🔖(minor) bump release to 1.18.0

Last PR was merged a bit too quicly and another migration
was added before the PR one.

.github/workflows/meet.yml

@@ -150,13 +150,14 @@ jobs:
         uses: actions/setup-python@v6
         with:
           python-version: "3.13"
-          cache: "pip"
-      - name: Install development dependencies
-        run: pip install --user .[dev]
+      - name: Install uv
+        uses: astral-sh/setup-uv@v7
+      - name: Install the project
+        run: uv sync --locked --all-extras
       - name: Check code formatting with ruff
-        run: ~/.local/bin/ruff format . --diff
+        run: uv run ruff format . --diff
       - name: Lint code with ruff
-        run: ~/.local/bin/ruff check .
+        run: uv run ruff check .
 
   lint-summary:
     runs-on: ubuntu-latest

.gitignore

@@ -83,3 +83,6 @@ docker/livekit/out
 
 # LiveKit CA configuration
 docker/livekit/rootCA.pem
+
+# Frontend rollup-plugin-visualizer
+/src/frontend/rollup-plugin-visualizer/*

CHANGELOG.md

@@ -8,17 +8,59 @@ and this project adheres to
 
 ## [Unreleased]
 
+## [1.18.0] - 2026-06-03
+
+### Added
+
+- 🔧(backend) backport logging configuration from docs
+- 🧑‍💻(backend) add management command to merge duplicate users
+- 👷(helm) add Kubernetes job for duplicate user merge command
+
+### Fixed
+
+- 🐛(backend) prevent duplicate pending users on concurrent requests
+- 🔒️(backend) prevent file change post checks #1377
+
+## [1.17.0] - 2026-05-31
+
+### Added
+
+- ✨(fullstack) allow participants to mute others based on room configuration
+- ✨(frontend) add synchronizer for room metadata updates
+- ✨(frontend) make reaction toolbar responsive on small viewports
+- ✨(frontend) enable reactions on mobile devices
+- ✨(frontend) introduce picture-in-picture meeting
+- ✨(backend) add core.recording.event.parsers.S3Parser
+- ✨(summary) extended support for all video / audio files #1358
+
+### Changed
+
+- ♻️(fullstack) simplify source serialization
+- ✨(backend) expose room configuration to all API consumers
+- 🩹(frontend) improve reaction toolbar centering with dynamic positioning
+- 🚀 (paas) remove buildpack requirements.txt to use the new uv.lock #1349
+- ✨(backend) allow room configuration and access level via external api #1260
+- ♻️(backend) prefix Swagger routes with /api
+
+### Fixed
+
+- 🩹(backend) fix swagger and redoc documentation URLs
+
+## [1.16.0] - 2026-05-13
+
 ### Added
 
 - 🔒️(backend) add validation of Room.configuration
 - ✨(helm) add support multiple transcribe worker / endpoint #1247
 - ✨(backend) make LiveKit Egress recording encoding configurable #1288
 - ✨(summary) add speaker-to-participant assignment
-- ✨(feat) Introduce Picture-in-Picture (PiP) #890
 
 ### Changed
 
 - ♻️(summary) change tasks endpoint signature
+- ⬆️(dependencies) update urllib3 to v2.7.0 [SECURITY]
+- 🧑‍💻(agents) use `uv` for package management
+- ✨(summary) improve speaker-to-participant assignment
 
 ### Fixed
 
@@ -28,6 +70,7 @@ and this project adheres to
 - ⬆️(mail) fix dependencies not having resolved or integrity field #1321
 - 🐛(summary) complete webm support #1328
 - 🐛(backend) add link to "Open" text in recording email
+- 🩹(frontend) fix spacing regression in mobile control bar
 
 ## [1.15.0] - 2026-04-30
 

Makefile

@@ -109,7 +109,7 @@ build-frontend: ## build the frontend container
 .PHONY: build-frontend
 
 build-agents: ## build the multi-user-transcriber agent container
-	@$(COMPOSE) build multi-user-transcriber
+	@$(COMPOSE) build multi-user-transcriber-dev
 .PHONY: build-agents
 
 down: ## stop and remove containers, networks, images, and volumes
@@ -138,7 +138,7 @@ run-agents: ## start the multi-user-transcriber agent
 .PHONY: run-agents
 
 run-agent-multi-user-transcriber: ## start the LiveKit agents (multi users transcriber)
-	@$(COMPOSE) up --force-recreate -d multi-user-transcriber
+	@$(COMPOSE) up --force-recreate -d multi-user-transcriber-dev
 .PHONY: run-agent-multi-user-transcriber
 
 run-agent-metadata-collector: ## start the LiveKit agents (metadata collector)

bin/Tiltfile

@@ -23,8 +23,8 @@ docker_build(
     live_update=[
         sync('../src/backend', '/app'),
         run(
-            'pip install -r /app/requirements.txt',
-            trigger=['./api/requirements.txt']
+            'uv sync --locked --no-dev',
+            trigger=['../src/backend/uv.lock', '../src/backend/pyproject.toml']
         )
     ]
 )
@@ -110,11 +110,20 @@ k8s_resource('meet-celery-backend', resource_deps=['redis'])
 k8s_resource('meet-celery-summarize', resource_deps=['redis'])
 k8s_resource('meet-celery-summary-backend', resource_deps=['redis'])
 k8s_resource('meet-celery-transcribe-default', resource_deps=['redis'])
-k8s_resource('meet-backend-migrate', resource_deps=['meet-backend'])
 k8s_resource('livekit-livekit-server', resource_deps=['redis'])
 k8s_resource('livekit-livekit-server-test-connection', resource_deps=['livekit-livekit-server'])
 k8s_resource('keycloak', resource_deps=['kc-postgresql'])
-k8s_resource('meet-backend-createsuperuser', resource_deps=['meet-backend-migrate'])
+# Trigger once on launch
+k8s_resource(
+    'meet-backend-createsuperuser',
+    resource_deps=['meet-backend-migrate'],
+    trigger_mode=TRIGGER_MODE_MANUAL,
+)
+k8s_resource(
+    'meet-backend-migrate',
+    resource_deps=['meet-backend'],
+    trigger_mode=TRIGGER_MODE_MANUAL,
+)
 
 migration = '''
 set -eu

bin/buildpack_postfrontend.sh

@@ -47,4 +47,3 @@ mv src/backend/* ./
 mv deploy/paas/* ./
 
 echo "3.13" > .python-version
-echo "." > requirements.txt

compose.yml

@@ -249,6 +249,7 @@ services:
   metadata-collector-dev:
     build:
       context: ./src/agents
+      target: development
     command: ["python", "metadata_collector.py", "dev"]
     environment:
       - LIVEKIT_URL=ws://livekit:7880
@@ -261,6 +262,7 @@ services:
       - AWS_S3_SECURE_ACCESS=False
     volumes:
       - ./src/agents:/app
+      - /app/.venv
     depends_on:
       - livekit
       - minio
@@ -269,6 +271,16 @@ services:
         - action: rebuild
           path: ./src/agents
 
+  multi-user-transcriber-dev:
+    build:
+      context: ./src/agents
+      target: development
+    env_file:
+      - env.d/development/multi_user_transcriber
+    volumes:
+      - ./src/agents:/app
+      - /app/.venv
+
   redis-summary:
     image: redis
     ports:
@@ -330,14 +342,6 @@ services:
         - action: rebuild
           path: ./src/summary
 
-  multi-user-transcriber:
-    build:
-      context: ./src/agents
-    env_file:
-      - env.d/development/multi_user_transcriber
-    volumes:
-      - ./src/agents:/app
-
 networks:
   default:
   resource-server:

docs/openapi.yaml

@@ -185,6 +185,7 @@ paths:
                           pin_code: "123456"
                           phone_number: "+1-555-0100"
                           default_country: "US"
+                        configuration: {}
         '401':
           $ref: '#/components/responses/UnauthorizedError'
         '403':
@@ -198,10 +199,6 @@ paths:
       description: |
         Creates a new room with secure defaults for external API usage.
         
-        **Restrictions:**
-        - Rooms are always created with `trusted` access (no public rooms via API)
-        - Room access_level can be updated from the webapp interface.
-        
         **Defaults:**
         - Delegated user is set as owner
         - Room slug auto-generated for uniqueness
@@ -218,8 +215,17 @@ paths:
               $ref: '#/components/schemas/RoomCreate'
             examples:
               emptyBody:
-                summary: No parameters (default)
-                value: {}
+                summary: No parameters (use all defaults)
+                value: { }
+              withAccessLevel:
+                summary: Specify access level
+                value:
+                  access_level: "trusted"
+              withConfiguration:
+                summary: Provide room configuration
+                value:
+                  configuration:
+                    everyone_can_mute: true
       responses:
         '201':
           description: Room created successfully
@@ -269,6 +275,7 @@ paths:
                       pin_code: "123456"
                       phone_number: "+1-555-0100"
                       default_country: "US"
+                    configuration: {}
         '401':
           $ref: '#/components/responses/UnauthorizedError'
         '403':
@@ -344,8 +351,56 @@ components:
 
     RoomCreate:
       type: object
-      description: Empty object - all room properties are auto-generated
-      properties: {}
+      description: |
+        Optional fields for room creation. All fields have secure defaults if omitted.
+      properties:
+        access_level:
+          $ref: '#/components/schemas/RoomAccessLevel'
+        configuration:
+          $ref: '#/components/schemas/RoomConfiguration'
+
+    RoomConfiguration:
+      type: object
+      description: |
+        Optional room behaviour settings. Unknown fields are rejected.
+        All fields are optional and default to `null` (server-side defaults apply).
+      properties:
+        can_publish_sources:
+          type: array
+          nullable: true
+          description: |
+            Restricts which media tracks participants are allowed to publish.
+            If `null`, all sources are permitted.
+          items:
+            type: string
+            enum:
+              - camera
+              - microphone
+              - screen_share
+              - screen_share_audio
+          example: [ "camera", "microphone" ]
+        everyone_can_mute:
+          type: boolean
+          nullable: true
+          description: |
+            Whether any participant can mute others, or only the room owner/moderator.
+            If `null`, the server default applies.
+          example: true
+      additionalProperties: false
+
+    RoomAccessLevel:
+      type: string
+      enum:
+        - public
+        - trusted
+        - restricted
+      description: |
+        Controls who can join the room without going through the lobby.
+
+        - `public`: Anyone with the room link can join directly, no authentication required.
+        - `trusted`: Authenticated users join directly. Unauthenticated users wait in the lobby for approval.
+        - `restricted`: Only participants explicitly trusted by the owner bypass the lobby. Everyone else waits for approval regardless of authentication.
+      example: "trusted"
 
     Room:
       type: object
@@ -362,10 +417,7 @@ components:
           description: URL-friendly room identifier (auto-generated)
           example: "aze-eere-zer"
         access_level:
-          type: string
-          readOnly: true
-          description: Room access level (always 'trusted' for API-created rooms)
-          example: "trusted"
+          $ref: '#/components/schemas/RoomAccessLevel'
         url:
           type: string
           format: uri
@@ -393,6 +445,8 @@ components:
               type: string
               description: Default country code
               example: "US"
+        configuration:
+          $ref: '#/components/schemas/RoomConfiguration'
 
     OAuthError:
       type: object

docs/resource_server.yaml

@@ -48,7 +48,7 @@ paths:
       summary: List rooms
       description: |
         Returns a list of rooms accessible to the authenticated user.
-        Only rooms where the delegated user has access will be returned.
+        Only rooms where the user has access will be returned.
       operationId: listRooms
       security:
         - BearerAuth: [rooms:list]
@@ -108,6 +108,7 @@ paths:
                           pin_code: "123456"
                           phone_number: "+1-555-0100"
                           default_country: "US"
+                        configuration: { }
         '401':
           $ref: '#/components/responses/UnauthorizedError'
         '403':
@@ -120,13 +121,9 @@ paths:
       summary: Create a room
       description: |
         Creates a new room with secure defaults for external API usage.
-        
-        **Restrictions:**
-        - Rooms are always created with `trusted` access (no public rooms via API)
-        - Room access_level can be updated from the webapp interface.
-        
+
         **Defaults:**
-        - Delegated user is set as owner
+        - user is set as owner
         - Room slug auto-generated for uniqueness
         - Telephony PIN auto-generated when enabled
         - Creation tracked with application client_id for auditing
@@ -141,8 +138,17 @@ paths:
               $ref: '#/components/schemas/RoomCreate'
             examples:
               emptyBody:
-                summary: No parameters (default)
-                value: {}
+                summary: No parameters (use all defaults)
+                value: { }
+              withAccessLevel:
+                summary: Specify access level
+                value:
+                  access_level: "trusted"
+              withConfiguration:
+                summary: Provide room configuration
+                value:
+                  configuration:
+                    everyone_can_mute: true
       responses:
         '201':
           description: Room created successfully
@@ -192,6 +198,7 @@ paths:
                       pin_code: "123456"
                       phone_number: "+1-555-0100"
                       default_country: "US"
+                    configuration: { }
         '401':
           $ref: '#/components/responses/UnauthorizedError'
         '403':
@@ -210,65 +217,58 @@ components:
         Include in requests as: `Authorization: Bearer <token>`
 
   schemas:
-    TokenRequest:
-      type: object
-      required:
-        - client_id
-        - client_secret
-        - grant_type
-        - scope
-      properties:
-        client_id:
-          type: string
-          description: Application client identifier
-          example: "550e8400-e29b-41d4-a716-446655440000"
-        client_secret:
-          type: string
-          format: password
-          writeOnly: true
-          description: Application secret key
-          example: "1234567890abcdefghijklmnopqrstuvwxyz"
-        grant_type:
-          type: string
-          enum:
-            - client_credentials
-          description: OAuth2 grant type (must be 'client_credentials')
-          example: "client_credentials"
-        scope:
-          type: string
-          format: email
-          description: |
-            Email address of the user to delegate.
-            The application will act on behalf of this user.
-            Note: This parameter is named 'scope' to align with OAuth2 conventions,
-            but accepts an email address to identify the user. This design allows
-            for future extensibility.
-          example: "user@example.com"
-
-    TokenResponse:
-      type: object
-      properties:
-        access_token:
-          type: string
-          description: JWT access token
-          example: "eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJpc3MiOiJtZWV0LWFwaSIsImF1ZCI6Im1lZXQtY2xpZW50cyIsImlhdCI6MTcwOTQ5MTIwMCwiZXhwIjoxNzA5NDk0ODAwLCJjbGllbnRfaWQiOiI1NTBlODQwMC1lMjliLTQxZDQtYTcxNi00NDY2NTU0NDAwMDAiLCJzY29wZSI6InJvb21zOmxpc3Qgcm9vbXM6cmV0cmlldmUgcm9vbXM6Y3JlYXRlIiwidXNlcl9pZCI6IjdiOGQ5YzQwLTNhMmItNGVkZi04NzFjLTJmM2Q0ZTVmNmE3YiIsImRlbGVnYXRlZCI6dHJ1ZX0.signature"
-        token_type:
-          type: string
-          description: Token type (always 'Bearer')
-          example: "Bearer"
-        expires_in:
-          type: integer
-          description: Token lifetime in seconds
-          example: 3600
-        scope:
-          type: string
-          description: Space-separated list of granted permission scopes
-          example: "rooms:list rooms:retrieve rooms:create"
-
     RoomCreate:
       type: object
-      description: Empty object - all room properties are auto-generated
-      properties: {}
+      description: |
+        Optional fields for room creation. All fields have secure defaults if omitted.
+      properties:
+        access_level:
+          $ref: '#/components/schemas/RoomAccessLevel'
+        configuration:
+          $ref: '#/components/schemas/RoomConfiguration'
+
+    RoomConfiguration:
+      type: object
+      description: |
+        Optional room behaviour settings. Unknown fields are rejected.
+        All fields are optional and default to `null` (server-side defaults apply).
+      properties:
+        can_publish_sources:
+          type: array
+          nullable: true
+          description: |
+            Restricts which media tracks participants are allowed to publish.
+            If `null`, all sources are permitted.
+          items:
+            type: string
+            enum:
+              - camera
+              - microphone
+              - screen_share
+              - screen_share_audio
+          example: [ "camera", "microphone" ]
+        everyone_can_mute:
+          type: boolean
+          nullable: true
+          description: |
+            Whether any participant can mute others, or only the room owner/moderator.
+            If `null`, the server default applies.
+          example: true
+      additionalProperties: false
+
+    RoomAccessLevel:
+      type: string
+      enum:
+        - public
+        - trusted
+        - restricted
+      description: |
+        Controls who can join the room without going through the lobby.
+
+        - `public`: Anyone with the room link can join directly, no authentication required.
+        - `trusted`: Authenticated users join directly. Unauthenticated users wait in the lobby for approval.
+        - `restricted`: Only participants explicitly trusted by the owner bypass the lobby. Everyone else waits for approval regardless of authentication.
+      example: "trusted"
 
