
+
+    token = generate_user_access_token(user, client_id=None)
+    client = APIClient()
+    client.credentials(HTTP_AUTHORIZATION=f"Bearer {token}")
+
+    response = client.get("/api/v1.0/users/me/")
+
+    assert response.status_code == 401
+    assert "invalid token claims" in str(response.data).lower()
+
+
+def test_user_access_token_inactive_user():
+    """A user access token for an inactive user should be rejected."""
+    user = UserFactory(is_active=False)
+
+    client = APIClient()
+    client.credentials(HTTP_AUTHORIZATION=f"Bearer {generate_user_access_token(user)}")
+
+    response = client.get("/api/v1.0/users/me/")
+
+    assert response.status_code == 401
+
+
+def test_user_access_token_feature_disabled(settings):
+    """When the feature is disabled, user access tokens should be ignored."""
+    settings.USER_ACCESS_TOKEN_ENABLED = False
+
+    user = UserFactory()
+
+    client = APIClient()
+    client.credentials(HTTP_AUTHORIZATION=f"Bearer {generate_user_access_token(user)}")
+
+    response = client.get("/api/v1.0/users/me/")
+
+    assert response.status_code == 401
+
+
+def test_user_access_token_does_not_break_session_authentication():
+    """A session-authenticated user should keep full access to the API."""
+    user = UserFactory()
+    RoomFactory(users=[(user, RoleChoices.OWNER)])
+
+    client = APIClient()
+    client.force_login(user)
+    response = client.get("/api/v1.0/rooms/")
+
+    assert response.status_code == 200
+    assert response.data["count"] == 1
+
+
+def test_user_access_token_application_jwt_not_accepted_on_core_api():
+    """An application-delegation JWT must not authenticate on the core API."""
+    user = UserFactory()
+
+    now = datetime.now(timezone.utc)
+    token = jwt.encode(
+        {
+            "iss": django_settings.APPLICATION_JWT_ISSUER,
+            "aud": django_settings.APPLICATION_JWT_AUDIENCE,
+            "iat": now,
+            "exp": now + timedelta(seconds=600),
+            "user_id": str(user.id),
+            "client_id": "some-client",
+            "delegated": True,
+            "scope": "rooms:retrieve",
+        },
+        django_settings.APPLICATION_JWT_SECRET_KEY,
+        algorithm=django_settings.APPLICATION_JWT_ALG,
+    )
+    client = APIClient()
+    client.credentials(HTTP_AUTHORIZATION=f"Bearer {token}")
+
+    # The user token backend must defer (wrong signature) and the request
+    # must end up unauthenticated.
+    response = client.get("/api/v1.0/users/me/")
+
+    assert response.status_code == 401
+
+
+def test_user_access_token_application_scope_revoked():
+    """Revoking the application's grant invalidates its outstanding tokens."""
+    user = UserFactory()
+    application = ApplicationFactory(scopes=[ApplicationScope.USERS_SESSION])
+
+    token = generate_user_access_token(user, application=application)
+
+    application.scopes = []
+    application.save()
+
+    client = APIClient()
+    client.credentials(HTTP_AUTHORIZATION=f"Bearer {token}")
+    response = client.get("/api/v1.0/users/me/")
+
+    assert response.status_code == 401
+    assert "application access revoked" in str(response.data).lower()
+
+
+def test_user_access_token_application_deactivated():
+    """Deactivating the application invalidates its outstanding tokens."""
+    user = UserFactory()
+    application = ApplicationFactory(scopes=[ApplicationScope.USERS_SESSION])
+
+    token = generate_user_access_token(user, application=application)
+
+    application.is_active = False
+    application.save()
+
+    client = APIClient()
+    client.credentials(HTTP_AUTHORIZATION=f"Bearer {token}")
+    response = client.get("/api/v1.0/users/me/")
+
+    assert response.status_code == 401
+    assert "application access revoked" in str(response.data).lower()
+
+
+def test_user_access_token_unknown_application():
+    """A token whose client_id matches no application is refused."""
+    user = UserFactory()
+
+    token = generate_user_access_token(user, client_id="not-an-application")
+    client = APIClient()
+    client.credentials(HTTP_AUTHORIZATION=f"Bearer {token}")
+
+    response = client.get("/api/v1.0/users/me/")
+
+    assert response.status_code == 401
+    assert "application access revoked" in str(response.data).lower()
+
+
+def test_user_access_token_does_not_override_existing_session():
+    """A Bearer token must not override the identity of a live session."""
+    session_user = UserFactory()
+    token_user = UserFactory()
+
+    client = APIClient()
+    client.force_login(session_user)
+    client.credentials(
+        HTTP_AUTHORIZATION=f"Bearer {generate_user_access_token(token_user)}"
+    )
+
+    response = client.get("/api/v1.0/users/me/")
+
+    assert response.status_code == 200
+    assert response.data["email"] == session_user.email

src/backend/core/tests/test_api_users_exchange_access_token.py

@@ -0,0 +1,262 @@
+"""
+Test users API endpoints in the Meet core app: exchange transit code.
+"""
+
+# pylint: disable=W0621
+
+import secrets
+
+import jwt
+import pytest
+from rest_framework.test import APIClient
+
+from core.factories import ApplicationFactory, UserFactory
+from core.models import ApplicationScope
+from core.services.transit_code import TransitCodeService
+
+pytestmark = pytest.mark.django_db
+
+
+def decode_user_access_token(token, settings):
+    """Decode a user access token with the token secret."""
+    return jwt.decode(
+        token,
+        settings.USER_ACCESS_TOKEN_SECRET_KEY,
+        algorithms=[settings.USER_ACCESS_TOKEN_ALG],
+        issuer=settings.USER_ACCESS_TOKEN_ISSUER,
+        audience=settings.USER_ACCESS_TOKEN_AUDIENCE,
+    )
+
+
+def generate_unknown_code(settings):
+    """Generate a well-formed code that was never stored."""
+    return secrets.token_urlsafe(settings.TRANSIT_CODE_NBYTES)
+
+
+@pytest.fixture
+def client():
+    """Return an anonymous API client with a random source IP.
+
+    A fresh IP per test isolates the anonymous throttle history, both
+    between the tests of this module and between test runs.
+    """
+    # `secrets` rather than `random`: the global random module is seeded
+    # deterministically by the factories, its sequence repeats across runs.
+    remote_addr = (
+        f"10.{secrets.randbelow(256)}.{secrets.randbelow(256)}"
+        f".{secrets.randbelow(254) + 1}"
+    )
+    return APIClient(REMOTE_ADDR=remote_addr)
+
+
+def test_exchange_access_token_missing_code(client):
+    """The exchange endpoint should validate its input."""
+    response = client.post("/api/v1.0/users/exchange-access-token/")
+
+    assert response.status_code == 400
+    assert "code" in response.data
+
+
+def test_exchange_access_token_get_method(client):
+    """The exchange endpoint should not accept GET."""
+
+    response = client.get("/api/v1.0/users/exchange-access-token/")
+    assert response.status_code == 405
+
+
+def test_exchange_access_token_malformed_code(client):
+    """A code whose length cannot match a generated one should be a 400."""
+    response = client.post(
+        "/api/v1.0/users/exchange-access-token/",
+        {"code": "not-a-valid-code"},
+    )
+
+    assert response.status_code == 400
+    assert "invalid transit code format" in str(response.data).lower()
+
+
+def test_exchange_access_token_unknown_code(client, settings):
+    """A well-formed but unknown code should be denied."""
+    response = client.post(
+        "/api/v1.0/users/exchange-access-token/",
+        {"code": generate_unknown_code(settings)},
+    )
+
+    assert response.status_code == 403
+    assert "invalid, expired or already used" in str(response.data).lower()
+
+
+def test_exchange_access_token_success(client, settings):
+    """A valid transit code should be exchangeable for an access token."""
+    user = UserFactory()
+
+    application = ApplicationFactory(scopes=[ApplicationScope.USERS_SESSION])
+    code = TransitCodeService().create_code(user, client_id=application.client_id)
+
+    response = client.post("/api/v1.0/users/exchange-access-token/", {"code": code})
+
+    assert response.status_code == 200
+    assert response.data["token_type"] == settings.USER_ACCESS_TOKEN_TYPE
+    assert response.data["expires_in"] == settings.USER_ACCESS_TOKEN_TTL
+    assert response.data["scope"] == "user:access"
+
+    payload = decode_user_access_token(response.data["access_token"], settings)
+    assert payload["user_id"] == str(user.id)
+    assert payload["client_id"] == application.client_id
+    assert payload["exp"] - payload["iat"] == settings.USER_ACCESS_TOKEN_TTL
+
+
+def test_exchange_access_token_single_use(client):
+    """A transit code should be exchangeable exactly once."""
+    user = UserFactory()
+
+    application = ApplicationFactory(scopes=[ApplicationScope.USERS_SESSION])
+    code = TransitCodeService().create_code(user, client_id=application.client_id)
+
+    response = client.post("/api/v1.0/users/exchange-access-token/", {"code": code})
+    assert response.status_code == 200
+
+    # Replaying the same code must be denied
+    response = client.post("/api/v1.0/users/exchange-access-token/", {"code": code})
+    assert response.status_code == 403
+    assert "invalid, expired or already used" in str(response.data).lower()
+
+
+def test_exchange_access_token_inactive_user(client):
+    """A code minted for a now-inactive user should be denied."""
+    user = UserFactory()
+
+    application = ApplicationFactory(scopes=[ApplicationScope.USERS_SESSION])
+    code = TransitCodeService().create_code(user, client_id=application.client_id)
+
+    user.is_active = False
+    user.save()
+
+    response = client.post("/api/v1.0/users/exchange-access-token/", {"code": code})
+
+    assert response.status_code == 403
+    assert "no longer access" in str(response.data).lower()
+
+
+def test_exchange_access_token_feature_disabled(client, settings):
+    """The exchange endpoint should return 404 when the feature is disabled."""
+    settings.USER_ACCESS_TOKEN_ENABLED = False
+
+    user = UserFactory()
+    application = ApplicationFactory(scopes=[ApplicationScope.USERS_SESSION])
+    code = TransitCodeService().create_code(user, client_id=application.client_id)
+
+    response = client.post("/api/v1.0/users/exchange-access-token/", {"code": code})
+
+    assert response.status_code == 404
+
+
+def test_exchange_access_token_throttled(client, settings):
+    """Anonymous exchange attempts should be rate limited."""
+    throttle_rates = settings.REST_FRAMEWORK["DEFAULT_THROTTLE_RATES"]
+    initial_rate = throttle_rates["exchange_access_token"]
+    # The rates dict is mutated in place: restore it explicitly, the
+    # `settings` fixture only rolls back attribute assignments.
+    throttle_rates["exchange_access_token"] = "2/minute"
+
+    try:
+        for _ in range(2):
+            response = client.post(
+                "/api/v1.0/users/exchange-access-token/",
+                {"code": generate_unknown_code(settings)},
+            )
+            assert response.status_code == 403
+
+        response = client.post(
+            "/api/v1.0/users/exchange-access-token/",
+            {"code": generate_unknown_code(settings)},
+        )
+        assert response.status_code == 429
+    finally:
+        throttle_rates["exchange_access_token"] = initial_rate
+
+
+def test_exchange_access_token_refused_when_already_authenticated(client):
+    """A session-authenticated browser must not exchange a transit code."""
+    user = UserFactory()
+    session_user = UserFactory()
+
+    application = ApplicationFactory(scopes=[ApplicationScope.USERS_SESSION])
+    code = TransitCodeService().create_code(user, client_id=application.client_id)
+
+    client.force_login(session_user)
+    response = client.post("/api/v1.0/users/exchange-access-token/", {"code": code})
+
+    assert response.status_code == 403
+    assert "already authenticated" in str(response.data).lower()
+
+    # The code was not consumed: it stays valid for its intended,
+    # cookieless embedded context.
+    client.logout()
+    response = client.post("/api/v1.0/users/exchange-access-token/", {"code": code})
+    assert response.status_code == 200
+
+
+def test_exchange_access_token_application_scope_revoked(client):
+    """A code is refused once the application's grant is revoked."""
+    user = UserFactory()
+
+    application = ApplicationFactory(scopes=[ApplicationScope.USERS_SESSION])
+    code = TransitCodeService().create_code(user, client_id=application.client_id)
+
+    application.scopes = []
+    application.save()
+
+    response = client.post("/api/v1.0/users/exchange-access-token/", {"code": code})
+
+    assert response.status_code == 403
+    assert "no longer create user sessions" in str(response.data).lower()
+
+
+def test_exchange_access_token_application_deactivated(client):
+    """A code is refused once the application is disabled."""
+    user = UserFactory()
+
+    application = ApplicationFactory(scopes=[ApplicationScope.USERS_SESSION])
+    code = TransitCodeService().create_code(user, client_id=application.client_id)
+
+    application.is_active = False
+    application.save()
+
+    response = client.post("/api/v1.0/users/exchange-access-token/", {"code": code})
+
+    assert response.status_code == 403
+    assert "no longer create user sessions" in str(response.data).lower()
+
+
+def test_exchange_access_token_unknown_application(client):
+    """A code whose client_id matches no application is refused."""
+    user = UserFactory()
+
+    code = TransitCodeService().create_code(user, client_id="not-an-application")
+
+    response = client.post("/api/v1.0/users/exchange-access-token/", {"code": code})
+
+    assert response.status_code == 403
+    assert "no longer create user sessions" in str(response.data).lower()
+
+
+def test_exchange_access_token_end_to_end(client):
+    """A token obtained from the exchange must authenticate on the core API.
+
+    Regression test: token issuance and token validation must stay in
+    sync on the claims they set and require (e.g. 'token_type').
+    """
+    user = UserFactory()
+    application = ApplicationFactory(scopes=[ApplicationScope.USERS_SESSION])
+    code = TransitCodeService().create_code(user, client_id=application.client_id)
+
+    response = client.post("/api/v1.0/users/exchange-access-token/", {"code": code})
+    assert response.status_code == 200
+
+    api_client = APIClient()
+    api_client.credentials(HTTP_AUTHORIZATION=f"Bearer {response.data['access_token']}")
+    me = api_client.get("/api/v1.0/users/me/")
+
+    assert me.status_code == 200
+    assert me.data["email"] == user.email

src/backend/core/tests/test_external_api_authentication.py

@@ -0,0 +1,96 @@
+"""Tests for the external API ResourceServerBackend."""
+
+from django.core.exceptions import SuspiciousOperation
+
+import pytest
+import responses
+from rest_framework.test import APIClient
+
+from core.external_api.authentication import ResourceServerBackend
+from core.factories import UserFactory
+from core.models import User
+
+pytestmark = pytest.mark.django_db
+
+
+def _payload(sub):
+    return {"sub": sub, "active": True, "scope": "lasuite_meet", "client_id": "app"}
+
+
+def test_resource_server_backend_get_or_create_user_active():
+    """An existing active user matching the sub should be returned."""
+
+    user = UserFactory()
+
+    result = ResourceServerBackend().get_or_create_user(
+        access_token="token", id_token=None, payload=_payload(user.sub)
+    )
+
+    assert result == user
+
+
+def test_resource_server_backend_get_or_create_user_inactive():
+    """An inactive user should be rejected even with a valid token."""
+
+    user = UserFactory(is_active=False)
+
+    with pytest.raises(SuspiciousOperation, match="User account is disabled."):
+        ResourceServerBackend().get_or_create_user(
+            access_token="token", id_token=None, payload=_payload(user.sub)
+        )
+
+
+def test_resource_server_backend_get_or_create_user_creates(settings):
+    """An unknown sub should create an active user when OIDC_CREATE_USER is set."""
+
+    settings.OIDC_CREATE_USER = True
+
+    result = ResourceServerBackend().get_or_create_user(
+        access_token="token", id_token=None, payload=_payload("new-sub")
+    )
+
+    assert result.sub == "new-sub"
+    assert result.is_active is True
+    assert User.objects.filter(sub="new-sub").exists()
+
+
+def test_resource_server_backend_get_or_create_user_no_creation(settings):
+    """An unknown sub should return None when OIDC_CREATE_USER is unset."""
+
+    settings.OIDC_CREATE_USER = False
+
+    result = ResourceServerBackend().get_or_create_user(
+        access_token="token", id_token=None, payload=_payload("new-sub")
+    )
+
+    assert result is None
+    assert not User.objects.filter(sub="new-sub").exists()
+
+
+@responses.activate
+def test_api_rooms_list_resource_server_inactive_user(settings):
+    """End to end: a valid introspected token for an inactive user should get 401."""
+
+    settings.OIDC_OP_INTROSPECTION_ENDPOINT = "https://oidc.example.com/introspect"
+    settings.OIDC_OP_URL = "https://oidc.example.com"
+
+    user = UserFactory(is_active=False)
+
+    responses.add(
+        responses.POST,
+        "https://oidc.example.com/introspect",
+        json={
+            "iss": "https://oidc.example.com",
+            "active": True,
+            "sub": user.sub,
+            "scope": "openid lasuite_meet rooms:list",
+            "client_id": "app",
+        },
+    )
+
+    client = APIClient()
+    client.credentials(HTTP_AUTHORIZATION="Bearer rs-token")
+    response = client.get("/external-api/v1.0/rooms/")
+
+    assert response.status_code == 401
+    assert "login failed" in str(response.data).lower()

src/backend/core/tests/test_external_api_rooms.py

@@ -16,8 +16,17 @@ import responses
 from lasuite.oidc_resource_server.authentication import ResourceServerAuthentication
 from rest_framework.test import APIClient
 
+from core.analytics import AnalyticsEvent
 from core.factories import ApplicationFactory, RoomFactory, UserFactory
-from core.models import ApplicationScope, RoleChoices, Room, RoomAccessLevel, User
+from core.models import (
+    Application,
+    ApplicationScope,
+    RoleChoices,
+    Room,
+    RoomAccessLevel,
+    User,
+)
+from core.services.room_management import RoomManagement
 
 pytestmark = pytest.mark.django_db
 
@@ -880,6 +889,509 @@ def test_api_rooms_create_public_access_level_when_default_is_public(settings):
     assert response.data["access_level"] == RoomAccessLevel.PUBLIC
 
 
+@mock.patch("core.external_api.viewsets.analytics.capture")
+def test_api_rooms_create_tracks_analytics(mock_capture):
+    """Creating a room should emit a ROOM_CREATED analytics event."""
+
+    user = UserFactory()
+    token = generate_test_token(user, [ApplicationScope.ROOMS_CREATE])
+    application = Application.objects.get()
+
+    client = APIClient()
+    client.credentials(HTTP_AUTHORIZATION=f"Bearer {token}")
+    response = client.post(
+        "/external-api/v1.0/rooms/",
+        {"access_level": RoomAccessLevel.RESTRICTED},
+        format="json",
+    )
+
+    assert response.status_code == 201
+
+    mock_capture.assert_called_once()
+    captured_user, event, properties = mock_capture.call_args[0]
+
+    assert captured_user == user
+    assert event == AnalyticsEvent.ROOM_CREATED
+    assert properties == {
+        "room_id": response.data["id"],
+        "access_level": RoomAccessLevel.RESTRICTED,
+        "client_id": str(application.client_id),
+        "external_api": True,
+        "auth_method": "ApplicationJWTAuthentication",
+        "$set": {"email": user.email},
+    }
+
+
+def test_api_rooms_update_requires_authentication():
+    """Updating a room without authentication should return 401."""
+
+    room = RoomFactory(users=[(UserFactory(), RoleChoices.OWNER)])
+
+    client = APIClient()
+    response = client.patch(
+        f"/external-api/v1.0/rooms/{room.id}/",
+        {"access_level": RoomAccessLevel.RESTRICTED},
+        format="json",
+    )
+
+    assert response.status_code == 401
+
+
+def test_api_rooms_update_requires_scope():
+    """Updating a room requires the ROOMS_UPDATE scope."""
+
+    user = UserFactory()
+    room = RoomFactory(users=[(user, RoleChoices.OWNER)])
+
+    # Token without ROOMS_UPDATE scope
+    token = generate_test_token(user, [ApplicationScope.ROOMS_RETRIEVE])
+
+    client = APIClient()
+    client.credentials(HTTP_AUTHORIZATION=f"Bearer {token}")
+    response = client.patch(
+        f"/external-api/v1.0/rooms/{room.id}/",
+        {"access_level": RoomAccessLevel.RESTRICTED},
+        format="json",
+    )
+
+    assert response.status_code == 403
+    assert (
+        "insufficient permissions. required scope: rooms:update"
+        in str(response.data).lower()
+    )
+
+
+def test_api_rooms_update_no_scope():
+    """Updating a room without any scope should return 403."""
+
+    user = UserFactory()
+    room = RoomFactory(users=[(user, RoleChoices.OWNER)])
+
+    token = generate_test_token(user, [])
+
+    client = APIClient()
+    client.credentials(HTTP_AUTHORIZATION=f"Bearer {token}")
+    response = client.patch(
+        f"/external-api/v1.0/rooms/{room.id}/",
+        {"access_level": RoomAccessLevel.RESTRICTED},
+        format="json",
+    )
+
+    assert response.status_code == 403
+    assert "insufficient permissions." in str(response.data).lower()
+
+
+@mock.patch.object(RoomManagement, "update_metadata")
+def test_api_rooms_update_owner_success(mock_update_metadata, settings):
+    """An owner should be able to update the access level and the configuration."""
+
+    settings.APPLICATION_BASE_URL = "http://your-application.com"
+
+    user = UserFactory()
+    room = RoomFactory(
+        users=[(user, RoleChoices.OWNER)],
+        access_level=RoomAccessLevel.TRUSTED,
+        configuration={},
+    )
+
+    token = generate_test_token(user, [ApplicationScope.ROOMS_UPDATE])
+
+    client = APIClient()
+    client.credentials(HTTP_AUTHORIZATION=f"Bearer {token}")
+    response = client.patch(
+        f"/external-api/v1.0/rooms/{room.id}/",
+        {
+            "access_level": RoomAccessLevel.RESTRICTED,
+            "configuration": {"everyone_can_mute": True},
+        },
+        format="json",
+    )
+
+    assert response.status_code == 200
+    assert response.data["id"] == str(room.id)
+    assert response.data["access_level"] == RoomAccessLevel.RESTRICTED
+    assert response.data["configuration"] == {"everyone_can_mute": True}
+    assert response.data["url"] == f"http://your-application.com/{room.slug}"
+
+    room.refresh_from_db()
+    assert room.access_level == RoomAccessLevel.RESTRICTED
+    assert room.configuration == {"everyone_can_mute": True}
+
+    mock_update_metadata.assert_called_once_with(
+        room_name=str(room.id),
+        metadata={
+            "configuration": {"everyone_can_mute": True},
+            "access_level": RoomAccessLevel.RESTRICTED,
+        },
+    )
+
+
+@mock.patch.object(RoomManagement, "update_metadata")
+def test_api_rooms_update_replaces_configuration(mock_update_metadata):
+    """The configuration is replaced as a whole, it is not merged with the stored one."""
+
+    user = UserFactory()
+    room = RoomFactory(
+        users=[(user, RoleChoices.OWNER)],
+        configuration={"can_publish_sources": ["camera"], "everyone_can_mute": True},
+    )
+
+    token = generate_test_token(user, [ApplicationScope.ROOMS_UPDATE])
+
+    client = APIClient()
+    client.credentials(HTTP_AUTHORIZATION=f"Bearer {token}")
+    response = client.patch(
+        f"/external-api/v1.0/rooms/{room.id}/",
+        {"configuration": {"everyone_can_mute": False}},
+        format="json",
+    )
+
+    assert response.status_code == 200
+
+    # The keys missing from the payload are dropped, not kept.
+    assert response.data["configuration"] == {"everyone_can_mute": False}
+
+    room.refresh_from_db()
+    assert room.configuration == {"everyone_can_mute": False}
+
+    mock_update_metadata.assert_called_once_with(
+        room_name=str(room.id),
+        metadata={
+            "configuration": {"everyone_can_mute": False},
+            "access_level": room.access_level,
+        },
+    )
+
+
+@mock.patch.object(RoomManagement, "update_metadata")
+def test_api_rooms_update_administrator_success(mock_update_metadata):
+    """An administrator should be able to update a room."""
+
+    user = UserFactory()
+    room = RoomFactory(
+        users=[(user, RoleChoices.ADMIN)],
+        access_level=RoomAccessLevel.TRUSTED,
+    )
+
+    token = generate_test_token(user, [ApplicationScope.ROOMS_UPDATE])
+
+    client = APIClient()
+    client.credentials(HTTP_AUTHORIZATION=f"Bearer {token}")
+    response = client.patch(
+        f"/external-api/v1.0/rooms/{room.id}/",
+        {"access_level": RoomAccessLevel.RESTRICTED},
+        format="json",
+    )
+
+    assert response.status_code == 200
+
+    room.refresh_from_db()
+    assert room.access_level == RoomAccessLevel.RESTRICTED
+    mock_update_metadata.assert_called_once()
+
+
+@mock.patch.object(RoomManagement, "update_metadata")
+def test_api_rooms_update_put_not_allowed(mock_update_metadata):
+    """PUT is not exposed: full replacement is not supported, only PATCH is."""
+
+    user = UserFactory()
+    room = RoomFactory(
+        users=[(user, RoleChoices.OWNER)],
+        access_level=RoomAccessLevel.TRUSTED,
+        configuration={},
+    )
+
+    token = generate_test_token(user, [ApplicationScope.ROOMS_UPDATE])
+
+    client = APIClient()
+    client.credentials(HTTP_AUTHORIZATION=f"Bearer {token}")
+    response = client.put(
+        f"/external-api/v1.0/rooms/{room.id}/",
+        {
+            "access_level": RoomAccessLevel.RESTRICTED,
+            "configuration": {"everyone_can_mute": True},
+        },
+        format="json",
+    )
+
+    assert response.status_code == 405
+
+    room.refresh_from_db()
+    assert room.access_level == RoomAccessLevel.TRUSTED
+    assert room.configuration == {}
+    mock_update_metadata.assert_not_called()
+
+
+@pytest.mark.parametrize("role", [RoleChoices.MEMBER, None])
+@mock.patch.object(RoomManagement, "update_metadata")
+def test_api_rooms_update_without_privileges(mock_update_metadata, role):
+    """Members and users without any role should not be able to update a room."""
+
+    user = UserFactory()
+    users = [(user, role)] if role else []
+    room = RoomFactory(users=users, access_level=RoomAccessLevel.TRUSTED)
+
+    token = generate_test_token(user, [ApplicationScope.ROOMS_UPDATE])
+
+    client = APIClient()
+    client.credentials(HTTP_AUTHORIZATION=f"Bearer {token}")
+    response = client.patch(
+        f"/external-api/v1.0/rooms/{room.id}/",
+        {"access_level": RoomAccessLevel.RESTRICTED},
+        format="json",
+    )
+
+    assert response.status_code == 403
+
+    room.refresh_from_db()
+    assert room.access_level == RoomAccessLevel.TRUSTED
+    mock_update_metadata.assert_not_called()
+
+
+@mock.patch.object(RoomManagement, "update_metadata")
+def test_api_rooms_update_readonly_enforcement(mock_update_metadata):
+    """Read-only fields provided on update should be ignored, the slug stays immutable."""
+
+    user = UserFactory()
+    room = RoomFactory(
+        users=[(user, RoleChoices.OWNER)],
+        access_level=RoomAccessLevel.TRUSTED,
+    )
+    expected_id, expected_name = str(room.id), room.name
+    expected_slug, expected_pin_code = room.slug, room.pin_code
+
+    token = generate_test_token(user, [ApplicationScope.ROOMS_UPDATE])
+
+    client = APIClient()
+    client.credentials(HTTP_AUTHORIZATION=f"Bearer {token}")
+    response = client.patch(
+        f"/external-api/v1.0/rooms/{room.id}/",
+        {
+            "id": str(uuid.uuid4()),
+            "name": "fake-name",
+            "slug": "fake-slug",
+            "pin_code": "000000",
+            "access_level": RoomAccessLevel.RESTRICTED,
+        },
+        format="json",
+    )
+
+    assert response.status_code == 200
+    assert response.data["id"] == expected_id
+    assert response.data["name"] == expected_name
+    assert response.data["slug"] == expected_slug
+
+    room.refresh_from_db()
+    assert str(room.id) == expected_id
+    assert room.name == expected_name
+    assert room.slug == expected_slug
+    assert room.pin_code == expected_pin_code
+
+    # The one writable field in the payload was applied
+    assert room.access_level == RoomAccessLevel.RESTRICTED
+    mock_update_metadata.assert_called_once()
+
+
+@mock.patch.object(RoomManagement, "update_metadata")
+def test_api_rooms_update_rejects_invalid_configuration(mock_update_metadata):
+    """Updating a room with unsupported configuration keys should fail."""
+
+    user = UserFactory()
+    room = RoomFactory(users=[(user, RoleChoices.OWNER)], configuration={})
+
+    token = generate_test_token(user, [ApplicationScope.ROOMS_UPDATE])
+
+    client = APIClient()
+    client.credentials(HTTP_AUTHORIZATION=f"Bearer {token}")
+    response = client.patch(
+        f"/external-api/v1.0/rooms/{room.id}/",
+        {"configuration": {"unsupported_flag": True}},
+        format="json",
+    )
+
+    assert response.status_code == 400
+    assert "extra inputs are not permitted" in str(response.data).lower()
+
+    room.refresh_from_db()
+    assert room.configuration == {}
+    mock_update_metadata.assert_not_called()
+
+
+@pytest.mark.parametrize(
+    "invalid_configuration",
+    [
+        {"can_publish_sources": ["invalid-source"]},
+        {"everyone_can_mute": "invalid-value"},
+    ],
+)
+@mock.patch.object(RoomManagement, "update_metadata")
+def test_api_rooms_update_rejects_invalid_configuration_values(
+    mock_update_metadata, invalid_configuration
+):
+    """Updating a room with invalid configuration values should fail."""
+
+    user = UserFactory()
+    room = RoomFactory(users=[(user, RoleChoices.OWNER)], configuration={})
+
+    token = generate_test_token(user, [ApplicationScope.ROOMS_UPDATE])
+
+    client = APIClient()
+    client.credentials(HTTP_AUTHORIZATION=f"Bearer {token}")
+    response = client.patch(
+        f"/external-api/v1.0/rooms/{room.id}/",
+        {"configuration": invalid_configuration},
+        format="json",
+    )
+
+    assert response.status_code == 400
+
+    room.refresh_from_db()
+    assert room.configuration == {}
+    mock_update_metadata.assert_not_called()
+
+
+@mock.patch.object(RoomManagement, "update_metadata")
+def test_api_rooms_update_public_access_disabled_by_default(mock_update_metadata):
+    """Switching a room to public should be disabled for the external API by default."""
+
+    user = UserFactory()
+    room = RoomFactory(
+        users=[(user, RoleChoices.OWNER)],
+        access_level=RoomAccessLevel.TRUSTED,
+    )
+
+    token = generate_test_token(user, [ApplicationScope.ROOMS_UPDATE])
+
+    client = APIClient()
+    client.credentials(HTTP_AUTHORIZATION=f"Bearer {token}")
+    response = client.patch(
+        f"/external-api/v1.0/rooms/{room.id}/",
+        {"access_level": RoomAccessLevel.PUBLIC},
+        format="json",
+    )
+
+    assert response.status_code == 400
+    assert "public rooms are disabled" in str(response.data).lower()
+
+    room.refresh_from_db()
+    assert room.access_level == RoomAccessLevel.TRUSTED
+    mock_update_metadata.assert_not_called()
+
+
+@mock.patch.object(RoomManagement, "update_metadata")
+def test_api_rooms_update_public_access_enabled_with_settings(
+    mock_update_metadata, settings
+):
+    """Switching a room to public should be allowed when explicitly enabled."""
+
+    settings.EXTERNAL_API_ALLOW_PUBLIC_ACCESS = True
+
+    user = UserFactory()
+    room = RoomFactory(
+        users=[(user, RoleChoices.OWNER)],
+        access_level=RoomAccessLevel.TRUSTED,
+    )
+
+    token = generate_test_token(user, [ApplicationScope.ROOMS_UPDATE])
+
+    client = APIClient()
+    client.credentials(HTTP_AUTHORIZATION=f"Bearer {token}")
+    response = client.patch(
+        f"/external-api/v1.0/rooms/{room.id}/",
+        {"access_level": RoomAccessLevel.PUBLIC},
+        format="json",
+    )
+
+    assert response.status_code == 200
+    assert response.data["access_level"] == RoomAccessLevel.PUBLIC
+
+    room.refresh_from_db()
+    assert room.access_level == RoomAccessLevel.PUBLIC
+    mock_update_metadata.assert_called_once()
+
+
+@mock.patch("core.external_api.viewsets.analytics.capture")
+@mock.patch.object(RoomManagement, "update_metadata")
+def test_api_rooms_update_unchanged_skips_livekit_sync(
+    mock_update_metadata, mock_capture
+):
+    """An update that changes nothing should not sync metadata nor report changes."""
+
+    user = UserFactory()
+    room = RoomFactory(
+        users=[(user, RoleChoices.OWNER)],
+        access_level=RoomAccessLevel.TRUSTED,
+        configuration={"everyone_can_mute": True},
+    )
+
+    token = generate_test_token(user, [ApplicationScope.ROOMS_UPDATE])
+
+    client = APIClient()
+    client.credentials(HTTP_AUTHORIZATION=f"Bearer {token}")
+    response = client.patch(
+        f"/external-api/v1.0/rooms/{room.id}/",
+        {
+            "access_level": RoomAccessLevel.TRUSTED,
+            "configuration": {"everyone_can_mute": True},
+        },
+        format="json",
+    )
+
+    assert response.status_code == 200
+    mock_update_metadata.assert_not_called()
+
+    # The event is still emitted for auditing, but reports an empty delta.
+    _, _, properties = mock_capture.call_args[0]
+    assert properties["updated_fields"] == []
+
+
+@mock.patch("core.external_api.viewsets.analytics.capture")
+@mock.patch.object(RoomManagement, "update_metadata")
+def test_api_rooms_update_tracks_analytics(mock_update_metadata, mock_capture):
+    """Updating a room should emit a ROOM_UPDATED analytics event."""
+
+    user = UserFactory()
+    room = RoomFactory(
+        users=[(user, RoleChoices.OWNER)],
+        access_level=RoomAccessLevel.TRUSTED,
+        configuration={},
+    )
+
+    token = generate_test_token(user, [ApplicationScope.ROOMS_UPDATE])
+    application = Application.objects.get()
+
+    client = APIClient()
+    client.credentials(HTTP_AUTHORIZATION=f"Bearer {token}")
+    response = client.patch(
+        f"/external-api/v1.0/rooms/{room.id}/",
+        {
+            "access_level": RoomAccessLevel.RESTRICTED,
+            "configuration": {"everyone_can_mute": True},
+        },
+        format="json",
+    )
+
+    assert response.status_code == 200
+
+    mock_capture.assert_called_once()
+    captured_user, event, properties = mock_capture.call_args[0]
+
+    assert captured_user == user
+    assert event == AnalyticsEvent.ROOM_UPDATED
+    assert properties == {
+        "room_id": str(room.pk),
+        "access_level": RoomAccessLevel.RESTRICTED,
+        "updated_fields": ["access_level", "configuration"],
+        "previous_access_level": RoomAccessLevel.TRUSTED,
+        "client_id": str(application.client_id),
+        "external_api": True,
+        "auth_method": "ApplicationJWTAuthentication",
+        "$set": {"email": user.email},
+    }
+
+    mock_update_metadata.assert_called_once()
+
+
 def test_api_rooms_response_no_url(settings):
     """Response should not include url field when APPLICATION_BASE_URL is None."""
     settings.APPLICATION_BASE_URL = None
@@ -1497,6 +2009,106 @@ def test_resource_server_denies_access_with_insufficient_scopes(settings):
     assert response.status_code == 403
 