     Room:
       type: object
@@ -285,10 +285,7 @@ components:
           description: URL-friendly room identifier (auto-generated)
           example: "aze-eere-zer"
         access_level:
-          type: string
-          readOnly: true
-          description: Room access level (always 'trusted' for API-created rooms)
-          example: "trusted"
+          $ref: '#/components/schemas/RoomAccessLevel'
         url:
           type: string
           format: uri
@@ -316,6 +313,8 @@ components:
               type: string
               description: Default country code
               example: "US"
+        configuration:
+          $ref: '#/components/schemas/RoomConfiguration'
 
     OAuthError:
       type: object

src/addons/outlook/package-lock.json

@@ -9,7 +9,7 @@
       "version": "0.0.1",
       "license": "MIT",
       "dependencies": {
-        "core-js": "^3.36.0",
+        "core-js": "^3.49.0",
         "regenerator-runtime": "^0.14.1"
       },
       "devDependencies": {
@@ -19,7 +19,7 @@
         "@types/office-runtime": "^1.0.35",
         "acorn": "^8.11.3",
         "babel-loader": "^9.1.3",
-        "copy-webpack-plugin": "^12.0.2",
+        "copy-webpack-plugin": "^14.0.0",
         "eslint-plugin-office-addins": "^4.0.3",
         "file-loader": "^6.2.0",
         "html-loader": "^5.0.0",
@@ -36,7 +36,7 @@
         "source-map-loader": "^5.0.0",
         "webpack": "^5.95.0",
         "webpack-cli": "^5.1.4",
-        "webpack-dev-server": "5.2.1"
+        "webpack-dev-server": "5.2.4"
       }
     },
     "node_modules/@apidevtools/json-schema-ref-parser": {
@@ -4319,44 +4319,195 @@
         "node": ">= 4.0.0"
       }
     },
-    "node_modules/@nodelib/fs.scandir": {
-      "version": "2.1.5",
-      "resolved": "https://registry.npmjs.org/@nodelib/fs.scandir/-/fs.scandir-2.1.5.tgz",
-      "integrity": "sha512-vq24Bq3ym5HEQm2NKCr3yXDwjc7vTsEThRDnkp2DK9p1uqLR+DHurm/NOTo0KG7HYHU7eppKZj3MyqYuMBf62g==",
+    "node_modules/@noble/hashes": {
+      "version": "1.4.0",
+      "resolved": "https://registry.npmjs.org/@noble/hashes/-/hashes-1.4.0.tgz",
+      "integrity": "sha512-V1JJ1WTRUqHHrOSh597hURcMqVKVGL/ea3kv0gSnEdsEZ0/+VyPghM1lMNGc00z7CIQorSvbKpuJkxvuHbvdbg==",
+      "dev": true,
+      "license": "MIT",
+      "engines": {
+        "node": ">= 16"
+      },
+      "funding": {
+        "url": "https://paulmillr.com/funding/"
+      }
+    },
+    "node_modules/@peculiar/asn1-cms": {
+      "version": "2.7.0",
+      "resolved": "https://registry.npmjs.org/@peculiar/asn1-cms/-/asn1-cms-2.7.0.tgz",
+      "integrity": "sha512-hew63shtzzvBcSHbhm+cyAmKe6AIfinT9hzEqSPjDC6opTTMKmTkQ0gHuN2KsWlvqiKw1S/fS94fhag/FJkioQ==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
-        "@nodelib/fs.stat": "2.0.5",
-        "run-parallel": "^1.1.9"
-      },
-      "engines": {
-        "node": ">= 8"
+        "@peculiar/asn1-schema": "^2.7.0",
+        "@peculiar/asn1-x509": "^2.7.0",
+        "@peculiar/asn1-x509-attr": "^2.7.0",
+        "asn1js": "^3.0.6",
+        "tslib": "^2.8.1"
       }
     },
-    "node_modules/@nodelib/fs.stat": {
-      "version": "2.0.5",
-      "resolved": "https://registry.npmjs.org/@nodelib/fs.stat/-/fs.stat-2.0.5.tgz",
-      "integrity": "sha512-RkhPPp2zrqDAQA/2jNhnztcPAlv64XdhIp7a7454A5ovI7Bukxgt7MX7udwAu3zg1DcpPU0rz3VV1SeaqvY4+A==",
-      "dev": true,
-      "license": "MIT",
-      "engines": {
-        "node": ">= 8"
-      }
-    },
-    "node_modules/@nodelib/fs.walk": {
-      "version": "1.2.8",
-      "resolved": "https://registry.npmjs.org/@nodelib/fs.walk/-/fs.walk-1.2.8.tgz",
-      "integrity": "sha512-oGB+UxlgWcgQkgwo8GcEGwemoTFt3FIO9ababBmaGwXIoBKZ+GTy0pP185beGg7Llih/NSHSV2XAs1lnznocSg==",
+    "node_modules/@peculiar/asn1-csr": {
+      "version": "2.7.0",
+      "resolved": "https://registry.npmjs.org/@peculiar/asn1-csr/-/asn1-csr-2.7.0.tgz",
+      "integrity": "sha512-VVsAyGqErT9D1SY4aEqozThXMVI+ssVRiv2DDeYuvpBKLIgZ3hYs3Ay3u/VSoKq6ESFi9cf6rf3IOOzfwh7oMA==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
-        "@nodelib/fs.scandir": "2.1.5",
-        "fastq": "^1.6.0"
+        "@peculiar/asn1-schema": "^2.7.0",
+        "@peculiar/asn1-x509": "^2.7.0",
+        "asn1js": "^3.0.6",
+        "tslib": "^2.8.1"
+      }
+    },
+    "node_modules/@peculiar/asn1-ecc": {
+      "version": "2.7.0",
+      "resolved": "https://registry.npmjs.org/@peculiar/asn1-ecc/-/asn1-ecc-2.7.0.tgz",
+      "integrity": "sha512-n7KEs/Q/wrB415cxy4fHOBhegp4NdJ15fkJPwcB/3/8iNBQC2L/N7SChJPKDJPZGYH0jD4Tg4/0vnHmwghnbKw==",
+      "dev": true,
+      "license": "MIT",
+      "dependencies": {
+        "@peculiar/asn1-schema": "^2.7.0",
+        "@peculiar/asn1-x509": "^2.7.0",
+        "asn1js": "^3.0.6",
+        "tslib": "^2.8.1"
+      }
+    },
+    "node_modules/@peculiar/asn1-pfx": {
+      "version": "2.7.0",
+      "resolved": "https://registry.npmjs.org/@peculiar/asn1-pfx/-/asn1-pfx-2.7.0.tgz",
+      "integrity": "sha512-V/nrlQVmhg7lYAsM7E13UDL5erAwFv6kCIVFqNaMIHSVi7dngcT839JkRTkQBqznMG98l2XjxYk74ZztAohZzA==",
+      "dev": true,
+      "license": "MIT",
+      "dependencies": {
+        "@peculiar/asn1-cms": "^2.7.0",
+        "@peculiar/asn1-pkcs8": "^2.7.0",
+        "@peculiar/asn1-rsa": "^2.7.0",
+        "@peculiar/asn1-schema": "^2.7.0",
+        "asn1js": "^3.0.6",
+        "tslib": "^2.8.1"
+      }
+    },
+    "node_modules/@peculiar/asn1-pkcs8": {
+      "version": "2.7.0",
+      "resolved": "https://registry.npmjs.org/@peculiar/asn1-pkcs8/-/asn1-pkcs8-2.7.0.tgz",
+      "integrity": "sha512-9GTl1nE8Mx1kTZ+7QyYatDyKsm34QcWRBFkY1iPvWC3X4Dona5s/tlLiQsx5WzVdZqiMBZNYT0buyw4/vbhnjw==",
+      "dev": true,
+      "license": "MIT",
+      "dependencies": {
+        "@peculiar/asn1-schema": "^2.7.0",
+        "@peculiar/asn1-x509": "^2.7.0",
+        "asn1js": "^3.0.6",
+        "tslib": "^2.8.1"
+      }
+    },
+    "node_modules/@peculiar/asn1-pkcs9": {
+      "version": "2.7.0",
+      "resolved": "https://registry.npmjs.org/@peculiar/asn1-pkcs9/-/asn1-pkcs9-2.7.0.tgz",
+      "integrity": "sha512-Bh7m+OuIaSEllPQcSd9OSp93F4ROWH7sbITWV8MI+8dwsjE5111/87VxiWVvYFKyww3vp39geLv9ENqhwWHcew==",
+      "dev": true,
+      "license": "MIT",
+      "dependencies": {
+        "@peculiar/asn1-cms": "^2.7.0",
+        "@peculiar/asn1-pfx": "^2.7.0",
+        "@peculiar/asn1-pkcs8": "^2.7.0",
+        "@peculiar/asn1-schema": "^2.7.0",
+        "@peculiar/asn1-x509": "^2.7.0",
+        "@peculiar/asn1-x509-attr": "^2.7.0",
+        "asn1js": "^3.0.6",
+        "tslib": "^2.8.1"
+      }
+    },
+    "node_modules/@peculiar/asn1-rsa": {
+      "version": "2.7.0",
+      "resolved": "https://registry.npmjs.org/@peculiar/asn1-rsa/-/asn1-rsa-2.7.0.tgz",
+      "integrity": "sha512-/qvENQrXyTZURjMqSeofHul0JJt2sNSzSwk36pl2olkHbaioMQgrASDZAlHXl0xUlnVbHj0uGgOrBMTb5x2aJQ==",
+      "dev": true,
+      "license": "MIT",
+      "dependencies": {
+        "@peculiar/asn1-schema": "^2.7.0",
+        "@peculiar/asn1-x509": "^2.7.0",
+        "asn1js": "^3.0.6",
+        "tslib": "^2.8.1"
+      }
+    },
+    "node_modules/@peculiar/asn1-schema": {
+      "version": "2.7.0",
+      "resolved": "https://registry.npmjs.org/@peculiar/asn1-schema/-/asn1-schema-2.7.0.tgz",
+      "integrity": "sha512-W8ZfWzLmQnrcky+eh3tni4IozMdqBDiHWU0N+vve/UGjMaUs8c0L7A2oEdkBXS8rTpWDpK/aoI3DG/L/hxmxPg==",
+      "dev": true,
+      "license": "MIT",
+      "dependencies": {
+        "@peculiar/utils": "^2.0.2",
+        "asn1js": "^3.0.6",
+        "tslib": "^2.8.1"
+      }
+    },
+    "node_modules/@peculiar/asn1-x509": {
+      "version": "2.7.0",
+      "resolved": "https://registry.npmjs.org/@peculiar/asn1-x509/-/asn1-x509-2.7.0.tgz",
+      "integrity": "sha512-mUn9RRrkGDnG4ALfunDmzyRW5dg+sWCj/pfnCCqEHYbkGxEpvUt6iVJv8Yw1cyp6SWZ26ZE5oSmI5SqEaen15g==",
+      "dev": true,
+      "license": "MIT",
+      "dependencies": {
+        "@peculiar/asn1-schema": "^2.7.0",
+        "@peculiar/utils": "^2.0.2",
+        "asn1js": "^3.0.6",
+        "tslib": "^2.8.1"
+      }
+    },
+    "node_modules/@peculiar/asn1-x509-attr": {
+      "version": "2.7.0",
+      "resolved": "https://registry.npmjs.org/@peculiar/asn1-x509-attr/-/asn1-x509-attr-2.7.0.tgz",
+      "integrity": "sha512-NS8e7SOgXipkzUPLF/sce7ukpMpWjhxYsH0n6Y+bHYo4TTxOb95Zv7hqwSuL212mj5YxovjdOKQOgH1As3E94w==",
+      "dev": true,
+      "license": "MIT",
+      "dependencies": {
+        "@peculiar/asn1-schema": "^2.7.0",
+        "@peculiar/asn1-x509": "^2.7.0",
+        "asn1js": "^3.0.6",
+        "tslib": "^2.8.1"
+      }
+    },
+    "node_modules/@peculiar/utils": {
+      "version": "2.0.3",
+      "resolved": "https://registry.npmjs.org/@peculiar/utils/-/utils-2.0.3.tgz",
+      "integrity": "sha512-+oL3HPFRIZ1St2K50lWCXiioIgSoxzz7R1J3uF6neO2yl1sgmpgY6XXJH4BdpoDkMWznQTeYF6oWNDZLCdQ4eQ==",
+      "dev": true,
+      "license": "MIT",
+      "dependencies": {
+        "tslib": "^2.8.1"
+      }
+    },
+    "node_modules/@peculiar/x509": {
+      "version": "1.14.3",
+      "resolved": "https://registry.npmjs.org/@peculiar/x509/-/x509-1.14.3.tgz",
+      "integrity": "sha512-C2Xj8FZ0uHWeCXXqX5B4/gVFQmtSkiuOolzAgutjTfseNOHT3pUjljDZsTSxXFGgio54bCzVFqmEOUrIVk8RDA==",
+      "dev": true,
+      "license": "MIT",
+      "dependencies": {
+        "@peculiar/asn1-cms": "^2.6.0",
+        "@peculiar/asn1-csr": "^2.6.0",
+        "@peculiar/asn1-ecc": "^2.6.0",
+        "@peculiar/asn1-pkcs9": "^2.6.0",
+        "@peculiar/asn1-rsa": "^2.6.0",
+        "@peculiar/asn1-schema": "^2.6.0",
+        "@peculiar/asn1-x509": "^2.6.0",
+        "pvtsutils": "^1.3.6",
+        "reflect-metadata": "^0.2.2",
+        "tslib": "^2.8.1",
+        "tsyringe": "^4.10.0"
       },
       "engines": {
-        "node": ">= 8"
+        "node": ">=20.0.0"
       }
     },
+    "node_modules/@peculiar/x509/node_modules/reflect-metadata": {
+      "version": "0.2.2",
+      "resolved": "https://registry.npmjs.org/reflect-metadata/-/reflect-metadata-0.2.2.tgz",
+      "integrity": "sha512-urBwgfrvVP/eAyXx4hluJivBKzuEbSQs9rKWCrCkbSxNv8mxPcUZKeuoF3Uy4mJl3Lwprp6yy5/39VWigZ4K6Q==",
+      "dev": true,
+      "license": "Apache-2.0"
+    },
     "node_modules/@pkgr/core": {
       "version": "0.2.9",
       "resolved": "https://registry.npmjs.org/@pkgr/core/-/core-0.2.9.tgz",
@@ -4370,19 +4521,6 @@
         "url": "https://opencollective.com/pkgr"
       }
     },
-    "node_modules/@sindresorhus/merge-streams": {
-      "version": "2.3.0",
-      "resolved": "https://registry.npmjs.org/@sindresorhus/merge-streams/-/merge-streams-2.3.0.tgz",
-      "integrity": "sha512-LtoMMhxAlorcGhmFYI+LhPgbPZCkgP6ra1YL604EeF6U98pLlQ3iWIGMdWSC+vWmPBWBNgmDBAhnAobLROJmwg==",
-      "dev": true,
-      "license": "MIT",
-      "engines": {
-        "node": ">=18"
-      },
-      "funding": {
-        "url": "https://github.com/sponsors/sindresorhus"
-      }
-    },
     "node_modules/@types/body-parser": {
       "version": "1.19.6",
       "resolved": "https://registry.npmjs.org/@types/body-parser/-/body-parser-1.19.6.tgz",
@@ -4584,16 +4722,6 @@
         "form-data": "^4.0.4"
       }
     },
-    "node_modules/@types/node-forge": {
-      "version": "1.3.14",
-      "resolved": "https://registry.npmjs.org/@types/node-forge/-/node-forge-1.3.14.tgz",
-      "integrity": "sha512-mhVF2BnD4BO+jtOp7z1CdzaK4mbuK0LLQYAvdOLqHTavxFNq4zA1EmYkpnFjP8HOUzedfQkRnp0E2ulSAYSzAw==",
-      "dev": true,
-      "license": "MIT",
-      "dependencies": {
-        "@types/node": "*"
-      }
-    },
     "node_modules/@types/office-js": {
       "version": "1.0.582",
       "resolved": "https://registry.npmjs.org/@types/office-js/-/office-js-1.0.582.tgz",
@@ -5650,6 +5778,21 @@
         "url": "https://github.com/sponsors/ljharb"
       }
     },
+    "node_modules/asn1js": {
+      "version": "3.0.10",
+      "resolved": "https://registry.npmjs.org/asn1js/-/asn1js-3.0.10.tgz",
+      "integrity": "sha512-S2s3aOytiKdFRdulw2qPE51MzjzVOisppcVv7jVFR+Kw0kxwvFrDcYA0h7Ndqbmj0HkMIXYWaoj7fli8kgx1eg==",
+      "dev": true,
+      "license": "BSD-3-Clause",
+      "dependencies": {
+        "pvtsutils": "^1.3.6",
+        "pvutils": "^1.1.5",
+        "tslib": "^2.8.1"
+      },
+      "engines": {
+        "node": ">=12.0.0"
+      }
+    },
     "node_modules/assertion-error": {
       "version": "1.1.0",
       "resolved": "https://registry.npmjs.org/assertion-error/-/assertion-error-1.1.0.tgz",
@@ -6121,6 +6264,16 @@
         "node": ">= 0.8"
       }
     },
+    "node_modules/bytestreamjs": {
+      "version": "2.0.1",
+      "resolved": "https://registry.npmjs.org/bytestreamjs/-/bytestreamjs-2.0.1.tgz",
+      "integrity": "sha512-U1Z/ob71V/bXfVABvNr/Kumf5VyeQRBEm6Txb0PQ6S7V5GpBM3w4Cbqz/xPDicR5tN0uvDifng8C+5qECeGwyQ==",
+      "dev": true,
+      "license": "BSD-3-Clause",
+      "engines": {
+        "node": ">=6.0.0"
+      }
+    },
     "node_modules/call-bind": {
       "version": "1.0.8",
       "resolved": "https://registry.npmjs.org/call-bind/-/call-bind-1.0.8.tgz",
@@ -6686,21 +6839,20 @@
       "license": "MIT"
     },
     "node_modules/copy-webpack-plugin": {
-      "version": "12.0.2",
-      "resolved": "https://registry.npmjs.org/copy-webpack-plugin/-/copy-webpack-plugin-12.0.2.tgz",
-      "integrity": "sha512-SNwdBeHyII+rWvee/bTnAYyO8vfVdcSTud4EIb6jcZ8inLeWucJE0DnxXQBjlQ5zlteuuvooGQy3LIyGxhvlOA==",
+      "version": "14.0.0",
+      "resolved": "https://registry.npmjs.org/copy-webpack-plugin/-/copy-webpack-plugin-14.0.0.tgz",
+      "integrity": "sha512-3JLW90aBGeaTLpM7mYQKpnVdgsUZRExY55giiZgLuX/xTQRUs1dOCwbBnWnvY6Q6rfZoXMNwzOQJCSZPppfqXA==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
-        "fast-glob": "^3.3.2",
         "glob-parent": "^6.0.1",
-        "globby": "^14.0.0",
         "normalize-path": "^3.0.0",
         "schema-utils": "^4.2.0",
-        "serialize-javascript": "^6.0.2"
+        "serialize-javascript": "^7.0.3",
+        "tinyglobby": "^0.2.12"
       },
       "engines": {
-        "node": ">= 18.12.0"
+        "node": ">= 20.9.0"
       },
       "funding": {
         "type": "opencollective",
@@ -6711,9 +6863,9 @@
       }
     },
     "node_modules/core-js": {
-      "version": "3.48.0",
-      "resolved": "https://registry.npmjs.org/core-js/-/core-js-3.48.0.tgz",
-      "integrity": "sha512-zpEHTy1fjTMZCKLHUZoVeylt9XrzaIN2rbPXEt0k+q7JE5CkCZdo6bNq55bn24a69CH7ErAVLKijxJja4fw+UQ==",
+      "version": "3.49.0",
+      "resolved": "https://registry.npmjs.org/core-js/-/core-js-3.49.0.tgz",
+      "integrity": "sha512-es1U2+YTtzpwkxVLwAFdSpaIMyQaq0PBgm3YD1W3Qpsn1NAmO3KSgZfu+oGSWVu6NvLHoHCV/aYcsE5wiB7ALg==",
       "hasInstallScript": true,
       "license": "MIT",
       "funding": {
@@ -8062,36 +8214,6 @@
       "dev": true,
       "license": "Apache-2.0"
     },
-    "node_modules/fast-glob": {
-      "version": "3.3.3",
-      "resolved": "https://registry.npmjs.org/fast-glob/-/fast-glob-3.3.3.tgz",
-      "integrity": "sha512-7MptL8U0cqcFdzIzwOTHoilX9x5BrNqye7Z/LuC7kCMRio1EMSyqRK3BEAUD7sXRq4iT4AzTVuZdhgQ2TCvYLg==",
-      "dev": true,
-      "license": "MIT",
-      "dependencies": {
-        "@nodelib/fs.stat": "^2.0.2",
-        "@nodelib/fs.walk": "^1.2.3",
-        "glob-parent": "^5.1.2",
-        "merge2": "^1.3.0",
-        "micromatch": "^4.0.8"
-      },
-      "engines": {
-        "node": ">=8.6.0"
-      }
-    },
-    "node_modules/fast-glob/node_modules/glob-parent": {
-      "version": "5.1.2",
-      "resolved": "https://registry.npmjs.org/glob-parent/-/glob-parent-5.1.2.tgz",
-      "integrity": "sha512-AOIgSQCepiJYwP3ARnGx+5VnTu2HBYdzbGP45eLw1vr3zB3vZLeyed1sC9hnbcOc9/SrMyM5RPQrkGz4aS9Zow==",
-      "dev": true,
-      "license": "ISC",
-      "dependencies": {
-        "is-glob": "^4.0.1"
-      },
-      "engines": {
-        "node": ">= 6"
-      }
-    },
     "node_modules/fast-json-stable-stringify": {
       "version": "2.1.0",
       "resolved": "https://registry.npmjs.org/fast-json-stable-stringify/-/fast-json-stable-stringify-2.1.0.tgz",
@@ -8180,16 +8302,6 @@
         "node": ">= 4.9.1"
       }
     },
-    "node_modules/fastq": {
-      "version": "1.20.1",
-      "resolved": "https://registry.npmjs.org/fastq/-/fastq-1.20.1.tgz",
-      "integrity": "sha512-GGToxJ/w1x32s/D2EKND7kTil4n8OVk/9mycTc4VDza13lOvpUZTGX3mFSCtV9ksdGBVzvsyAVLM6mHFThxXxw==",
-      "dev": true,
-      "license": "ISC",
-      "dependencies": {
-        "reusify": "^1.0.4"
-      }
-    },
     "node_modules/faye-websocket": {
       "version": "0.11.4",
       "resolved": "https://registry.npmjs.org/faye-websocket/-/faye-websocket-0.11.4.tgz",
@@ -8758,37 +8870,6 @@
         "url": "https://github.com/sponsors/ljharb"
       }
     },
-    "node_modules/globby": {
-      "version": "14.1.0",
-      "resolved": "https://registry.npmjs.org/globby/-/globby-14.1.0.tgz",
-      "integrity": "sha512-0Ia46fDOaT7k4og1PDW4YbodWWr3scS2vAr2lTbsplOt2WkKp0vQbkI9wKis/T5LV/dqPjO3bpS/z6GTJB82LA==",
-      "dev": true,
-      "license": "MIT",
-      "dependencies": {
-        "@sindresorhus/merge-streams": "^2.1.0",
-        "fast-glob": "^3.3.3",
-        "ignore": "^7.0.3",
-        "path-type": "^6.0.0",
-        "slash": "^5.1.0",
-        "unicorn-magic": "^0.3.0"
-      },
-      "engines": {
-        "node": ">=18"
-      },
-      "funding": {
-        "url": "https://github.com/sponsors/sindresorhus"
-      }
-    },
-    "node_modules/globby/node_modules/ignore": {
-      "version": "7.0.5",
-      "resolved": "https://registry.npmjs.org/ignore/-/ignore-7.0.5.tgz",
-      "integrity": "sha512-Hs59xBNfUIunMFgWAbGX5cq6893IbWg4KnrjbYwX3tx0ztorVgTDA6B2sxf8ejHJ4wz8BqGUMYlnzNBer5NvGg==",
-      "dev": true,
-      "license": "MIT",
-      "engines": {
-        "node": ">= 4"
-      }
-    },
     "node_modules/gopd": {
       "version": "1.2.0",
       "resolved": "https://registry.npmjs.org/gopd/-/gopd-1.2.0.tgz",
@@ -11044,16 +11125,6 @@
       "dev": true,
       "license": "MIT"
     },
-    "node_modules/merge2": {
-      "version": "1.4.1",
-      "resolved": "https://registry.npmjs.org/merge2/-/merge2-1.4.1.tgz",
-      "integrity": "sha512-8q7VEgMJW4J8tcfVPy8g09NcQwZdbwFEqhe/WZkoIzjn/3TGDwtOCYtXGxA3O8tPzpczCCDgv+P2P5y00ZJOOg==",
-      "dev": true,
-      "license": "MIT",
-      "engines": {
-        "node": ">= 8"
-      }
-    },
     "node_modules/methods": {
       "version": "1.1.2",
       "resolved": "https://registry.npmjs.org/methods/-/methods-1.1.2.tgz",
@@ -12638,19 +12709,6 @@
       "dev": true,
       "license": "MIT"
     },
-    "node_modules/path-type": {
-      "version": "6.0.0",
-      "resolved": "https://registry.npmjs.org/path-type/-/path-type-6.0.0.tgz",
-      "integrity": "sha512-Vj7sf++t5pBD637NSfkxpHSMfWaeig5+DKWLhcqIYx6mWQz5hdJTGDVMQiJcw1ZYkhs7AazKDGpRVji1LJCZUQ==",
-      "dev": true,
-      "license": "MIT",
-      "engines": {
-        "node": ">=18"
-      },
-      "funding": {
-        "url": "https://github.com/sponsors/sindresorhus"
-      }
-    },
     "node_modules/pathval": {
       "version": "1.1.1",
       "resolved": "https://registry.npmjs.org/pathval/-/pathval-1.1.1.tgz",
@@ -12786,6 +12844,24 @@
         "url": "https://github.com/sponsors/sindresorhus"
       }
     },
+    "node_modules/pkijs": {
+      "version": "3.4.0",
+      "resolved": "https://registry.npmjs.org/pkijs/-/pkijs-3.4.0.tgz",
+      "integrity": "sha512-emEcLuomt2j03vxD54giVB4SxTjnsqkU692xZOZXHDVoYyypEm+b3jpiTcc+Cf+myooc+/Ly0z01jqeNHVgJGw==",
+      "dev": true,
+      "license": "BSD-3-Clause",
+      "dependencies": {
+        "@noble/hashes": "1.4.0",
+        "asn1js": "^3.0.6",
+        "bytestreamjs": "^2.0.1",
+        "pvtsutils": "^1.3.6",
+        "pvutils": "^1.1.3",
+        "tslib": "^2.8.1"
+      },
+      "engines": {
+        "node": ">=16.0.0"
+      }
+    },
     "node_modules/possible-typed-array-names": {
       "version": "1.1.0",
       "resolved": "https://registry.npmjs.org/possible-typed-array-names/-/possible-typed-array-names-1.1.0.tgz",
@@ -12969,6 +13045,26 @@
         "node": ">=6"
       }
     },
+    "node_modules/pvtsutils": {
+      "version": "1.3.6",
+      "resolved": "https://registry.npmjs.org/pvtsutils/-/pvtsutils-1.3.6.tgz",
+      "integrity": "sha512-PLgQXQ6H2FWCaeRak8vvk1GW462lMxB5s3Jm673N82zI4vqtVUPuZdffdZbPDFRoU8kAhItWFtPCWiPpp4/EDg==",
+      "dev": true,
+      "license": "MIT",
+      "dependencies": {
+        "tslib": "^2.8.1"
+      }
+    },
+    "node_modules/pvutils": {
+      "version": "1.1.5",
+      "resolved": "https://registry.npmjs.org/pvutils/-/pvutils-1.1.5.tgz",
+      "integrity": "sha512-KTqnxsgGiQ6ZAzZCVlJH5eOjSnvlyEgx1m8bkRJfOhmGRqfo5KLvmAlACQkrjEtOQ4B7wF9TdSLIs9O90MX9xA==",
+      "dev": true,
+      "license": "MIT",
+      "engines": {
+        "node": ">=16.0.0"
+      }
+    },
     "node_modules/qs": {
       "version": "6.14.2",
       "resolved": "https://registry.npmjs.org/qs/-/qs-6.14.2.tgz",
@@ -12985,37 +13081,6 @@
         "url": "https://github.com/sponsors/ljharb"
       }
     },
-    "node_modules/queue-microtask": {
-      "version": "1.2.3",
-      "resolved": "https://registry.npmjs.org/queue-microtask/-/queue-microtask-1.2.3.tgz",
-      "integrity": "sha512-NuaNSa6flKT5JaSYQzJok04JzTL1CA6aGhv5rfLW3PgqA+M2ChpZQnAC8h8i4ZFkBS8X5RqkDBHA7r4hej3K9A==",
-      "dev": true,
-      "funding": [
-        {
-          "type": "github",
-          "url": "https://github.com/sponsors/feross"
-        },
-        {
-          "type": "patreon",
-          "url": "https://www.patreon.com/feross"
-        },
-        {
-          "type": "consulting",
-          "url": "https://feross.org/support"
-        }
-      ],
-      "license": "MIT"
-    },
-    "node_modules/randombytes": {
-      "version": "2.1.0",
-      "resolved": "https://registry.npmjs.org/randombytes/-/randombytes-2.1.0.tgz",
-      "integrity": "sha512-vYl3iOX+4CKUWuxGi9Ukhie6fsqXqS9FE2Zaic4tNFD2N2QQaXOMFbuKK4QmDHC0JO6B1Zp41J0LpT0oR68amQ==",
-      "dev": true,
-      "license": "MIT",
-      "dependencies": {
-        "safe-buffer": "^5.1.0"
-      }
-    },
     "node_modules/range-parser": {
       "version": "1.2.1",
       "resolved": "https://registry.npmjs.org/range-parser/-/range-parser-1.2.1.tgz",
@@ -13502,17 +13567,6 @@
         "node": ">= 4"
       }
     },
-    "node_modules/reusify": {
-      "version": "1.1.0",
-      "resolved": "https://registry.npmjs.org/reusify/-/reusify-1.1.0.tgz",
-      "integrity": "sha512-g6QUff04oZpHs0eG5p83rFLhHeV00ug/Yf9nZM6fLeUrPguBTkTQOdpAWWspMh55TZfVQDPaN3NQJfbVRAxdIw==",
-      "dev": true,
-      "license": "MIT",
-      "engines": {
-        "iojs": ">=1.0.0",
-        "node": ">=0.10.0"
-      }
-    },
     "node_modules/rfdc": {
       "version": "1.4.1",
       "resolved": "https://registry.npmjs.org/rfdc/-/rfdc-1.4.1.tgz",
@@ -13545,30 +13599,6 @@
         "node": ">=0.12.0"
       }
     },
-    "node_modules/run-parallel": {
-      "version": "1.2.0",
-      "resolved": "https://registry.npmjs.org/run-parallel/-/run-parallel-1.2.0.tgz",
-      "integrity": "sha512-5l4VyZR86LZ/lDxZTR6jqL8AFE2S0IFLMP26AbjsLVADxHdhB/c0GUsH+y39UfCi3dzz8OlQuPmnaJOMoDHQBA==",
-      "dev": true,
-      "funding": [
-        {
-          "type": "github",
-          "url": "https://github.com/sponsors/feross"
-        },
-        {
-          "type": "patreon",
-          "url": "https://www.patreon.com/feross"
-        },
-        {
-          "type": "consulting",
-          "url": "https://feross.org/support"
-        }
-      ],
-      "license": "MIT",
-      "dependencies": {
-        "queue-microtask": "^1.2.2"
-      }
-    },
     "node_modules/rxjs": {
       "version": "7.8.2",
       "resolved": "https://registry.npmjs.org/rxjs/-/rxjs-7.8.2.tgz",
@@ -13763,17 +13793,17 @@
       "license": "MIT"
     },
     "node_modules/selfsigned": {
-      "version": "2.4.1",
-      "resolved": "https://registry.npmjs.org/selfsigned/-/selfsigned-2.4.1.tgz",
-      "integrity": "sha512-th5B4L2U+eGLq1TVh7zNRGBapioSORUeymIydxgFpwww9d2qyKvtuPU2jJuHvYAwwqi2Y596QBL3eEqcPEYL8Q==",
+      "version": "5.5.0",
+      "resolved": "https://registry.npmjs.org/selfsigned/-/selfsigned-5.5.0.tgz",
+      "integrity": "sha512-ftnu3TW4+3eBfLRFnDEkzGxSF/10BJBkaLJuBHZX0kiPS7bRdlpZGu6YGt4KngMkdTwJE6MbjavFpqHvqVt+Ew==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
-        "@types/node-forge": "^1.3.0",
-        "node-forge": "^1"
+        "@peculiar/x509": "^1.14.2",
+        "pkijs": "^3.3.3"
       },
       "engines": {
-        "node": ">=10"
+        "node": ">=18"
       }
     },
     "node_modules/semver": {
@@ -13842,13 +13872,13 @@
       }
     },
     "node_modules/serialize-javascript": {
-      "version": "6.0.2",
-      "resolved": "https://registry.npmjs.org/serialize-javascript/-/serialize-javascript-6.0.2.tgz",
-      "integrity": "sha512-Saa1xPByTTq2gdeFZYLLo+RFE35NHZkAbqZeWNd3BpzppeVisAqpDjcp8dyf6uIvEqJRd46jemmyA4iFIeVk8g==",
+      "version": "7.0.5",
+      "resolved": "https://registry.npmjs.org/serialize-javascript/-/serialize-javascript-7.0.5.tgz",
+      "integrity": "sha512-F4LcB0UqUl1zErq+1nYEEzSHJnIwb3AF2XWB94b+afhrekOUijwooAYqFyRbjYkm2PAKBabx6oYv/xDxNi8IBw==",
       "dev": true,
       "license": "BSD-3-Clause",
-      "dependencies": {
-        "randombytes": "^2.1.0"
+      "engines": {
+        "node": ">=20.0.0"
       }
     },
     "node_modules/serve-index": {
@@ -14260,19 +14290,6 @@
         "simple-concat": "^1.0.0"
       }
     },
-    "node_modules/slash": {
-      "version": "5.1.0",
-      "resolved": "https://registry.npmjs.org/slash/-/slash-5.1.0.tgz",
-      "integrity": "sha512-ZA6oR3T/pEyuqwMgAKT0/hAv8oAXckzbkmR0UkUosQ+Mc4RxGoJkRmwHgHufaenlyAgE1Mxgpdcrf75y6XcnDg==",
-      "dev": true,
-      "license": "MIT",
-      "engines": {
-        "node": ">=14.16"
-      },
-      "funding": {
-        "url": "https://github.com/sponsors/sindresorhus"
-      }
-    },
     "node_modules/sockjs": {
       "version": "0.3.24",
       "resolved": "https://registry.npmjs.org/sockjs/-/sockjs-0.3.24.tgz",
@@ -15020,6 +15037,26 @@
       "dev": true,
       "license": "0BSD"
     },
+    "node_modules/tsyringe": {
+      "version": "4.10.0",
+      "resolved": "https://registry.npmjs.org/tsyringe/-/tsyringe-4.10.0.tgz",
+      "integrity": "sha512-axr3IdNuVIxnaK5XGEUFTu3YmAQ6lllgrvqfEoR16g/HGnYY/6We4oWENtAnzK6/LpJ2ur9PAb80RBt7/U4ugw==",
+      "dev": true,
+      "license": "MIT",
+      "dependencies": {
+        "tslib": "^1.9.3"
+      },
+      "engines": {
+        "node": ">= 6.0.0"
+      }
+    },
+    "node_modules/tsyringe/node_modules/tslib": {
+      "version": "1.14.1",
+      "resolved": "https://registry.npmjs.org/tslib/-/tslib-1.14.1.tgz",
+      "integrity": "sha512-Xni35NKzjgMrwevysHTCArtLDpPvye8zV/0E4EyYn43P7/7qvQwPh9BGkHewbMulVntbigmcT7rdX3BNo9wRJg==",
+      "dev": true,
+      "license": "0BSD"
+    },
     "node_modules/tunnel-agent": {
       "version": "0.6.0",
       "resolved": "https://registry.npmjs.org/tunnel-agent/-/tunnel-agent-0.6.0.tgz",
@@ -15311,19 +15348,6 @@
         "node": ">=4"
       }
     },
-    "node_modules/unicorn-magic": {
-      "version": "0.3.0",
-      "resolved": "https://registry.npmjs.org/unicorn-magic/-/unicorn-magic-0.3.0.tgz",
-      "integrity": "sha512-+QBBXBCvifc56fsbuxZQ6Sic3wqqc3WWaqxs58gvJrcOuN83HGTCwz3oS5phzU9LthRNE9VrJCFCLUgHeeFnfA==",
-      "dev": true,
-      "license": "MIT",
-      "engines": {
-        "node": ">=18"
-      },
-      "funding": {
-        "url": "https://github.com/sponsors/sindresorhus"
-      }
-    },
     "node_modules/universalify": {
       "version": "2.0.1",
       "resolved": "https://registry.npmjs.org/universalify/-/universalify-2.0.1.tgz",
@@ -15654,15 +15678,15 @@
       }
     },
     "node_modules/webpack-dev-server": {
-      "version": "5.2.1",
-      "resolved": "https://registry.npmjs.org/webpack-dev-server/-/webpack-dev-server-5.2.1.tgz",
-      "integrity": "sha512-ml/0HIj9NLpVKOMq+SuBPLHcmbG+TGIjXRHsYfZwocUBIqEvws8NnS/V9AFQ5FKP+tgn5adwVwRrTEpGL33QFQ==",
+      "version": "5.2.4",
+      "resolved": "https://registry.npmjs.org/webpack-dev-server/-/webpack-dev-server-5.2.4.tgz",
+      "integrity": "sha512-GqDPGZN9bRqKBTkp4aWkobDDHMsrXKoGSdOH56smIri8qR0JG8gfL8/v/f/OZR3/OKXjG8uwJbFVhKm/FNU/UA==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
         "@types/bonjour": "^3.5.13",
         "@types/connect-history-api-fallback": "^1.5.4",
-        "@types/express": "^4.17.21",
+        "@types/express": "^4.17.25",
         "@types/express-serve-static-core": "^4.17.21",
         "@types/serve-index": "^1.9.4",
         "@types/serve-static": "^1.15.5",
@@ -15672,17 +15696,17 @@
         "bonjour-service": "^1.2.1",
         "chokidar": "^3.6.0",
         "colorette": "^2.0.10",
-        "compression": "^1.7.4",
+        "compression": "^1.8.1",
         "connect-history-api-fallback": "^2.0.0",
-        "express": "^4.21.2",
+        "express": "^4.22.1",
         "graceful-fs": "^4.2.6",
-        "http-proxy-middleware": "^2.0.7",
+        "http-proxy-middleware": "^2.0.9",
         "ipaddr.js": "^2.1.0",
         "launch-editor": "^2.6.1",
         "open": "^10.0.3",
         "p-retry": "^6.2.0",
         "schema-utils": "^4.2.0",
-        "selfsigned": "^2.4.1",
+        "selfsigned": "^5.5.0",
         "serve-index": "^1.9.1",
         "sockjs": "^0.3.24",
         "spdy": "^4.0.2",
@@ -15738,9 +15762,9 @@
       }
     },
     "node_modules/webpack-dev-server/node_modules/ipaddr.js": {
-      "version": "2.3.0",
-      "resolved": "https://registry.npmjs.org/ipaddr.js/-/ipaddr.js-2.3.0.tgz",
-      "integrity": "sha512-Zv/pA+ciVFbCSBBjGfaKUya/CcGmUHzTydLMaTwrUUEM2DIEO3iZvueGxmacvmN50fGpGVKeTXpb2LcYQxeVdg==",
+      "version": "2.4.0",
+      "resolved": "https://registry.npmjs.org/ipaddr.js/-/ipaddr.js-2.4.0.tgz",
+      "integrity": "sha512-9VGk3HGanVE6JoZXHiCpnGy5X0jYDnN4EA4lntFPj+1vIWlFhIylq2CrrCOJH9EAhc5CYhq18F2Av2tgoAPsYQ==",
       "dev": true,
       "license": "MIT",
       "engines": {
@@ -15767,9 +15791,9 @@
       }
     },
     "node_modules/webpack-dev-server/node_modules/ws": {
-      "version": "8.20.0",
-      "resolved": "https://registry.npmjs.org/ws/-/ws-8.20.0.tgz",
-      "integrity": "sha512-sAt8BhgNbzCtgGbt2OxmpuryO63ZoDk/sqaB/znQm94T4fCEsy/yV+7CdC1kJhOU9lboAEU7R3kquuycDoibVA==",
+      "version": "8.20.1",
+      "resolved": "https://registry.npmjs.org/ws/-/ws-8.20.1.tgz",
+      "integrity": "sha512-It4dO0K5v//JtTXuPkfEOaI3uUN87iYPnqo/ZzqCoG3g8uhA66QUMs/SrM0YK7/NAu+r4LMh/9dq2A7k+rHs+w==",
       "dev": true,
       "license": "MIT",
       "engines": {