 
+@responses.activate
+@mock.patch.object(RoomManagement, "update_metadata")
+def test_resource_server_updates_room_with_prefixed_scope(
+    mock_update_metadata, settings
+):
+    """A resource server token carrying the prefixed update scope should be accepted."""
+
+    user = UserFactory(sub="very-specific-sub")
+    room = RoomFactory(
+        users=[(user, RoleChoices.OWNER)],
+        access_level=RoomAccessLevel.TRUSTED,
+    )
+
+    settings.OIDC_RS_CLIENT_ID = "some_client_id"
+    settings.OIDC_RS_CLIENT_SECRET = "some_client_secret"
+    settings.OIDC_RS_SCOPES_PREFIX = "lasuite_meet"
+
+    settings.OIDC_OP_URL = "https://oidc.example.com"
+    settings.OIDC_VERIFY_SSL = False
+    settings.OIDC_TIMEOUT = 5
+    settings.OIDC_PROXY = None
+    settings.OIDC_OP_JWKS_ENDPOINT = "https://oidc.example.com/jwks"
+    settings.OIDC_OP_INTROSPECTION_ENDPOINT = "https://oidc.example.com/introspect"
+
+    responses.add(
+        responses.POST,
+        "https://oidc.example.com/introspect",
+        json={
+            "iss": "https://oidc.example.com",
+            "aud": "some_client_id",  # settings.OIDC_RS_CLIENT_ID
+            "sub": "very-specific-sub",
+            "client_id": "some_service_provider",
+            "scope": "openid lasuite_meet lasuite_meet:rooms:update",
+            "active": True,
+        },
+    )
+
+    client = APIClient()
+    client.credentials(HTTP_AUTHORIZATION="Bearer some_token")
+    response = client.patch(
+        f"/external-api/v1.0/rooms/{room.id}/",
+        {"access_level": RoomAccessLevel.RESTRICTED},
+        format="json",
+    )
+
+    assert response.status_code == 200
+
+    room.refresh_from_db()
+    assert room.access_level == RoomAccessLevel.RESTRICTED
+    mock_update_metadata.assert_called_once()
+
+
+@responses.activate
+def test_resource_server_denies_room_update_without_update_scope(settings):
+    """A resource server token without the update scope should be denied."""
+
+    user = UserFactory(sub="very-specific-sub")
+    room = RoomFactory(
+        users=[(user, RoleChoices.OWNER)],
+        access_level=RoomAccessLevel.TRUSTED,
+    )
+
+    settings.OIDC_RS_CLIENT_ID = "some_client_id"
+    settings.OIDC_RS_CLIENT_SECRET = "some_client_secret"
+    settings.OIDC_RS_SCOPES_PREFIX = "lasuite_meet"
+
+    settings.OIDC_OP_URL = "https://oidc.example.com"
+    settings.OIDC_VERIFY_SSL = False
+    settings.OIDC_TIMEOUT = 5
+    settings.OIDC_PROXY = None
+    settings.OIDC_OP_JWKS_ENDPOINT = "https://oidc.example.com/jwks"
+    settings.OIDC_OP_INTROSPECTION_ENDPOINT = "https://oidc.example.com/introspect"
+
+    responses.add(
+        responses.POST,
+        "https://oidc.example.com/introspect",
+        json={
+            "iss": "https://oidc.example.com",
+            "aud": "some_client_id",  # settings.OIDC_RS_CLIENT_ID
+            "sub": "very-specific-sub",
+            "client_id": "some_service_provider",
+            "scope": "openid lasuite_meet lasuite_meet:rooms:retrieve",
+            "active": True,
+        },
+    )
+
+    client = APIClient()
+    client.credentials(HTTP_AUTHORIZATION="Bearer some_token")
+    response = client.patch(
+        f"/external-api/v1.0/rooms/{room.id}/",
+        {"access_level": RoomAccessLevel.RESTRICTED},
+        format="json",
+    )
+
+    assert response.status_code == 403
+
+    room.refresh_from_db()
+    assert room.access_level == RoomAccessLevel.TRUSTED
+
+
 # ==============================
 # Addons
 # ==============================
@@ -1548,6 +2160,32 @@ def test_api_rooms_create_with_valid_addons_token():
     assert room.get_role(user) == RoleChoices.OWNER
 
 
+@mock.patch.object(RoomManagement, "update_metadata")
+def test_api_rooms_update_with_valid_addons_token(mock_update_metadata):
+    """Updating a room with a valid addons token should succeed."""
+    user = UserFactory()
+    room = RoomFactory(
+        users=[(user, RoleChoices.OWNER)],
+        access_level=RoomAccessLevel.TRUSTED,
+    )
+
+    token = generate_addons_test_token(user, [ApplicationScope.ROOMS_UPDATE])
+
+    client = APIClient()
+    client.credentials(HTTP_AUTHORIZATION=f"Bearer {token}")
+    response = client.patch(
+        f"/external-api/v1.0/rooms/{room.id}/",
+        {"access_level": RoomAccessLevel.RESTRICTED},
+        format="json",
+    )
+
+    assert response.status_code == 200
+
+    room.refresh_from_db()
+    assert room.access_level == RoomAccessLevel.RESTRICTED
+    mock_update_metadata.assert_called_once()
+
+
 def test_api_rooms_addons_token_inactive_user():
     """Addons token for an inactive user should return 401."""
     user = UserFactory(is_active=False)

src/backend/core/tests/test_external_api_users.py

@@ -0,0 +1,209 @@
+"""
+Tests for external API /users endpoints (transit codes)
+"""
+
+# pylint: disable=W0621
+
+from datetime import datetime, timedelta, timezone
+from unittest import mock
+
+from django.conf import settings as django_settings
+
+import jwt
+import pytest
+from lasuite.oidc_resource_server.authentication import ResourceServerAuthentication
+from rest_framework.test import APIClient
+
+from core.factories import ApplicationFactory, UserFactory
+from core.models import ApplicationScope
+from core.services.transit_code import TransitCodeService
+
+pytestmark = pytest.mark.django_db
+
+
+def generate_addons_test_token(user, scopes):
+    """Generate a valid JWT token signed with the addons secret for testing."""
+    now = datetime.now(timezone.utc)
+
+    payload = {
+        "iss": django_settings.ADDONS_TOKEN_ISSUER,
+        "aud": django_settings.ADDONS_TOKEN_AUDIENCE,
+        "iat": now,
+        "exp": now + timedelta(seconds=django_settings.ADDONS_TOKEN_TTL),
+        "scope": " ".join(scopes),
+        "user_id": str(user.id),
+    }
+
+    return jwt.encode(
+        payload,
+        django_settings.ADDONS_TOKEN_SECRET_KEY,
+        algorithm=django_settings.ADDONS_TOKEN_ALG,
+    )
+
+
+def generate_test_token(user, scopes, application=None):
+    """Generate a valid application JWT token for testing."""
+    now = datetime.now(timezone.utc)
+    scope_string = " ".join(scopes)
+
+    if application is None:
+        application = ApplicationFactory(scopes=scopes)
+
+    payload = {
+        "iss": django_settings.APPLICATION_JWT_ISSUER,
+        "aud": django_settings.APPLICATION_JWT_AUDIENCE,
+        "iat": now,
+        "exp": now
+        + timedelta(seconds=django_settings.APPLICATION_JWT_EXPIRATION_SECONDS),
+        "client_id": str(application.client_id),
+        "scope": scope_string,
+        "user_id": str(user.id),
+        "delegated": True,
+    }
+
+    return jwt.encode(
+        payload,
+        django_settings.APPLICATION_JWT_SECRET_KEY,
+        algorithm=django_settings.APPLICATION_JWT_ALG,
+    )
+
+
+def test_api_users_transit_code_requires_authentication():
+    """Minting a transit code without authentication should return 401."""
+    client = APIClient()
+    response = client.post("/external-api/v1.0/users/transit-code/")
+
+    assert response.status_code == 401
+
+
+def test_api_users_transit_code_missing_scope():
+    """A token without the 'users:session' scope should be rejected."""
+    user = UserFactory()
+
+    token = generate_test_token(user, [ApplicationScope.ROOMS_RETRIEVE])
+
+    client = APIClient()
+    client.credentials(HTTP_AUTHORIZATION=f"Bearer {token}")
+    response = client.post("/external-api/v1.0/users/transit-code/")
+
+    assert response.status_code == 403
+    assert "users:session" in str(response.data)
+
+
+def test_api_users_transit_code_success(settings):
+    """A delegated user with the scope should be able to mint a transit code."""
+    user = UserFactory()
+
+    token = generate_test_token(user, [ApplicationScope.USERS_SESSION])
+
+    client = APIClient()
+    client.credentials(HTTP_AUTHORIZATION=f"Bearer {token}")
+    response = client.post("/external-api/v1.0/users/transit-code/")
+
+    assert response.status_code == 200
+    assert response.data["expires_in"] == settings.TRANSIT_CODE_TTL
+
+    code = response.data["transit_code"]
+    # Opaque, high-entropy random string
+    assert len(code) == (4 * settings.TRANSIT_CODE_NBYTES + 2) // 3
+
+    # The code is stored server-side and references the delegated user
+    code_data = TransitCodeService().consume_code(code)
+    assert code_data == {
+        "user_id": str(user.id),
+        "client_id": mock.ANY,
+    }
+
+
+def test_api_users_transit_code_scope_claim_exceeding_db_grant():
+    """A 'users:session' claim beyond the grant recorded in database is refused."""
+    user = UserFactory()
+    application = ApplicationFactory(scopes=[ApplicationScope.ROOMS_RETRIEVE])
+
+    token = generate_test_token(
+        user, [ApplicationScope.USERS_SESSION], application=application
+    )
+
+    client = APIClient()
+    client.credentials(HTTP_AUTHORIZATION=f"Bearer {token}")
+    response = client.post("/external-api/v1.0/users/transit-code/")
+
+    assert response.status_code == 403
+    assert "not granted" in str(response.data)
+
+
+def test_api_users_transit_code_get_forbidden():
+    """Minting a transit code with a GET should not be allowed."""
+    user = UserFactory()
+
+    token = generate_test_token(user, [ApplicationScope.USERS_SESSION])
+
+    client = APIClient()
+    client.credentials(HTTP_AUTHORIZATION=f"Bearer {token}")
+    response = client.get("/external-api/v1.0/users/transit-code/")
+
+    assert response.status_code == 405
+
+
+def test_api_users_transit_code_resource_server_not_supported():
+    """A resource server token must not be able to mint a transit code."""
+    user = UserFactory()
+
+    with mock.patch.object(
+        ResourceServerAuthentication,
+        "authenticate",
+        return_value=(user, {"scope": "users:session", "client_id": "rs-client"}),
+    ) as mock_rs_authenticate:
+        client = APIClient()
+        client.credentials(HTTP_AUTHORIZATION="Bearer some-opaque-rs-token")
+        response = client.post("/external-api/v1.0/users/transit-code/")
+
+    assert response.status_code == 401
+    mock_rs_authenticate.assert_not_called()
+
+
+def test_api_users_transit_code_feature_disabled(settings):
+    """Minting a transit code should return 404 when the feature is disabled."""
+    settings.USER_ACCESS_TOKEN_ENABLED = False
+
+    user = UserFactory()
+    token = generate_test_token(user, [ApplicationScope.USERS_SESSION])
+
+    client = APIClient()
+    client.credentials(HTTP_AUTHORIZATION=f"Bearer {token}")
+    response = client.post("/external-api/v1.0/users/transit-code/")
+
+    assert response.status_code == 404
+
+
+def test_api_users_transit_code_inactive_user():
+    """An inactive user should not be able to mint a transit code."""
+    user = UserFactory(is_active=False)
+
+    token = generate_test_token(user, [ApplicationScope.USERS_SESSION])
+
+    client = APIClient()
+    client.credentials(HTTP_AUTHORIZATION=f"Bearer {token}")
+    response = client.post("/external-api/v1.0/users/transit-code/")
+
+    assert response.status_code == 401
+
+
+def test_api_users_transit_code_rejects_addons_token():
+    """An addons token must not be able to mint a transit code.
+
+    The token carries the 'users:session' scope and is signed with the addons
+    secret, so only the missing backend stands between it and a transit code.
+    """
+    user = UserFactory()
+    token = generate_addons_test_token(user, [ApplicationScope.USERS_SESSION])
+
+    client = APIClient()
+    client.credentials(HTTP_AUTHORIZATION=f"Bearer {token}")
+
+    with mock.patch.object(
+        ResourceServerAuthentication, "authenticate", return_value=None
+    ):
+        response = client.post("/external-api/v1.0/users/transit-code/")
+
+    assert response.status_code == 401

src/backend/core/tests/test_models_users.py

@@ -26,6 +26,64 @@ def test_models_users_id_unique():
         factories.UserFactory(id=user.id)
 
 
+@pytest.mark.parametrize(
+    "sub,is_valid",
+    [
+        # cases from suitenumerique/docs PR #1295 (same validator)
+        ("valid_sub.@+-:=/", True),
+        ("invalid süb", False),
+        (12345, True),
+        # Auth0 emits "provider|user-id" subject identifiers
+        ("auth0|644c0bc8f1874ef6d339fb34", True),
+        ("google-oauth2|103547991597142817347", True),
+        # Keycloak-style UUID
+        ("f:550e8400-e29b-41d4-a716-446655440000:jdoe", True),
+        # base64/URN-style identifiers
+        ("dGVzdC1zdWItdmFsdWU=", True),
+        ("urn:example:user/42", True),
+        # legacy format still accepted
+        ("user@example.com", True),
+        # space (U+0020) is printable ASCII and remains allowed
+        ("sub with space", True),
+        # non-ASCII values are rejected
+        ("émilie", False),
+        # ASCII control characters (U+0000-U+001F, U+007F) are rejected:
+        # NUL passes isascii() but cannot be stored in PostgreSQL text
+        # fields, and the others invite log injection and interop issues
+        ("nul\x00sub", False),
+        ("\x00", False),
+        ("tab\tsub", False),
+        ("newline\nsub", False),
+        ("del\x7fsub", False),
+    ],
+)
+def test_models_users_sub_validator(sub, is_valid):
+    """
+    The "sub" field should accept any ASCII string as required by
+    OpenID Connect Core 1.0 §2 and RFC 7519 §4.1.2, and reject non-ASCII values.
+    """
+    user = factories.UserFactory()
+    user.sub = sub
+    if is_valid:
+        user.full_clean()
+    else:
+        with pytest.raises(
+            ValidationError,
+            match="Enter a valid sub. This value should be printable ASCII only.",
+        ):
+            user.full_clean()
+
+
+def test_models_users_sub_max_length():
+    """The "sub" field should enforce the 255 ASCII characters limit of OIDC Core 1.0 §2."""
+    user = factories.UserFactory(sub="a" * 255)
+    assert user.sub == "a" * 255
+
+    user.sub = "a" * 256
+    with pytest.raises(ValidationError, match="at most 255 characters"):
+        user.full_clean()
+
+
 def test_models_users_send_mail_main_existing():
     """The "email_user' method should send mail to the user's email address."""
     user = factories.UserFactory()

src/backend/core/tests/test_settings_release.py

@@ -0,0 +1,47 @@
+"""Unit tests for the get_release settings helper."""
+
+import re
+
+import pytest
+
+from meet.settings import get_release
+
+
+@pytest.fixture(name="base_dir")
+def fixture_empty_base_dir(tmp_path, monkeypatch):
+    """Point get_release at an empty directory."""
+    monkeypatch.setattr("meet.settings.BASE_DIR", str(tmp_path))
+    return tmp_path
+
+
+def test_get_release_reads_project_pyproject():
+    """Should return the semantic version of the backend's pyproject.toml."""
+    assert re.fullmatch(r"\d+\.\d+\.\d+", get_release())
+
+
+def test_get_release_reads_pyproject_version(base_dir):
+    """Should return the version declared in the [project] table."""
+    (base_dir / "pyproject.toml").write_text(
+        '[project]\nname = "meet"\nversion = "1.2.3"\n', encoding="utf-8"
+    )
+    assert get_release() == "1.2.3"
+
+
+@pytest.mark.usefixtures("base_dir")
+def test_get_release_missing_pyproject():
+    """Should fall back to "NA" without a pyproject.toml."""
+    assert get_release() == "NA"
+
+
+@pytest.mark.parametrize(
+    "content",
+    [
+        '[project]\nname = "meet"\n',  # no version
+        "[tool.uv]\npackage = true\n",  # no [project] table
+        "[project\nversion = ",  # malformed TOML
+    ],
+)
+def test_get_release_unreadable_version(base_dir, content):
+    """Should fall back to "NA" without a readable version in pyproject.toml."""
+    (base_dir / "pyproject.toml").write_text(content, encoding="utf-8")
+    assert get_release() == "NA"

src/backend/core/tests/test_settings_video_codec.py

@@ -0,0 +1,22 @@
+"""Unit tests for the LIVEKIT_DEFAULT_VIDEO_CODEC setting value."""
+
+import pytest
+
+from meet.settings import VideoCodecValue
+
+
+@pytest.mark.parametrize(
+    "raw,expected",
+    [("vp9", "vp9"), ("AV1", "av1"), ("  h264  ", "h264")],
+)
+def test_video_codec_value_normalizes(raw, expected):
+    """Whitespace is trimmed and the name is lowercased before it is checked."""
+    # environ=False keeps __new__ from resolving the value, so the instance survives.
+    assert VideoCodecValue(environ=False).to_python(raw) == expected
+
+
+@pytest.mark.parametrize("raw", ["vp10", "", "h.264"])
+def test_video_codec_value_rejects_unsupported(raw):
+    """A name outside the accepted list stops the settings module loading."""
+    with pytest.raises(ValueError, match="Unsupported video codec"):
+        VideoCodecValue(environ=False).to_python(raw)

src/backend/core/urls.py

@@ -48,6 +48,11 @@ external_router.register(
     external_viewsets.RoomViewSet,
     basename="external_room",
 )
+external_router.register(
+    "users",
+    external_viewsets.UserViewSet,
+    basename="external_user",
+)
 
 urlpatterns = [
     path(

src/backend/core/utils.py

@@ -499,6 +499,3 @@ def build_telephony_config():
         "default_country": country,
         "international_phone_number": international,
     }
-
-
-CACHE_SCAN_ITERSIZE = 500

src/backend/core/validators.py

@@ -0,0 +1,23 @@
+"""Custom validators for the core app."""
+
+from django.core.exceptions import ValidationError
+from django.utils.translation import gettext_lazy as _
+
+
+def sub_validator(value):
+    """Validate that the sub is printable ASCII only.
+
+    OpenID Connect Core 1.0 (section 2) allows any ASCII (RFC 20) string of
+    at most 255 characters, so no character whitelist is applied: providers
+    legitimately emit "|" (Auth0), ":" (Keycloak), "=", "/", etc. As a
+    deliberate hardening beyond the spec, ASCII control characters
+    (U+0000-U+001F and U+007F) are rejected: no known provider emits them,
+    NUL cannot be stored in PostgreSQL text fields, and the others invite
+    log-injection and interoperability issues. For str values,
+    ``isprintable()`` is false exactly for those control characters, while
+    space (U+0020) remains allowed.
+    """
+    if not value.isascii() or not value.isprintable():
+        raise ValidationError(
+            _("Enter a valid sub. This value should be printable ASCII only.")
+        )

src/backend/locale/de_DE/LC_MESSAGES/django.po

@@ -8,7 +8,7 @@ msgid ""
 msgstr ""
 "Project-Id-Version: PACKAGE VERSION\n"
 "Report-Msgid-Bugs-To: \n"
-"POT-Creation-Date: 2026-07-02 10:47+0000\n"
+"POT-Creation-Date: 2026-09-02 22:52+0000\n"
 "PO-Revision-Date: YEAR-MO-DA HO:MI+ZONE\n"
 "Last-Translator: FULL NAME <EMAIL@ADDRESS>\n"
 "Language-Team: LANGUAGE <LL@li.org>\n"
@@ -51,11 +51,11 @@ msgstr ""
 msgid "File preview"
 msgstr ""
 
-#: core/admin.py:300 core/admin.py:443
+#: core/admin.py:300 core/admin.py:450
 msgid "No owner"
 msgstr "Kein Eigentümer"
 
-#: core/admin.py:303 core/admin.py:446
+#: core/admin.py:303 core/admin.py:453
 msgid "Multiple owners"
 msgstr "Mehrere Eigentümer"
 
@@ -98,11 +98,11 @@ msgstr "%(count)s Aufnahme(n) erfolgreich als ‚Fehler beim Stoppen‘ markiert
 msgid "Skipped %(count)s recording(s) with an ineligible status."
 msgstr "%(count)s abgelaufene Aufnahme(n) übersprungen."
 