src/addons/outlook/package.json

@@ -26,7 +26,7 @@
     "watch": "webpack --mode development --watch"
   },
   "dependencies": {
-    "core-js": "^3.36.0",
+    "core-js": "^3.49.0",
     "regenerator-runtime": "^0.14.1"
   },
   "devDependencies": {
@@ -36,7 +36,7 @@
     "@types/office-runtime": "^1.0.35",
     "acorn": "^8.11.3",
     "babel-loader": "^9.1.3",
-    "copy-webpack-plugin": "^12.0.2",
+    "copy-webpack-plugin": "^14.0.0",
     "eslint-plugin-office-addins": "^4.0.3",
     "file-loader": "^6.2.0",
     "html-loader": "^5.0.0",
@@ -53,7 +53,7 @@
     "source-map-loader": "^5.0.0",
     "webpack": "^5.95.0",
     "webpack-cli": "^5.1.4",
-    "webpack-dev-server": "5.2.1"
+    "webpack-dev-server": "5.2.4"
   },
   "prettier": "office-addin-prettier-config",
   "browserslist": [

src/agents/.dockerignore

@@ -0,0 +1,38 @@
+# Python
+__pycache__
+*.pyc
+**/__pycache__
+**/*.pyc
+venv
+**/.venv
+
+# System-specific files
+.DS_Store
+**/.DS_Store
+
+# Docker
+compose.*
+env.d
+
+# Docs
+docs
+*.md
+*.log
+
+# Development/test cache & configurations
+data
+.cache
+.circleci
+.git
+.iml
+db.sqlite3
+.pylint.d
+
+**/.idea
+**/.vscode
+**/.pytest_cache
+**/.mypy_cache
+**/.ruff_cache
+
+# Env
+.env

src/agents/Dockerfile

@@ -6,31 +6,61 @@ RUN apt-get update && apt-get install -y \
     libgobject-2.0-0 \
     && rm -rf /var/lib/apt/lists/*
 
+
+# ---- Builder image ----
 FROM base AS builder
 
-WORKDIR /builder
+ENV UV_COMPILE_BYTECODE=1 \
+    UV_LINK_MODE=copy \
+    UV_PYTHON_DOWNLOADS=0
 
-COPY pyproject.toml .
-
-RUN mkdir /install && \
-  pip install --prefix=/install .
-
-FROM base AS development
+# Install uv
+COPY --from=ghcr.io/astral-sh/uv:0.10.9 /uv /uvx /bin/
 
 WORKDIR /app
 
-COPY pyproject.toml .
-RUN pip install --no-cache-dir ".[dev]"
+# Install production dependencies without the project itself (cacheable layer)
+RUN --mount=type=cache,target=/root/.cache/uv \
+    --mount=type=bind,source=uv.lock,target=uv.lock \
+    --mount=type=bind,source=pyproject.toml,target=pyproject.toml \
+    uv sync --locked --no-install-project --no-dev
 
-COPY . .
+# Install the project
+COPY . /app
+RUN --mount=type=cache,target=/root/.cache/uv \
+    uv sync --locked --no-dev
 
-CMD ["python", "metadata_collector.py", "dev"]
 
+# ---- Development image ----
+FROM base AS development
+
+ENV UV_COMPILE_BYTECODE=1 \
+    UV_LINK_MODE=copy \
+    UV_PYTHON_DOWNLOADS=0
+
+COPY --from=ghcr.io/astral-sh/uv:0.10.9 /uv /uvx /bin/
+
+WORKDIR /app
+
+COPY . /app
+
+RUN --mount=type=cache,target=/root/.cache/uv \
+    uv sync --locked --all-extras
+
+ENV PATH="/app/.venv/bin:$PATH"
+
+CMD ["python", "multi_user_transcriber.py", "dev"]
+
+
+# ---- Production image ----
 FROM base AS production
 
 WORKDIR /app
 
-COPY --from=builder /install /usr/local
+# Copy the pre-built virtualenv and application source
+COPY --from=builder /app /app
+
+ENV PATH="/app/.venv/bin:$PATH"
 
 # Remove pip to reduce attack surface in production
 RUN pip uninstall -y pip
@@ -39,6 +69,4 @@ RUN pip uninstall -y pip
 ARG DOCKER_USER
 USER ${DOCKER_USER}
 
-COPY ./*.py /app/
-
 CMD ["python", "multi_user_transcriber.py", "start"]

src/agents/pyproject.toml

@@ -1,7 +1,7 @@
 
 [project]
 name = "agents"
-version = "1.15.0"
+version = "1.18.0"
 requires-python = ">=3.12"
 dependencies = [
     "livekit-agents==1.4.5",
@@ -18,12 +18,8 @@ dev = [
     "ruff==0.15.6",
 ]
 
-[tool.setuptools]
-py-modules = ["multi_user_transcriber", "metadata_collector", "exceptions"]
-
-[build-system]
-requires = ["setuptools>=61.0"]
-build-backend = "setuptools.build_meta"
+[tool.uv]
+package = false
 
 [tool.ruff]
 target-version = "py313"

src/backend/core/api/__init__.py

@@ -8,6 +8,8 @@ from rest_framework import views as drf_views
 from rest_framework.decorators import api_view
 from rest_framework.response import Response
 
+from core.utils import build_telephony_config
+
 
 def exception_handler(exc, context):
     """Handle Django ValidationError as an accepted exception.
@@ -58,13 +60,7 @@ def get_frontend_configuration(request):
                 "allowed_mimetypes"
             ],
         },
-        "telephony": {
-            "enabled": settings.ROOM_TELEPHONY_ENABLED,
-            "phone_number": settings.ROOM_TELEPHONY_PHONE_NUMBER
-            if settings.ROOM_TELEPHONY_ENABLED
-            else None,
-            "default_country": settings.ROOM_TELEPHONY_DEFAULT_COUNTRY,
-        },
+        "telephony": build_telephony_config(),
         "subtitle": {"enabled": settings.ROOM_SUBTITLE_ENABLED},
         "livekit": {
             "url": settings.LIVEKIT_CONFIGURATION["url"],

src/backend/core/api/permissions.py

@@ -136,3 +136,33 @@ class FilePermission(IsAuthenticated):
             raise Http404
 
         return obj.get_abilities(request.user).get(view.action, False)
+
+
+class CanMuteParticipant(permissions.BasePermission):
+    """
+    Grant muting rights based on role or room configuration.
+
+    - Admins and owners can always mute.
+    - When `everyone_can_mute` is enabled on the room, any participant
+      currently in the room (proven by a valid LiveKit token for that room)
+      can mute.
+    """
+
+    def has_object_permission(self, request, view, obj):
+        """Check if the requesting user is allowed to mute a participant in the given room."""
+
+        is_livekit_token_auth = request.auth and hasattr(request.auth, "video")
+
+        # Always allow admins/owners when authenticated with session cookie
+        if not is_livekit_token_auth and obj.is_administrator_or_owner(request.user):
+            return True
+
+        everyone_can_mute = obj.configuration.get("everyone_can_mute", True)
+        if not everyone_can_mute:
+            return False
+
+        if not is_livekit_token_auth:
+            return False
+
+        # LiveKit token scoped to this room
+        return request.auth.video.room == str(obj.id)

src/backend/core/api/serializers.py

@@ -13,7 +13,7 @@ from django.core.exceptions import SuspiciousOperation
 from django.utils.translation import gettext_lazy as _
 
 from django_pydantic_field.rest_framework import SchemaField
-from pydantic import BaseModel, Field
+from pydantic import BaseModel, Field, field_serializer
 from pydantic import ValidationError as PydanticValidationError
 from rest_framework import serializers
 from rest_framework.exceptions import PermissionDenied
@@ -166,11 +166,6 @@ class RoomSerializer(serializers.ModelSerializer):
             )
             output["accesses"] = access_serializer.data
 
-        configuration = output["configuration"]
-
-        if not is_admin_or_owner:
-            del output["configuration"]
-
         should_access_room = (
             (
                 instance.access_level == models.RoomAccessLevel.TRUSTED
@@ -187,7 +182,7 @@ class RoomSerializer(serializers.ModelSerializer):
                 room_id=room_id,
                 user=request.user,
                 username=username,
-                configuration=configuration,
+                configuration=output["configuration"],
                 is_admin_or_owner=is_admin_or_owner,
             )
         else:
@@ -317,9 +312,7 @@ class MuteParticipantSerializer(BaseParticipantsManagementSerializer):
     )
 
 
-RoomConfigurationTrackSource = Literal[
-    "camera", "microphone", "screen_share", "screen_share_audio"
-]
+TrackSource = Literal["camera", "microphone", "screen_share", "screen_share_audio"]
 
 
 class RoomConfiguration(BaseModel):
@@ -328,14 +321,12 @@ class RoomConfiguration(BaseModel):
     Unknown fields are rejected.
     """
 
-    can_publish_sources: list[RoomConfigurationTrackSource] | None = None
+    can_publish_sources: list[TrackSource] | None = None
+    everyone_can_mute: bool | None = None
 
     model_config = {"extra": "forbid"}
 
 
-TrackSource = Literal["SCREEN_SHARE", "SCREEN_SHARE_AUDIO", "CAMERA", "MICROPHONE"]
-
-
 class ParticipantPermission(BaseModel):
     """Mirror the LiveKit ParticipantPermission protobuf.
 