-#: core/admin.py:510
+#: core/admin.py:517
 msgid "No scopes"
 msgstr "Keine Scopes"
 
-#: core/admin.py:512
+#: core/admin.py:519
 msgid "Scopes"
 msgstr "Scopes"
 
@@ -110,185 +110,201 @@ msgstr "Scopes"
 msgid "Creator is me"
 msgstr "Ersteller bin ich"
 
-#: core/api/serializers.py:89
+#: core/api/serializers.py:108
 msgid "You must be administrator or owner of a room to add accesses to it."
 msgstr ""
 "Sie müssen Administrator oder Eigentümer eines Raums sein, um Zugriffe "
 "hinzuzufügen."
 
-#: core/api/serializers.py:534
+#: core/api/serializers.py:560
 msgid "This file extension is not allowed."
 msgstr "Diese Dateiendung ist nicht erlaubt."
 
-#: core/api/viewsets.py:1222
+#: core/api/viewsets.py:1268
 msgid "You have reached the maximum number of files for this type."
 msgstr "Sie haben die maximale Anzahl an Dateien dieses Typs erreicht."
 
-#: core/models.py:37
+#: core/models.py:38
 msgid "Member"
 msgstr "Mitglied"
 
-#: core/models.py:38
+#: core/models.py:39
 msgid "Administrator"
 msgstr "Administrator"
 
-#: core/models.py:39
+#: core/models.py:40
 msgid "Owner"
 msgstr "Eigentümer"
 
-#: core/models.py:55
+#: core/models.py:56
 msgid "Initiated"
 msgstr "Gestartet"
 
-#: core/models.py:56
+#: core/models.py:57
 msgid "Active"
 msgstr "Aktiv"
 
-#: core/models.py:57
+#: core/models.py:58
 msgid "Stopped"
 msgstr "Beendet"
 
-#: core/models.py:58
+#: core/models.py:59
 msgid "Saved"
 msgstr "Gespeichert"
 
-#: core/models.py:59
+#: core/models.py:60
 msgid "Aborted"
 msgstr "Abgebrochen"
 
-#: core/models.py:60
+#: core/models.py:61
 msgid "Failed to Start"
 msgstr "Start fehlgeschlagen"
 
-#: core/models.py:61
+#: core/models.py:62
 msgid "Failed to Stop"
 msgstr "Stopp fehlgeschlagen"
 
-#: core/models.py:62
+#: core/models.py:63
 msgid "Notification succeeded"
 msgstr "Benachrichtigung erfolgreich"
 
-#: core/models.py:65
+#: core/models.py:66
 msgid "External process successful"
 msgstr "Externer Prozess erfolgreich"
 
-#: core/models.py:67
+#: core/models.py:68
 msgid "External process failed"
 msgstr "Externer Prozess fehlgeschlagen"
 
-#: core/models.py:96
+#: core/models.py:97
 msgid "SCREEN_RECORDING"
 msgstr "BILDSCHIRMAUFZEICHNUNG"
 
-#: core/models.py:97
+#: core/models.py:98
 msgid "TRANSCRIPT"
 msgstr "TRANSKRIPT"
 
-#: core/models.py:103
+#: core/models.py:104
 msgid "Public Access"
 msgstr "Öffentlicher Zugriff"
 
-#: core/models.py:104
+#: core/models.py:105
 msgid "Trusted Access"
 msgstr "Vertrauenswürdiger Zugriff"
 
-#: core/models.py:105
+#: core/models.py:106
 msgid "Restricted Access"
 msgstr "Eingeschränkter Zugriff"
 
-#: core/models.py:117
+#: core/models.py:118
 msgid "id"
 msgstr "ID"
 
-#: core/models.py:118
+#: core/models.py:119
 msgid "primary key for the record as UUID"
 msgstr "Primärschlüssel des Eintrags als UUID"
 
-#: core/models.py:124
+#: core/models.py:125
 msgid "created on"
 msgstr "erstellt am"
 
-#: core/models.py:125
+#: core/models.py:126
 msgid "date and time at which a record was created"
 msgstr "Datum und Uhrzeit der Erstellung eines Eintrags"
 
-#: core/models.py:130
+#: core/models.py:131
 msgid "updated on"
 msgstr "aktualisiert am"
 
-#: core/models.py:131
+#: core/models.py:132
 msgid "date and time at which a record was last updated"
 msgstr "Datum und Uhrzeit der letzten Aktualisierung eines Eintrags"
 
-#: core/models.py:151
-msgid ""
-"Enter a valid sub. This value may contain only letters, numbers, and @/./+/-/"
-"_ characters."
-msgstr ""
-"Geben Sie einen gültigen Sub ein. Dieser Wert darf nur Buchstaben, Zahlen "
-"und die Zeichen @/./+/-/_ enthalten."
-
-#: core/models.py:157
+#: core/models.py:150
 msgid "sub"
 msgstr "Sub"
 
-#: core/models.py:159
+#: core/models.py:152
 msgid ""
 "Optional for pending users; required upon account activation. 255 characters "
-"or fewer. Letters, numbers, and @/./+/-/_ characters only."
+"or fewer. Printable ASCII characters only."
 msgstr ""
 "Optional für ausstehende Benutzer; erforderlich nach Kontoaktivierung. "
-"Maximal 255 Zeichen. Nur Buchstaben, Zahlen und @/./+/-/_ Zeichen erlaubt."
+"Maximal 255 Zeichen. Nur druckbare ASCII-Zeichen erlaubt."
 
-#: core/models.py:168
+#: core/validators.py:22
+msgid "Enter a valid sub. This value should be printable ASCII only."
+msgstr "Geben Sie einen gültigen sub ein. Dieser Wert darf nur druckbare ASCII-Zeichen enthalten."
+
+#: core/models.py:161
 msgid "identity email address"
 msgstr "Identitäts-E-Mail-Adresse"
 
-#: core/models.py:173
+#: core/models.py:166
 msgid "admin email address"
 msgstr "Administrator-E-Mail-Adresse"
 
-#: core/models.py:175
+#: core/models.py:168
 msgid "full name"
 msgstr "Vollständiger Name"
 
-#: core/models.py:177
+#: core/models.py:170
 msgid "short name"
 msgstr "Kurzname"
 
-#: core/models.py:183
+#: core/models.py:176
 msgid "language"
 msgstr "Sprache"
 
-#: core/models.py:184
+#: core/models.py:177
 msgid "The language in which the user wants to see the interface."
 msgstr "Die Sprache, in der der Benutzer die Oberfläche sehen möchte."
 
-#: core/models.py:190
+#: core/models.py:183
 msgid "The timezone in which the user wants to see times."
 msgstr "Die Zeitzone, in der der Benutzer die Zeiten sehen möchte."
 
-#: core/models.py:193
+#: core/models.py:190
+msgid "default room access level"
+msgstr ""
+
+#: core/models.py:192
+msgid ""
+"Access level applied by default to new rooms created by this user. When "
+"empty, the instance default is used."
+msgstr ""
+
+#: core/models.py:199
+#, fuzzy
+#| msgid "Visio room configuration"
+msgid "default room configuration"
+msgstr "Visio-Raumkonfiguration"
+
+#: core/models.py:201
+msgid "Configurations applied by default to new rooms created by this user."
+msgstr ""
+
+#: core/models.py:205
 msgid "device"
 msgstr "Gerät"
 
-#: core/models.py:195
+#: core/models.py:207
 msgid "Whether the user is a device or a real user."
 msgstr "Ob es sich um ein Gerät oder einen echten Benutzer handelt."
 
-#: core/models.py:198
+#: core/models.py:210
 msgid "staff status"
 msgstr "Mitarbeiterstatus"
 
-#: core/models.py:200
+#: core/models.py:212
 msgid "Whether the user can log into this admin site."
 msgstr "Ob der Benutzer sich bei dieser Admin-Seite anmelden kann."
 
-#: core/models.py:203
+#: core/models.py:215
 msgid "active"
 msgstr "aktiv"
 
-#: core/models.py:206
+#: core/models.py:218
 msgid ""
 "Whether this user should be treated as active. Unselect this instead of "
 "deleting accounts."
@@ -296,66 +312,66 @@ msgstr ""
 "Ob dieser Benutzer als aktiv behandelt werden soll. Deaktivieren Sie dies "
 "anstelle des Löschens des Kontos."
 
-#: core/models.py:219
+#: core/models.py:231
 msgid "user"
 msgstr "Benutzer"
 
-#: core/models.py:220
+#: core/models.py:232
 msgid "users"
 msgstr "Benutzer"
 
-#: core/models.py:286
+#: core/models.py:298
 msgid "Resource"
 msgstr "Ressource"
 
-#: core/models.py:287
+#: core/models.py:299
 msgid "Resources"
 msgstr "Ressourcen"
 
-#: core/models.py:345
+#: core/models.py:357
 msgid "Resource access"
 msgstr "Ressourcenzugriff"
 
-#: core/models.py:346
+#: core/models.py:358
 msgid "Resource accesses"
 msgstr "Ressourcenzugriffe"
 
-#: core/models.py:352
+#: core/models.py:364
 msgid "Resource access with this User and Resource already exists."
 msgstr ""
 "Ein Ressourcenzugriff mit diesem Benutzer und dieser Ressource existiert "
 "bereits."
 
-#: core/models.py:409
+#: core/models.py:421
 msgid "Visio room configuration"
 msgstr "Visio-Raumkonfiguration"
 
-#: core/models.py:410
+#: core/models.py:422
 msgid "Values for Visio parameters to configure the room."
 msgstr "Werte für Visio-Parameter zur Konfiguration des Raums."
 
-#: core/models.py:417
+#: core/models.py:429
 msgid "Room PIN code"
 msgstr "PIN-Code für den Raum"
 
-#: core/models.py:418
+#: core/models.py:430
 msgid "Unique n-digit code that identifies this room in telephony mode."
 msgstr ""
 "Eindeutiger n-stelliger Code, der diesen Raum im Telephonmodus identifiziert."
 
-#: core/models.py:424 core/models.py:578
+#: core/models.py:436 core/models.py:597
 msgid "Room"
 msgstr "Raum"
 
-#: core/models.py:425
+#: core/models.py:437
 msgid "Rooms"
 msgstr "Räume"
 
-#: core/models.py:589
+#: core/models.py:608
 msgid "Worker ID"
 msgstr "Worker-ID"
 
-#: core/models.py:591
+#: core/models.py:610
 msgid ""
 "Enter an identifier for the worker recording.This ID is retained even when "
 "the worker stops, allowing for easy tracking."
@@ -364,153 +380,153 @@ msgstr ""
 "erhalten, auch wenn der Worker stoppt, was ein einfaches Nachverfolgen "
 "ermöglicht."
 
-#: core/models.py:599
+#: core/models.py:618
 msgid "Recording mode"
 msgstr "Aufzeichnungsmodus"
 
-#: core/models.py:600
+#: core/models.py:619
 msgid "Defines the mode of recording being called."
 msgstr "Definiert den aufgerufenen Aufzeichnungsmodus."
 
-#: core/models.py:605 core/models.py:606
+#: core/models.py:624 core/models.py:625
 msgid "Recording options"
 msgstr "Aufnahmeoptionen"
 
-#: core/models.py:613
+#: core/models.py:632
 msgid "External Process ID"
 msgstr "External Process ID"
 
-#: core/models.py:614
+#: core/models.py:633
 msgid "ID of the external process associated with the recording."
 msgstr "ID des externen Prozesses, der mit der Aufzeichnung verknüpft ist"
 
-#: core/models.py:620
+#: core/models.py:639
 msgid "Recording"
 msgstr "Aufzeichnung"
 
-#: core/models.py:621
+#: core/models.py:640
 msgid "Recordings"
 msgstr "Aufzeichnungen"
 
-#: core/models.py:731
+#: core/models.py:750
 msgid "Recording/user relation"
 msgstr "Beziehung Aufzeichnung/Benutzer"
 
-#: core/models.py:732
+#: core/models.py:751
 msgid "Recording/user relations"
 msgstr "Beziehungen Aufzeichnung/Benutzer"
 
-#: core/models.py:738
+#: core/models.py:757
 msgid "This user is already in this recording."
 msgstr "Dieser Benutzer ist bereits Teil dieser Aufzeichnung."
 
-#: core/models.py:744
+#: core/models.py:763
 msgid "This team is already in this recording."
 msgstr "Dieses Team ist bereits Teil dieser Aufzeichnung."
 
-#: core/models.py:750
+#: core/models.py:769
 msgid "Either user or team must be set, not both."
 msgstr "Entweder Benutzer oder Team muss festgelegt werden, nicht beides."
 
-#: core/models.py:767
+#: core/models.py:786
 msgid "Create rooms"
 msgstr "Räume erstellen"
 
-#: core/models.py:768
+#: core/models.py:787
 msgid "List rooms"
 msgstr "Räume auflisten"
 
-#: core/models.py:769
+#: core/models.py:788
 msgid "Retrieve room details"
 msgstr "Raumdetails abrufen"
 
-#: core/models.py:770
+#: core/models.py:789
 msgid "Update rooms"
 msgstr "Räume aktualisieren"
 
-#: core/models.py:771
+#: core/models.py:790
 msgid "Delete rooms"
 msgstr "Räume löschen"
 
-#: core/models.py:784
+#: core/models.py:803
 msgid "Application name"
 msgstr "Anwendungsname"
 
-#: core/models.py:785
+#: core/models.py:804
 msgid "Descriptive name for this application."
 msgstr "Beschreibender Name für diese Anwendung."
 
-#: core/models.py:795
+#: core/models.py:814
 msgid "Hashed on Save. Copy it now if this is a new secret."
 msgstr ""
 "Beim Speichern gehasht. Jetzt kopieren, wenn dies ein neues Geheimnis ist."
 
-#: core/models.py:806
+#: core/models.py:825
 msgid "Application"
 msgstr "Anwendung"
 
-#: core/models.py:807
+#: core/models.py:826
 msgid "Applications"
 msgstr "Anwendungen"
 
-#: core/models.py:830
+#: core/models.py:849
 msgid "Enter a valid domain"
 msgstr "Geben Sie eine gültige Domain ein"
 
-#: core/models.py:833
+#: core/models.py:852
 msgid "Domain"
 msgstr "Domain"
 
-#: core/models.py:834
+#: core/models.py:853
 msgid "Email domain this application can act on behalf of."
 msgstr "E-Mail-Domain, im Namen der diese Anwendung handeln kann."
 
-#: core/models.py:846
+#: core/models.py:865
 msgid "Application domain"
 msgstr "Anwendungsdomain"
 
-#: core/models.py:847
+#: core/models.py:866
 msgid "Application domains"
 msgstr "Anwendungsdomains"
 
-#: core/models.py:865
+#: core/models.py:884
 msgid "Pending"
 msgstr "Ausstehend"
 
-#: core/models.py:866
+#: core/models.py:885
 msgid "Analyzing"
 msgstr ""
 
-#: core/models.py:873
+#: core/models.py:892
 msgid "Ready"
 msgstr "Bereit"
 
-#: core/models.py:879
+#: core/models.py:898
 msgid "Background image"
 msgstr "Hintergrundbild"
 
-#: core/models.py:891
+#: core/models.py:910
 msgid "title"
 msgstr "Titel"
 
-#: core/models.py:915
+#: core/models.py:934
 msgid "Malware detection info when the analysis status is unsafe."
 msgstr ""
 "Informationen zur Malware-Erkennung, wenn der Analyse-Status unsicher ist."
 
-#: core/models.py:920
+#: core/models.py:939
 msgid "File"
 msgstr "Datei"
 
-#: core/models.py:921
+#: core/models.py:940
 msgid "Files"
 msgstr "Dateien"
 
-#: core/models.py:1041
+#: core/models.py:1060
 msgid "This file is already hard deleted."
 msgstr "Diese Datei wurde bereits endgültig gelöscht."
 
-#: core/models.py:1051
+#: core/models.py:1070
 #, fuzzy
 #| msgid "To hard delete a file, it must first be soft deleted."
 msgid "To hard delete a file, it must first be soft deleted."
@@ -518,15 +534,15 @@ msgstr ""
 "Um eine Datei endgültig zu löschen, muss sie zuvor weich gelöscht worden "
 "sein."
 
-#: core/recording/event/notification.py:123
+#: core/recording/event/notification.py:124
 msgid "Your recording is ready"
 msgstr "Ihre Aufzeichnung ist bereit"
 
-#: core/recording/event/notification.py:194
+#: core/recording/event/notification.py:195
 msgid "Transcription"
 msgstr "Transkription"
 
-#: core/recording/event/notification.py:204
+#: core/recording/event/notification.py:206
 #, python-brace-format
 msgid "Meeting \"{room}\" on {room_recording_date} at {room_recording_time}"
 msgstr ""
@@ -537,25 +553,25 @@ msgstr ""
 msgid "Video call in progress: {sender.email} is waiting for you to connect"
 msgstr "Videoanruf läuft: {sender.email} wartet auf Ihre Teilnahme"
 
-#: core/templates/mail/html/invitation.html:159
-#: core/templates/mail/html/screen_recording.html:159
-#: core/templates/mail/text/invitation.txt:3
-#: core/templates/mail/text/screen_recording.txt:3
+#: core/templates/mail/html/invitation.html:151
+#: core/templates/mail/html/screen_recording.html:151
+#: core/templates/mail/text/invitation.txt:4
+#: core/templates/mail/text/screen_recording.txt:4
 msgid "Logo email"
 msgstr "Logo-E-Mail"
 
-#: core/templates/mail/html/invitation.html:189
-#: core/templates/mail/text/invitation.txt:5
+#: core/templates/mail/html/invitation.html:181
+#: core/templates/mail/text/invitation.txt:6
 msgid "invites you to join an ongoing video call"
 msgstr "lädt Sie zu einem laufenden Videoanruf ein"
 
-#: core/templates/mail/html/invitation.html:200
-#: core/templates/mail/text/invitation.txt:7
+#: core/templates/mail/html/invitation.html:192
+#: core/templates/mail/text/invitation.txt:8
 msgid "JOIN THE CALL"
 msgstr "AM ANRUF TEILNEHMEN"
 
-#: core/templates/mail/html/invitation.html:227
-#: core/templates/mail/text/invitation.txt:13
+#: core/templates/mail/html/invitation.html:219
+#: core/templates/mail/text/invitation.txt:14
 msgid ""
 "If you can't click the button, copy and paste the URL into your browser to "
 "join the call."
@@ -563,41 +579,47 @@ msgstr ""
 "Wenn Sie den Button nicht anklicken können, kopieren Sie die URL und fügen "
 "Sie sie in Ihren Browser ein, um am Anruf teilzunehmen."
 
-#: core/templates/mail/html/invitation.html:235
-#: core/templates/mail/text/invitation.txt:15
+#: core/templates/mail/html/invitation.html:227
+#: core/templates/mail/text/invitation.txt:16
 msgid "Tips for a better experience:"
 msgstr "Tipps für ein besseres Erlebnis:"
 
-#: core/templates/mail/html/invitation.html:237
-#: core/templates/mail/text/invitation.txt:17
+#: core/templates/mail/html/invitation.html:229
+#: core/templates/mail/text/invitation.txt:18
 msgid "Use Chrome or Firefox for better call quality"
 msgstr "Verwenden Sie Chrome oder Firefox für eine bessere Anrufqualität"
 
-#: core/templates/mail/html/invitation.html:238
-#: core/templates/mail/text/invitation.txt:18
+#: core/templates/mail/html/invitation.html:230
+#: core/templates/mail/text/invitation.txt:19
 msgid "Test your microphone and camera before joining"
 msgstr "Testen Sie Ihr Mikrofon und Ihre Kamera vor dem Beitritt"
 
-#: core/templates/mail/html/invitation.html:239
-#: core/templates/mail/text/invitation.txt:19
+#: core/templates/mail/html/invitation.html:231
+#: core/templates/mail/text/invitation.txt:20
 msgid "Make sure you have a stable internet connection"
 msgstr "Stellen Sie sicher, dass Sie eine stabile Internetverbindung haben"
 
-#: core/templates/mail/html/invitation.html:248
-#: core/templates/mail/html/screen_recording.html:245
-#: core/templates/mail/text/invitation.txt:21
-#: core/templates/mail/text/screen_recording.txt:23
+#: core/templates/mail/html/invitation.html:240
+#: core/templates/mail/html/screen_recording.html:237
+#: core/templates/mail/text/invitation.txt:22
+#: core/templates/mail/text/screen_recording.txt:24
 #, python-format
 msgid " Thank you for using %(brandname)s. "
 msgstr " Vielen Dank für die Nutzung von %(brandname)s. "
 
-#: core/templates/mail/html/screen_recording.html:188
-#: core/templates/mail/text/screen_recording.txt:6
+#: core/templates/mail/html/invitation.html:271
+#, python-format
+msgid ""
+"This mail has been sent to %(email)s by <a href=\"%(href)s\">%(name)s</a>"
+msgstr ""
+
+#: core/templates/mail/html/screen_recording.html:180
+#: core/templates/mail/text/screen_recording.txt:7
 msgid "Your recording is ready!"
 msgstr "Ihre Aufzeichnung ist fertig!"
 
-#: core/templates/mail/html/screen_recording.html:195
-#: core/templates/mail/text/screen_recording.txt:8
+#: core/templates/mail/html/screen_recording.html:187
+#: core/templates/mail/text/screen_recording.txt:9
 #, python-format
 msgid ""
 " Your recording of \"%(room_name)s\" on %(recording_date)s at "
@@ -606,14 +628,14 @@ msgstr ""
 " Ihre Aufzeichnung von \"%(room_name)s\" am %(recording_date)s um "
 "%(recording_time)s steht nun zum Herunterladen bereit. "
 
-#: core/templates/mail/html/screen_recording.html:195
-#: core/templates/mail/text/screen_recording.txt:8
+#: core/templates/mail/html/screen_recording.html:187
+#: core/templates/mail/text/screen_recording.txt:9
 #, python-format
 msgid " The recording will expire in %(days)s days. "
 msgstr " Die Aufzeichnung wird in %(days)s Tagen ablaufen. "
 
-#: core/templates/mail/html/screen_recording.html:200
-#: core/templates/mail/text/screen_recording.txt:9
+#: core/templates/mail/html/screen_recording.html:192
+#: core/templates/mail/text/screen_recording.txt:10
 msgid ""
 " Sharing the recording via link is not yet available. Only organizers can "
 "download it. "
@@ -621,33 +643,33 @@ msgstr ""
 " Die Freigabe der Aufzeichnung per Link ist noch nicht verfügbar. Nur "
 "Organisatoren können sie herunterladen. "
 
-#: core/templates/mail/html/screen_recording.html:206
-#: core/templates/mail/text/screen_recording.txt:11
+#: core/templates/mail/html/screen_recording.html:198
+#: core/templates/mail/text/screen_recording.txt:12
 msgid "To keep this recording permanently:"
 msgstr "So speichern Sie diese Aufzeichnung dauerhaft:"
 
-#: core/templates/mail/html/screen_recording.html:208
+#: core/templates/mail/html/screen_recording.html:200
 #, python-format
 msgid "Click the \"<a href=\"%(link)s\">Open</a>\" link below "
 msgstr "Klicken Sie auf den Link „<a href=\"%(link)s\">Öffnen</a>\" unten "
 
-#: core/templates/mail/html/screen_recording.html:209
-#: core/templates/mail/text/screen_recording.txt:14
+#: core/templates/mail/html/screen_recording.html:201
+#: core/templates/mail/text/screen_recording.txt:15
 msgid "Use the \"Download\" button in the interface "
 msgstr "Verwenden Sie den Button „Herunterladen“ in der Oberfläche "
 
-#: core/templates/mail/html/screen_recording.html:210
-#: core/templates/mail/text/screen_recording.txt:15
+#: core/templates/mail/html/screen_recording.html:202
+#: core/templates/mail/text/screen_recording.txt:16
 msgid "Save the file to your preferred location"
 msgstr "Speichern Sie die Datei an einem gewünschten Ort"
 
-#: core/templates/mail/html/screen_recording.html:221
-#: core/templates/mail/text/screen_recording.txt:17
+#: core/templates/mail/html/screen_recording.html:213
+#: core/templates/mail/text/screen_recording.txt:18
 msgid "Open"
 msgstr "Öffnen"
 
-#: core/templates/mail/html/screen_recording.html:230
-#: core/templates/mail/text/screen_recording.txt:19
+#: core/templates/mail/html/screen_recording.html:222
+#: core/templates/mail/text/screen_recording.txt:20
 #, python-format
 msgid ""
 " If you have any questions or need assistance, please contact our support "
@@ -656,28 +678,33 @@ msgstr ""
 " Wenn Sie Fragen haben oder Unterstützung benötigen, wenden Sie sich bitte "
 "an unser Support-Team unter %(support_email)s. "
 
-#: core/templates/mail/text/screen_recording.txt:13
+#: core/templates/mail/text/invitation.txt:24
+#, python-format
+msgid "This mail has been sent to %(email)s by %(name)s [%(href)s]"
+msgstr ""
+
+#: core/templates/mail/text/screen_recording.txt:14
 #, fuzzy, python-format
 #| msgid "Click the \"<a href=\"%(link)s\">Open</a>\" link below "
 msgid "Click the \"Open [%(link)s]\" link below "
 msgstr "Klicken Sie auf den Link „<a href=\"%(link)s\">Öffnen</a>\" unten "
 
-#: meet/settings.py:228
+#: meet/settings.py:238
 msgid "English"
 msgstr "Englisch"
 
-#: meet/settings.py:229
+#: meet/settings.py:239
 msgid "French"
 msgstr "Französisch"
 
-#: meet/settings.py:230
+#: meet/settings.py:240
 msgid "Dutch"
 msgstr "Niederländisch"
 
-#: meet/settings.py:231
+#: meet/settings.py:241
 msgid "German"
 msgstr "Deutsch"
 
-#: meet/settings.py:233
+#: meet/settings.py:242
 msgid "Spanish"
 msgstr "Spanisch"

src/backend/locale/en_US/LC_MESSAGES/django.po

@@ -8,7 +8,7 @@ msgid ""
 msgstr ""
 "Project-Id-Version: PACKAGE VERSION\n"
 "Report-Msgid-Bugs-To: \n"
-"POT-Creation-Date: 2026-07-02 10:47+0000\n"
+"POT-Creation-Date: 2026-09-02 22:52+0000\n"
 "PO-Revision-Date: YEAR-MO-DA HO:MI+ZONE\n"
 "Last-Translator: FULL NAME <EMAIL@ADDRESS>\n"
 "Language-Team: LANGUAGE <LL@li.org>\n"
@@ -51,11 +51,11 @@ msgstr ""
 msgid "File preview"
 msgstr ""
 
-#: core/admin.py:300 core/admin.py:443
+#: core/admin.py:300 core/admin.py:450
 msgid "No owner"
 msgstr "No owner"
 
-#: core/admin.py:303 core/admin.py:446
+#: core/admin.py:303 core/admin.py:453
 msgid "Multiple owners"
 msgstr "Multiple owners"
 
@@ -98,11 +98,11 @@ msgstr "%(count)s recording(s) successfully marked as 'Failed to Stop'."
 msgid "Skipped %(count)s recording(s) with an ineligible status."
 msgstr "Skipped %(count)s expired recording(s)."
 
-#: core/admin.py:510
+#: core/admin.py:517
 msgid "No scopes"
 msgstr "No scopes"
 
-#: core/admin.py:512
+#: core/admin.py:519
 msgid "Scopes"
 msgstr "Scopes"
 
@@ -110,183 +110,199 @@ msgstr "Scopes"
 msgid "Creator is me"
 msgstr "Creator is me"
 
-#: core/api/serializers.py:89
+#: core/api/serializers.py:108
 msgid "You must be administrator or owner of a room to add accesses to it."
 msgstr "You must be administrator or owner of a room to add accesses to it."
 
-#: core/api/serializers.py:534
+#: core/api/serializers.py:560
 msgid "This file extension is not allowed."
 msgstr "This file extension is not allowed."
 
-#: core/api/viewsets.py:1222
+#: core/api/viewsets.py:1268
 msgid "You have reached the maximum number of files for this type."
 msgstr "You have reached the maximum number of files for this type."
 
-#: core/models.py:37
+#: core/models.py:38
 msgid "Member"
 msgstr "Member"
 
-#: core/models.py:38
+#: core/models.py:39
 msgid "Administrator"
 msgstr "Administrator"
 
-#: core/models.py:39
+#: core/models.py:40
 msgid "Owner"
 msgstr "Owner"
 
-#: core/models.py:55
+#: core/models.py:56
 msgid "Initiated"
 msgstr "Initiated"
 
-#: core/models.py:56
+#: core/models.py:57
 msgid "Active"
 msgstr "Active"
 
-#: core/models.py:57
+#: core/models.py:58
 msgid "Stopped"
 msgstr "Stopped"
 
-#: core/models.py:58
+#: core/models.py:59
 msgid "Saved"
 msgstr "Saved"
 
-#: core/models.py:59
+#: core/models.py:60
 msgid "Aborted"
 msgstr "Aborted"
 
-#: core/models.py:60
+#: core/models.py:61
 msgid "Failed to Start"
 msgstr "Failed to Start"
 
-#: core/models.py:61
+#: core/models.py:62
 msgid "Failed to Stop"
 msgstr "Failed to Stop"
 
-#: core/models.py:62
+#: core/models.py:63
 msgid "Notification succeeded"
 msgstr "Notification succeeded"
 
-#: core/models.py:65
+#: core/models.py:66
 msgid "External process successful"
 msgstr "External process successful"
 
-#: core/models.py:67
+#: core/models.py:68
 msgid "External process failed"
 msgstr "External process failed"
 
-#: core/models.py:96
+#: core/models.py:97
 msgid "SCREEN_RECORDING"
 msgstr "SCREEN_RECORDING"
 
-#: core/models.py:97
+#: core/models.py:98
 msgid "TRANSCRIPT"
 msgstr "TRANSCRIPT"
 
-#: core/models.py:103
+#: core/models.py:104
 msgid "Public Access"
 msgstr "Public Access"
 
-#: core/models.py:104
+#: core/models.py:105
 msgid "Trusted Access"
 msgstr "Trusted Access"
 
-#: core/models.py:105
+#: core/models.py:106
 msgid "Restricted Access"
 msgstr "Restricted Access"
 
-#: core/models.py:117
+#: core/models.py:118
 msgid "id"
 msgstr "id"
 
-#: core/models.py:118
+#: core/models.py:119
 msgid "primary key for the record as UUID"
 msgstr "primary key for the record as UUID"
 
-#: core/models.py:124
+#: core/models.py:125
 msgid "created on"
 msgstr "created on"
 
-#: core/models.py:125
+#: core/models.py:126
 msgid "date and time at which a record was created"
 msgstr "date and time at which a record was created"
 
-#: core/models.py:130
+#: core/models.py:131
 msgid "updated on"
 msgstr "updated on"
 
-#: core/models.py:131
+#: core/models.py:132
 msgid "date and time at which a record was last updated"
 msgstr "date and time at which a record was last updated"
 
-#: core/models.py:151
-msgid ""
-"Enter a valid sub. This value may contain only letters, numbers, and @/./+/-/"
-"_ characters."
-msgstr ""
-"Enter a valid sub. This value may contain only letters, numbers, and @/./+/-/"
-"_ characters."
-
-#: core/models.py:157
+#: core/models.py:150
 msgid "sub"
 msgstr "sub"
 
-#: core/models.py:159
+#: core/models.py:152
 msgid ""
 "Optional for pending users; required upon account activation. 255 characters "
-"or fewer. Letters, numbers, and @/./+/-/_ characters only."
+"or fewer. Printable ASCII characters only."
 msgstr ""
-"Required. 255 characters or fewer. Letters, numbers, and @/./+/-/_ "
-"characters only."
+"Optional for pending users; required upon account activation. 255 characters "
+"or fewer. Printable ASCII characters only."
 
-#: core/models.py:168
+#: core/validators.py:22
+msgid "Enter a valid sub. This value should be printable ASCII only."
+msgstr "Enter a valid sub. This value should be printable ASCII only."
+
+#: core/models.py:161
 msgid "identity email address"
 msgstr "identity email address"
 
-#: core/models.py:173
+#: core/models.py:166
 msgid "admin email address"
 msgstr "admin email address"
 
-#: core/models.py:175
+#: core/models.py:168
 msgid "full name"
 msgstr "full name"
 
-#: core/models.py:177
+#: core/models.py:170
 msgid "short name"
 msgstr "short name"
 
-#: core/models.py:183
+#: core/models.py:176
 msgid "language"
 msgstr "language"
 
-#: core/models.py:184
+#: core/models.py:177
 msgid "The language in which the user wants to see the interface."
 msgstr "The language in which the user wants to see the interface."
 
-#: core/models.py:190
+#: core/models.py:183
 msgid "The timezone in which the user wants to see times."
 msgstr "The timezone in which the user wants to see times."
 
-#: core/models.py:193
+#: core/models.py:190
+msgid "default room access level"
+msgstr ""
+
+#: core/models.py:192
+msgid ""
+"Access level applied by default to new rooms created by this user. When "
+"empty, the instance default is used."
+msgstr ""
+
+#: core/models.py:199
+#, fuzzy
+#| msgid "Visio room configuration"
+msgid "default room configuration"
+msgstr "Visio room configuration"
+
+#: core/models.py:201
+msgid "Configurations applied by default to new rooms created by this user."
+msgstr ""
+
+#: core/models.py:205
 msgid "device"
 msgstr "device"
 
-#: core/models.py:195
+#: core/models.py:207
 msgid "Whether the user is a device or a real user."
 msgstr "Whether the user is a device or a real user."
 
-#: core/models.py:198
+#: core/models.py:210
 msgid "staff status"
 msgstr "staff status"
 
-#: core/models.py:200
+#: core/models.py:212
 msgid "Whether the user can log into this admin site."
 msgstr "Whether the user can log into this admin site."
 
-#: core/models.py:203
+#: core/models.py:215
 msgid "active"
 msgstr "active"
 
-#: core/models.py:206
+#: core/models.py:218
 msgid ""
 "Whether this user should be treated as active. Unselect this instead of "
 "deleting accounts."
@@ -294,63 +310,63 @@ msgstr ""
 "Whether this user should be treated as active. Unselect this instead of "
 "deleting accounts."
 
-#: core/models.py:219
+#: core/models.py:231
 msgid "user"
 msgstr "user"
 
-#: core/models.py:220
+#: core/models.py:232
 msgid "users"
 msgstr "users"
 
-#: core/models.py:286
+#: core/models.py:298
 msgid "Resource"
 msgstr "Resource"
 
-#: core/models.py:287
+#: core/models.py:299
 msgid "Resources"
 msgstr "Resources"
 
-#: core/models.py:345
+#: core/models.py:357
 msgid "Resource access"
 msgstr "Resource access"
 
-#: core/models.py:346
+#: core/models.py:358
 msgid "Resource accesses"
 msgstr "Resource accesses"
 
-#: core/models.py:352
+#: core/models.py:364
 msgid "Resource access with this User and Resource already exists."
 msgstr "Resource access with this User and Resource already exists."
 
-#: core/models.py:409
+#: core/models.py:421
 msgid "Visio room configuration"
 msgstr "Visio room configuration"
 
-#: core/models.py:410
+#: core/models.py:422
 msgid "Values for Visio parameters to configure the room."
 msgstr "Values for Visio parameters to configure the room."
 
-#: core/models.py:417
+#: core/models.py:429
 msgid "Room PIN code"
 msgstr "Room PIN code"
 
-#: core/models.py:418
+#: core/models.py:430
 msgid "Unique n-digit code that identifies this room in telephony mode."
 msgstr "Unique n-digit code that identifies this room in telephony mode."
 
-#: core/models.py:424 core/models.py:578
+#: core/models.py:436 core/models.py:597
 msgid "Room"
 msgstr "Room"
 
-#: core/models.py:425
+#: core/models.py:437
 msgid "Rooms"
 msgstr "Rooms"
 
-#: core/models.py:589
+#: core/models.py:608
 msgid "Worker ID"
 msgstr "Worker ID"
 
-#: core/models.py:591
+#: core/models.py:610
 msgid ""
 "Enter an identifier for the worker recording.This ID is retained even when "
 "the worker stops, allowing for easy tracking."
@@ -358,171 +374,171 @@ msgstr ""
 "Enter an identifier for the worker recording.This ID is retained even when "
 "the worker stops, allowing for easy tracking."
 
-#: core/models.py:599
+#: core/models.py:618
 msgid "Recording mode"
 msgstr "Recording mode"
 
-#: core/models.py:600
+#: core/models.py:619
 msgid "Defines the mode of recording being called."
 msgstr "Defines the mode of recording being called."
 
-#: core/models.py:605 core/models.py:606
+#: core/models.py:624 core/models.py:625
 msgid "Recording options"
 msgstr "Recording options"
 
-#: core/models.py:613
+#: core/models.py:632
 msgid "External Process ID"
 msgstr "External Process ID"
 
-#: core/models.py:614
+#: core/models.py:633
 msgid "ID of the external process associated with the recording."
 msgstr "ID of the external process associated with the recording."
 
-#: core/models.py:620
+#: core/models.py:639
 msgid "Recording"
 msgstr "Recording"
 
-#: core/models.py:621
+#: core/models.py:640
 msgid "Recordings"
 msgstr "Recordings"
 
-#: core/models.py:731
+#: core/models.py:750
 msgid "Recording/user relation"
 msgstr "Recording/user relation"
 
-#: core/models.py:732
+#: core/models.py:751
 msgid "Recording/user relations"
 msgstr "Recording/user relations"
 
-#: core/models.py:738
+#: core/models.py:757
 msgid "This user is already in this recording."
 msgstr "This user is already in this recording."
 
-#: core/models.py:744
+#: core/models.py:763
 msgid "This team is already in this recording."
 msgstr "This team is already in this recording."
 
-#: core/models.py:750
+#: core/models.py:769
 msgid "Either user or team must be set, not both."
 msgstr "Either user or team must be set, not both."
 
-#: core/models.py:767
+#: core/models.py:786
 #, fuzzy
 #| msgid "created on"
 msgid "Create rooms"
 msgstr "Create rooms"
 
-#: core/models.py:768
+#: core/models.py:787
 msgid "List rooms"
 msgstr "List rooms"
 
-#: core/models.py:769
+#: core/models.py:788
 msgid "Retrieve room details"
 msgstr "Retrieve room details"
 
-#: core/models.py:770
+#: core/models.py:789
 #, fuzzy
 #| msgid "updated on"
 msgid "Update rooms"
 msgstr "Update rooms"
 
-#: core/models.py:771
+#: core/models.py:790
 msgid "Delete rooms"
 msgstr "Delete rooms"
 
-#: core/models.py:784
+#: core/models.py:803
 msgid "Application name"
 msgstr "Application name"
 
-#: core/models.py:785
+#: core/models.py:804
 msgid "Descriptive name for this application."
 msgstr "Descriptive name for this application."
 
-#: core/models.py:795
+#: core/models.py:814
 msgid "Hashed on Save. Copy it now if this is a new secret."
 msgstr "Hashed on Save. Copy it now if this is a new secret."
 
-#: core/models.py:806
+#: core/models.py:825
 msgid "Application"
 msgstr "Application"
 
-#: core/models.py:807
+#: core/models.py:826
 msgid "Applications"
 msgstr "Applications"
 
-#: core/models.py:830
+#: core/models.py:849
 msgid "Enter a valid domain"
 msgstr "Enter a valid domain"
 
-#: core/models.py:833
+#: core/models.py:852
 msgid "Domain"
 msgstr "Domain"
 
-#: core/models.py:834
+#: core/models.py:853
 msgid "Email domain this application can act on behalf of."
 msgstr "Email domain this application can act on behalf of."
 
-#: core/models.py:846
+#: core/models.py:865
 msgid "Application domain"
 msgstr "Application domain"
 
-#: core/models.py:847
+#: core/models.py:866
 msgid "Application domains"
 msgstr "Application domains"
 
-#: core/models.py:865
+#: core/models.py:884
 #, fuzzy
 #| msgid "Recording"
 msgid "Pending"
 msgstr "Pending"
 
-#: core/models.py:866
+#: core/models.py:885
 msgid "Analyzing"
 msgstr ""
 
-#: core/models.py:873
+#: core/models.py:892
 msgid "Ready"
 msgstr "Ready"
 
-#: core/models.py:879
+#: core/models.py:898
 msgid "Background image"
 msgstr "Background image"
 
-#: core/models.py:891
+#: core/models.py:910
 msgid "title"
 msgstr "title"
 
-#: core/models.py:915
+#: core/models.py:934
 msgid "Malware detection info when the analysis status is unsafe."
 msgstr "Malware detection info when the analysis status is unsafe."
 
-#: core/models.py:920
+#: core/models.py:939
 msgid "File"
 msgstr "File"
 
-#: core/models.py:921
+#: core/models.py:940
 msgid "Files"
 msgstr "Files"
 
-#: core/models.py:1041
+#: core/models.py:1060
 #, fuzzy
 #| msgid "This user is already in this recording."
 msgid "This file is already hard deleted."
 msgstr "This file is already hard deleted."
 
-#: core/models.py:1051
+#: core/models.py:1070
 msgid "To hard delete a file, it must first be soft deleted."
 msgstr "To hard delete a file, it must first be soft deleted."
 
-#: core/recording/event/notification.py:123
+#: core/recording/event/notification.py:124
 msgid "Your recording is ready"
 msgstr "Your recording is ready"
 
-#: core/recording/event/notification.py:194
+#: core/recording/event/notification.py:195
 msgid "Transcription"
 msgstr "Transcription"
 
-#: core/recording/event/notification.py:204
+#: core/recording/event/notification.py:206
 #, python-brace-format
 msgid "Meeting \"{room}\" on {room_recording_date} at {room_recording_time}"
 msgstr "Meeting \"{room}\" on {room_recording_date} at {room_recording_time}"
@@ -532,25 +548,25 @@ msgstr "Meeting \"{room}\" on {room_recording_date} at {room_recording_time}"
 msgid "Video call in progress: {sender.email} is waiting for you to connect"
 msgstr "Video call in progress: {sender.email} is waiting for you to connect"
 
-#: core/templates/mail/html/invitation.html:159
-#: core/templates/mail/html/screen_recording.html:159
-#: core/templates/mail/text/invitation.txt:3
-#: core/templates/mail/text/screen_recording.txt:3
+#: core/templates/mail/html/invitation.html:151
+#: core/templates/mail/html/screen_recording.html:151
+#: core/templates/mail/text/invitation.txt:4
+#: core/templates/mail/text/screen_recording.txt:4
 msgid "Logo email"
 msgstr "Logo email"
 
-#: core/templates/mail/html/invitation.html:189
-#: core/templates/mail/text/invitation.txt:5
+#: core/templates/mail/html/invitation.html:181
+#: core/templates/mail/text/invitation.txt:6
 msgid "invites you to join an ongoing video call"
 msgstr "invites you to join an ongoing video call"
 
-#: core/templates/mail/html/invitation.html:200
-#: core/templates/mail/text/invitation.txt:7
+#: core/templates/mail/html/invitation.html:192
+#: core/templates/mail/text/invitation.txt:8
 msgid "JOIN THE CALL"
 msgstr "JOIN THE CALL"
 
-#: core/templates/mail/html/invitation.html:227
-#: core/templates/mail/text/invitation.txt:13
+#: core/templates/mail/html/invitation.html:219
+#: core/templates/mail/text/invitation.txt:14
 msgid ""
 "If you can't click the button, copy and paste the URL into your browser to "
 "join the call."
@@ -558,41 +574,47 @@ msgstr ""
 "If you can't click the button, copy and paste the URL into your browser to "
 "join the call."
 
-#: core/templates/mail/html/invitation.html:235
-#: core/templates/mail/text/invitation.txt:15
+#: core/templates/mail/html/invitation.html:227
+#: core/templates/mail/text/invitation.txt:16
 msgid "Tips for a better experience:"
 msgstr "Tips for a better experience:"
 
-#: core/templates/mail/html/invitation.html:237
-#: core/templates/mail/text/invitation.txt:17
+#: core/templates/mail/html/invitation.html:229
+#: core/templates/mail/text/invitation.txt:18
 msgid "Use Chrome or Firefox for better call quality"
 msgstr "Use Chrome or Firefox for better call quality"
 
-#: core/templates/mail/html/invitation.html:238
-#: core/templates/mail/text/invitation.txt:18
+#: core/templates/mail/html/invitation.html:230
+#: core/templates/mail/text/invitation.txt:19
 msgid "Test your microphone and camera before joining"
 msgstr "Test your microphone and camera before joining"
 
-#: core/templates/mail/html/invitation.html:239
-#: core/templates/mail/text/invitation.txt:19
+#: core/templates/mail/html/invitation.html:231
+#: core/templates/mail/text/invitation.txt:20
 msgid "Make sure you have a stable internet connection"
 msgstr "Make sure you have a stable internet connection"
 
-#: core/templates/mail/html/invitation.html:248
-#: core/templates/mail/html/screen_recording.html:245
-#: core/templates/mail/text/invitation.txt:21
-#: core/templates/mail/text/screen_recording.txt:23
+#: core/templates/mail/html/invitation.html:240
+#: core/templates/mail/html/screen_recording.html:237
+#: core/templates/mail/text/invitation.txt:22
+#: core/templates/mail/text/screen_recording.txt:24
 #, python-format
 msgid " Thank you for using %(brandname)s. "
 msgstr " Thank you for using %(brandname)s. "
 
-#: core/templates/mail/html/screen_recording.html:188
-#: core/templates/mail/text/screen_recording.txt:6
+#: core/templates/mail/html/invitation.html:271
+#, python-format
+msgid ""
+"This mail has been sent to %(email)s by <a href=\"%(href)s\">%(name)s</a>"
+msgstr ""
+
+#: core/templates/mail/html/screen_recording.html:180
+#: core/templates/mail/text/screen_recording.txt:7
 msgid "Your recording is ready!"
 msgstr "Your recording is ready!"
 
-#: core/templates/mail/html/screen_recording.html:195
-#: core/templates/mail/text/screen_recording.txt:8
+#: core/templates/mail/html/screen_recording.html:187
+#: core/templates/mail/text/screen_recording.txt:9
 #, python-format
 msgid ""
 " Your recording of \"%(room_name)s\" on %(recording_date)s at "
@@ -601,14 +623,14 @@ msgstr ""
 " Your recording of \"%(room_name)s\" on %(recording_date)s at "
 "%(recording_time)s is now ready to download. "
 
-#: core/templates/mail/html/screen_recording.html:195
-#: core/templates/mail/text/screen_recording.txt:8
+#: core/templates/mail/html/screen_recording.html:187
+#: core/templates/mail/text/screen_recording.txt:9
 #, python-format
 msgid " The recording will expire in %(days)s days. "
 msgstr " The recording will expire in %(days)s days. "
 
-#: core/templates/mail/html/screen_recording.html:200
-#: core/templates/mail/text/screen_recording.txt:9
+#: core/templates/mail/html/screen_recording.html:192
+#: core/templates/mail/text/screen_recording.txt:10
 msgid ""
 " Sharing the recording via link is not yet available. Only organizers can "
 "download it. "
@@ -616,33 +638,33 @@ msgstr ""
 " Sharing the recording via link is not yet available. Only organizers can "
 "download it. "
 
-#: core/templates/mail/html/screen_recording.html:206
-#: core/templates/mail/text/screen_recording.txt:11
+#: core/templates/mail/html/screen_recording.html:198
+#: core/templates/mail/text/screen_recording.txt:12
 msgid "To keep this recording permanently:"
 msgstr "To keep this recording permanently:"
 
-#: core/templates/mail/html/screen_recording.html:208
+#: core/templates/mail/html/screen_recording.html:200
 #, python-format
 msgid "Click the \"<a href=\"%(link)s\">Open</a>\" link below "
 msgstr "Click the \"<a href=\"%(link)s\">Open</a>\" link below "
 
-#: core/templates/mail/html/screen_recording.html:209
-#: core/templates/mail/text/screen_recording.txt:14
+#: core/templates/mail/html/screen_recording.html:201
+#: core/templates/mail/text/screen_recording.txt:15
 msgid "Use the \"Download\" button in the interface "
 msgstr "Use the \"Download\" button in the interface "
 
-#: core/templates/mail/html/screen_recording.html:210
-#: core/templates/mail/text/screen_recording.txt:15
+#: core/templates/mail/html/screen_recording.html:202
+#: core/templates/mail/text/screen_recording.txt:16
 msgid "Save the file to your preferred location"
 msgstr "Save the file to your preferred location"
 
-#: core/templates/mail/html/screen_recording.html:221
-#: core/templates/mail/text/screen_recording.txt:17
+#: core/templates/mail/html/screen_recording.html:213
+#: core/templates/mail/text/screen_recording.txt:18
 msgid "Open"
 msgstr "Open"
 
-#: core/templates/mail/html/screen_recording.html:230
-#: core/templates/mail/text/screen_recording.txt:19
+#: core/templates/mail/html/screen_recording.html:222
+#: core/templates/mail/text/screen_recording.txt:20
 #, python-format
 msgid ""
 " If you have any questions or need assistance, please contact our support "
@@ -651,28 +673,33 @@ msgstr ""
 " If you have any questions or need assistance, please contact our support "
 "team at %(support_email)s. "
 
-#: core/templates/mail/text/screen_recording.txt:13
+#: core/templates/mail/text/invitation.txt:24
+#, python-format
+msgid "This mail has been sent to %(email)s by %(name)s [%(href)s]"
+msgstr ""
+
+#: core/templates/mail/text/screen_recording.txt:14
 #, fuzzy, python-format
 #| msgid "Click the \"<a href=\"%(link)s\">Open</a>\" link below "
 msgid "Click the \"Open [%(link)s]\" link below "
 msgstr "Click the \"<a href=\"%(link)s\">Open</a>\" link below "
 
-#: meet/settings.py:228
+#: meet/settings.py:238
 msgid "English"
 msgstr "English"
 
-#: meet/settings.py:229
+#: meet/settings.py:239
 msgid "French"
 msgstr "French"
 
-#: meet/settings.py:230
+#: meet/settings.py:240
 msgid "Dutch"
 msgstr "Dutch"
 
-#: meet/settings.py:231
+#: meet/settings.py:241
 msgid "German"
 msgstr "German"
 
-#: meet/settings.py:233
+#: meet/settings.py:242
 msgid "Spanish"
 msgstr "Spanish"

src/backend/locale/es_ES/LC_MESSAGES/django.po

@@ -8,7 +8,7 @@ msgid ""
 msgstr ""
 "Project-Id-Version: PACKAGE VERSION\n"
 "Report-Msgid-Bugs-To: \n"
-"POT-Creation-Date: 2026-07-02 10:47+0000\n"
+"POT-Creation-Date: 2026-09-02 22:52+0000\n"
 "PO-Revision-Date: YEAR-MO-DA HO:MI+ZONE\n"
 "Last-Translator: FULL NAME <EMAIL@ADDRESS>\n"
 "Language-Team: LANGUAGE <LL@li.org>\n"
@@ -41,20 +41,20 @@ msgstr "Eliminar Salas"
 msgid "Derived info"
 msgstr ""
 
-#: core/admin.py:237
 # 'Marcas de tiempo' is a bad translation for spanish
+#: core/admin.py:237
 msgid "Timestamps"
-msgstr "" 
+msgstr ""
 
 #: core/admin.py:240
 msgid "File preview"
 msgstr "Vista previa"
 
-#: core/admin.py:300 core/admin.py:443
+#: core/admin.py:300 core/admin.py:450
 msgid "No owner"
 msgstr "Sin propietario"
 
-#: core/admin.py:303 core/admin.py:446
+#: core/admin.py:303 core/admin.py:453
 msgid "Multiple owners"
 msgstr "Varios propietarios"
 
@@ -89,18 +89,19 @@ msgstr "Marcar las grabaciones seleccionadas como «Error al detener»"
 #: core/admin.py:386
 #, python-format
 msgid "%(count)s recording(s) successfully marked as 'Failed to Stop'."
-msgstr "%(count)s grabación(es) marcada(s) correctamente como «Error al detener»."
+msgstr ""
+"%(count)s grabación(es) marcada(s) correctamente como «Error al detener»."
 
 #: core/admin.py:394
 #, python-format
 msgid "Skipped %(count)s recording(s) with an ineligible status."
 msgstr "Se han omitido %(count)s grabación(es) con un estado no elegible."
 
-#: core/admin.py:510
+#: core/admin.py:517
 msgid "No scopes"
 msgstr ""
 
-#: core/admin.py:512
+#: core/admin.py:519
 msgid "Scopes"
 msgstr "Ámbitos"
 
@@ -108,545 +109,599 @@ msgstr "Ámbitos"
 msgid "Creator is me"
 msgstr "Yo soy el creador"
 
-#: core/api/serializers.py:89
+#: core/api/serializers.py:108
 msgid "You must be administrator or owner of a room to add accesses to it."
-msgstr "Debes ser administrador o propietario de una reunión para añadirle accesos."
+msgstr ""
+"Debes ser administrador o propietario de una reunión para añadirle accesos."
 
-#: core/api/serializers.py:534
+#: core/api/serializers.py:560
 msgid "This file extension is not allowed."
 msgstr "Esta extensión de archivo no está permitida."
 
-#: core/api/viewsets.py:1222
+#: core/api/viewsets.py:1268
 msgid "You have reached the maximum number of files for this type."
 msgstr "Has alcanzado el número máximo de archivos de este tipo."
 