@@ -355,6 +346,10 @@ class ParticipantPermission(BaseModel):
 
     model_config = {"extra": "forbid"}
 
+    @field_serializer("can_publish_sources")
+    def _serialize_sources(self, sources: list[str]) -> list[str]:
+        return [s.upper() for s in sources]
+
 
 class UpdateParticipantSerializer(BaseParticipantsManagementSerializer):
     """Validate participant update data."""

src/backend/core/api/viewsets.py

@@ -33,6 +33,7 @@ from rest_framework import (
 from rest_framework import (
     status as drf_status,
 )
+from rest_framework.settings import api_settings
 
 from core import enums, models, utils
 from core.api.filters import ListFileFilter
@@ -76,6 +77,11 @@ from core.services.participants_management import (
     ParticipantsManagementException,
 )
 from core.services.room_creation import RoomCreation
+from core.services.room_management import (
+    RoomManagement,
+    RoomManagementException,
+    RoomNotFoundException,
+)
 from core.services.subtitle import SubtitleException, SubtitleService
 from core.tasks.file import process_file_deletion
 
@@ -299,6 +305,41 @@ class RoomViewSet(
         if callback_id := self.request.data.get("callback_id"):
             RoomCreation().persist_callback_state(callback_id, room)
 
+    def perform_update(self, serializer):
+        """Persist the room update, then sync metadata to LiveKit."""
+
+        old_configuration = serializer.instance.configuration
+        old_access_level = serializer.instance.access_level
+
+        room = serializer.save()
+
+        if (
+            room.configuration == old_configuration
+            and room.access_level == old_access_level
+        ):
+            return
+
+        metadata = {
+            "configuration": room.configuration,
+            "access_level": room.access_level,
+        }
+
+        try:
+            RoomManagement().update_metadata(
+                room_name=str(room.id),
+                metadata=metadata,
+            )
+        except RoomNotFoundException:
+            logger.info(
+                "LiveKit room %s does not exist yet, skipping metadata sync",
+                room.id,
+            )
+        except RoomManagementException:
+            logger.warning(
+                "Failed to sync metadata to LiveKit for room %s",
+                room.id,
+            )
+
     @decorators.action(
         detail=True,
         methods=["post"],
@@ -614,7 +655,11 @@ class RoomViewSet(
         methods=["post"],
         url_path="mute-participant",
         url_name="mute-participant",
-        permission_classes=[permissions.HasPrivilegesOnRoom],
+        permission_classes=[permissions.CanMuteParticipant],
+        authentication_classes=[
+            LiveKitTokenAuthentication,
+            *api_settings.DEFAULT_AUTHENTICATION_CLASSES,
+        ],
     )
     def mute_participant(self, request, pk=None):  # pylint: disable=unused-argument
         """Mute a specific track for a participant in the room."""
@@ -623,6 +668,26 @@ class RoomViewSet(
         serializer = serializers.MuteParticipantSerializer(data=request.data)
         serializer.is_valid(raise_exception=True)
 
+        # TEMPORARY: a LiveKit token proves access was granted, not that the caller
+        # joined. Cross-check identity against the live participant list until auth
+        # is hardened. Skipped for non-LiveKit auth backends.
+        caller_identity = getattr(request.auth, "identity", None)
+        if caller_identity is not None:
+            try:
+                ParticipantsManagement().check_if_in_meeting(
+                    room_name=str(room.pk),
+                    identity=caller_identity,
+                )
+            except (ParticipantNotFoundException, ParticipantsManagementException):
+                logger.warning(
+                    "Failed to verify caller presence for mute in room %s; denying",
+                    room.pk,
+                )
+                return drf_response.Response(
+                    {"error": "Could not verify caller presence"},
+                    status=drf_status.HTTP_403_FORBIDDEN,
+                )
+
         try:
             ParticipantsManagement().mute(
                 room_name=str(room.pk),
@@ -1131,96 +1196,124 @@ class FileViewSet(
         """
         Check the actual uploaded file and mark it as ready.
         """
-
+        # Ensures we go through authorization checks
         file = self.get_object()
 
-        if not file.is_pending_upload:
+        # Try to update the file with the new state. If the file is already in this state
+        # we are in a concurrent request, and we should reject that request
+        updated_rows = models.File.objects.filter(
+            upload_state=models.FileUploadStateChoices.PENDING,
+            pk=kwargs["pk"],
+        ).update(upload_state=models.FileUploadStateChoices.ANALYZING)
+        if updated_rows != 1:
             raise drf_exceptions.ValidationError(
                 {"file": "This action is only available for files in PENDING state."},
                 code="file_upload_state_not_pending",
             )
+        file.refresh_from_db()
 
         s3_client = default_storage.connection.meta.client
+        validation_error = None
 
-        head_response = s3_client.head_object(
-            Bucket=default_storage.bucket_name, Key=file.file_key
-        )
-        file_size = head_response["ContentLength"]
-
-        if settings.FILE_UPLOAD_APPLY_RESTRICTIONS:
-            config_for_file_type = settings.FILE_UPLOAD_RESTRICTIONS[file.type]
-            if file_size > config_for_file_type["max_size"]:
-                self._complete_file_deletion(file)
-                logger.info(
-                    "upload_ended: file size (%s) for file %s higher than the allowed max size",
-                    file_size,
-                    file.file_key,
-                )
-                raise drf_exceptions.ValidationError(
-                    detail="The file size is higher than the allowed max size.",
-                    code="file_size_exceeded",
-                )
-
-        # python-magic recommends using at least the first 2048 bytes
-        # to reduce incorrect identification.
-        # This is a tradeoff between pulling in the whole file and the most likely relevant bytes
-        # of the file for mime type identification.
-        if file_size > 2048:
-            range_response = s3_client.get_object(
-                Bucket=default_storage.bucket_name,
-                Key=file.file_key,
-                Range="bytes=0-2047",
-            )
-            file_head = range_response["Body"].read()
-        else:
-            file_head = s3_client.get_object(
-                Bucket=default_storage.bucket_name, Key=file.file_key
-            )["Body"].read()
-
-        # Use improved MIME type detection combining magic bytes and file extension
-        logger.info("upload_ended: detecting mimetype for file: %s", file.file_key)
-        mimetype = utils.detect_mimetype(file_head, filename=file.filename)
-
-        if settings.FILE_UPLOAD_APPLY_RESTRICTIONS:
-            config_for_file_type = settings.FILE_UPLOAD_RESTRICTIONS[file.type]
-            allowed_file_mimetypes = config_for_file_type["allowed_mimetypes"]
-            if mimetype not in allowed_file_mimetypes:
-                self._complete_file_deletion(file)
-                logger.warning(
-                    "upload_ended: mimetype not allowed %s for file %s",
-                    mimetype,
-                    file.file_key,
-                )
-                raise drf_exceptions.ValidationError(
-                    detail="The file type is not allowed.",
-                    code="file_type_not_allowed",
-                )
-
-        file.upload_state = models.FileUploadStateChoices.READY
-        file.mimetype = mimetype
-        file.size = file_size
-
-        file.save(update_fields=["upload_state", "mimetype", "size"])
-
-        if head_response["ContentType"] != mimetype:
-            logger.info(
-                "upload_ended: content type mismatch between object storage and file,"
-                " updating from %s to %s",
-                head_response["ContentType"],
-                mimetype,
-            )
+        try:
+            # We copy the file to its final destination, we will run the checks on that
+            # final file and ignore any updates to the temporary file. (We cannot revoke the policy,
+            # so the temporary file might still be updated after that.)
+            # The temporary folders will need to be cleaned periodically
             s3_client.copy_object(
                 Bucket=default_storage.bucket_name,
                 Key=file.file_key,
                 CopySource={
                     "Bucket": default_storage.bucket_name,
-                    "Key": file.file_key,
+                    "Key": file.temporary_file_key,
                 },
-                ContentType=mimetype,
-                Metadata=head_response["Metadata"],
-                MetadataDirective="REPLACE",
             )
 
+            head_response = s3_client.head_object(
+                Bucket=default_storage.bucket_name, Key=file.file_key
+            )
+            file_size = head_response["ContentLength"]
+            # python-magic recommends using at least the first 2048 bytes
+            # to reduce incorrect identification.
+            # This is a tradeoff between pulling in the whole file and
+            # the most likely relevant bytes
+            # of the file for mime type identification.
+            if file_size > 2048:
+                range_response = s3_client.get_object(
+                    Bucket=default_storage.bucket_name,
+                    Key=file.file_key,
+                    Range="bytes=0-2047",
+                )
+                file_head = range_response["Body"].read()
+            else:
+                file_head = s3_client.get_object(
+                    Bucket=default_storage.bucket_name, Key=file.file_key
+                )["Body"].read()
+
+            logger.info("upload_ended: detecting mimetype for file: %s", file.file_key)
+            mimetype = utils.detect_mimetype(file_head, filename=file.filename)
+
+            if settings.FILE_UPLOAD_APPLY_RESTRICTIONS:
+                config_for_file_type = settings.FILE_UPLOAD_RESTRICTIONS[file.type]
+                if file_size > config_for_file_type["max_size"]:
+                    logger.info(
+                        "upload_ended: file size (%s) for file %s higher than the allowed max size",
+                        file_size,
+                        file.file_key,
+                    )
+                    validation_error = drf_exceptions.ValidationError(
+                        detail="The file size is higher than the allowed max size.",
+                        code="file_size_exceeded",
+                    )
+                else:
+                    # Use improved MIME type detection combining magic bytes and file extension
+                    allowed_file_mimetypes = config_for_file_type["allowed_mimetypes"]
+                    if mimetype not in allowed_file_mimetypes:
+                        logger.warning(
+                            "upload_ended: mimetype not allowed %s for file %s",
+                            mimetype,
+                            file.file_key,
+                        )
+                        validation_error = drf_exceptions.ValidationError(
+                            detail="The file type is not allowed.",
+                            code="file_type_not_allowed",
+                        )
+
+            if validation_error is not None:
+                self._complete_file_deletion(file)
+            else:
+                file.upload_state = models.FileUploadStateChoices.READY
+                file.mimetype = mimetype
+                file.size = file_size
+                file.save(update_fields=["upload_state", "mimetype", "size"])
+
+                if head_response["ContentType"] != mimetype:
+                    logger.info(
+                        "upload_ended: content type mismatch between object storage and file,"
+                        " updating from %s to %s",
+                        head_response["ContentType"],
+                        mimetype,
+                    )
+                    s3_client.copy_object(
+                        Bucket=default_storage.bucket_name,
+                        Key=file.file_key,
+                        CopySource={
+                            "Bucket": default_storage.bucket_name,
+                            "Key": file.file_key,
+                        },
+                        ContentType=mimetype,
+                        Metadata=head_response["Metadata"],
+                        MetadataDirective="REPLACE",
+                    )
+        except Exception as e:
+            logger.exception("Failed to analyze file, reverting to pending state")
+            file.upload_state = models.FileUploadStateChoices.PENDING
+            file.save()
+            raise e
+
+        if validation_error:
+            raise validation_error
+
         # Not yet implemented
         # Change the file.upload_state when this will be done
         # malware_detection.analyse_file(file.file_key, file_id=file.id)

src/backend/core/external_api/serializers.py

@@ -4,10 +4,11 @@
 
 from django.conf import settings
 
+from pydantic import ValidationError
 from rest_framework import serializers
 
 from core import models, utils
-from core.api.serializers import BaseValidationOnlySerializer
+from core.api.serializers import BaseValidationOnlySerializer, RoomConfiguration
 
 OAUTH2_GRANT_TYPE_CLIENT_CREDENTIALS = "client_credentials"
 
@@ -34,10 +35,37 @@ class RoomSerializer(serializers.ModelSerializer):
     following the principle of least privilege.
     """
 
+    configuration = serializers.JSONField(required=False)
+
     class Meta:
         model = models.Room
-        fields = ["id", "name", "slug", "pin_code", "access_level"]
-        read_only_fields = ["id", "name", "slug", "pin_code", "access_level"]
+        fields = ["id", "name", "slug", "pin_code", "access_level", "configuration"]
+        read_only_fields = ["id", "name", "slug", "pin_code"]
+
+    def validate_configuration(self, value):
+        """Validate room configuration against the RoomConfiguration schema."""
+        if value is None or value == {}:
+            return value
+        try:
+            RoomConfiguration.model_validate(value)
+        except ValidationError as e:
+            raise serializers.ValidationError(e.errors()) from e
+        return value
+
+    def validate_access_level(self, access_level):
+        """Reject public access_level unless explicitly allowed or the default is already public."""
+
+        if settings.EXTERNAL_API_DEFAULT_ACCESS_LEVEL == models.RoomAccessLevel.PUBLIC:
+            return access_level
+
+        if (
+            access_level == models.RoomAccessLevel.PUBLIC
+            and not settings.EXTERNAL_API_ALLOW_PUBLIC_ACCESS
+        ):
+            raise serializers.ValidationError(
+                "Public rooms are disabled for the external API."
+            )
+        return access_level
 
     def to_representation(self, instance):
         """Enrich response with application-specific computed fields."""
@@ -68,6 +96,9 @@ class RoomSerializer(serializers.ModelSerializer):
 
         # Set secure defaults
         validated_data["name"] = utils.generate_room_slug()
-        validated_data["access_level"] = models.RoomAccessLevel.TRUSTED
+        validated_data.setdefault(
+            "access_level", settings.EXTERNAL_API_DEFAULT_ACCESS_LEVEL
+        )
+        validated_data.setdefault("configuration", {})
 
         return super().create(validated_data)

src/backend/core/external_api/viewsets.py

@@ -4,7 +4,7 @@ from logging import getLogger
 
 from django.conf import settings
 from django.contrib.auth.hashers import check_password
-from django.core.exceptions import SuspiciousOperation, ValidationError
+from django.core.exceptions import ValidationError
 from django.core.validators import validate_email
 
 from lasuite.oidc_resource_server.authentication import ResourceServerAuthentication
@@ -23,6 +23,11 @@ from core import api, models
 from core.api.feature_flag import FeatureFlag
 from core.services.jwt_token import JwtTokenService
 