-#: core/models.py:37
+#: core/models.py:38
 msgid "Member"
 msgstr "Miembro"
 
-#: core/models.py:38
+#: core/models.py:39
 msgid "Administrator"
 msgstr "Administrador"
 
-#: core/models.py:39
+#: core/models.py:40
 msgid "Owner"
 msgstr "Propietario"
 
-#: core/models.py:55
 # To check here and following lines for gender agreement (Masculine/Feminine)
+#: core/models.py:56
 msgid "Initiated"
 msgstr "Iniciada"
 
-#: core/models.py:56
+#: core/models.py:57
 msgid "Active"
 msgstr "Activa"
 
-#: core/models.py:57
+#: core/models.py:58
 msgid "Stopped"
 msgstr "Detenida"
 
-#: core/models.py:58
+#: core/models.py:59
 msgid "Saved"
 msgstr "Guardada"
 
-#: core/models.py:59
+#: core/models.py:60
 msgid "Aborted"
 msgstr "Cancelada"
 
-#: core/models.py:60
+#: core/models.py:61
 msgid "Failed to Start"
 msgstr "Error al iniciar"
 
-#: core/models.py:61
+#: core/models.py:62
 msgid "Failed to Stop"
 msgstr "Error al detener"
 
-#: core/models.py:62
+#: core/models.py:63
 msgid "Notification succeeded"
 msgstr "Notificado correctamente"
 
-#: core/models.py:65
+#: core/models.py:66
 msgid "External process successful"
 msgstr "Proceso externo finalizado correctamente"
 
-#: core/models.py:67
+#: core/models.py:68
 msgid "External process failed"
 msgstr "Error en el Proceso externo"
 
-#: core/models.py:96
+#: core/models.py:97
 msgid "SCREEN_RECORDING"
 msgstr "GRABACIÓN_DE_PANTALLA"
 
-#: core/models.py:97
+#: core/models.py:98
 msgid "TRANSCRIPT"
 msgstr "TRANSCRIPCIÓN"
 
-#: core/models.py:103
+#: core/models.py:104
 msgid "Public Access"
 msgstr "Acceso público"
 
-#: core/models.py:104
+#: core/models.py:105
 msgid "Trusted Access"
 msgstr "Acceso usuarios autorizados"
 
-#: core/models.py:105
+#: core/models.py:106
 msgid "Restricted Access"
 msgstr "Acceso restringido"
 
-#: core/models.py:117
+#: core/models.py:118
 msgid "id"
 msgstr "id"
 
-#: core/models.py:118
+#: core/models.py:119
 msgid "primary key for the record as UUID"
 msgstr "clave primaria del registro en forma de UUID"
 
-#: core/models.py:124
+#: core/models.py:125
 msgid "created on"
 msgstr "creado el"
 
-#: core/models.py:125
+#: core/models.py:126
 msgid "date and time at which a record was created"
 msgstr "fecha y hora en que se creó un registro"
 
-#: core/models.py:130
+#: core/models.py:131
 msgid "updated on"
 msgstr "actualizado el"
 
-#: core/models.py:131
+#: core/models.py:132
 msgid "date and time at which a record was last updated"
 msgstr "fecha y hora de la última actualización de un registro"
 
-#: core/models.py:151
-msgid ""
-"Enter a valid sub. This value may contain only letters, numbers, and @/./+/-/"
-"_ characters."
-msgstr "Introduce un sub válido. Este valor solo puede contener letras, números y los caracteres @/./+/-/_."
-
-#: core/models.py:157
+#: core/models.py:150
 msgid "sub"
 msgstr "sub"
 
-#: core/models.py:159
+#: core/models.py:152
 msgid ""
 "Optional for pending users; required upon account activation. 255 characters "
-"or fewer. Letters, numbers, and @/./+/-/_ characters only."
-msgstr "Opcional para los usuarios pendientes; obligatorio al activar la cuenta. 255 caracteres como máximo. Solo letras, números y los caracteres @/./+/-/_."
+"or fewer. Printable ASCII characters only."
+msgstr ""
+"Opcional para los usuarios pendientes; obligatorio al activar la cuenta. "
+"255 caracteres como máximo. Solo caracteres ASCII imprimibles."
 
-#: core/models.py:168
+#: core/validators.py:22
+msgid "Enter a valid sub. This value should be printable ASCII only."
+msgstr "Introduzca un sub válido. Este valor solo debe contener caracteres ASCII imprimibles."
+
+#: core/models.py:161
 msgid "identity email address"
 msgstr "dirección de correo electrónico"
 
-#: core/models.py:173
+#: core/models.py:166
 msgid "admin email address"
 msgstr "dirección de correo electrónico de administrador"
 
-#: core/models.py:175
+#: core/models.py:168
 msgid "full name"
 msgstr "nombre completo"
 
-#: core/models.py:177
+#: core/models.py:170
 msgid "short name"
 msgstr "nombre corto"
 
-#: core/models.py:183
+#: core/models.py:176
 msgid "language"
 msgstr "idioma"
 
-#: core/models.py:184
+#: core/models.py:177
 msgid "The language in which the user wants to see the interface."
 msgstr "El idioma preferido de interfaz."
 
-#: core/models.py:190
+#: core/models.py:183
 msgid "The timezone in which the user wants to see times."
 msgstr "La zona horaria en la que el usuario quiere ver las horas."
 
-#: core/models.py:193
+#: core/models.py:190
+msgid "default room access level"
+msgstr ""
+
+#: core/models.py:192
+msgid ""
+"Access level applied by default to new rooms created by this user. When "
+"empty, the instance default is used."
+msgstr ""
+
+#: core/models.py:199
+#, fuzzy
+#| msgid "Visio room configuration"
+msgid "default room configuration"
+msgstr "Configuración de la videoconferencia"
+
+#: core/models.py:201
+msgid "Configurations applied by default to new rooms created by this user."
+msgstr ""
+
+#: core/models.py:205
 msgid "device"
 msgstr "dispositivo"
 
-#: core/models.py:195
+#: core/models.py:207
 msgid "Whether the user is a device or a real user."
 msgstr "Si el usuario es un dispositivo o un usuario real."
 
-#: core/models.py:198
+#: core/models.py:210
 msgid "staff status"
 msgstr "estado del personal"
 
-#: core/models.py:200
+#: core/models.py:212
 msgid "Whether the user can log into this admin site."
 msgstr "Si el usuario puede acceder a este sitio de administración."
 
-#: core/models.py:203
+#: core/models.py:215
 msgid "active"
 msgstr "activo"
 
-#: core/models.py:206
+#: core/models.py:218
 msgid ""
 "Whether this user should be treated as active. Unselect this instead of "
 "deleting accounts."
-msgstr "Si este usuario debe considerarse activo. Desmarca esta opción en lugar de eliminar cuentas."
+msgstr ""
+"Si este usuario debe considerarse activo. Desmarca esta opción en lugar de "
+"eliminar cuentas."
 
-#: core/models.py:219
+#: core/models.py:231
 msgid "user"
 msgstr "usuario"
 
-#: core/models.py:220
+#: core/models.py:232
 msgid "users"
 msgstr "usuarios"
 
-#: core/models.py:286
+#: core/models.py:298
 msgid "Resource"
 msgstr "Recurso"
 
-#: core/models.py:287
+#: core/models.py:299
 msgid "Resources"
 msgstr "Recursos"
 
-#: core/models.py:345
+#: core/models.py:357
 msgid "Resource access"
 msgstr "Acceso a recursos"
 
-#: core/models.py:346
+#: core/models.py:358
 msgid "Resource accesses"
 msgstr "Accesos a recursos"
 
-#: core/models.py:352
+#: core/models.py:364
 msgid "Resource access with this User and Resource already exists."
 msgstr "Ya existe un acceso al recurso con este usuario y este recurso."
 
-#: core/models.py:409
+#: core/models.py:421
 msgid "Visio room configuration"
 msgstr "Configuración de la videoconferencia"
 
-#: core/models.py:410
+#: core/models.py:422
 msgid "Values for Visio parameters to configure the room."
-msgstr "Valores de los parámetros de videoconferencia para configurar la reunión."
+msgstr ""
+"Valores de los parámetros de videoconferencia para configurar la reunión."
 
-#: core/models.py:417
+#: core/models.py:429
 msgid "Room PIN code"
 msgstr "Código PIN de la reunión"
 
-#: core/models.py:418
+#: core/models.py:430
 msgid "Unique n-digit code that identifies this room in telephony mode."
-msgstr "Código único de n dígitos que identifica esta reunión en modo telefónico."
+msgstr ""
+"Código único de n dígitos que identifica esta reunión en modo telefónico."
 
-#: core/models.py:424 core/models.py:578
+#: core/models.py:436 core/models.py:597
 msgid "Room"
 msgstr "Reunión"
 
-#: core/models.py:425
+#: core/models.py:437
 msgid "Rooms"
 msgstr "Reuniones"
 
-#: core/models.py:589
+#: core/models.py:608
 msgid "Worker ID"
 msgstr "ID del worker"
 
-#: core/models.py:591
+#: core/models.py:610
 msgid ""
 "Enter an identifier for the worker recording.This ID is retained even when "
 "the worker stops, allowing for easy tracking."
-msgstr "Introduce un identificador para la grabación del worker. Este identificador se conserva incluso cuando el worker se detiene, lo que permite un seguimiento sencillo."
+msgstr ""
+"Introduce un identificador para la grabación del worker. Este identificador "
+"se conserva incluso cuando el worker se detiene, lo que permite un "
+"seguimiento sencillo."
 
-#: core/models.py:599
+#: core/models.py:618
 msgid "Recording mode"
 msgstr "Modo de grabación"
 
-#: core/models.py:600
+#: core/models.py:619
 msgid "Defines the mode of recording being called."
 msgstr "Define el modo de grabación a utilizar."
 
-#: core/models.py:605 core/models.py:606
+#: core/models.py:624 core/models.py:625
 msgid "Recording options"
 msgstr "Opciones de grabación"
 
-#: core/models.py:613
+#: core/models.py:632
 msgid "External Process ID"
 msgstr "ID del proceso externo"
 
-#: core/models.py:614
+#: core/models.py:633
 msgid "ID of the external process associated with the recording."
 msgstr "ID del proceso externo asociado a la grabación."
 
-#: core/models.py:620
+#: core/models.py:639
 msgid "Recording"
 msgstr "Grabación"
 
-#: core/models.py:621
+#: core/models.py:640
 msgid "Recordings"
 msgstr "Grabaciones"
 
-#: core/models.py:731
+#: core/models.py:750
 msgid "Recording/user relation"
 msgstr "Relación grabación/usuario"
 
-#: core/models.py:732
+#: core/models.py:751
 msgid "Recording/user relations"
 msgstr "Relaciones grabación/usuario"
 
-#: core/models.py:738
+#: core/models.py:757
 msgid "This user is already in this recording."
 msgstr "Este usuario ya está en esta grabación."
 
-#: core/models.py:744
+#: core/models.py:763
 msgid "This team is already in this recording."
 msgstr "Este equipo ya está en esta grabación."
 
-#: core/models.py:750
+#: core/models.py:769
 msgid "Either user or team must be set, not both."
 msgstr "Debe definirse el usuario o el equipo, pero no ambos."
 
-#: core/models.py:767
+#: core/models.py:786
 msgid "Create rooms"
 msgstr "Crear reunión"
 
-#: core/models.py:768
+#: core/models.py:787
 msgid "List rooms"
 msgstr "Listar reuniones"
 
-#: core/models.py:769
+#: core/models.py:788
 msgid "Retrieve room details"
 msgstr "Ver los detalles de una reunión"
 
-#: core/models.py:770
+#: core/models.py:789
 msgid "Update rooms"
 msgstr "Actualizar las reuniones"
 
-#: core/models.py:771
+#: core/models.py:790
 msgid "Delete rooms"
 msgstr "Eliminar las reuniones"
 
-#: core/models.py:784
+#: core/models.py:803
 msgid "Application name"
 msgstr "Nombre de la aplicación"
 
-#: core/models.py:785
+#: core/models.py:804
 msgid "Descriptive name for this application."
 msgstr "Nombre descriptivo de esta aplicación."
 
-#: core/models.py:795
+#: core/models.py:814
 msgid "Hashed on Save. Copy it now if this is a new secret."
 msgstr "Se cifra al guardar. Cópialo ahora si se trata de un secreto nuevo."
 
-#: core/models.py:806
+#: core/models.py:825
 msgid "Application"
 msgstr "Aplicación"
 
-#: core/models.py:807
+#: core/models.py:826
 msgid "Applications"
 msgstr "Aplicaciones"
 
-#: core/models.py:830
+#: core/models.py:849
 msgid "Enter a valid domain"
 msgstr "Introduce un dominio válido"
 
-#: core/models.py:833
+#: core/models.py:852
 msgid "Domain"
 msgstr "Dominio"
 
-#: core/models.py:834
+#: core/models.py:853
 msgid "Email domain this application can act on behalf of."
-msgstr "Dominio de correo electrónico en cuyo nombre puede actuar esta aplicación."
+msgstr ""
+"Dominio de correo electrónico en cuyo nombre puede actuar esta aplicación."
 
-#: core/models.py:846
+#: core/models.py:865
 msgid "Application domain"
 msgstr "Dominio de aplicación"
 
-#: core/models.py:847
+#: core/models.py:866
 msgid "Application domains"
 msgstr "Dominios de aplicación"
 
-#: core/models.py:865
+#: core/models.py:884
 msgid "Pending"
 msgstr "Pendiente"
 
-#: core/models.py:866
+#: core/models.py:885
 msgid "Analyzing"
 msgstr "Analizando"
 
-#: core/models.py:873
+#: core/models.py:892
 msgid "Ready"
 msgstr "Listo"
 
-#: core/models.py:879
+#: core/models.py:898
 msgid "Background image"
 msgstr "Imagen de fondo"
 
-#: core/models.py:891
+#: core/models.py:910
 msgid "title"
 msgstr "título"
 
-#: core/models.py:915
+#: core/models.py:934
 msgid "Malware detection info when the analysis status is unsafe."
-msgstr "Información sobre la detección de malware cuando el estado del análisis no es seguro."
+msgstr ""
+"Información sobre la detección de malware cuando el estado del análisis no "
+"es seguro."
 
-#: core/models.py:920
+#: core/models.py:939
 msgid "File"
 msgstr "Archivo"
 
-#: core/models.py:921
+#: core/models.py:940
 msgid "Files"
 msgstr "Archivos"
 
-#: core/models.py:1041
+#: core/models.py:1060
 msgid "This file is already hard deleted."
 msgstr "Este archivo ya se ha eliminado definitivamente."
 
-#: core/models.py:1051
+#: core/models.py:1070
 msgid "To hard delete a file, it must first be soft deleted."
-msgstr "Para eliminar definitivamente un archivo, primero debe haberse marcado como eliminado."
+msgstr ""
+"Para eliminar definitivamente un archivo, primero debe haberse marcado como "
+"eliminado."
 
-#: core/recording/event/notification.py:123
+#: core/recording/event/notification.py:124
 msgid "Your recording is ready"
 msgstr "Tu grabación está lista"
 
-#: core/recording/event/notification.py:194
+#: core/recording/event/notification.py:195
 msgid "Transcription"
 msgstr "Transcripción"
 
-#: core/recording/event/notification.py:204
+#: core/recording/event/notification.py:206
 #, python-brace-format
 msgid "Meeting \"{room}\" on {room_recording_date} at {room_recording_time}"
-msgstr "Reunión \"{room}\" del {room_recording_date} a las {room_recording_time}"
+msgstr ""
+"Reunión \"{room}\" del {room_recording_date} a las {room_recording_time}"
 
 #: core/services/invitation.py:44
 #, python-brace-format
 msgid "Video call in progress: {sender.email} is waiting for you to connect"
 msgstr "Videollamada en curso: {sender.email} está esperando a que te conectes"
 
-#: core/templates/mail/html/invitation.html:159
-#: core/templates/mail/html/screen_recording.html:159
-#: core/templates/mail/text/invitation.txt:3
-#: core/templates/mail/text/screen_recording.txt:3
+#: core/templates/mail/html/invitation.html:151
+#: core/templates/mail/html/screen_recording.html:151
+#: core/templates/mail/text/invitation.txt:4
+#: core/templates/mail/text/screen_recording.txt:4
 msgid "Logo email"
 msgstr "Logotipo del correo"
 
-#: core/templates/mail/html/invitation.html:189
-#: core/templates/mail/text/invitation.txt:5
+#: core/templates/mail/html/invitation.html:181
+#: core/templates/mail/text/invitation.txt:6
 msgid "invites you to join an ongoing video call"
 msgstr "te invita a unirte a una videollamada en curso"
 
-#: core/templates/mail/html/invitation.html:200
-#: core/templates/mail/text/invitation.txt:7
+#: core/templates/mail/html/invitation.html:192
+#: core/templates/mail/text/invitation.txt:8
 msgid "JOIN THE CALL"
 msgstr "UNIRSE A LA LLAMADA"
 
-#: core/templates/mail/html/invitation.html:227
-#: core/templates/mail/text/invitation.txt:13
+#: core/templates/mail/html/invitation.html:219
+#: core/templates/mail/text/invitation.txt:14
 msgid ""
 "If you can't click the button, copy and paste the URL into your browser to "
 "join the call."
-msgstr "Si no puedes hacer clic en el botón, copia y pega la URL en tu navegador para unirte a la llamada."
+msgstr ""
+"Si no puedes hacer clic en el botón, copia y pega la URL en tu navegador "
+"para unirte a la llamada."
 
-#: core/templates/mail/html/invitation.html:235
-#: core/templates/mail/text/invitation.txt:15
+#: core/templates/mail/html/invitation.html:227
+#: core/templates/mail/text/invitation.txt:16
 msgid "Tips for a better experience:"
 msgstr "Consejos para una mejor experiencia:"
 
-#: core/templates/mail/html/invitation.html:237
-#: core/templates/mail/text/invitation.txt:17
+#: core/templates/mail/html/invitation.html:229
+#: core/templates/mail/text/invitation.txt:18
 msgid "Use Chrome or Firefox for better call quality"
 msgstr "Usa Chrome o Firefox para una mejor calidad de llamada"
 
-#: core/templates/mail/html/invitation.html:238
-#: core/templates/mail/text/invitation.txt:18
+#: core/templates/mail/html/invitation.html:230
+#: core/templates/mail/text/invitation.txt:19
 msgid "Test your microphone and camera before joining"
 msgstr "Prueba tu micrófono y tu cámara antes de unirte"
 
-#: core/templates/mail/html/invitation.html:239
-#: core/templates/mail/text/invitation.txt:19
+#: core/templates/mail/html/invitation.html:231
+#: core/templates/mail/text/invitation.txt:20
 msgid "Make sure you have a stable internet connection"
 msgstr "Asegúrate de tener una conexión a internet estable"
 
-#: core/templates/mail/html/invitation.html:248
-#: core/templates/mail/html/screen_recording.html:245
-#: core/templates/mail/text/invitation.txt:21
-#: core/templates/mail/text/screen_recording.txt:23
+#: core/templates/mail/html/invitation.html:240
+#: core/templates/mail/html/screen_recording.html:237
+#: core/templates/mail/text/invitation.txt:22
+#: core/templates/mail/text/screen_recording.txt:24
 #, python-format
 msgid " Thank you for using %(brandname)s. "
 msgstr " Gracias por usar %(brandname)s. "
 
-#: core/templates/mail/html/screen_recording.html:188
-#: core/templates/mail/text/screen_recording.txt:6
+#: core/templates/mail/html/invitation.html:271
+#, python-format
+msgid ""
+"This mail has been sent to %(email)s by <a href=\"%(href)s\">%(name)s</a>"
+msgstr ""
+
+#: core/templates/mail/html/screen_recording.html:180
+#: core/templates/mail/text/screen_recording.txt:7
 msgid "Your recording is ready!"
 msgstr "¡Tu grabación está lista!"
 
-#: core/templates/mail/html/screen_recording.html:195
-#: core/templates/mail/text/screen_recording.txt:8
+#: core/templates/mail/html/screen_recording.html:187
+#: core/templates/mail/text/screen_recording.txt:9
 #, python-format
 msgid ""
 " Your recording of \"%(room_name)s\" on %(recording_date)s at "
 "%(recording_time)s is now ready to download. "
-msgstr " Tu grabación de \"%(room_name)s\" del %(recording_date)s a las %(recording_time)s ya está lista para descargar. "
+msgstr ""
+" Tu grabación de \"%(room_name)s\" del %(recording_date)s a las "
+"%(recording_time)s ya está lista para descargar. "
 
-#: core/templates/mail/html/screen_recording.html:195
-#: core/templates/mail/text/screen_recording.txt:8
+#: core/templates/mail/html/screen_recording.html:187
+#: core/templates/mail/text/screen_recording.txt:9
 #, python-format
 msgid " The recording will expire in %(days)s days. "
 msgstr " La grabación caducará dentro de %(days)s días. "
 
-#: core/templates/mail/html/screen_recording.html:200
-#: core/templates/mail/text/screen_recording.txt:9
+#: core/templates/mail/html/screen_recording.html:192
+#: core/templates/mail/text/screen_recording.txt:10
 msgid ""
 " Sharing the recording via link is not yet available. Only organizers can "
 "download it. "
-msgstr " Compartir la grabación mediante un enlace todavía no está disponible. Solo los organizadores pueden descargarla. "
+msgstr ""
+" Compartir la grabación mediante un enlace todavía no está disponible. Solo "
+"los organizadores pueden descargarla. "
 
-#: core/templates/mail/html/screen_recording.html:206
-#: core/templates/mail/text/screen_recording.txt:11
+#: core/templates/mail/html/screen_recording.html:198
+#: core/templates/mail/text/screen_recording.txt:12
 msgid "To keep this recording permanently:"
 msgstr "Para conservar esta grabación de forma permanente:"
 
-#: core/templates/mail/html/screen_recording.html:208
+#: core/templates/mail/html/screen_recording.html:200
 #, python-format
 msgid "Click the \"<a href=\"%(link)s\">Open</a>\" link below "
-msgstr "Haz clic en el enlace \"<a href=\"%(link)s\">Abrir</a>\" que aparece abajo "
+msgstr ""
+"Haz clic en el enlace \"<a href=\"%(link)s\">Abrir</a>\" que aparece abajo "
 
-#: core/templates/mail/html/screen_recording.html:209
-#: core/templates/mail/text/screen_recording.txt:14
+#: core/templates/mail/html/screen_recording.html:201
+#: core/templates/mail/text/screen_recording.txt:15
 msgid "Use the \"Download\" button in the interface "
 msgstr "Usa el botón \"Descargar\" de la interfaz "
 
-#: core/templates/mail/html/screen_recording.html:210
-#: core/templates/mail/text/screen_recording.txt:15
+#: core/templates/mail/html/screen_recording.html:202
+#: core/templates/mail/text/screen_recording.txt:16
 msgid "Save the file to your preferred location"
 msgstr "Guarda el archivo en la ubicación que prefieras"
 
-#: core/templates/mail/html/screen_recording.html:221
-#: core/templates/mail/text/screen_recording.txt:17
+#: core/templates/mail/html/screen_recording.html:213
+#: core/templates/mail/text/screen_recording.txt:18
 msgid "Open"
 msgstr "Abrir"
 
-#: core/templates/mail/html/screen_recording.html:230
-#: core/templates/mail/text/screen_recording.txt:19
+#: core/templates/mail/html/screen_recording.html:222
+#: core/templates/mail/text/screen_recording.txt:20
 #, python-format
 msgid ""
 " If you have any questions or need assistance, please contact our support "
 "team at %(support_email)s. "
-msgstr " Si tienes alguna pregunta o necesitas ayuda, ponte en contacto con nuestro equipo de soporte en %(support_email)s. "
+msgstr ""
+" Si tienes alguna pregunta o necesitas ayuda, ponte en contacto con nuestro "
+"equipo de soporte en %(support_email)s. "
 
-#: core/templates/mail/text/screen_recording.txt:13
+#: core/templates/mail/text/invitation.txt:24
+#, python-format
+msgid "This mail has been sent to %(email)s by %(name)s [%(href)s]"
+msgstr ""
+
+#: core/templates/mail/text/screen_recording.txt:14
 #, python-format
 msgid "Click the \"Open [%(link)s]\" link below "
 msgstr "Haz clic en el enlace \"Abrir [%(link)s]\" que aparece abajo "
 
-#: meet/settings.py:228
+#: meet/settings.py:238
 msgid "English"
 msgstr "Inglés"
 
-#: meet/settings.py:229
+#: meet/settings.py:239
 msgid "French"
 msgstr "Francés"
 
-#: meet/settings.py:230
+#: meet/settings.py:240
 msgid "Dutch"
 msgstr "Neerlandés"
 
-#: meet/settings.py:231
+#: meet/settings.py:241
 msgid "German"
 msgstr "Alemán"
 
-#: meet/settings.py:233
+#: meet/settings.py:242
 msgid "Spanish"
 msgstr "Español"

src/backend/locale/fr_FR/LC_MESSAGES/django.po

@@ -8,7 +8,7 @@ msgid ""
 msgstr ""
 "Project-Id-Version: PACKAGE VERSION\n"
 "Report-Msgid-Bugs-To: \n"
-"POT-Creation-Date: 2026-07-02 10:47+0000\n"
+"POT-Creation-Date: 2026-09-02 22:52+0000\n"
 "PO-Revision-Date: YEAR-MO-DA HO:MI+ZONE\n"
 "Last-Translator: antoine.lebaud@mail.numerique.gouv.fr\n"
 "Language-Team: LANGUAGE <LL@li.org>\n"
@@ -51,11 +51,11 @@ msgstr ""
 msgid "File preview"
 msgstr ""
 
-#: core/admin.py:300 core/admin.py:443
+#: core/admin.py:300 core/admin.py:450
 msgid "No owner"
 msgstr "Pas de propriétaire"
 
-#: core/admin.py:303 core/admin.py:446
+#: core/admin.py:303 core/admin.py:453
 msgid "Multiple owners"
 msgstr "Plusieurs propriétaires"
 
@@ -99,11 +99,11 @@ msgstr ""
 msgid "Skipped %(count)s recording(s) with an ineligible status."
 msgstr "%(count)s enregistrement(s) avec un statut inéligible ignoré(s)."
 
-#: core/admin.py:510
+#: core/admin.py:517
 msgid "No scopes"
 msgstr "Aucun scopes"
 
-#: core/admin.py:512
+#: core/admin.py:519
 msgid "Scopes"
 msgstr "Scopes"
 
@@ -111,187 +111,203 @@ msgstr "Scopes"
 msgid "Creator is me"
 msgstr "Je suis le créateur"
 
-#: core/api/serializers.py:89
+#: core/api/serializers.py:108
 msgid "You must be administrator or owner of a room to add accesses to it."
 msgstr ""
 "Vous devez être administrateur ou propriétaire d'une salle pour y ajouter "
 "des accès."
 
-#: core/api/serializers.py:534
+#: core/api/serializers.py:560
 msgid "This file extension is not allowed."
 msgstr "Cette extension n'est pas autorisée"
 
-#: core/api/viewsets.py:1222
+#: core/api/viewsets.py:1268
 msgid "You have reached the maximum number of files for this type."
 msgstr "Vous avez atteint le nombre maximum de fichiers de ce type"
 
-#: core/models.py:37
+#: core/models.py:38
 msgid "Member"
 msgstr "Membre"
 
-#: core/models.py:38
+#: core/models.py:39
 msgid "Administrator"
 msgstr "Administrateur"
 
-#: core/models.py:39
+#: core/models.py:40
 msgid "Owner"
 msgstr "Propriétaire"
 
-#: core/models.py:55
+#: core/models.py:56
 msgid "Initiated"
 msgstr "Initié"
 
-#: core/models.py:56
+#: core/models.py:57
 msgid "Active"
 msgstr "Actif"
 
-#: core/models.py:57
+#: core/models.py:58
 msgid "Stopped"
 msgstr "Arrêté"
 
-#: core/models.py:58
+#: core/models.py:59
 msgid "Saved"
 msgstr "Enregistré"
 
-#: core/models.py:59
+#: core/models.py:60
 msgid "Aborted"
 msgstr "Abandonné"
 
-#: core/models.py:60
+#: core/models.py:61
 msgid "Failed to Start"
 msgstr "Échec au démarrage"
 
-#: core/models.py:61
+#: core/models.py:62
 msgid "Failed to Stop"
 msgstr "Échec à l'arrêt"
 
-#: core/models.py:62
+#: core/models.py:63
 msgid "Notification succeeded"
 msgstr "Notification réussie"
 
-#: core/models.py:65
+#: core/models.py:66
 msgid "External process successful"
 msgstr "Traitement externe : succès"
 
-#: core/models.py:67
+#: core/models.py:68
 msgid "External process failed"
 msgstr "Traitement externe : erreur"
 
-#: core/models.py:96
+#: core/models.py:97
 msgid "SCREEN_RECORDING"
 msgstr "ENREGISTREMENT_ÉCRAN"
 
-#: core/models.py:97
+#: core/models.py:98
 msgid "TRANSCRIPT"
 msgstr "TRANSCRIPTION"
 
-#: core/models.py:103
+#: core/models.py:104
 msgid "Public Access"
 msgstr "Accès public"
 
-#: core/models.py:104
+#: core/models.py:105
 msgid "Trusted Access"
 msgstr "Accès de confiance"
 
-#: core/models.py:105
+#: core/models.py:106
 msgid "Restricted Access"
 msgstr "Accès restreint"
 
-#: core/models.py:117
+#: core/models.py:118
 msgid "id"
 msgstr "id"
 
-#: core/models.py:118
+#: core/models.py:119
 msgid "primary key for the record as UUID"
 msgstr "clé primaire pour l'enregistrement sous forme d'UUID"
 
-#: core/models.py:124
+#: core/models.py:125
 msgid "created on"
 msgstr "créé le"
 
-#: core/models.py:125
+#: core/models.py:126
 msgid "date and time at which a record was created"
 msgstr "date et heure auxquelles un enregistrement a été créé"
 
-#: core/models.py:130
+#: core/models.py:131
 msgid "updated on"
 msgstr "mis à jour le"
 
-#: core/models.py:131
+#: core/models.py:132
 msgid "date and time at which a record was last updated"
 msgstr ""
 "date et heure auxquelles un enregistrement a été mis à jour pour la dernière "
 "fois"
 
-#: core/models.py:151
-msgid ""
-"Enter a valid sub. This value may contain only letters, numbers, and @/./+/-/"
-"_ characters."
-msgstr ""
-"Entrez un sub valide. Cette valeur ne peut contenir que des lettres, des "
-"chiffres et les caractères @/./+/-/_."
-
-#: core/models.py:157
+#: core/models.py:150
 msgid "sub"
 msgstr "sub"
 
-#: core/models.py:159
+#: core/models.py:152
 msgid ""
 "Optional for pending users; required upon account activation. 255 characters "
-"or fewer. Letters, numbers, and @/./+/-/_ characters only."
+"or fewer. Printable ASCII characters only."
 msgstr ""
-"Optionnel pour les utilisateurs en attente ; requis lors de l'activation du "
-"compte. 255 caractères maximum. Lettres, chiffres et @/./+/-/_ uniquement."
+"Facultatif pour les utilisateurs en attente ; obligatoire lors de l’activation "
+"du compte. 255 caractères maximum. Caractères ASCII imprimables uniquement."
 
-#: core/models.py:168
+#: core/validators.py:22
+msgid "Enter a valid sub. This value should be printable ASCII only."
+msgstr "Saisissez un sub valide. Cette valeur ne doit contenir que des caractères ASCII imprimables."
+
+#: core/models.py:161
 msgid "identity email address"
 msgstr "adresse e-mail d'identité"
 
-#: core/models.py:173
+#: core/models.py:166
 msgid "admin email address"
 msgstr "adresse e-mail d'administrateur"
 
-#: core/models.py:175
+#: core/models.py:168
 msgid "full name"
 msgstr "nom complet"
 
-#: core/models.py:177
+#: core/models.py:170
 msgid "short name"
 msgstr "nom court"
 
-#: core/models.py:183
+#: core/models.py:176
 msgid "language"
 msgstr "langue"
 
-#: core/models.py:184
+#: core/models.py:177
 msgid "The language in which the user wants to see the interface."
 msgstr "La langue dans laquelle l'utilisateur souhaite voir l'interface."
 
-#: core/models.py:190
+#: core/models.py:183
 msgid "The timezone in which the user wants to see times."
 msgstr "Le fuseau horaire dans lequel l'utilisateur souhaite voir les heures."
 
-#: core/models.py:193
+#: core/models.py:190
+msgid "default room access level"
+msgstr ""
+
+#: core/models.py:192
+msgid ""
+"Access level applied by default to new rooms created by this user. When "
+"empty, the instance default is used."
+msgstr ""
+
+#: core/models.py:199
+#, fuzzy
+#| msgid "Visio room configuration"
+msgid "default room configuration"
+msgstr "Configuration de la salle de visioconférence"
+
+#: core/models.py:201
+msgid "Configurations applied by default to new rooms created by this user."
+msgstr ""
+
+#: core/models.py:205
 msgid "device"
 msgstr "appareil"
 
-#: core/models.py:195
+#: core/models.py:207
 msgid "Whether the user is a device or a real user."
 msgstr "Si l'utilisateur est un appareil ou un utilisateur réel."
 
-#: core/models.py:198
+#: core/models.py:210
 msgid "staff status"
 msgstr "statut du personnel"
 
-#: core/models.py:200
+#: core/models.py:212
 msgid "Whether the user can log into this admin site."
 msgstr "Si l'utilisateur peut se connecter à ce site d'administration."
 
-#: core/models.py:203
+#: core/models.py:215
 msgid "active"
 msgstr "actif"
 
-#: core/models.py:206
+#: core/models.py:218
 msgid ""
 "Whether this user should be treated as active. Unselect this instead of "
 "deleting accounts."
@@ -299,65 +315,65 @@ msgstr ""
 "Si cet utilisateur doit être traité comme actif. Désélectionnez cette option "
 "au lieu de supprimer des comptes."
 
-#: core/models.py:219
+#: core/models.py:231
 msgid "user"
 msgstr "utilisateur"
 
-#: core/models.py:220
+#: core/models.py:232
 msgid "users"
 msgstr "utilisateurs"
 
-#: core/models.py:286
+#: core/models.py:298
 msgid "Resource"
 msgstr "Ressource"
 
-#: core/models.py:287
+#: core/models.py:299
 msgid "Resources"
 msgstr "Ressources"
 
-#: core/models.py:345
+#: core/models.py:357
 msgid "Resource access"
 msgstr "Accès aux ressources"
 
-#: core/models.py:346
+#: core/models.py:358
 msgid "Resource accesses"
 msgstr "Accès aux ressources"
 
-#: core/models.py:352
+#: core/models.py:364
 msgid "Resource access with this User and Resource already exists."
 msgstr ""
 "L'accès à la ressource avec cet utilisateur et cette ressource existe déjà."
 
-#: core/models.py:409
+#: core/models.py:421
 msgid "Visio room configuration"
 msgstr "Configuration de la salle de visioconférence"
 
-#: core/models.py:410
+#: core/models.py:422
 msgid "Values for Visio parameters to configure the room."
 msgstr "Valeurs des paramètres de visioconférence pour configurer la salle."
 
-#: core/models.py:417
+#: core/models.py:429
 msgid "Room PIN code"
 msgstr "Code PIN de la salle"
 
-#: core/models.py:418
+#: core/models.py:430
 msgid "Unique n-digit code that identifies this room in telephony mode."
 msgstr ""
 "Code unique à n chiffres qui identifie cette salle en mode téléphonique."
 
-#: core/models.py:424 core/models.py:578
+#: core/models.py:436 core/models.py:597
 msgid "Room"
 msgstr "Salle"
 
-#: core/models.py:425
+#: core/models.py:437
 msgid "Rooms"
 msgstr "Salles"
 
-#: core/models.py:589
+#: core/models.py:608
 msgid "Worker ID"
 msgstr "ID du Worker"
 
-#: core/models.py:591
+#: core/models.py:610
 msgid ""
 "Enter an identifier for the worker recording.This ID is retained even when "
 "the worker stops, allowing for easy tracking."
@@ -365,170 +381,170 @@ msgstr ""
 "Entrez un identifiant pour l'enregistrement du Worker. Cet identifiant est "
 "conservé même lorsque le Worker s'arrête, permettant un suivi facile."
 
-#: core/models.py:599
+#: core/models.py:618
 msgid "Recording mode"
 msgstr "Mode d'enregistrement"
 
-#: core/models.py:600
+#: core/models.py:619
 msgid "Defines the mode of recording being called."
 msgstr "Définit le mode d'enregistrement appelé."
 
-#: core/models.py:605 core/models.py:606
+#: core/models.py:624 core/models.py:625
 msgid "Recording options"
 msgstr "Options d'enregistrement"
 
-#: core/models.py:613
+#: core/models.py:632
 msgid "External Process ID"
 msgstr "ID Traitement externe"
 
-#: core/models.py:614
+#: core/models.py:633
 msgid "ID of the external process associated with the recording."
 msgstr "ID du traitement externe associé avec l'enregistrement."
 
-#: core/models.py:620
+#: core/models.py:639
 msgid "Recording"
 msgstr "Enregistrement"
 
-#: core/models.py:621
+#: core/models.py:640
 msgid "Recordings"
 msgstr "Enregistrements"
 
-#: core/models.py:731
+#: core/models.py:750
 msgid "Recording/user relation"
 msgstr "Relation enregistrement/utilisateur"
 
-#: core/models.py:732
+#: core/models.py:751
 msgid "Recording/user relations"
 msgstr "Relations enregistrement/utilisateur"
 
-#: core/models.py:738
+#: core/models.py:757
 msgid "This user is already in this recording."
 msgstr "Cet utilisateur est déjà dans cet enregistrement."
 
-#: core/models.py:744
+#: core/models.py:763
 msgid "This team is already in this recording."
 msgstr "Cette équipe est déjà dans cet enregistrement."
 
-#: core/models.py:750
+#: core/models.py:769
 msgid "Either user or team must be set, not both."
 msgstr "Soit l'utilisateur, soit l'équipe doit être défini, pas les deux."
 
-#: core/models.py:767
+#: core/models.py:786
 msgid "Create rooms"
 msgstr "Créer des salles"
 
-#: core/models.py:768
+#: core/models.py:787
 msgid "List rooms"
 msgstr "Lister les salles"
 
-#: core/models.py:769
+#: core/models.py:788
 msgid "Retrieve room details"
 msgstr "Afficher les détails d’une salle"
 
-#: core/models.py:770
+#: core/models.py:789
 msgid "Update rooms"
 msgstr "Mettre à jour les salles"
 
-#: core/models.py:771
+#: core/models.py:790
 msgid "Delete rooms"
 msgstr "Supprimer les salles"
 
-#: core/models.py:784
+#: core/models.py:803
 msgid "Application name"
 msgstr "Nom de l’application"
 
-#: core/models.py:785
+#: core/models.py:804
 msgid "Descriptive name for this application."
 msgstr "Nom descriptif de cette application."
 
-#: core/models.py:795
+#: core/models.py:814
 msgid "Hashed on Save. Copy it now if this is a new secret."
 msgstr ""
 "Haché lors de l’enregistrement. Copiez-le maintenant s’il s’agit d’un "
 "nouveau secret."
 
-#: core/models.py:806
+#: core/models.py:825
 msgid "Application"
 msgstr "Application"
 
-#: core/models.py:807
+#: core/models.py:826
 msgid "Applications"
 msgstr "Applications"
 
-#: core/models.py:830
+#: core/models.py:849
 msgid "Enter a valid domain"
 msgstr "Saisissez un domaine valide"
 
-#: core/models.py:833
+#: core/models.py:852
 msgid "Domain"
 msgstr "Domaine"
 
-#: core/models.py:834
+#: core/models.py:853
 msgid "Email domain this application can act on behalf of."
 msgstr "Domaine de messagerie au nom duquel cette application peut agir."
 
-#: core/models.py:846
+#: core/models.py:865
 msgid "Application domain"
 msgstr "Domaine d’application"
 
-#: core/models.py:847
+#: core/models.py:866
 msgid "Application domains"
 msgstr "Domaines d’application"
 
-#: core/models.py:865
+#: core/models.py:884
 msgid "Pending"
 msgstr "En attente"
 
-#: core/models.py:866
+#: core/models.py:885
 msgid "Analyzing"
 msgstr ""
 
-#: core/models.py:873
+#: core/models.py:892
 msgid "Ready"
 msgstr "Prêt"
 
-#: core/models.py:879
+#: core/models.py:898
 msgid "Background image"
 msgstr "Image de fond"
 
-#: core/models.py:891
+#: core/models.py:910
 msgid "title"
 msgstr "Titre"
 
-#: core/models.py:915
+#: core/models.py:934
 msgid "Malware detection info when the analysis status is unsafe."
 msgstr ""
 "Information concernant la détection de Malware cand le statut n'est pas sain"
 
-#: core/models.py:920
+#: core/models.py:939
 msgid "File"
 msgstr "Fichier"
 
-#: core/models.py:921
+#: core/models.py:940
 msgid "Files"
 msgstr "Fichiers"
 
-#: core/models.py:1041
+#: core/models.py:1060
 #, fuzzy
 #| msgid "This user is already in this recording."
 msgid "This file is already hard deleted."
 msgstr "Ce fichier a été supprimé."
 
-#: core/models.py:1051
+#: core/models.py:1070
 msgid "To hard delete a file, it must first be soft deleted."
 msgstr ""
 "Pour supprimer définitivement un fichier il doit d'abord avoir été marqué "
 "comme supprimé (soft delete)"
 
-#: core/recording/event/notification.py:123
+#: core/recording/event/notification.py:124
 msgid "Your recording is ready"
 msgstr "Votre enregistrement est prêt"
 
-#: core/recording/event/notification.py:194
+#: core/recording/event/notification.py:195
 msgid "Transcription"
 msgstr "Transcription"
 
-#: core/recording/event/notification.py:204
+#: core/recording/event/notification.py:206
 #, python-brace-format
 msgid "Meeting \"{room}\" on {room_recording_date} at {room_recording_time}"
 msgstr "Réunion \"{room}\" du {room_recording_date} à {room_recording_time}"
@@ -538,25 +554,25 @@ msgstr "Réunion \"{room}\" du {room_recording_date} à {room_recording_time}"
 msgid "Video call in progress: {sender.email} is waiting for you to connect"
 msgstr "Appel vidéo en cours : {sender.email} attend que vous vous connectiez"
 
-#: core/templates/mail/html/invitation.html:159
-#: core/templates/mail/html/screen_recording.html:159
-#: core/templates/mail/text/invitation.txt:3
-#: core/templates/mail/text/screen_recording.txt:3
+#: core/templates/mail/html/invitation.html:151
+#: core/templates/mail/html/screen_recording.html:151
+#: core/templates/mail/text/invitation.txt:4
+#: core/templates/mail/text/screen_recording.txt:4
 msgid "Logo email"
 msgstr "Logo email"
 
-#: core/templates/mail/html/invitation.html:189
-#: core/templates/mail/text/invitation.txt:5
+#: core/templates/mail/html/invitation.html:181
+#: core/templates/mail/text/invitation.txt:6
 msgid "invites you to join an ongoing video call"
 msgstr "vous invite à rejoindre un appel vidéo en cours"
 
-#: core/templates/mail/html/invitation.html:200
-#: core/templates/mail/text/invitation.txt:7
+#: core/templates/mail/html/invitation.html:192
+#: core/templates/mail/text/invitation.txt:8
 msgid "JOIN THE CALL"
 msgstr "REJOINDRE L'APPEL"
 
-#: core/templates/mail/html/invitation.html:227
-#: core/templates/mail/text/invitation.txt:13
+#: core/templates/mail/html/invitation.html:219
+#: core/templates/mail/text/invitation.txt:14
 msgid ""
 "If you can't click the button, copy and paste the URL into your browser to "
 "join the call."
@@ -564,41 +580,47 @@ msgstr ""
 "Si vous ne pouvez pas cliquer sur le bouton, copiez et collez l'URL dans "
 "votre navigateur pour rejoindre l'appel."
 
-#: core/templates/mail/html/invitation.html:235
-#: core/templates/mail/text/invitation.txt:15
+#: core/templates/mail/html/invitation.html:227
+#: core/templates/mail/text/invitation.txt:16
 msgid "Tips for a better experience:"
 msgstr "Conseils pour une meilleure expérience :"
 
-#: core/templates/mail/html/invitation.html:237
-#: core/templates/mail/text/invitation.txt:17
+#: core/templates/mail/html/invitation.html:229
+#: core/templates/mail/text/invitation.txt:18
 msgid "Use Chrome or Firefox for better call quality"
 msgstr "Utilisez Chrome ou Firefox pour une meilleure qualité d'appel"
 
-#: core/templates/mail/html/invitation.html:238
-#: core/templates/mail/text/invitation.txt:18
+#: core/templates/mail/html/invitation.html:230
+#: core/templates/mail/text/invitation.txt:19
 msgid "Test your microphone and camera before joining"
 msgstr "Testez votre microphone et votre caméra avant de rejoindre"
 
-#: core/templates/mail/html/invitation.html:239
-#: core/templates/mail/text/invitation.txt:19
+#: core/templates/mail/html/invitation.html:231
+#: core/templates/mail/text/invitation.txt:20
 msgid "Make sure you have a stable internet connection"
 msgstr "Assurez-vous d'avoir une connexion Internet stable"
 
-#: core/templates/mail/html/invitation.html:248
-#: core/templates/mail/html/screen_recording.html:245
-#: core/templates/mail/text/invitation.txt:21
-#: core/templates/mail/text/screen_recording.txt:23
+#: core/templates/mail/html/invitation.html:240
+#: core/templates/mail/html/screen_recording.html:237
+#: core/templates/mail/text/invitation.txt:22
+#: core/templates/mail/text/screen_recording.txt:24
 #, python-format
 msgid " Thank you for using %(brandname)s. "
 msgstr " Merci d'utiliser %(brandname)s. "
 
-#: core/templates/mail/html/screen_recording.html:188
-#: core/templates/mail/text/screen_recording.txt:6
+#: core/templates/mail/html/invitation.html:271
+#, python-format
+msgid ""
+"This mail has been sent to %(email)s by <a href=\"%(href)s\">%(name)s</a>"
+msgstr ""
+
+#: core/templates/mail/html/screen_recording.html:180
+#: core/templates/mail/text/screen_recording.txt:7
 msgid "Your recording is ready!"
 msgstr "Votre enregistrement est prêt !"
 
-#: core/templates/mail/html/screen_recording.html:195
-#: core/templates/mail/text/screen_recording.txt:8
+#: core/templates/mail/html/screen_recording.html:187
+#: core/templates/mail/text/screen_recording.txt:9
 #, python-format
 msgid ""
 " Your recording of \"%(room_name)s\" on %(recording_date)s at "
@@ -607,14 +629,14 @@ msgstr ""
 " Votre enregistrement de \"%(room_name)s\" du %(recording_date)s à "
 "%(recording_time)s est maintenant prêt à être téléchargé. "
 
-#: core/templates/mail/html/screen_recording.html:195
-#: core/templates/mail/text/screen_recording.txt:8
+#: core/templates/mail/html/screen_recording.html:187
+#: core/templates/mail/text/screen_recording.txt:9
 #, python-format
 msgid " The recording will expire in %(days)s days. "
 msgstr " L'enregistrement expirera dans %(days)s jours. "
 
-#: core/templates/mail/html/screen_recording.html:200
-#: core/templates/mail/text/screen_recording.txt:9
+#: core/templates/mail/html/screen_recording.html:192
+#: core/templates/mail/text/screen_recording.txt:10
 msgid ""
 " Sharing the recording via link is not yet available. Only organizers can "
 "download it. "
@@ -622,33 +644,33 @@ msgstr ""
 "Le partage de l'enregistrement via lien n'est pas encore disponible. Seuls "
 "les organisateurs peuvent le télécharger."
 
-#: core/templates/mail/html/screen_recording.html:206
-#: core/templates/mail/text/screen_recording.txt:11
+#: core/templates/mail/html/screen_recording.html:198
+#: core/templates/mail/text/screen_recording.txt:12
 msgid "To keep this recording permanently:"
 msgstr "Pour conserver cet enregistrement de façon permanente :"
 
-#: core/templates/mail/html/screen_recording.html:208
+#: core/templates/mail/html/screen_recording.html:200
 #, python-format
 msgid "Click the \"<a href=\"%(link)s\">Open</a>\" link below "
 msgstr "Cliquez sur le lien \"<a href=\"%(link)s\">Ouvrir</a>\" ci-dessous "
 
-#: core/templates/mail/html/screen_recording.html:209
-#: core/templates/mail/text/screen_recording.txt:14
+#: core/templates/mail/html/screen_recording.html:201
+#: core/templates/mail/text/screen_recording.txt:15
 msgid "Use the \"Download\" button in the interface "
 msgstr "Utilisez le bouton \"Télécharger\" dans l'interface "
 
-#: core/templates/mail/html/screen_recording.html:210
-#: core/templates/mail/text/screen_recording.txt:15
+#: core/templates/mail/html/screen_recording.html:202
+#: core/templates/mail/text/screen_recording.txt:16
 msgid "Save the file to your preferred location"
 msgstr "Enregistrez le fichier à l'emplacement de votre choix"
 
-#: core/templates/mail/html/screen_recording.html:221
-#: core/templates/mail/text/screen_recording.txt:17
+#: core/templates/mail/html/screen_recording.html:213
+#: core/templates/mail/text/screen_recording.txt:18
 msgid "Open"
 msgstr "Ouvrir"
 
-#: core/templates/mail/html/screen_recording.html:230
-#: core/templates/mail/text/screen_recording.txt:19
+#: core/templates/mail/html/screen_recording.html:222
+#: core/templates/mail/text/screen_recording.txt:20
 #, python-format
 msgid ""
 " If you have any questions or need assistance, please contact our support "
@@ -657,28 +679,33 @@ msgstr ""
 " Si vous avez des questions ou besoin d'assistance, veuillez contacter notre "
 "équipe d'assistance à %(support_email)s. "
 
-#: core/templates/mail/text/screen_recording.txt:13
+#: core/templates/mail/text/invitation.txt:24
+#, python-format
+msgid "This mail has been sent to %(email)s by %(name)s [%(href)s]"
+msgstr ""
+
+#: core/templates/mail/text/screen_recording.txt:14
 #, fuzzy, python-format
 #| msgid "Click the \"<a href=\"%(link)s\">Open</a>\" link below "
 msgid "Click the \"Open [%(link)s]\" link below "
 msgstr "Cliquez sur le lien \"<a href=\"%(link)s\">Ouvrir</a>\" ci-dessous "
 
-#: meet/settings.py:228
+#: meet/settings.py:238
 msgid "English"
 msgstr "Anglais"
 
-#: meet/settings.py:229
+#: meet/settings.py:239
 msgid "French"
 msgstr "Français"
 
-#: meet/settings.py:230
+#: meet/settings.py:240
 msgid "Dutch"
 msgstr "Néerlandais"
 
-#: meet/settings.py:231
+#: meet/settings.py:241
 msgid "German"
 msgstr "Allemand"
 
-#: meet/settings.py:233
+#: meet/settings.py:242
 msgid "Spanish"
 msgstr "Espagnol"

src/backend/locale/nl_NL/LC_MESSAGES/django.po

@@ -8,7 +8,7 @@ msgid ""
 msgstr ""
 "Project-Id-Version: PACKAGE VERSION\n"
 "Report-Msgid-Bugs-To: \n"
-"POT-Creation-Date: 2026-07-02 10:47+0000\n"
+"POT-Creation-Date: 2026-09-02 22:52+0000\n"
 "PO-Revision-Date: YEAR-MO-DA HO:MI+ZONE\n"
 "Last-Translator: FULL NAME <EMAIL@ADDRESS>\n"
 "Language-Team: LANGUAGE <LL@li.org>\n"
@@ -51,11 +51,11 @@ msgstr ""
 msgid "File preview"
 msgstr ""
 
-#: core/admin.py:300 core/admin.py:443
+#: core/admin.py:300 core/admin.py:450
 msgid "No owner"
 msgstr "Geen eigenaar"
 
-#: core/admin.py:303 core/admin.py:446
+#: core/admin.py:303 core/admin.py:453
 msgid "Multiple owners"
 msgstr "Meerdere eigenaren"
 
@@ -98,11 +98,11 @@ msgstr "%(count)s opname(s) succesvol gemarkeerd als 'Mislukt bij stoppen'."
 msgid "Skipped %(count)s recording(s) with an ineligible status."
 msgstr "%(count)s opname(s) met een niet-toegestane status overgeslagen."
 
-#: core/admin.py:510
+#: core/admin.py:517
 msgid "No scopes"
 msgstr "Geen scopes"
 
-#: core/admin.py:512
+#: core/admin.py:519
 msgid "Scopes"
 msgstr "Scopes"
 
@@ -110,184 +110,200 @@ msgstr "Scopes"
 msgid "Creator is me"
 msgstr "Maker ben ik"
 
-#: core/api/serializers.py:89
+#: core/api/serializers.py:108
 msgid "You must be administrator or owner of a room to add accesses to it."
 msgstr ""
 "Je moet beheerder of eigenaar van een ruimte zijn om toegang toe te voegen."
 
-#: core/api/serializers.py:534
+#: core/api/serializers.py:560
 msgid "This file extension is not allowed."
 msgstr "Deze bestandsextensie is niet toegestaan."
 
-#: core/api/viewsets.py:1222
+#: core/api/viewsets.py:1268
 msgid "You have reached the maximum number of files for this type."
 msgstr "Het maximale aantal bestanden voor dit type is bereikt."
 
-#: core/models.py:37
+#: core/models.py:38
 msgid "Member"
 msgstr "Lid"
 
-#: core/models.py:38
+#: core/models.py:39
 msgid "Administrator"
 msgstr "Beheerder"
 
-#: core/models.py:39
+#: core/models.py:40
 msgid "Owner"
 msgstr "Eigenaar"
 
-#: core/models.py:55
+#: core/models.py:56
 msgid "Initiated"
 msgstr "Gestart"
 
-#: core/models.py:56
+#: core/models.py:57
 msgid "Active"
 msgstr "Actief"
 
-#: core/models.py:57
+#: core/models.py:58
 msgid "Stopped"
 msgstr "Gestopt"
 
-#: core/models.py:58
+#: core/models.py:59
 msgid "Saved"
 msgstr "Opgeslagen"
 
-#: core/models.py:59
+#: core/models.py:60
 msgid "Aborted"
 msgstr "Afgebroken"
 
-#: core/models.py:60
+#: core/models.py:61
 msgid "Failed to Start"
 msgstr "Starten mislukt"
 
-#: core/models.py:61
+#: core/models.py:62
 msgid "Failed to Stop"
 msgstr "Stoppen mislukt"
 
-#: core/models.py:62
+#: core/models.py:63
 msgid "Notification succeeded"
 msgstr "Notificatie geslaagd"
 
-#: core/models.py:65
+#: core/models.py:66
 msgid "External process successful"
 msgstr "Externe procedure succesvol"
 
-#: core/models.py:67
+#: core/models.py:68
 msgid "External process failed"
 msgstr "Het externe proces is mislukt."
 