+from ..services.provisional_user_service import (
+    ProvisionalUserCreationDisabledError,
+    ProvisionalUserIntegrityError,
+    ProvisionalUserService,
+)
 from . import authentication, permissions, serializers
 
 logger = getLogger(__name__)
@@ -94,40 +99,14 @@ class ApplicationViewSet(viewsets.ViewSet):
             )
 
         try:
-            user = models.User.objects.get(email__iexact=email)
-        except models.User.DoesNotExist as e:
-            if (
-                settings.APPLICATION_ALLOW_USER_CREATION
-                and settings.OIDC_FALLBACK_TO_EMAIL_FOR_IDENTIFICATION
-                and not settings.OIDC_USER_SUB_FIELD_IMMUTABLE
-            ):
-                # Create a provisional user without `sub`, identified by email only.
-                #
-                # This relies on Django LaSuite implicitly updating the `sub` field on the
-                # user's first successful OIDC authentication. If this stops working,
-                # check for behavior changes in Django LaSuite.
-                #
-                # `OIDC_USER_SUB_FIELD_IMMUTABLE` comes from Django LaSuite and prevents `sub`
-                # updates. We override its default value to allow setting `sub` for
-                # provisional users.
-                user = models.User(
-                    sub=None,
-                    email=email,
-                )
-                user.set_unusable_password()
-                user.save()
-                logger.info(
-                    "Provisional user created via application: user_id=%s, email=%s, client_id=%s",
-                    user.id,
-                    email,
-                    application.client_id,
-                )
-            else:
-                raise drf_exceptions.NotFound("User not found.") from e
-        except models.User.MultipleObjectsReturned as e:
-            raise SuspiciousOperation(
-                "Multiple user accounts share a common email."
-            ) from e
+            user, _ = ProvisionalUserService().get_or_create(email, client_id)
+        except ProvisionalUserCreationDisabledError as not_found_error:
+            raise drf_exceptions.NotFound("User not found.") from not_found_error
+        except ProvisionalUserIntegrityError:
+            return drf_response.Response(
+                {"error": "Failed to create or retrieve provisional user."},
+                status=drf_status.HTTP_409_CONFLICT,
+            )
 
         scope = " ".join(application.scopes or [])
 

src/backend/core/management/commands/merge_duplicate_users.py

@@ -0,0 +1,168 @@
+"""Management command to merge duplicate users based on their email address."""
+
+# pylint: disable=too-many-locals
+
+from django.contrib.auth import get_user_model
+from django.core.management.base import BaseCommand, CommandError
+from django.db import transaction
+from django.db.models import Count
+
+from core.models import File, RecordingAccess, ResourceAccess, RoleChoices
+
+User = get_user_model()
+
+ROLE_PRIORITY = {
+    RoleChoices.OWNER: 3,
+    RoleChoices.ADMIN: 2,
+    RoleChoices.MEMBER: 1,
+}
+
+
+class Command(BaseCommand):
+    """
+    Merge duplicate users sharing the same email into the most recently created one.
+
+    The KEPT user is the most recently created. All room memberships, recording
+    accesses and files are transferred to it. When a conflict exists, the
+    higher-privilege role wins. Stale users are then deleted.
+    Each email group is processed inside a single database transaction.
+    """
+
+    help = __doc__
+
+    def add_arguments(self, parser):
+        parser.add_argument(
+            "--dry-run",
+            action="store_true",
+            help="Simulate the merge without writing any changes to the database.",
+        )
+        parser.add_argument(
+            "--email-filter",
+            type=str,
+            default=None,
+            help="Only merge users whose email contains this string (e.g. '@example.com').",
+        )
+
+    def handle(self, *args, **options):
+        """Execute the management command."""
+        dry_run = options["dry_run"]
+        email_filter = options["email_filter"]
+
+        if dry_run:
+            self.stdout.write("[DRY-RUN] No changes will be written.\n")
+
+        users_qs = User.objects.all()
+        if email_filter:
+            users_qs = users_qs.filter(email__icontains=email_filter)
+            self.stdout.write(f"[INFO] Filtering emails containing '{email_filter}'.\n")
+
+        duplicate_emails = (
+            users_qs.exclude(email__isnull=True)
+            .exclude(email="")
+            .values("email")
+            .annotate(cnt=Count("id"))
+            .filter(cnt__gt=1)
+            .values_list("email", flat=True)
+        )
+
+        if not duplicate_emails:
+            self.stdout.write("[INFO] No duplicate users found. Nothing to do.")
+            return
+
+        self.stdout.write(
+            f"[INFO] Found {len(duplicate_emails)} email(s) with duplicate users."
+        )
+
+        total_merged = 0
+        total_deleted = 0
+        failed_emails = []
+
+        for email in duplicate_emails:
+            # Secondary sort by id ensures a stable, deterministic order when
+            # created_at timestamps are equal (common in tests and bulk imports).
+            users = list(User.objects.filter(email=email).order_by("created_at", "id"))
+            kept_user = users[-1]
+            stale_users = users[:-1]
+
+            self.stdout.write(
+                f"\n[INFO] Email '{email}': {len(users)} users — "
+                f"keeping {kept_user.id} (created {kept_user.created_at.date()})."
+            )
+            for u in stale_users:
+                self.stdout.write(
+                    f"       stale: {u.id} (created {u.created_at.date()})"
+                )
+
+            if dry_run:
+                ra_count = ResourceAccess.objects.filter(user__in=stale_users).count()
+                rca_count = RecordingAccess.objects.filter(user__in=stale_users).count()
+                f_count = File.objects.filter(creator__in=stale_users).count()
+                self.stdout.write(
+                    f"       [DRY-RUN] Would migrate: {ra_count} ResourceAccess, "
+                    f"{rca_count} RecordingAccess, {f_count} File(s)."
+                )
+                continue
+
+            try:
+                group_deleted = 0
+                with transaction.atomic():
+                    for stale_user in stale_users:
+                        self._merge_resource_accesses(stale_user, kept_user)
+                        self._merge_recording_accesses(stale_user, kept_user)
+                        self._merge_files(stale_user, kept_user)
+                        stale_user.delete()
+                        group_deleted += 1
+
+                total_deleted += group_deleted
+                total_merged += 1
+
+            except Exception as exc:  # noqa: BLE001 #pylint: disable=broad-exception-caught
+                failed_emails.append(email)
+                self.stderr.write(f"[ERROR] Failed to merge '{email}': {exc}")
+
+        if failed_emails:
+            raise CommandError(
+                f"Failed to merge {len(failed_emails)} email group(s): {', '.join(failed_emails)}"
+            )
+
+        self.stdout.write(
+            self.style.SUCCESS(
+                f"\n[DONE] Merged {total_merged} group(s), deleted {total_deleted} user(s)."
+            )
+        )
+
+    def _merge_resource_accesses(self, stale_user, kept_user):
+        """Transfer room memberships from stale_user to kept_user."""
+        for ra in ResourceAccess.objects.filter(user=stale_user):
+            existing = ResourceAccess.objects.filter(
+                user=kept_user, resource=ra.resource
+            ).first()
+
+            if existing is None:
+                ra.user = kept_user
+                ra.save(update_fields=["user"])
+            else:
+                if ROLE_PRIORITY.get(ra.role, 0) > ROLE_PRIORITY.get(existing.role, 0):
+                    existing.role = ra.role
+                    existing.save(update_fields=["role"])
+                ra.delete()
+
+    def _merge_recording_accesses(self, stale_user, kept_user):
+        """Transfer recording accesses from stale_user to kept_user."""
+        for rca in RecordingAccess.objects.filter(user=stale_user):
+            existing = RecordingAccess.objects.filter(
+                user=kept_user, recording=rca.recording
+            ).first()
+
+            if existing is None:
+                rca.user = kept_user
+                rca.save(update_fields=["user"])
+            else:
+                if ROLE_PRIORITY.get(rca.role, 0) > ROLE_PRIORITY.get(existing.role, 0):
+                    existing.role = rca.role
+                    existing.save(update_fields=["role"])
+                rca.delete()
+
+    def _merge_files(self, stale_user, kept_user):
+        """Re-assign files created by stale_user to kept_user."""
+        File.objects.filter(creator=stale_user).update(creator=kept_user)

src/backend/core/migrations/0019_user_unique_email_when_sub_is_null.py

@@ -0,0 +1,19 @@
+# Generated by Django 5.2.14 on 2026-06-02 17:31
+
+import django.db.models.functions.text
+from django.db import migrations, models
+
+
+class Migration(migrations.Migration):
+
+    dependencies = [
+        ('auth', '0012_alter_user_first_name_max_length'),
+        ('core', '0018_rename_active_application_is_active'),
+    ]
+
+    operations = [
+        migrations.AddConstraint(
+            model_name='user',
+            constraint=models.UniqueConstraint(django.db.models.functions.text.Lower('email'), condition=models.Q(('sub__isnull', True)), name='unique_email_when_sub_is_null'),
+        ),
+    ]

src/backend/core/migrations/0020_alter_file_upload_state.py

@@ -0,0 +1,18 @@
+# Generated by Django 5.2.14 on 2026-06-03 12:14
+
+from django.db import migrations, models
+
+
+class Migration(migrations.Migration):
+
+    dependencies = [
+        ('core', '0019_user_unique_email_when_sub_is_null'),
+    ]
+
+    operations = [
+        migrations.AlterField(
+            model_name='file',
+            name='upload_state',
+            field=models.CharField(choices=[('pending', 'Pending'), ('analyzing', 'Analyzing'), ('ready', 'Ready')], max_length=25),
+        ),
+    ]

src/backend/core/models.py

@@ -211,6 +211,13 @@ class User(AbstractBaseUser, BaseModel, auth_models.PermissionsMixin):
         ordering = ("-created_at",)
         verbose_name = _("user")
         verbose_name_plural = _("users")
+        constraints = [
+            models.UniqueConstraint(
+                models.functions.Lower("email"),
+                condition=models.Q(sub__isnull=True),
+                name="unique_email_when_sub_is_null",
+            )
+        ]
 
     def __str__(self):
         return self.email or self.admin_email or str(self.id)
@@ -388,6 +395,7 @@ class Room(Resource):
         choices=RoomAccessLevel.choices,
         default=settings.RESOURCE_DEFAULT_ACCESS_LEVEL,
     )
+    # Public configuration exposed to any room participant via the API
     configuration = models.JSONField(
         blank=True,
         default=dict,
@@ -838,8 +846,8 @@ class FileUploadStateChoices(models.TextChoices):
     """Possible states of a file."""
 
     PENDING = "pending", _("Pending")
+    ANALYZING = "analyzing", _("Analyzing")
     # Commented out for now, as we may need this when we implement the malware detection logic.
-    # ANALYZING = "analyzing", _("Analyzing")
     # SUSPICIOUS = "suspicious", _("Suspicious")
     # FILE_TOO_LARGE_TO_ANALYZE = (
     #     "file_too_large_to_analyze",
@@ -946,6 +954,16 @@ class File(BaseModel):
 
         return f"{settings.FILE_UPLOAD_PATH}/{self.pk!s}"
 
+    @property
+    def temporary_key_base(self):
+        """Temporary key base used while upload is still pending."""
+        if not self.pk:
+            raise RuntimeError(
+                "The file instance must be saved before requesting a storage key."
+            )
+
+        return f"{settings.FILE_UPLOAD_TMP_PATH}/{self.pk!s}"
+
     @property
     def file_key(self):
         """Key used to store the file in object storage."""
@@ -954,6 +972,12 @@ class File(BaseModel):
         # leaking Personal Information in logs, etc.
         return f"{self.key_base}{extension!s}"
 
+    @property
+    def temporary_file_key(self):
+        """Temporary key used to upload the file before it is finalized."""
+        _, extension = splitext(self.filename)
+        return f"{self.temporary_key_base}{extension!s}"
+
     def get_abilities(self, user):
         """
         Compute and return abilities for a given user on the file.

src/backend/core/recording/event/parsers.py

@@ -1,6 +1,7 @@
 """Meet storage event parser classes."""
 
 import logging
+import mimetypes
 import re
 from dataclasses import dataclass
 from functools import lru_cache
@@ -18,6 +19,9 @@ from .exceptions import (
     ParsingEventDataError,
 )
 
+# Additional MIME type mapping
+mimetypes.add_type("audio/ogg", ".ogg")
+
 logger = logging.getLogger(__name__)
 
 
@@ -74,8 +78,8 @@ def get_parser() -> EventParser:
     return event_parser_cls(bucket_name=settings.AWS_STORAGE_BUCKET_NAME)
 
 
-class MinioParser:
-    """Handle parsing and validation of Minio storage events."""
+class BaseS3Parser:
+    """Base class for handling parsing and validation of S3-compatible storage events."""
 
     def __init__(self, bucket_name: str, allowed_filetypes=None):
         """Initialize parser with target bucket name and accepted filetypes."""
@@ -91,32 +95,6 @@ class MinioParser:
             rf"(?P<url_encoded_folder_path>(?:[^%]+%2F)+)?{settings.RECORDING_OUTPUT_FOLDER}%2F(?P<recording_id>{UUID_REGEX})\.(?P<extension>{FILE_EXT_REGEX})"
         )
 
-    @staticmethod
-    def parse(data):
-        """Convert raw Minio event dictionary to StorageEvent object."""
-
-        if not data:
-            raise ParsingEventDataError("Received empty data.")
-
-        try:
-            record = data["Records"][0]
-            s3 = record["s3"]
-            bucket_name = s3["bucket"]["name"]
-            file_object = s3["object"]
-            filepath = file_object["key"]
-            filetype = file_object["contentType"]
-        except (KeyError, IndexError) as e:
-            raise ParsingEventDataError(f"Missing or malformed key: {e}.") from e
-        try:
-            return StorageEvent(
-                filepath=filepath,
-                filetype=filetype,
-                bucket_name=bucket_name,
-                metadata=None,
-            )
-        except TypeError as e:
-            raise ParsingEventDataError(f"Missing essential data fields: {e}") from e
-
     def validate(self, event_data: StorageEvent) -> str:
         """Verify StorageEvent matches bucket, filetype and filepath requirements."""
 
@@ -141,9 +119,56 @@ class MinioParser:
         return recording_id
 
     def get_recording_id(self, data):
-        """Extract recording ID from Minio event through parsing and validation."""
+        """Extract recording ID from S3 event through parsing and validation."""
 
         event_data = self.parse(data)
-        recording_id = self.validate(event_data)
+        return self.validate(event_data)
 
-        return recording_id
+    def parse(self, data: Dict) -> StorageEvent:
+        """To be implemented by subclasses."""
+        raise NotImplementedError("Subclasses must implement parse()")
+
+
+class MinioParser(BaseS3Parser):
+    """Minio specific event parsing."""
+
+    def parse(self, data: Dict) -> StorageEvent:
+        if not data:
+            raise ParsingEventDataError("Received empty data.")
+        try:
+            record = data["Records"][0]
+            s3 = record["s3"]
+            return StorageEvent(
+                filepath=s3["object"]["key"],
+                filetype=s3["object"]["contentType"],  # Minio-specific field
+                bucket_name=s3["bucket"]["name"],
+                metadata=None,
+            )
+        except (KeyError, IndexError) as e:
+            raise ParsingEventDataError(f"Malformed Minio event: {e}") from e
+        except TypeError as e:
+            raise ParsingEventDataError(f"Missing essential data fields: {e}") from e
+
+
+class S3Parser(BaseS3Parser):
+    """AWS S3 specific event parsing."""
+
+    def parse(self, data: Dict) -> StorageEvent:
+        if not data:
+            raise ParsingEventDataError("Received empty data.")
+        try:
+            # AWS S3 structure can slightly differ from Minio implementation
+            record = data["Records"][0]
+            s3 = record["s3"]
+            filepath = s3["object"]["key"]
+            if not filepath:
+                raise ParsingEventDataError("Missing object key name")
+            filetype, _ = mimetypes.guess_type(filepath)
+            return StorageEvent(
+                filepath=filepath,
+                filetype=filetype,
+                bucket_name=s3["bucket"]["name"],
+                metadata=None,
+            )
+        except (KeyError, IndexError) as e:
+            raise ParsingEventDataError(f"Malformed S3 event: {e}") from e

src/backend/core/services/participants_management.py

@@ -15,6 +15,7 @@ from livekit.api import (
     TwirpError,
     UpdateParticipantRequest,
 )
+from livekit.protocol.models import ParticipantInfo
 
 from core import utils
 
@@ -154,3 +155,44 @@ class ParticipantsManagement:
 
         finally:
             await lkapi.aclose()
+
+    @async_to_sync
+    async def check_if_in_meeting(self, room_name: str, identity: str) -> bool:
+        """Check whether `identity` is currently a participant in `room_name`.
+
+        Raises ParticipantsManagementException for unexpected LiveKit errors
+        so callers can fail closed rather than silently allowing the action.
+        """
+
+        if not room_name or not identity:
+            return False
+
+        lkapi = utils.create_livekit_client()
+
+        try:
+            participant = await lkapi.room.get_participant(
+                RoomParticipantIdentity(
+                    room=room_name,
+                    identity=identity,
+                )
+            )
+        except TwirpError as e:
+            if e.code == "not_found":
+                raise ParticipantNotFoundException("Participant does not exist") from e
+
+            logger.exception(
+                "Unexpected error checking participant %s in room %s",
+                identity,
+                room_name,
+            )
+            raise ParticipantsManagementException(
+                "Could not verify participant presence"
+            ) from e
+
+        finally:
+            await lkapi.aclose()
+
+        return (
+            participant is not None
+            and participant.state != ParticipantInfo.State.DISCONNECTED
+        )