-#: core/models.py:96
+#: core/models.py:97
 msgid "SCREEN_RECORDING"
 msgstr "SCHERM_OPNAME"
 
-#: core/models.py:97
+#: core/models.py:98
 msgid "TRANSCRIPT"
 msgstr "TRANSCRIPT"
 
-#: core/models.py:103
+#: core/models.py:104
 msgid "Public Access"
 msgstr "Openbare toegang"
 
-#: core/models.py:104
+#: core/models.py:105
 msgid "Trusted Access"
 msgstr "Vertrouwde toegang"
 
-#: core/models.py:105
+#: core/models.py:106
 msgid "Restricted Access"
 msgstr "Beperkte toegang"
 
-#: core/models.py:117
+#: core/models.py:118
 msgid "id"
 msgstr "id"
 
-#: core/models.py:118
+#: core/models.py:119
 msgid "primary key for the record as UUID"
 msgstr "primaire sleutel voor het record als UUID"
 
-#: core/models.py:124
+#: core/models.py:125
 msgid "created on"
 msgstr "aangemaakt op"
 
-#: core/models.py:125
+#: core/models.py:126
 msgid "date and time at which a record was created"
 msgstr "datum en tijd waarop een record werd aangemaakt"
 
-#: core/models.py:130
+#: core/models.py:131
 msgid "updated on"
 msgstr "bijgewerkt op"
 
-#: core/models.py:131
+#: core/models.py:132
 msgid "date and time at which a record was last updated"
 msgstr "datum en tijd waarop een record voor het laatst werd bijgewerkt"
 
-#: core/models.py:151
-msgid ""
-"Enter a valid sub. This value may contain only letters, numbers, and @/./+/-/"
-"_ characters."
-msgstr ""
-"Voer een geldige sub in. Deze waarde mag alleen letters, cijfers en @/./+/-/"
-"_ tekens bevatten."
-
-#: core/models.py:157
+#: core/models.py:150
 msgid "sub"
 msgstr "sub"
 
-#: core/models.py:159
+#: core/models.py:152
 msgid ""
 "Optional for pending users; required upon account activation. 255 characters "
-"or fewer. Letters, numbers, and @/./+/-/_ characters only."
+"or fewer. Printable ASCII characters only."
 msgstr ""
-"Optioneel voor gebruikers in afwachting; vereist bij accountactivering. "
-"Maximum 255 tekens. Alleen letters, cijfers en @/./+/-/_ toegestaan."
+"Optioneel voor gebruikers in afwachting; verplicht bij het activeren van het "
+"account. Maximaal 255 tekens. Alleen afdrukbare ASCII-tekens."
 
-#: core/models.py:168
+#: core/validators.py:22
+msgid "Enter a valid sub. This value should be printable ASCII only."
+msgstr "Voer een geldige sub in. Deze waarde mag alleen afdrukbare ASCII-tekens bevatten."
+
+#: core/models.py:161
 msgid "identity email address"
 msgstr "identiteit e-mailadres"
 
-#: core/models.py:173
+#: core/models.py:166
 msgid "admin email address"
 msgstr "beheerder e-mailadres"
 
-#: core/models.py:175
+#: core/models.py:168
 msgid "full name"
 msgstr "volledige naam"
 
-#: core/models.py:177
+#: core/models.py:170
 msgid "short name"
 msgstr "korte naam"
 
-#: core/models.py:183
+#: core/models.py:176
 msgid "language"
 msgstr "taal"
 
-#: core/models.py:184
+#: core/models.py:177
 msgid "The language in which the user wants to see the interface."
 msgstr "De taal waarin de gebruiker de interface wil zien."
 
-#: core/models.py:190
+#: core/models.py:183
 msgid "The timezone in which the user wants to see times."
 msgstr "De tijdzone waarin de gebruiker tijden wil zien."
 
-#: core/models.py:193
+#: core/models.py:190
+msgid "default room access level"
+msgstr ""
+
+#: core/models.py:192
+msgid ""
+"Access level applied by default to new rooms created by this user. When "
+"empty, the instance default is used."
+msgstr ""
+
+#: core/models.py:199
+#, fuzzy
+#| msgid "Visio room configuration"
+msgid "default room configuration"
+msgstr "Visio-ruimteconfiguratie"
+
+#: core/models.py:201
+msgid "Configurations applied by default to new rooms created by this user."
+msgstr ""
+
+#: core/models.py:205
 msgid "device"
 msgstr "apparaat"
 
-#: core/models.py:195
+#: core/models.py:207
 msgid "Whether the user is a device or a real user."
 msgstr "Of de gebruiker een apparaat is of een echte gebruiker."
 
-#: core/models.py:198
+#: core/models.py:210
 msgid "staff status"
 msgstr "personeelsstatus"
 
-#: core/models.py:200
+#: core/models.py:212
 msgid "Whether the user can log into this admin site."
 msgstr "Of de gebruiker kan inloggen op deze beheersite."
 
-#: core/models.py:203
+#: core/models.py:215
 msgid "active"
 msgstr "actief"
 
-#: core/models.py:206
+#: core/models.py:218
 msgid ""
 "Whether this user should be treated as active. Unselect this instead of "
 "deleting accounts."
@@ -295,64 +311,64 @@ msgstr ""
 "Of deze gebruiker als actief moet worden behandeld. Deselecteer dit in "
 "plaats van accounts te verwijderen."
 
-#: core/models.py:219
+#: core/models.py:231
 msgid "user"
 msgstr "gebruiker"
 
-#: core/models.py:220
+#: core/models.py:232
 msgid "users"
 msgstr "gebruikers"
 
-#: core/models.py:286
+#: core/models.py:298
 msgid "Resource"
 msgstr "Bron"
 
-#: core/models.py:287
+#: core/models.py:299
 msgid "Resources"
 msgstr "Bronnen"
 
-#: core/models.py:345
+#: core/models.py:357
 msgid "Resource access"
 msgstr "Brontoegang"
 
-#: core/models.py:346
+#: core/models.py:358
 msgid "Resource accesses"
 msgstr "Brontoegangsrechten"
 
-#: core/models.py:352
+#: core/models.py:364
 msgid "Resource access with this User and Resource already exists."
 msgstr "Brontoegang met deze gebruiker en bron bestaat al."
 
-#: core/models.py:409
+#: core/models.py:421
 msgid "Visio room configuration"
 msgstr "Visio-ruimteconfiguratie"
 
-#: core/models.py:410
+#: core/models.py:422
 msgid "Values for Visio parameters to configure the room."
 msgstr "Waarden voor Visio-parameters om de ruimte te configureren."
 
-#: core/models.py:417
+#: core/models.py:429
 msgid "Room PIN code"
 msgstr "Pincode van de kamer"
 
-#: core/models.py:418
+#: core/models.py:430
 msgid "Unique n-digit code that identifies this room in telephony mode."
 msgstr ""
 "Unieke n-cijferige code die deze kamer identificeert in telefonie-modus."
 
-#: core/models.py:424 core/models.py:578
+#: core/models.py:436 core/models.py:597
 msgid "Room"
 msgstr "Ruimte"
 
-#: core/models.py:425
+#: core/models.py:437
 msgid "Rooms"
 msgstr "Ruimtes"
 
-#: core/models.py:589
+#: core/models.py:608
 msgid "Worker ID"
 msgstr "Worker ID"
 
-#: core/models.py:591
+#: core/models.py:610
 msgid ""
 "Enter an identifier for the worker recording.This ID is retained even when "
 "the worker stops, allowing for easy tracking."
@@ -360,152 +376,152 @@ msgstr ""
 "Voer een identificatie in voor de worker-opname. Deze ID blijft behouden, "
 "zelfs wanneer de worker stopt, waardoor eenvoudige tracking mogelijk is."
 
-#: core/models.py:599
+#: core/models.py:618
 msgid "Recording mode"
 msgstr "Opnamemodus"
 
-#: core/models.py:600
+#: core/models.py:619
 msgid "Defines the mode of recording being called."
 msgstr "Definieert de modus van opname die wordt aangeroepen."
 
-#: core/models.py:605 core/models.py:606
+#: core/models.py:624 core/models.py:625
 msgid "Recording options"
 msgstr "Opnameopties"
 
-#: core/models.py:613
+#: core/models.py:632
 msgid "External Process ID"
 msgstr "Externe proces-ID"
 
-#: core/models.py:614
+#: core/models.py:633
 msgid "ID of the external process associated with the recording."
 msgstr "ID van het externe proces dat aan de opname is gekoppeld."
 
-#: core/models.py:620
+#: core/models.py:639
 msgid "Recording"
 msgstr "Opname"
 
-#: core/models.py:621
+#: core/models.py:640
 msgid "Recordings"
 msgstr "Opnames"
 
-#: core/models.py:731
+#: core/models.py:750
 msgid "Recording/user relation"
 msgstr "Opname/gebruiker-relatie"
 
-#: core/models.py:732
+#: core/models.py:751
 msgid "Recording/user relations"
 msgstr "Opname/gebruiker-relaties"
 
-#: core/models.py:738
+#: core/models.py:757
 msgid "This user is already in this recording."
 msgstr "Deze gebruiker is al in deze opname."
 
-#: core/models.py:744
+#: core/models.py:763
 msgid "This team is already in this recording."
 msgstr "Dit team is al in deze opname."
 
-#: core/models.py:750
+#: core/models.py:769
 msgid "Either user or team must be set, not both."
 msgstr "Ofwel gebruiker of team moet worden ingesteld, niet beide."
 
-#: core/models.py:767
+#: core/models.py:786
 msgid "Create rooms"
 msgstr "Ruimtes aanmaken"
 
-#: core/models.py:768
+#: core/models.py:787
 msgid "List rooms"
 msgstr "Ruimtes weergeven"
 
-#: core/models.py:769
+#: core/models.py:788
 msgid "Retrieve room details"
 msgstr "Details van een ruimte ophalen"
 
-#: core/models.py:770
+#: core/models.py:789
 msgid "Update rooms"
 msgstr "Ruimtes bijwerken"
 
-#: core/models.py:771
+#: core/models.py:790
 msgid "Delete rooms"
 msgstr "Ruimtes verwijderen"
 
-#: core/models.py:784
+#: core/models.py:803
 msgid "Application name"
 msgstr "Naam van de applicatie"
 
-#: core/models.py:785
+#: core/models.py:804
 msgid "Descriptive name for this application."
 msgstr "Beschrijvende naam voor deze applicatie."
 
-#: core/models.py:795
+#: core/models.py:814
 msgid "Hashed on Save. Copy it now if this is a new secret."
 msgstr ""
 "Wordt gehasht bij het opslaan. Kopieer het nu als dit een nieuw geheim is."
 
-#: core/models.py:806
+#: core/models.py:825
 msgid "Application"
 msgstr "Applicatie"
 
-#: core/models.py:807
+#: core/models.py:826
 msgid "Applications"
 msgstr "Applicaties"
 
-#: core/models.py:830
+#: core/models.py:849
 msgid "Enter a valid domain"
 msgstr "Voer een geldig domein in"
 
-#: core/models.py:833
+#: core/models.py:852
 msgid "Domain"
 msgstr "Domein"
 
-#: core/models.py:834
+#: core/models.py:853
 msgid "Email domain this application can act on behalf of."
 msgstr "E-maildomein namens welke deze applicatie kan handelen."
 
-#: core/models.py:846
+#: core/models.py:865
 msgid "Application domain"
 msgstr "Applicatiedomein"
 
-#: core/models.py:847
+#: core/models.py:866
 msgid "Application domains"
 msgstr "Applicatiedomeinen"
 
-#: core/models.py:865
+#: core/models.py:884
 msgid "Pending"
 msgstr "In afwachting"
 
-#: core/models.py:866
+#: core/models.py:885
 msgid "Analyzing"
 msgstr ""
 
-#: core/models.py:873
+#: core/models.py:892
 msgid "Ready"
 msgstr "Klaar"
 
-#: core/models.py:879
+#: core/models.py:898
 msgid "Background image"
 msgstr "Achtergrondafbeelding"
 
-#: core/models.py:891
+#: core/models.py:910
 msgid "title"
 msgstr "Titel"
 
-#: core/models.py:915
+#: core/models.py:934
 msgid "Malware detection info when the analysis status is unsafe."
 msgstr "Informatie over malwaredetectie wanneer de analysestatus onveilig is."
 
-#: core/models.py:920
+#: core/models.py:939
 msgid "File"
 msgstr "Bestand"
 
-#: core/models.py:921
+#: core/models.py:940
 msgid "Files"
 msgstr "Bestanden"
 
-#: core/models.py:1041
+#: core/models.py:1060
 msgid "This file is already hard deleted."
 msgstr "Dit bestand is al definitief verwijderd."
 
-#: core/models.py:1051
+#: core/models.py:1070
 #, fuzzy
 #| msgid "To hard delete a file, it must first be soft deleted."
 msgid "To hard delete a file, it must first be soft deleted."
@@ -513,15 +529,15 @@ msgstr ""
 "Om een bestand definitief te verwijderen, moet het eerst zacht verwijderd "
 "zijn."
 
-#: core/recording/event/notification.py:123
+#: core/recording/event/notification.py:124
 msgid "Your recording is ready"
 msgstr "Je opname is klaar"
 
-#: core/recording/event/notification.py:194
+#: core/recording/event/notification.py:195
 msgid "Transcription"
 msgstr "Transcriptie"
 
-#: core/recording/event/notification.py:204
+#: core/recording/event/notification.py:206
 #, python-brace-format
 msgid "Meeting \"{room}\" on {room_recording_date} at {room_recording_time}"
 msgstr ""
@@ -532,25 +548,25 @@ msgstr ""
 msgid "Video call in progress: {sender.email} is waiting for you to connect"
 msgstr "Video-oproep bezig: {sender.email} wacht op je verbinding"
 
-#: core/templates/mail/html/invitation.html:159
-#: core/templates/mail/html/screen_recording.html:159
-#: core/templates/mail/text/invitation.txt:3
-#: core/templates/mail/text/screen_recording.txt:3
+#: core/templates/mail/html/invitation.html:151
+#: core/templates/mail/html/screen_recording.html:151
+#: core/templates/mail/text/invitation.txt:4
+#: core/templates/mail/text/screen_recording.txt:4
 msgid "Logo email"
 msgstr "Logo e-mail"
 
-#: core/templates/mail/html/invitation.html:189
-#: core/templates/mail/text/invitation.txt:5
+#: core/templates/mail/html/invitation.html:181
+#: core/templates/mail/text/invitation.txt:6
 msgid "invites you to join an ongoing video call"
 msgstr "nodigt je uit om deel te nemen aan een lopende video-oproep"
 
-#: core/templates/mail/html/invitation.html:200
-#: core/templates/mail/text/invitation.txt:7
+#: core/templates/mail/html/invitation.html:192
+#: core/templates/mail/text/invitation.txt:8
 msgid "JOIN THE CALL"
 msgstr "NEEM DEEL AAN DE OPROEP"
 
-#: core/templates/mail/html/invitation.html:227
-#: core/templates/mail/text/invitation.txt:13
+#: core/templates/mail/html/invitation.html:219
+#: core/templates/mail/text/invitation.txt:14
 msgid ""
 "If you can't click the button, copy and paste the URL into your browser to "
 "join the call."
@@ -558,41 +574,47 @@ msgstr ""
 "Als je niet op de knop kunt klikken, kopieer en plak dan de URL in je "
 "browser om deel te nemen aan de oproep."
 
-#: core/templates/mail/html/invitation.html:235
-#: core/templates/mail/text/invitation.txt:15
+#: core/templates/mail/html/invitation.html:227
+#: core/templates/mail/text/invitation.txt:16
 msgid "Tips for a better experience:"
 msgstr "Tips voor een betere ervaring:"
 
-#: core/templates/mail/html/invitation.html:237
-#: core/templates/mail/text/invitation.txt:17
+#: core/templates/mail/html/invitation.html:229
+#: core/templates/mail/text/invitation.txt:18
 msgid "Use Chrome or Firefox for better call quality"
 msgstr "Gebruik Chrome of Firefox voor betere gesprekskwaliteit"
 
-#: core/templates/mail/html/invitation.html:238
-#: core/templates/mail/text/invitation.txt:18
+#: core/templates/mail/html/invitation.html:230
+#: core/templates/mail/text/invitation.txt:19
 msgid "Test your microphone and camera before joining"
 msgstr "Test je microfoon en camera voordat je deelneemt"
 
-#: core/templates/mail/html/invitation.html:239
-#: core/templates/mail/text/invitation.txt:19
+#: core/templates/mail/html/invitation.html:231
+#: core/templates/mail/text/invitation.txt:20
 msgid "Make sure you have a stable internet connection"
 msgstr "Zorg ervoor dat je een stabiele internetverbinding hebt"
 
-#: core/templates/mail/html/invitation.html:248
-#: core/templates/mail/html/screen_recording.html:245
-#: core/templates/mail/text/invitation.txt:21
-#: core/templates/mail/text/screen_recording.txt:23
+#: core/templates/mail/html/invitation.html:240
+#: core/templates/mail/html/screen_recording.html:237
+#: core/templates/mail/text/invitation.txt:22
+#: core/templates/mail/text/screen_recording.txt:24
 #, python-format
 msgid " Thank you for using %(brandname)s. "
 msgstr " Bedankt voor het gebruik van %(brandname)s. "
 
-#: core/templates/mail/html/screen_recording.html:188
-#: core/templates/mail/text/screen_recording.txt:6
+#: core/templates/mail/html/invitation.html:271
+#, python-format
+msgid ""
+"This mail has been sent to %(email)s by <a href=\"%(href)s\">%(name)s</a>"
+msgstr ""
+
+#: core/templates/mail/html/screen_recording.html:180
+#: core/templates/mail/text/screen_recording.txt:7
 msgid "Your recording is ready!"
 msgstr "Je opname is klaar!"
 
-#: core/templates/mail/html/screen_recording.html:195
-#: core/templates/mail/text/screen_recording.txt:8
+#: core/templates/mail/html/screen_recording.html:187
+#: core/templates/mail/text/screen_recording.txt:9
 #, python-format
 msgid ""
 " Your recording of \"%(room_name)s\" on %(recording_date)s at "
@@ -601,14 +623,14 @@ msgstr ""
 " Je opname van \"%(room_name)s\" op %(recording_date)s om %(recording_time)s "
 "is nu klaar om te downloaden. "
 
-#: core/templates/mail/html/screen_recording.html:195
-#: core/templates/mail/text/screen_recording.txt:8
+#: core/templates/mail/html/screen_recording.html:187
+#: core/templates/mail/text/screen_recording.txt:9
 #, python-format
 msgid " The recording will expire in %(days)s days. "
 msgstr " De opname verloopt over %(days)s dagen. "
 
-#: core/templates/mail/html/screen_recording.html:200
-#: core/templates/mail/text/screen_recording.txt:9
+#: core/templates/mail/html/screen_recording.html:192
+#: core/templates/mail/text/screen_recording.txt:10
 msgid ""
 " Sharing the recording via link is not yet available. Only organizers can "
 "download it. "
@@ -616,33 +638,33 @@ msgstr ""
 "Het delen van de opname via een link is nog niet beschikbaar. Alleen "
 "organisatoren kunnen deze downloaden."
 
-#: core/templates/mail/html/screen_recording.html:206
-#: core/templates/mail/text/screen_recording.txt:11
+#: core/templates/mail/html/screen_recording.html:198
+#: core/templates/mail/text/screen_recording.txt:12
 msgid "To keep this recording permanently:"
 msgstr "Om deze opname permanent te bewaren:"
 
-#: core/templates/mail/html/screen_recording.html:208
+#: core/templates/mail/html/screen_recording.html:200
 #, python-format
 msgid "Click the \"<a href=\"%(link)s\">Open</a>\" link below "
 msgstr "Klik op de \"<a href=\"%(link)s\">Openen</a>\"-link hieronder "
 
-#: core/templates/mail/html/screen_recording.html:209
-#: core/templates/mail/text/screen_recording.txt:14
+#: core/templates/mail/html/screen_recording.html:201
+#: core/templates/mail/text/screen_recording.txt:15
 msgid "Use the \"Download\" button in the interface "
 msgstr "Gebruik de \"Download\"-knop in de interface "
 
-#: core/templates/mail/html/screen_recording.html:210
-#: core/templates/mail/text/screen_recording.txt:15
+#: core/templates/mail/html/screen_recording.html:202
+#: core/templates/mail/text/screen_recording.txt:16
 msgid "Save the file to your preferred location"
 msgstr "Sla het bestand op naar je gewenste locatie"
 
-#: core/templates/mail/html/screen_recording.html:221
-#: core/templates/mail/text/screen_recording.txt:17
+#: core/templates/mail/html/screen_recording.html:213
+#: core/templates/mail/text/screen_recording.txt:18
 msgid "Open"
 msgstr "Openen"
 
-#: core/templates/mail/html/screen_recording.html:230
-#: core/templates/mail/text/screen_recording.txt:19
+#: core/templates/mail/html/screen_recording.html:222
+#: core/templates/mail/text/screen_recording.txt:20
 #, python-format
 msgid ""
 " If you have any questions or need assistance, please contact our support "
@@ -651,28 +673,33 @@ msgstr ""
 " Als je vragen hebt of hulp nodig hebt, neem dan contact op met ons support "
 "team via %(support_email)s. "
 
-#: core/templates/mail/text/screen_recording.txt:13
+#: core/templates/mail/text/invitation.txt:24
+#, python-format
+msgid "This mail has been sent to %(email)s by %(name)s [%(href)s]"
+msgstr ""
+
+#: core/templates/mail/text/screen_recording.txt:14
 #, fuzzy, python-format
 #| msgid "Click the \"<a href=\"%(link)s\">Open</a>\" link below "
 msgid "Click the \"Open [%(link)s]\" link below "
 msgstr "Klik op de \"<a href=\"%(link)s\">Openen</a>\"-link hieronder "
 
-#: meet/settings.py:228
+#: meet/settings.py:238
 msgid "English"
 msgstr "Engels"
 
-#: meet/settings.py:229
+#: meet/settings.py:239
 msgid "French"
 msgstr "Frans"
 
-#: meet/settings.py:230
+#: meet/settings.py:240
 msgid "Dutch"
 msgstr "Nederlands"
 
-#: meet/settings.py:231
+#: meet/settings.py:241
 msgid "German"
 msgstr "Duits"
 
-#: meet/settings.py:233
+#: meet/settings.py:242
 msgid "Spanish"
 msgstr "Spaans"

src/backend/meet/settings.py

@@ -12,7 +12,7 @@ https://docs.djangoproject.com/en/3.1/ref/settings/
 
 # pylint: disable=too-many-lines
 
-import json
+import tomllib
 import warnings
 from os import path
 from socket import gethostbyname, gethostname
@@ -37,22 +37,34 @@ GB = 1024 * MB
 def get_release():
     """
     Get the current release of the application
-
-    By release, we mean the release from the version.json file à la Mozilla [1]
-    (if any). If this file has not been found, it defaults to "NA".
-
-    [1]
-    https://github.com/mozilla-services/Dockerflow/blob/master/docs/version_object.md
     """
-    # Try to get the current release from the version.json file generated by the
-    # CI during the Docker image build
     try:
-        with open(path.join(BASE_DIR, "version.json"), encoding="utf8") as version:
-            return json.load(version)["version"]
-    except FileNotFoundError:
+        with open(path.join(BASE_DIR, "pyproject.toml"), "rb") as pyproject:
+            return tomllib.load(pyproject)["project"]["version"]
+    except (FileNotFoundError, KeyError, tomllib.TOMLDecodeError):
         return "NA"  # Default: not available
 
 
+class VideoCodecValue(values.Value):
+    """
+    A video codec name, normalized to lowercase and validated against the codecs
+    supported by the LiveKit client, so that a typo fails at startup instead of
+    silently downgrading every publisher to another codec.
+    """
+
+    codecs = frozenset(("vp8", "h264", "vp9", "av1"))
+
+    def to_python(self, value):
+        """Normalize the codec name and ensure it is a supported one."""
+        codec = super().to_python(value).strip().lower()
+        if codec not in self.codecs:
+            raise ValueError(
+                f"Unsupported video codec {value!r}, "
+                f"expected one of: {', '.join(sorted(self.codecs))}."
+            )
+        return codec
+
+
 class Base(Configuration):
     """
     This is the base configuration every configuration (aka environment) should inherit from. It
@@ -129,6 +141,15 @@ class Base(Configuration):
     MEDIA_BASE_URL = values.Value(
         "", environ_name="MEDIA_BASE_URL", environ_prefix=None
     )
+    # Header the reverse proxy uses to pass the original request URL to the
+    # media-auth subrequest views. nginx-ingress sends X-Original-URL, which is
+    # the default. Other proxies use different headers -- Traefik's ForwardAuth,
+    # for instance, sends X-Forwarded-Uri and cannot emit X-Original-URL at all.
+    MEDIA_AUTH_ORIGINAL_URL_HEADER = values.Value(
+        default="HTTP_X_ORIGINAL_URL",
+        environ_name="MEDIA_AUTH_ORIGINAL_URL_HEADER",
+        environ_prefix=None,
+    )
 
     SITE_ID = 1
 
@@ -326,6 +347,7 @@ class Base(Configuration):
     REST_FRAMEWORK = {
         "DEFAULT_AUTHENTICATION_CLASSES": (
             "core.authentication.backends.SessionAuthenticationWith401",
+            "core.authentication.user_token.UserAccessJWTAuthentication",
         ),
         "DEFAULT_PARSER_CLASSES": [
             "rest_framework.parsers.JSONParser",
@@ -345,6 +367,11 @@ class Base(Configuration):
                 environ_name="REQUEST_ENTRY_THROTTLE_RATES",
                 environ_prefix=None,
             ),
+            "exchange_access_token": values.Value(
+                default="30/minute",
+                environ_name="EXCHANGE_ACCESS_TOKEN_THROTTLE_RATES",
+                environ_prefix=None,
+            ),
             "creation_callback": values.Value(
                 default="600/minute",
                 environ_name="CREATION_CALLBACK_THROTTLE_RATES",
@@ -460,6 +487,9 @@ class Base(Configuration):
 
     # Sentry
     SENTRY_DSN = values.Value(None, environ_name="SENTRY_DSN")
+    SENTRY_TRACES_SAMPLE_RATE = values.FloatValue(
+        0.0, environ_name="SENTRY_TRACES_SAMPLE_RATE", environ_prefix=None
+    )
 
     # Easy thumbnails
     THUMBNAIL_EXTENSION = "webp"
@@ -666,6 +696,9 @@ class Base(Configuration):
         environ_prefix=None,
         default=False,
     )
+    LIVEKIT_DEFAULT_VIDEO_CODEC = VideoCodecValue(
+        "vp9", environ_name="LIVEKIT_DEFAULT_VIDEO_CODEC", environ_prefix=None
+    )
     CONNECTION_TEST_ENABLED = values.BooleanValue(
         environ_name="CONNECTION_TEST_ENABLED",
         environ_prefix=None,
@@ -747,63 +780,26 @@ class Base(Configuration):
     # recordings), whose request never carries advanced EncodingOptions.
     # When disabled, LiveKit falls back to its built-in H264_720P_30 preset
     # (1280x720, 30 fps, 3000 kbps H.264 MAIN video, 128 kbps AAC audio).
-    # When enabled, the encoding parameters are resolved from the default profile
-    # and resolution below and passed to LiveKit as EncodingOptions (advanced),
-    # replacing the preset. Lowering framerate and bitrate reduces output file
-    # size and CPU load on the egress worker.
+    # When enabled, the values below are passed to LiveKit as EncodingOptions
+    # (advanced) and replace the preset. Lowering framerate and bitrate reduces
+    # output file size and CPU load on the egress worker.
     RECORDING_ENCODING_ENABLED = values.BooleanValue(
         False, environ_name="RECORDING_ENCODING_ENABLED", environ_prefix=None
     )
-
-    # Map resolution name -> {"width": ..., "height": ...} in pixels.
-    RECORDING_ENCODING_AVAILABLE_RESOLUTIONS = values.DictValue(
-        {
-            "540p": {"width": 960, "height": 540},
-            "720p": {"width": 1280, "height": 720},
-            "1080p": {"width": 1920, "height": 1080},
-        },
-        environ_name="RECORDING_ENCODING_AVAILABLE_RESOLUTIONS",
+    RECORDING_ENCODING_WIDTH = values.PositiveIntegerValue(
+        1280, environ_name="RECORDING_ENCODING_WIDTH", environ_prefix=None
+    )
+    RECORDING_ENCODING_HEIGHT = values.PositiveIntegerValue(
+        720, environ_name="RECORDING_ENCODING_HEIGHT", environ_prefix=None
+    )
+    RECORDING_ENCODING_FRAMERATE = values.PositiveIntegerValue(
+        30, environ_name="RECORDING_ENCODING_FRAMERATE", environ_prefix=None
+    )
+    RECORDING_ENCODING_VIDEO_BITRATE_KBPS = values.PositiveIntegerValue(
+        3000,
+        environ_name="RECORDING_ENCODING_VIDEO_BITRATE_KBPS",
         environ_prefix=None,
     )
-
-    # Bitrate scales with resolution so quality stays consistent across sizes.
-    RECORDING_ENCODING_AVAILABLE_PROFILES = values.DictValue(
-        {
-            "talking_heads": {
-                "fps": 15,
-                "kbps": {"540p": 400, "720p": 700, "1080p": 1200},
-            },
-            "text": {
-                "fps": 15,
-                "kbps": {"540p": 600, "720p": 1000, "1080p": 1800},
-            },
-            "mixed": {
-                "fps": 20,
-                "kbps": {"540p": 900, "720p": 1500, "1080p": 2500},
-            },
-            "full": {
-                "fps": 30,
-                "kbps": {"540p": 2000, "720p": 3000, "1080p": 4500},
-            },
-        },
-        environ_name="RECORDING_ENCODING_AVAILABLE_PROFILES",
-        environ_prefix=None,
-    )
-
-    # Defaults used when no profile/resolution is specified per recording.
-    # Must be keys of the two dicts above (validated at startup).
-    RECORDING_ENCODING_DEFAULT_PROFILE = values.Value(
-        "full",
-        environ_name="RECORDING_ENCODING_DEFAULT_PROFILE",
-        environ_prefix=None,
-    )
-    RECORDING_ENCODING_DEFAULT_RESOLUTION = values.Value(
-        "720p",
-        environ_name="RECORDING_ENCODING_DEFAULT_RESOLUTION",
-        environ_prefix=None,
-    )
-
-    # Settings independent of profile/resolution.
     RECORDING_ENCODING_AUDIO_BITRATE_KBPS = values.PositiveIntegerValue(
         128,
         environ_name="RECORDING_ENCODING_AUDIO_BITRATE_KBPS",
@@ -818,7 +814,6 @@ class Base(Configuration):
     SUMMARY_SERVICE_VERSION = values.PositiveIntegerValue(
         1, environ_name="SUMMARY_SERVICE_VERSION", environ_prefix=None
     )
-
     SUMMARY_SERVICE_ENDPOINT = values.Value(
         None, environ_name="SUMMARY_SERVICE_ENDPOINT", environ_prefix=None
     )
@@ -894,7 +889,7 @@ class Base(Configuration):
         "room_lobby", environ_name="LOBBY_KEY_PREFIX", environ_prefix=None
     )
     LOBBY_WAITING_TIMEOUT = values.PositiveIntegerValue(
-        3, environ_name="LOBBY_WAITING_TIMEOUT", environ_prefix=None
+        6, environ_name="LOBBY_WAITING_TIMEOUT", environ_prefix=None
     )
     LOBBY_DENIED_TIMEOUT = values.PositiveIntegerValue(
         5, environ_name="LOBBY_DENIED_TIMEOUT", environ_prefix=None
@@ -909,11 +904,6 @@ class Base(Configuration):
         environ_name="LOBBY_NOTIFICATION_TYPE",
         environ_prefix=None,
     )
-    LOBBY_COOKIE_NAME = values.Value(
-        "lobbyParticipantId",
-        environ_name="LOBBY_COOKIE_NAME",
-        environ_prefix=None,
-    )
 
     # Calendar integrations
     ROOM_CREATION_CALLBACK_CACHE_TIMEOUT = values.PositiveIntegerValue(
@@ -1036,6 +1026,66 @@ class Base(Configuration):
         environ_name="APPLICATION_BASE_URL",
         environ_prefix=None,
     )
+
+    # User access tokens (embedded frontend / iframe support)
+    USER_ACCESS_TOKEN_ENABLED = values.BooleanValue(
+        False, environ_name="USER_ACCESS_TOKEN_ENABLED", environ_prefix=None
+    )
+    USER_ACCESS_TOKEN_SECRET_KEY = SecretFileValue(
+        None, environ_name="USER_ACCESS_TOKEN_SECRET_KEY", environ_prefix=None
+    )
+    USER_ACCESS_TOKEN_ALG = values.Value(
+        "HS256",
+        environ_name="USER_ACCESS_TOKEN_ALG",
+        environ_prefix=None,
+    )
+    USER_ACCESS_TOKEN_ISSUER = values.Value(
+        "lasuite-meet",
+        environ_name="USER_ACCESS_TOKEN_ISSUER",
+        environ_prefix=None,
+    )
+    USER_ACCESS_TOKEN_AUDIENCE = values.Value(
+        None,
+        environ_name="USER_ACCESS_TOKEN_AUDIENCE",
+        environ_prefix=None,
+    )
+    # Lifetime of the user access token obtained through the exchange
+    # endpoint. It never transits through a URL, so it can cover a full
+    # meeting (default: 2 hours).
+    USER_ACCESS_TOKEN_TTL = values.PositiveIntegerValue(
+        7200,
+        environ_name="USER_ACCESS_TOKEN_TTL",
+        environ_prefix=None,
+    )
+    # Lifetime of the single-use transit code handed to the frontend
+    # through a URL fragment. Kept very short by design: it must only
+    # survive the redirect and the exchange call.
+    TRANSIT_CODE_TTL = values.PositiveIntegerValue(
+        60,
+        environ_name="TRANSIT_CODE_TTL",
+        environ_prefix=None,
+    )
+    TRANSIT_CODE_CACHE_PREFIX = values.Value(
+        "transit-code",
+        environ_name="TRANSIT_CODE_CACHE_PREFIX",
+        environ_prefix=None,
+    )
+    # Number of random bytes per code (48 bytes -> 64 url-safe characters)
+    TRANSIT_CODE_NBYTES = values.PositiveIntegerValue(
+        48,
+        environ_name="TRANSIT_CODE_NBYTES",
+        environ_prefix=None,
+    )
+    USER_ACCESS_TOKEN_TYPE = values.Value(
+        "Bearer",
+        environ_name="USER_ACCESS_TOKEN_TYPE",
+        environ_prefix=None,
+    )
+    USER_ACCESS_TOKEN_TYPE_CLAIM = values.Value(
+        "user_token",
+        environ_name="USER_ACCESS_TOKEN_TYPE_CLAIM",
+        environ_prefix=None,
+    )
     # Warning: EXTERNAL_API_ALLOW_PUBLIC_ACCESS is ignored when
     # EXTERNAL_API_DEFAULT_ACCESS_LEVEL=public.
     EXTERNAL_API_ALLOW_PUBLIC_ACCESS = values.BooleanValue(
@@ -1139,6 +1189,12 @@ class Base(Configuration):
         environ_prefix=None,
     )
 
+    LOGGING_SILENCED_401_PATHS = values.ListValue(
+        default=["/api/v1.0/users/me/"],
+        environ_name="LOGGING_SILENCED_401_PATHS",
+        environ_prefix=None,
+    )
+
     # Logging
     # We want to make it easy to log to console but by default we log production
     # to Sentry and don't want to log to console.
@@ -1151,10 +1207,16 @@ class Base(Configuration):
                 "style": "{",
             },
         },
+        "filters": {
+            "silence_expected_401": {
+                "()": "core.logging_filters.SilenceExpected401",
+            },
+        },
         "handlers": {
             "console": {
                 "class": "logging.StreamHandler",
                 "formatter": "simple",
+                "filters": ["silence_expected_401"],
             },
         },
         # Override root logger to send it to console
@@ -1165,6 +1227,13 @@ class Base(Configuration):
             ),
         },
         "loggers": {
+            "request.summary": {
+                "level": values.Value(
+                    "WARNING",
+                    environ_name="LOGGING_LEVEL_REQUEST_SUMMARY",
+                    environ_prefix="",
+                )
+            },
             "core": {
                 "handlers": ["console"],
                 "level": values.Value(
@@ -1207,49 +1276,6 @@ class Base(Configuration):
             },
         }
 
-    @classmethod
-    def _check_recording_encoding_maps(cls):
-        """Ensure the per-recording encoding maps are mutually consistent.
-
-        Every profile in RECORDING_ENCODING_AVAILABLE_PROFILES must declare an fps and
-        a bitrate for each resolution declared in RECORDING_ENCODING_AVAILABLE_RESOLUTIONS,
-        and each non-empty default must name an entry of its map.
-        """
-        # DictValue resolves to a dict at runtime; pylint sees the descriptor.
-        # pylint: disable=no-member
-        resolutions = set(cls.RECORDING_ENCODING_AVAILABLE_RESOLUTIONS)
-        for profile, spec in cls.RECORDING_ENCODING_AVAILABLE_PROFILES.items():
-            if "fps" not in spec or "kbps" not in spec:
-                raise ValueError(
-                    f"Profile '{profile}' in RECORDING_ENCODING_AVAILABLE_PROFILES must "
-                    "define both 'fps' and 'kbps'."
-                )
-
-            profile_resolutions = set(spec["kbps"])
-            if profile_resolutions != resolutions:
-                raise ValueError(
-                    f"Profile '{profile}' in RECORDING_ENCODING_AVAILABLE_PROFILES must "
-                    "define a bitrate for exactly the resolutions in "
-                    "RECORDING_ENCODING_AVAILABLE_RESOLUTIONS, mismatch on: "
-                    f"{resolutions ^ profile_resolutions}"
-                )
-
-        default_resolution = cls.RECORDING_ENCODING_DEFAULT_RESOLUTION
-        if default_resolution and default_resolution not in resolutions:
-            raise ValueError(
-                f"RECORDING_ENCODING_DEFAULT_RESOLUTION '{default_resolution}' is not a "
-                "key of RECORDING_ENCODING_AVAILABLE_RESOLUTIONS, choose from "
-                f"{sorted(resolutions)}."
-            )
-
-        profiles = set(cls.RECORDING_ENCODING_AVAILABLE_PROFILES)
-        default_profile = cls.RECORDING_ENCODING_DEFAULT_PROFILE
-        if default_profile and default_profile not in profiles:
-            raise ValueError(
-                f"RECORDING_ENCODING_DEFAULT_PROFILE '{default_profile}' is not a key of "
-                f"RECORDING_ENCODING_AVAILABLE_PROFILES, choose from {sorted(profiles)}."
-            )
-
     @classmethod
     def post_setup(cls):
         """Post setup configuration.
@@ -1263,8 +1289,6 @@ class Base(Configuration):
                 "FILE_UPLOAD_TMP_PATH cannot be the same as FILE_UPLOAD_PATH"
             )
 
-        cls._check_recording_encoding_maps()
-
         if (
             cls.SUMMARY_SERVICE_VERSION == 1
             and cls.SUMMARY_SERVICE_ENDPOINT is not None
@@ -1285,7 +1309,14 @@ class Base(Configuration):
                 dsn=cls.SENTRY_DSN,
                 environment=cls.__name__.lower(),  # build, test, development, production
                 release=get_release(),
-                integrations=[DjangoIntegration()],
+                traces_sample_rate=cls.SENTRY_TRACES_SAMPLE_RATE,
+                integrations=[
+                    DjangoIntegration(
+                        transaction_style="url",
+                        middleware_spans=True,
+                        cache_spans=True,
+                    )
+                ],
             )
             sentry_sdk.set_tag("application", "backend")
 
@@ -1377,6 +1408,9 @@ class Test(Base):
     ADDONS_ENABLED = True
     ADDONS_CSRF_SECRET = "secret-key-padded-for-minimum-len!-addons"  # noqa:S105
     ADDONS_TOKEN_SECRET_KEY = "secret-key-padded-for-minimum-len!-addons"  # noqa:S105
+    USER_ACCESS_TOKEN_ENABLED = True
+    USER_ACCESS_TOKEN_SECRET_KEY = "secret-key-padded-for-minimum-len!-room"  # noqa:S105
+    USER_ACCESS_TOKEN_AUDIENCE = "Test inc."  # noqa:S105
 
     CONNECTION_TEST_ENABLED = True
 

src/backend/pyproject.toml

@@ -7,7 +7,7 @@ build-backend = "uv_build"
 
 [project]
 name = "meet"
-version = "1.30.0"
+version = "1.31.0"
 authors = [{ "name" = "DINUM", "email" = "dev@mail.numerique.gouv.fr" }]
 classifiers = [
     "Development Status :: 5 - Production/Stable",

src/backend/uv.lock

@@ -1187,7 +1187,7 @@ wheels = [
 
 [[package]]
 name = "meet"
-version = "1.30.0"
+version = "1.31.0"
 source = { editable = "." }
 dependencies = [
     { name = "aiohttp" },

src/frontend/Dockerfile

@@ -4,12 +4,12 @@ USER node
 
 WORKDIR /home/frontend/
 
-COPY ./src/frontend/package.json ./package.json
-COPY ./src/frontend/package-lock.json ./package-lock.json
+COPY --chown=node:node ./src/frontend/package.json ./package.json
+COPY --chown=node:node ./src/frontend/package-lock.json ./package-lock.json
 
 RUN npm ci
 
-COPY .dockerignore ./.dockerignore
+COPY --chown=node:node .dockerignore ./.dockerignore
 COPY --chown=node:node ./src/frontend/ .
 
 ### ---- Front-end builder image ----
@@ -42,19 +42,10 @@ ENV VITE_APP_TITLE=${VITE_APP_TITLE}
 RUN npm run build
 
 # ---- Front-end image ----
-FROM nginxinc/nginx-unprivileged:1.30.3-alpine3.23 AS frontend-production
+FROM nginxinc/nginx-unprivileged:1.30.4-alpine3.24 AS frontend-production
 
 USER root
-
-# Security patches for known CVEs
-RUN apk update && apk upgrade  \
-    libcrypto3>=3.5.7-r0 \
-    libssl3>=3.5.7-r0 \
-    musl \
-    musl-utils \
-    zlib>=1.3.2-r0 \
-    && apk del curl
-
+RUN apk del curl
 USER nginx
 
 # Un-privileged user running the application

src/frontend/package-lock.json

@@ -1,12 +1,12 @@
 {
   "name": "meet",
-  "version": "1.30.0",
+  "version": "1.31.0",
   "lockfileVersion": 3,
   "requires": true,
   "packages": {
     "": {
       "name": "meet",
-      "version": "1.30.0",
+      "version": "1.31.0",
       "dependencies": {
         "@fontsource-variable/atkinson-hyperlegible-next": "5.3.0",
         "@fontsource-variable/lexend": "5.3.0",
@@ -23,18 +23,18 @@
         "@timephy/rnnoise-wasm": "1.0.0",
         "crisp-sdk-web": "1.1.2",
         "hoofd": "1.7.3",
-        "humanize-duration": "3.33.2",
+        "humanize-duration": "3.34.1",
         "i18next": "26.3.6",
         "i18next-browser-languagedetector": "8.2.1",
         "i18next-parser": "9.4.0",
         "i18next-resources-to-backend": "1.2.3",
         "livekit-client": "2.21.0",
-        "posthog-js": "1.414.0",
+        "posthog-js": "1.418.10",
         "react": "18.3.1",
         "react-aria": "3.50.0",
         "react-aria-components": "1.19.0",
         "react-dom": "18.3.1",
-        "react-i18next": "17.0.10",
+        "react-i18next": "17.0.12",
         "react-stately": "3.48.0",
         "use-sound": "5.0.0",
         "valtio": "2.3.2",
@@ -1720,28 +1720,28 @@
       "license": "MIT"
     },
     "node_modules/@posthog/browser-common": {
-      "version": "0.4.0",
-      "resolved": "https://registry.npmjs.org/@posthog/browser-common/-/browser-common-0.4.0.tgz",
-      "integrity": "sha512-W9DCGVks15docUMPvJ2nd8NS16Gn74bsGWuaeg31beEKFSjdW8wvnQ1ETY6WSql5pYxZb3GdJmEUZVVstKSrBQ==",
+      "version": "0.5.2",
+      "resolved": "https://registry.npmjs.org/@posthog/browser-common/-/browser-common-0.5.2.tgz",
+      "integrity": "sha512-8GvfEshFdeKIccuy3kpp6mDBxawQtRamMYRCwzy1r1ixLKQVLAGs3afhOf6r75yp59ZQBi5mtXQgUJ2Jz8eHuw==",
       "license": "MIT",
       "dependencies": {
-        "@posthog/core": "^1.46.8",
-        "@posthog/types": "^1.402.0"
+        "@posthog/core": "^1.48.11",
+        "@posthog/types": "^1.405.3"
       }
     },
     "node_modules/@posthog/core": {
-      "version": "1.49.1",
-      "resolved": "https://registry.npmjs.org/@posthog/core/-/core-1.49.1.tgz",
-      "integrity": "sha512-jdZh85tG56OXLH881CVwBZyiXCPPaZasfYeWwm9kVUvxC/Rb+lz7wYN9GuqSEmNPJgVnK4v8wS0bCaFc3OmVEA==",
+      "version": "1.53.2",
+      "resolved": "https://registry.npmjs.org/@posthog/core/-/core-1.53.2.tgz",
+      "integrity": "sha512-Knx8442G2LyPVIzLvhcBX/TIdeHpZhrYrtZou3Uw8FWfbr9gQtQeOZDCog3MWcDxJ+4vAnMAAOzf5cYpc7Gxyw==",
       "license": "MIT",
       "dependencies": {
-        "@posthog/types": "^1.407.0"
+        "@posthog/types": "^1.411.1"
       }
     },
     "node_modules/@posthog/types": {
-      "version": "1.407.1",
-      "resolved": "https://registry.npmjs.org/@posthog/types/-/types-1.407.1.tgz",
-      "integrity": "sha512-WhbkXPC2rgylXqmxHqv70ffI3k+KxyR6s7DBIfr5NvIqHkxp6v0pk31D/jbz0DNVbzwkLjyll2pxr4FNbJiYzg==",
+      "version": "1.411.1",
+      "resolved": "https://registry.npmjs.org/@posthog/types/-/types-1.411.1.tgz",
+      "integrity": "sha512-Gd7tnSYctcSXup3naVlAgavvenByRao6rsSYdMgWgP35KE9jFn+rMHNRJeI5LNjJuLzMXHEVcgzAN7xcATefdw==",
       "license": "MIT"
     },
     "node_modules/@react-aria/overlays": {
@@ -6354,11 +6354,12 @@
       "integrity": "sha512-iARIBPgcQrwtEr+tALF+rapJ8qSc+Set2GJQl7xT1MQzWaVkFebdJhR3alVlSiUf5U7nAANKuj3aWpwerocD5w=="
     },
     "node_modules/html-parse-stringify": {
-      "version": "3.0.1",
-      "resolved": "https://registry.npmjs.org/html-parse-stringify/-/html-parse-stringify-3.0.1.tgz",
-      "integrity": "sha512-KknJ50kTInJ7qIScF3jeaFRpMpE8/lfiTdzf/twXyPBLAGrLRTmkz3AdTnKeh40X8k9L2fdYwEp/42WGXIRGcg==",
-      "dependencies": {
-        "void-elements": "3.1.0"
+      "version": "4.0.1",
+      "resolved": "https://registry.npmjs.org/html-parse-stringify/-/html-parse-stringify-4.0.1.tgz",
+      "integrity": "sha512-0zHsZJrK7S3K2aucXWL6ycoYJ/iNtIcFHC/nYQgFklPtrv5LpJctIiSCroWZWeuoXvuyFdzp6KzjJQ+OT5MfFw==",
+      "license": "MIT",
+      "funding": {
+        "url": "https://locize.com"
       }
     },
     "node_modules/htmlparser2": {
@@ -6401,9 +6402,9 @@
       }
     },
     "node_modules/humanize-duration": {
-      "version": "3.33.2",
-      "resolved": "https://registry.npmjs.org/humanize-duration/-/humanize-duration-3.33.2.tgz",
-      "integrity": "sha512-K7Ny/ULO1hDm2nnhvAY+SJV1skxFb61fd073SG1IWJl+D44ULrruCuTyjHKjBVVcSuTlnY99DKtgEG39CM5QOQ==",
+      "version": "3.34.1",
+      "resolved": "https://registry.npmjs.org/humanize-duration/-/humanize-duration-3.34.1.tgz",
+      "integrity": "sha512-YIiigjQ+O31rvcyDJPK1ptTZtvSErjBtmHy93VhbwxB/VwMG0FszKs2IB667tFxmOhNapePQQxa24luQRDkKFQ==",
       "license": "Unlicense",
       "funding": {
         "url": "https://github.com/sponsors/EvanHahn"
@@ -9131,16 +9132,16 @@
       "license": "MIT"
     },
     "node_modules/posthog-js": {
-      "version": "1.414.0",
-      "resolved": "https://registry.npmjs.org/posthog-js/-/posthog-js-1.414.0.tgz",
-      "integrity": "sha512-dtZd4asdskr8lNyltAEX6zyn48uO1pO0EMvx6AXJU65PFhu6yn2LPbKtQcyLysjcN57FJPNT9QYL6St5SBJHqw==",
+      "version": "1.418.10",
+      "resolved": "https://registry.npmjs.org/posthog-js/-/posthog-js-1.418.10.tgz",
+      "integrity": "sha512-XMvmmnuFoesSPjFo+wvzXkvuzYqIho8CVqxugG1Wt768offFARYNZDd1/xWfm9vk/pJTJ4RhUEHRzLpggmGx9Q==",
       "license": "(Apache-2.0 AND MIT)",
       "dependencies": {
-        "@posthog/browser-common": "^0.4.0",
-        "@posthog/core": "^1.46.9",
-        "@posthog/types": "^1.402.2",
+        "@posthog/browser-common": "^0.5.0",
+        "@posthog/core": "^1.48.8",
+        "@posthog/types": "^1.405.1",
         "core-js": "^3.49.0",
-        "dompurify": "^3.4.12",
+        "dompurify": "^3.4.13",
         "fflate": "^0.4.8",
         "preact": "^10.29.3",
         "query-selector-shadow-dom": "^1.0.1",
@@ -9435,13 +9436,13 @@
       }
     },
     "node_modules/react-i18next": {
-      "version": "17.0.10",
-      "resolved": "https://registry.npmjs.org/react-i18next/-/react-i18next-17.0.10.tgz",
-      "integrity": "sha512-XneHftyYA774MJkkccSkZ5oKrUpCnXIPmxio3wemqrVzCRLWiGXOMbIzObrer03fNDEnm8g8R5yYls4HcE+esg==",
+      "version": "17.0.12",
+      "resolved": "https://registry.npmjs.org/react-i18next/-/react-i18next-17.0.12.tgz",
+      "integrity": "sha512-lFWPEGkxQ6RhusdUkysFBD58VHfSSzvHBzqMgN0SvfVpdQGfwtNkStTqdy08/sJd7s807qqutgx93fRpD0DJ3Q==",
       "license": "MIT",
       "dependencies": {
-        "@babel/runtime": "^7.29.2",
-        "html-parse-stringify": "^3.0.1",
+        "@babel/runtime": "^7.29.7",
+        "html-parse-stringify": "^4.0.1",
         "use-sync-external-store": "^1.6.0"
       },
       "peerDependencies": {
@@ -11608,14 +11609,6 @@
         "url": "https://github.com/sponsors/jonschlinkert"
       }
     },
-    "node_modules/void-elements": {
-      "version": "3.1.0",
-      "resolved": "https://registry.npmjs.org/void-elements/-/void-elements-3.1.0.tgz",
-      "integrity": "sha512-Dhxzh5HZuiHQhbvTW9AMetFfBHDMYpo23Uo9btPXgdYP+3T5S+p+jgNy7spra+veYhBP2dCSgxR/i2Y02h5/6w==",
-      "engines": {
-        "node": ">=0.10.0"
-      }
-    },
     "node_modules/walk-sync": {
       "version": "2.2.0",
       "resolved": "https://registry.npmjs.org/walk-sync/-/walk-sync-2.2.0.tgz",

src/frontend/package.json

@@ -1,7 +1,7 @@
 {
   "name": "meet",
   "private": true,
-  "version": "1.30.0",
+  "version": "1.31.0",
   "type": "module",
   "scripts": {
     "dev": "panda codegen && vite",
@@ -30,18 +30,18 @@
     "@timephy/rnnoise-wasm": "1.0.0",
     "crisp-sdk-web": "1.1.2",
     "hoofd": "1.7.3",
-    "humanize-duration": "3.33.2",
+    "humanize-duration": "3.34.1",
     "i18next": "26.3.6",
     "i18next-browser-languagedetector": "8.2.1",
     "i18next-parser": "9.4.0",
     "i18next-resources-to-backend": "1.2.3",
     "livekit-client": "2.21.0",
-    "posthog-js": "1.414.0",
+    "posthog-js": "1.418.10",
     "react": "18.3.1",
     "react-aria": "3.50.0",
     "react-aria-components": "1.19.0",
     "react-dom": "18.3.1",
-    "react-i18next": "17.0.10",
+    "react-i18next": "17.0.12",
     "react-stately": "3.48.0",
     "use-sound": "5.0.0",
     "valtio": "2.3.2",

src/frontend/src/App.tsx

@@ -12,6 +12,7 @@ import { routes } from './routes'
 import './i18n/init'
 import { queryClient } from '@/api/queryClient'
 import { AppInitialization } from '@/components/AppInitialization'
+import { TransitCodeGate } from '@/features/auth/components/TransitCodeGate'
 import { useIsSdkContext } from '@/features/sdk/hooks/useIsSdkContext'
 import { useApplyA11yFonts } from '@/hooks/useApplyA11yFonts'
 
@@ -24,23 +25,29 @@ function App() {
 
   return (
     <QueryClientProvider client={queryClient}>
-      {!isSDKContext && <AppInitialization />}
-      <Suspense fallback={null}>
-        <I18nProvider locale={i18n.language}>
-          <Layout>
-            <Switch>
-              {Object.entries(routes).map(([, route], i) => (
-                <Route key={i} path={route.path} component={route.Component} />
-              ))}
-              <Route component={NotFoundScreen} />
-            </Switch>
-          </Layout>
-          <ReactQueryDevtools
-            initialIsOpen={false}
-            buttonPosition="bottom-left"
-          />
-        </I18nProvider>
-      </Suspense>
+      <TransitCodeGate>
+        {!isSDKContext && <AppInitialization />}
+        <Suspense fallback={null}>
+          <I18nProvider locale={i18n.language}>
+            <Layout>
+              <Switch>
+                {Object.entries(routes).map(([, route], i) => (
+                  <Route
+                    key={i}
+                    path={route.path}
+                    component={route.Component}
+                  />
+                ))}
+                <Route component={NotFoundScreen} />
+              </Switch>
+            </Layout>
+            <ReactQueryDevtools
+              initialIsOpen={false}
+              buttonPosition="bottom-left"
+            />
+          </I18nProvider>
+        </Suspense>
+      </TransitCodeGate>
     </QueryClientProvider>
   )
 }

src/frontend/src/api/fetchApi.ts

@@ -1,17 +1,23 @@
 import { ApiError } from './ApiError'
 import { apiUrl } from './apiUrl'
+import { getAccessToken } from '@/stores/accessToken'
 
 export const fetchApi = async <T = Record<string, unknown>>(
   url: string,
   options?: RequestInit
 ): Promise<T> => {
   const csrfToken = getCsrfToken()
+  // Embedded (iframe) mode: the user access token obtained through the
+  // transit code exchange authenticates requests in place of the session
+  // cookie, which is blocked in third-party contexts.
+  const accessToken = getAccessToken()
   const response = await fetch(apiUrl(url), {
     credentials: 'include',
     ...options,
     headers: {
       'Content-Type': 'application/json',
       ...(!!csrfToken && { 'X-CSRFToken': csrfToken }),
+      ...(!!accessToken && { Authorization: `Bearer ${accessToken}` }),
       ...options?.headers,
     },
   })