src/backend/core/services/provisional_user_service.py

@@ -0,0 +1,110 @@
+"""Service for provisional user creation."""
+
+import logging
+
+from django.conf import settings
+from django.core.exceptions import SuspiciousOperation, ValidationError
+from django.db import IntegrityError
+
+from core import models
+
+logger = logging.getLogger(__name__)
+
+
+class ProvisionalUserError(Exception):
+    """Base exception for provisional user service errors."""
+
+
+class ProvisionalUserCreationDisabledError(ProvisionalUserError):
+    """Raised when provisional user creation is disabled by configuration."""
+
+
+class ProvisionalUserIntegrityError(ProvisionalUserError):
+    """Raised when a provisional user cannot be created or retrieved after a race condition."""
+
+
+class ProvisionalUserService:
+    """Handles creation and retrieval of provisional users.
+
+    A provisional user is created without a `sub`, identified by email only.
+    The `sub` is set on first successful OIDC authentication via Django LaSuite.
+    """
+
+    def __init__(self):
+        """Initialize the service."""
+
+        # `OIDC_USER_SUB_FIELD_IMMUTABLE` comes from Django LaSuite and prevents `sub`
+        # updates. We override its default value to allow setting `sub` for
+        # provisional users.
+
+        self._is_creation_enabled = (
+            settings.APPLICATION_ALLOW_USER_CREATION
+            and settings.OIDC_FALLBACK_TO_EMAIL_FOR_IDENTIFICATION
+            and not settings.OIDC_USER_SUB_FIELD_IMMUTABLE
+        )
+
+    def _get_by_email(self, email: str) -> models.User | None:
+        """Return the user with this email, or None if not found."""
+        try:
+            return models.User.objects.get(email__iexact=email)
+        except models.User.DoesNotExist:
+            return None
+        except models.User.MultipleObjectsReturned as e:
+            raise SuspiciousOperation(
+                "Multiple user accounts share a common email."
+            ) from e
+
+    def get_or_create(
+        self, email: str, client_id: str
+    ) -> tuple[models.User | None, bool]:
+        """Get or create a provisional user identified by email.
+
+        Args:
+            email: The email address to identify the user.
+            client_id: The application client_id, used for audit logging only.
+
+        Returns:
+            A (user, created) tuple — mirrors get_or_create conventions.
+
+        Raises:
+            ProvisionalUserError: If creation and retrieval both fail.
+        """
+        user = self._get_by_email(email)
+        if user:
+            return user, False
+
+        if not self._is_creation_enabled:
+            raise ProvisionalUserCreationDisabledError(
+                "Provisional user creation is disabled by configuration."
+            )
+
+        # Create a provisional user without `sub`, identified by email only.
+        # This relies on Django LaSuite implicitly updating the `sub` field on the
+        # user's first successful OIDC authentication. If this stops working,
+        # check for behavior changes in Django LaSuite.
+        try:
+            user = models.User(sub=None, email=email)
+            user.set_unusable_password()
+            user.save()
+            logger.info(
+                "Provisional user created via application: user_id=%s, email=%s, client_id=%s",
+                user.id,
+                email,
+                client_id,
+            )
+            return user, True
+        except (IntegrityError, ValidationError) as e:
+            logger.warning(
+                "Race condition on provisional user creation, fetching existing: "
+                "email=%s, client_id=%s",
+                email,
+                client_id,
+            )
+            user = self._get_by_email(email)
+
+            if user:
+                return user, False
+
+            raise ProvisionalUserIntegrityError(
+                "Failed to create or retrieve provisional user."
+            ) from e

src/backend/core/services/room_management.py

@@ -0,0 +1,64 @@
+"""Room management service for LiveKit rooms."""
+
+# pylint: disable=no-name-in-module
+
+import json
+from logging import getLogger
+from typing import Dict, Optional
+
+from asgiref.sync import async_to_sync
+from livekit.api import (
+    TwirpError,
+    UpdateRoomMetadataRequest,
+)
+
+from core import utils
+
+logger = getLogger(__name__)
+
+
+class RoomManagementException(Exception):
+    """Exception raised when a room management operation fails."""
+
+
+class RoomNotFoundException(RoomManagementException):
+    """Raised when the target room does not exist in LiveKit."""
+
+
+class RoomManagement:
+    """Service for managing LiveKit rooms."""
+
+    @async_to_sync
+    async def update_metadata(self, room_name: str, metadata: Optional[Dict] = None):
+        """Update a LiveKit room's metadata.
+
+        The `room_name` corresponds to the LiveKit room identifier
+        (i.e. the Room model's UUID as a string).
+        """
+
+        lkapi = utils.create_livekit_client()
+
+        try:
+            await lkapi.room.update_room_metadata(
+                UpdateRoomMetadataRequest(
+                    room=room_name,
+                    metadata=json.dumps(metadata) if metadata is not None else "",
+                )
+            )
+
+        except TwirpError as e:
+            if e.code == "not_found":
+                logger.warning(
+                    "Room %s not found in LiveKit, skipping metadata update",
+                    room_name,
+                )
+                raise RoomNotFoundException("Room does not exist") from e
+
+            logger.exception(
+                "Unexpected error updating metadata for room %s",
+                room_name,
+            )
+            raise RoomManagementException("Could not update room metadata") from e
+
+        finally:
+            await lkapi.aclose()

src/backend/core/tests/authentication/test_backends.py

@@ -346,8 +346,11 @@ def test_authentication_getter_existing_user_change_fields(
 
     # One and only one additional update query when a field has changed
     # Note: .save() triggers uniqueness validation queries for unique fields,
-    # adding extra SELECT queries before the UPDATE (e.g., checking unique=True on 'sub')
-    with django_assert_num_queries(3):
+    # adding extra SELECT queries before the UPDATE:
+    #   - unique=True on 'sub'
+    #   - unique=True on 'admin_email'
+    #   - partial unique index 'unique_email_when_sub_is_null'
+    with django_assert_num_queries(5):
         authenticated_user = klass.get_or_create_user(
             access_token="test-token", id_token=None, payload=None
         )

src/backend/core/tests/files/test_api_files_create.py

@@ -118,7 +118,7 @@ def test_api_files_create_file_authenticated_success():
 
     assert policy_parsed.scheme == "http"
     assert policy_parsed.netloc in ["minio:9000", "localhost:9000"]
-    assert policy_parsed.path == f"/meet-media-storage/files/{file.id!s}.png"
+    assert policy_parsed.path == f"/meet-media-storage/tmp/files/{file.id!s}.png"
 
     query_params = parse_qs(policy_parsed.query)
 

src/backend/core/tests/files/test_api_files_upload_ended.py

@@ -1,6 +1,7 @@
 """Test related to item upload ended API."""
 
 import logging
+from concurrent.futures import ThreadPoolExecutor
 from io import BytesIO
 
 from django.core.files.storage import default_storage
@@ -81,7 +82,7 @@ def test_api_file_upload_ended_success(settings):
     )
 
     default_storage.save(
-        file.file_key,
+        file.temporary_file_key,
         BytesIO(b"my prose"),
     )
 
@@ -97,6 +98,7 @@ def test_api_file_upload_ended_success(settings):
     assert response.json()["mimetype"] == "text/plain"
 
 
+@pytest.mark.django_db(transaction=True)
 def test_api_file_upload_ended_mimetype_not_allowed(settings, caplog):
     """
     Test that the API returns a 400 when the mimetype is not allowed.
@@ -119,7 +121,7 @@ def test_api_file_upload_ended_mimetype_not_allowed(settings, caplog):
     )
 
     default_storage.save(
-        file.file_key,
+        file.temporary_file_key,
         BytesIO(b"my prose"),
     )
 
@@ -156,7 +158,7 @@ def test_api_file_upload_ended_mimetype_not_allowed_not_checking_mimetype(settin
     )
 
     default_storage.save(
-        file.file_key,
+        file.temporary_file_key,
         BytesIO(b"my prose"),
     )
 
@@ -200,7 +202,7 @@ def test_api_upload_ended_mismatch_mimetype_with_object_storage(settings, caplog
 
     s3_client.put_object(
         Bucket=default_storage.bucket_name,
-        Key=file.file_key,
+        Key=file.temporary_file_key,
         ContentType="text/html",
         Body=BytesIO(
             b'<meta http-equiv="refresh" content="0; url=https://fichiers.numerique.gouv.fr">'
@@ -211,7 +213,7 @@ def test_api_upload_ended_mismatch_mimetype_with_object_storage(settings, caplog
     )
 
     head_object = s3_client.head_object(
-        Bucket=default_storage.bucket_name, Key=file.file_key
+        Bucket=default_storage.bucket_name, Key=file.temporary_file_key
     )
 
     assert head_object["ContentType"] == "text/html"
@@ -234,9 +236,10 @@ def test_api_upload_ended_mismatch_mimetype_with_object_storage(settings, caplog
     assert head_object["Metadata"] == {"foo": "bar"}
 
 
+@pytest.mark.django_db(transaction=True)
 def test_api_upload_ended_file_size_exceeded(settings, caplog):
     """
-    Test when the file size exceed the allowed max upload file size
+    Test when the file size exceeds the allowed max upload file size
     should return a 400 and delete the file.
     """
 
@@ -256,7 +259,7 @@ def test_api_upload_ended_file_size_exceeded(settings, caplog):
     )
 
     default_storage.save(
-        file.file_key,
+        file.temporary_file_key,
         BytesIO(b"my prose"),
     )
 
@@ -270,3 +273,48 @@ def test_api_upload_ended_file_size_exceeded(settings, caplog):
 
     assert not models.File.objects.filter(id=file.id).exists()
     assert not default_storage.exists(file.file_key)
+
+
+@pytest.mark.django_db(transaction=True)
+def test_api_file_upload_ended_concurrent_calls_are_serialized(settings):
+    """Only one concurrent upload-ended call can finalize a pending upload."""
+    settings.FILE_UPLOAD_APPLY_RESTRICTIONS = True
+    settings.FILE_UPLOAD_RESTRICTIONS = {
+        "background_image": {
+            **settings.FILE_UPLOAD_RESTRICTIONS["background_image"],
+            "allowed_mimetypes": ["text/plain"],
+        },
+    }
+
+    user = factories.UserFactory()
+    file = factories.FileFactory(
+        type=FileTypeChoices.BACKGROUND_IMAGE,
+        filename="my_file.txt",
+        creator=user,
+    )
+    default_storage.save(file.temporary_file_key, BytesIO(b"my prose"))
+
+    def call_upload_ended():
+        client = APIClient()
+        client.force_login(user)
+        return client.post(f"/api/v1.0/files/{file.id!s}/upload-ended/")
+
+    with ThreadPoolExecutor(max_workers=2) as executor:
+        futures = [
+            executor.submit(call_upload_ended),
+            executor.submit(call_upload_ended),
+        ]
+        responses = [future.result() for future in futures]
+
+    status_codes = sorted(response.status_code for response in responses)
+    assert status_codes == [200, 400]
+
+    failed_response = next(
+        response for response in responses if response.status_code == 400
+    )
+    assert failed_response.json() == {
+        "file": "This action is only available for files in PENDING state."
+    }
+
+    file.refresh_from_db()
+    assert file.upload_state == FileUploadStateChoices.READY

src/backend/core/tests/management/test_management_merge_duplicate_users.py

@@ -0,0 +1,460 @@
+"""Tests for the merge_duplicate_users management command."""
+
+from unittest import mock
+
+from django.core.management import base, call_command
+
+import pytest
+
+from core.factories import (
+    FileFactory,
+    UserFactory,
+    UserRecordingAccessFactory,
+    UserResourceAccessFactory,
+)
+from core.models import RecordingAccess, ResourceAccess, RoleChoices, User
+
+pytestmark = pytest.mark.django_db
+
+# pylint: disable=W0613
+
+
+def test_merge_no_duplicates_does_nothing():
+    """Command should do nothing when no duplicate users exist."""
+    user = UserFactory(email="unique@example.com")
+    call_command("merge_duplicate_users")
+    assert User.objects.count() == 1
+    assert User.objects.filter(id=user.id).exists()
+
+
+def test_merge_keeps_most_recently_created_user():
+    """Command should keep the most recently created user when duplicates exist."""
+    user1 = UserFactory(email="dup@example.com")
+    user2 = UserFactory(email="dup@example.com")
+    call_command("merge_duplicate_users")
+    assert not User.objects.filter(id=user1.id).exists()
+    assert User.objects.filter(id=user2.id).exists()
+
+
+def test_merge_deletes_all_stale_users():
+    """Command should delete all stale users and keep only the most recently created one."""
+    email = "many@example.com"
+    UserFactory(email=email)
+    UserFactory(email=email)
+    user_kept = UserFactory(email=email)
+    call_command("merge_duplicate_users")
+    assert User.objects.filter(email=email).count() == 1
+    assert User.objects.filter(id=user_kept.id).exists()
+
+
+# ── ResourceAccess ─────────────────────────────────────────────────────────────
+
+
+def test_merge_transfers_resource_access_to_kept_user():
+    """ResourceAccess should be transferred to the kept user when stale user is merged."""
+    user1 = UserFactory(email="dup@example.com")
+    user2 = UserFactory(email="dup@example.com")
+    ra = UserResourceAccessFactory(user=user1)
+    call_command("merge_duplicate_users")
+    ra.refresh_from_db()
+    assert ra.user == user2
+
+
+def test_merge_transfers_multiple_room_accesses():
+    """All ResourceAccesses should be transferred to the kept user when stale user is merged."""
+    user1 = UserFactory(email="dup@example.com")
+    user2 = UserFactory(email="dup@example.com")
+    accesses = UserResourceAccessFactory.create_batch(3, user=user1)
+    call_command("merge_duplicate_users")
+    assert not ResourceAccess.objects.filter(user=user1).exists()
+    for ra in accesses:
+        assert ResourceAccess.objects.filter(user=user2, resource=ra.resource).exists()
+
+
+def test_merge_all_resource_accesses_owned_by_kept_user_nothing_changes():
+    """ResourceAccesses should remain unchanged when all are already owned by the kept user."""
+    user1 = UserFactory(email="dup@example.com")
+    user2 = UserFactory(email="dup@example.com")
+    accesses = UserResourceAccessFactory.create_batch(3, user=user2)
+    call_command("merge_duplicate_users")
+    assert not ResourceAccess.objects.filter(user=user1).exists()
+    for ra in accesses:
+        ra.refresh_from_db()
+        assert ra.user == user2
+
+
+def test_merge_resource_access_conflict_upgrades_to_owner():
+    """ResourceAccess role should be upgraded to owner when stale user has a higher role."""
+    user1 = UserFactory(email="dup@example.com")
+    user2 = UserFactory(email="dup@example.com")
+    ra1 = UserResourceAccessFactory(user=user1, role=RoleChoices.OWNER)
+    ra2 = UserResourceAccessFactory(
+        user=user2, resource=ra1.resource, role=RoleChoices.MEMBER
+    )
+    other_accesses = UserResourceAccessFactory.create_batch(
+        3, user=user1, role=RoleChoices.MEMBER
+    )
+    call_command("merge_duplicate_users")
+    ra2.refresh_from_db()
+    assert ra2.role == RoleChoices.OWNER
+    assert not ResourceAccess.objects.filter(user=user1).exists()
+    for ra in other_accesses:
+        assert ResourceAccess.objects.filter(
+            user=user2, resource=ra.resource, role=RoleChoices.MEMBER
+        ).exists()
+
+
+def test_merge_resource_access_conflict_upgrades_to_admin():
+    """ResourceAccess role should be upgraded to admin when stale user has a higher role."""
+    user1 = UserFactory(email="dup@example.com")
+    user2 = UserFactory(email="dup@example.com")
+    ra1 = UserResourceAccessFactory(user=user1, role=RoleChoices.ADMIN)
+    ra2 = UserResourceAccessFactory(
+        user=user2, resource=ra1.resource, role=RoleChoices.MEMBER
+    )
+    other_accesses = UserResourceAccessFactory.create_batch(
+        3, user=user1, role=RoleChoices.MEMBER
+    )
+    call_command("merge_duplicate_users")
+    ra2.refresh_from_db()
+    assert ra2.role == RoleChoices.ADMIN
+    assert not ResourceAccess.objects.filter(user=user1).exists()
+    for ra in other_accesses:
+        assert ResourceAccess.objects.filter(
+            user=user2, resource=ra.resource, role=RoleChoices.MEMBER
+        ).exists()
+
+
+def test_merge_resource_access_conflict_does_not_downgrade_role():
+    """ResourceAccess role should not be downgraded when stale user has a lower role."""
+    user1 = UserFactory(email="dup@example.com")
+    user2 = UserFactory(email="dup@example.com")
+    ra1 = UserResourceAccessFactory(user=user1, role=RoleChoices.MEMBER)
+    ra2 = UserResourceAccessFactory(
+        user=user2, resource=ra1.resource, role=RoleChoices.OWNER
+    )
+    other_accesses = UserResourceAccessFactory.create_batch(
+        3, user=user1, role=RoleChoices.MEMBER
+    )
+    call_command("merge_duplicate_users")
+    ra2.refresh_from_db()
+    assert ra2.role == RoleChoices.OWNER
+    assert not ResourceAccess.objects.filter(user=user1).exists()
+    for ra in other_accesses:
+        assert ResourceAccess.objects.filter(
+            user=user2, resource=ra.resource, role=RoleChoices.MEMBER
+        ).exists()
+
+
+def test_merge_resource_access_conflict_equal_role_keeps_single_access():
+    """ResourceAccess should keep one entry for the kept user when both ones have the same role."""
+    user1 = UserFactory(email="dup@example.com")
+    user2 = UserFactory(email="dup@example.com")
+    ra1 = UserResourceAccessFactory(user=user1, role=RoleChoices.MEMBER)
+    UserResourceAccessFactory(
+        user=user2, resource=ra1.resource, role=RoleChoices.MEMBER
+    )
+    call_command("merge_duplicate_users")
+    accesses = ResourceAccess.objects.filter(resource=ra1.resource)
+    assert accesses.count() == 1
+    assert accesses.first().user == user2
+    assert accesses.first().role == RoleChoices.MEMBER
+
+
+# ── RecordingAccess ────────────────────────────────────────────────────────────
+
+
+def test_merge_transfers_recording_access_to_kept_user():
+    """RecordingAccess should be transferred to the kept user when stale user is merged."""
+    user1 = UserFactory(email="dup@example.com")
+    user2 = UserFactory(email="dup@example.com")
+    rca = UserRecordingAccessFactory(user=user1)
+    call_command("merge_duplicate_users")
+    rca.refresh_from_db()
+    assert rca.user == user2
+
+
+def test_merge_transfers_multiple_recording_accesses():
+    """All RecordingAccesses should be transferred to the kept user when stale user is merged."""
+    user1 = UserFactory(email="dup@example.com")
+    user2 = UserFactory(email="dup@example.com")
+    accesses = UserRecordingAccessFactory.create_batch(3, user=user1)
+    call_command("merge_duplicate_users")
+    assert not RecordingAccess.objects.filter(user=user1).exists()
+    for rca in accesses:
+        assert RecordingAccess.objects.filter(
+            user=user2, recording=rca.recording
+        ).exists()
+
+
+def test_merge_all_recording_accesses_owned_by_kept_user_nothing_changes():
+    """RecordingAccesses should remain unchanged when all are already owned by the kept user."""
+    user1 = UserFactory(email="dup@example.com")
+    user2 = UserFactory(email="dup@example.com")
+    accesses = UserRecordingAccessFactory.create_batch(3, user=user2)
+    call_command("merge_duplicate_users")
+    assert not RecordingAccess.objects.filter(user=user1).exists()
+    for rca in accesses:
+        rca.refresh_from_db()
+        assert rca.user == user2
+
+
+def test_merge_recording_access_conflict_upgrades_to_owner():
+    """RecordingAccess role should be upgraded to owner when stale user has a higher role."""
+    user1 = UserFactory(email="dup@example.com")
+    user2 = UserFactory(email="dup@example.com")
+    rca1 = UserRecordingAccessFactory(user=user1, role=RoleChoices.OWNER)
+    rca2 = UserRecordingAccessFactory(
+        user=user2, recording=rca1.recording, role=RoleChoices.MEMBER
+    )
+    other_accesses = UserRecordingAccessFactory.create_batch(
+        3, user=user1, role=RoleChoices.MEMBER
+    )
+    call_command("merge_duplicate_users")
+    rca2.refresh_from_db()
+    assert rca2.role == RoleChoices.OWNER
+    assert not RecordingAccess.objects.filter(user=user1).exists()
+    for rca in other_accesses:
+        assert RecordingAccess.objects.filter(
+            user=user2, recording=rca.recording, role=RoleChoices.MEMBER
+        ).exists()
+
+
+def test_merge_recording_access_conflict_upgrades_to_admin():
+    """RecordingAccess role should be upgraded to admin when stale user has a higher role."""
+    user1 = UserFactory(email="dup@example.com")
+    user2 = UserFactory(email="dup@example.com")
+    rca1 = UserRecordingAccessFactory(user=user1, role=RoleChoices.ADMIN)
+    rca2 = UserRecordingAccessFactory(
+        user=user2, recording=rca1.recording, role=RoleChoices.MEMBER
+    )
+    other_accesses = UserRecordingAccessFactory.create_batch(
+        3, user=user1, role=RoleChoices.MEMBER
+    )
+    call_command("merge_duplicate_users")
+    rca2.refresh_from_db()
+    assert rca2.role == RoleChoices.ADMIN
+    assert not RecordingAccess.objects.filter(user=user1).exists()
+    for rca in other_accesses:
+        assert RecordingAccess.objects.filter(
+            user=user2, recording=rca.recording, role=RoleChoices.MEMBER
+        ).exists()
+
+
+def test_merge_recording_access_conflict_does_not_downgrade_role():
+    """RecordingAccess role should not be downgraded when stale user has a lower role."""
+    user1 = UserFactory(email="dup@example.com")
+    user2 = UserFactory(email="dup@example.com")
+    rca1 = UserRecordingAccessFactory(user=user1, role=RoleChoices.MEMBER)
+    rca2 = UserRecordingAccessFactory(
+        user=user2, recording=rca1.recording, role=RoleChoices.OWNER
+    )
+    other_accesses = UserRecordingAccessFactory.create_batch(
+        3, user=user1, role=RoleChoices.MEMBER
+    )
+    call_command("merge_duplicate_users")
+    rca2.refresh_from_db()
+    assert rca2.role == RoleChoices.OWNER
+    assert not RecordingAccess.objects.filter(user=user1).exists()
+    for rca in other_accesses:
+        assert RecordingAccess.objects.filter(
+            user=user2, recording=rca.recording, role=RoleChoices.MEMBER
+        ).exists()
+
+
+def test_merge_recording_access_conflict_equal_role_keeps_single_access():
+    """RecordingAccess should keep one entry for the user when both users have the same role."""
+    user1 = UserFactory(email="dup@example.com")
+    user2 = UserFactory(email="dup@example.com")
+    rca1 = UserRecordingAccessFactory(user=user1, role=RoleChoices.MEMBER)
+    UserRecordingAccessFactory(
+        user=user2, recording=rca1.recording, role=RoleChoices.MEMBER
+    )
+    call_command("merge_duplicate_users")
+    accesses = RecordingAccess.objects.filter(recording=rca1.recording)
+    assert accesses.count() == 1
+    assert accesses.first().user == user2
+    assert accesses.first().role == RoleChoices.MEMBER
+
+
+# ── Files ──────────────────────────────────────────────────────────────────────
+
+
+def test_merge_reassigns_files_to_kept_user():
+    """Files should be reassigned to the kept user when stale user is merged."""
+    user1 = UserFactory(email="dup@example.com")
+    user2 = UserFactory(email="dup@example.com")
+    files = FileFactory.create_batch(3, creator=user1)
+    call_command("merge_duplicate_users")
+    for f in files:
+        f.refresh_from_db()
+        assert f.creator == user2
+
+
+def test_merge_kept_user_own_files_untouched():
+    """Files already owned by the kept user should remain unchanged after merge."""
+    user1 = UserFactory(email="dup@example.com")
+    user2 = UserFactory(email="dup@example.com")
+    FileFactory(creator=user1)
+    kept_file = FileFactory(creator=user2)
+    call_command("merge_duplicate_users")
+    kept_file.refresh_from_db()
+    assert kept_file.creator == user2
+
+
+# ── Dry-run ────────────────────────────────────────────────────────────────────
+
+
+def test_merge_dry_run_does_not_delete_users():
+    """Command should not delete any users when dry-run is enabled."""
+    UserFactory(email="dup@example.com")
+    UserFactory(email="dup@example.com")
+    call_command("merge_duplicate_users", dry_run=True)
+    assert User.objects.filter(email="dup@example.com").count() == 2
+
+
+def test_merge_dry_run_does_not_move_resource_access():
+    """Command should not move resource accesses when dry-run is enabled."""
+    user1 = UserFactory(email="dup@example.com")
+    UserFactory(email="dup@example.com")
+    ra = UserResourceAccessFactory(user=user1)
+    call_command("merge_duplicate_users", dry_run=True)
+    ra.refresh_from_db()
+    assert ra.user == user1
+
+
+def test_merge_dry_run_does_not_move_recording_access():
+    """Command should not move recording accesses when dry-run is enabled."""
+    user1 = UserFactory(email="dup@example.com")
+    UserFactory(email="dup@example.com")
+    ra = UserRecordingAccessFactory(user=user1)
+    call_command("merge_duplicate_users", dry_run=True)
+    ra.refresh_from_db()
+    assert ra.user == user1
+
+
+def test_merge_dry_run_does_not_move_files():
+    """Command should not reassign files when dry-run is enabled."""
+    user1 = UserFactory(email="dup@example.com")
+    UserFactory(email="dup@example.com")
+    f = FileFactory(creator=user1)
+    call_command("merge_duplicate_users", dry_run=True)
+    f.refresh_from_db()
+    assert f.creator == user1
+
+
+# ── Isolation ──────────────────────────────────────────────────────────────────
+
+
+def test_merge_non_duplicate_users_untouched():
+    """Non-duplicate users should remain untouched when other duplicates are merged."""
+    unique = UserFactory(email="unique@example.com")
+    UserFactory(email="dup@example.com")
+    UserFactory(email="dup@example.com")
+    call_command("merge_duplicate_users")
+    assert User.objects.filter(id=unique.id).exists()
+
+
+def test_merge_non_duplicate_resource_access_untouched():
+    """ResourceAccess of non-duplicate users should remain untouched."""
+    unique = UserFactory(email="unique@example.com")
+    ra = UserResourceAccessFactory(user=unique)
+    UserFactory(email="dup@example.com")
+    UserFactory(email="dup@example.com")
+    call_command("merge_duplicate_users")
+    ra.refresh_from_db()
+    assert ra.user == unique
+
+
+def test_merge_multiple_email_groups_all_merged():
+    """Command should merge all duplicate email groups in a single run."""
+    for i in range(3):
+        UserFactory(email=f"group{i}@example.com")
+        UserFactory(email=f"group{i}@example.com")
+    call_command("merge_duplicate_users")
+    for i in range(3):
+        assert User.objects.filter(email=f"group{i}@example.com").count() == 1
+    assert User.objects.count() == 3
+
+
+# ── NULL / blank email guard ───────────────────────────────────────────────────
+
+
+def test_merge_does_not_merge_users_with_null_email():
+    """Users with NULL email must never be merged together, even if multiple exist."""
+    user1 = UserFactory(email=None)
+    user2 = UserFactory(email=None)
+    call_command("merge_duplicate_users")
+    assert User.objects.filter(id=user1.id).exists()
+    assert User.objects.filter(id=user2.id).exists()
+
+
+def test_merge_does_not_merge_users_with_blank_email():
+    """Users with empty-string email must never be merged together, even if multiple exist."""
+    user1 = UserFactory(email="")
+    user2 = UserFactory(email="")
+    call_command("merge_duplicate_users")
+    assert User.objects.filter(id=user1.id).exists()
+    assert User.objects.filter(id=user2.id).exists()
+
+
+# ── Atomicity ──────────────────────────────────────────────────────────────────
+
+
+@mock.patch(
+    "core.management.commands.merge_duplicate_users.Command._merge_recording_accesses",
+    side_effect=Exception("forced failure"),
+)
+def test_merge_is_atomic_rolls_back_all_on_any_failure(mock_reassign_files):
+    """Merge should be fully rolled back when any step fails."""
+    user1 = UserFactory(email="dup@example.com")
+    user2 = UserFactory(email="dup@example.com")
+    resource_accesses = UserResourceAccessFactory.create_batch(3, user=user1)
+    recording_accesses = UserRecordingAccessFactory.create_batch(3, user=user1)
+    files = FileFactory.create_batch(3, creator=user1)
+
+    with pytest.raises(base.CommandError):
+        call_command("merge_duplicate_users")
+
+    assert User.objects.filter(id=user1.id).exists()
+    assert User.objects.filter(id=user2.id).exists()
+    for ra in resource_accesses:
+        ra.refresh_from_db()
+        assert ra.user == user1
+    for rca in recording_accesses:
+        rca.refresh_from_db()
+        assert rca.user == user1
+    for f in files:
+        f.refresh_from_db()
+        assert f.creator == user1
+
+
+# ── Email filter ───────────────────────────────────────────────────────────────
+
+
+def test_merge_email_filter_only_merges_matching_emails():
+    """Command should only merge users whose email matches the filter."""
+    UserFactory(email="user1@example.com")
+    UserFactory(email="user1@example.com")
+    other1 = UserFactory(email="user1@other.com")
+    other2 = UserFactory(email="user1@other.com")
+    call_command("merge_duplicate_users", email_filter="@example.com")
+    assert User.objects.filter(email="user1@example.com").count() == 1
+    assert User.objects.filter(id=other1.id).exists()
+    assert User.objects.filter(id=other2.id).exists()
+
+
+def test_merge_email_filter_no_match_does_nothing():
+    """Command should do nothing when the email filter matches no users."""
+    UserFactory(email="user1@example.com")
+    UserFactory(email="user1@example.com")
+    call_command("merge_duplicate_users", email_filter="@nomatch.com")
+    assert User.objects.filter(email="user1@example.com").count() == 2
+
+
+def test_merge_email_filter_is_case_insensitive():
+    """Command should match emails case-insensitively when filtering."""
+    UserFactory(email="user1@Example.com")
+    UserFactory(email="user1@Example.com")
+    call_command("merge_duplicate_users", email_filter="@example.com")
+    assert User.objects.filter(email="user1@Example.com").count() == 1

src/backend/core/tests/recording/event/test_parsers.py

@@ -18,10 +18,13 @@ from core.recording.event.exceptions import (
 )
 from core.recording.event.parsers import (
     MinioParser,
+    S3Parser,
     StorageEvent,
     get_parser,
 )
 
+# MinioParser
+
 
 @pytest.fixture
 def valid_minio_event():
@@ -47,7 +50,7 @@ def minio_parser():
     return MinioParser(bucket_name="test-bucket")
 
 
-def test_parse_valid_event(minio_parser, valid_minio_event):
+def test_minio_parse_valid_event(minio_parser, valid_minio_event):
     """Test parsing a valid Minio event."""
     event = minio_parser.parse(valid_minio_event)
     assert isinstance(event, StorageEvent)
@@ -57,13 +60,33 @@ def test_parse_valid_event(minio_parser, valid_minio_event):
     assert event.metadata is None
 
 
-def test_parse_empty_data(minio_parser):
+def test_minio_parse_with_video_type(minio_parser):
+    """Test parsing event with video file type."""
+    video_event = {
+        "Records": [
+            {
+                "s3": {
+                    "bucket": {"name": "test-bucket"},
+                    "object": {
+                        "key": "46d1a121-2426-484d-8fb3-09b5d886f7a8.mp4",
+                        "contentType": "video/mp4",
+                    },
+                }
+            }
+        ]
+    }
+    event = minio_parser.parse(video_event)
+    assert event.filetype == "video/mp4"
+    assert event.filepath.endswith(".mp4")
+
+
+def test_minio_parse_empty_data(minio_parser):
     """Test parsing empty event data raises error."""
     with pytest.raises(ParsingEventDataError, match="Received empty data."):
         minio_parser.parse({})
 
 
-def test_parse_missing_keys(minio_parser):
+def test_minio_parse_missing_keys(minio_parser):
     """Test parsing event with missing key."""
 
     invalid_minio_event = {
@@ -77,11 +100,11 @@ def test_parse_missing_keys(minio_parser):
         ]
     }
 
-    with pytest.raises(ParsingEventDataError, match="Missing or malformed key"):
+    with pytest.raises(ParsingEventDataError, match="Malformed Minio event:"):
         minio_parser.parse(invalid_minio_event)
 
 
-def test_parse_none_key(minio_parser):
+def test_minio_parse_none_key(minio_parser):
     """Test parsing event with None field."""
 
     invalid_minio_event = {
@@ -102,7 +125,7 @@ def test_parse_none_key(minio_parser):
         minio_parser.parse(invalid_minio_event)
 
 
-def test_validate_invalid_bucket(minio_parser):
+def test_minio_validate_invalid_bucket(minio_parser):
     """Test validation with wrong bucket name."""
     event = StorageEvent(
         filepath="recording%2F46d1a121-2426-484d-8fb3-09b5d886f7a8.ogg",
@@ -114,7 +137,7 @@ def test_validate_invalid_bucket(minio_parser):
         minio_parser.validate(event)
 
 
-def test_validate_invalid_filetype(minio_parser):
+def test_minio_validate_invalid_filetype(minio_parser):
     """Test validation with unsupported file type."""
     event = StorageEvent(
         filepath="recording%2F46d1a121-2426-484d-8fb3-09b5d886f7a8.txt",
@@ -139,7 +162,7 @@ def test_validate_invalid_filetype(minio_parser):
         "folder%2Fuploads%2F46d1a121-2426-484d-8fb3-09b5d886f7a8.ogg",  # nested but no recordings/
     ],
 )
-def test_validate_invalid_filepath(invalid_filepath, minio_parser):
+def test_minio_validate_invalid_filepath(invalid_filepath, minio_parser):
     """Test validation with malformed filepath."""
     event = StorageEvent(
         filepath=invalid_filepath,
@@ -151,7 +174,7 @@ def test_validate_invalid_filepath(invalid_filepath, minio_parser):
         minio_parser.validate(event)
 
 
-def test_validate_valid_event(minio_parser):
+def test_minio_validate_valid_event(minio_parser):
     """Test validation with valid event data."""
     event = StorageEvent(
         filepath="recordings%2F46d1a121-2426-484d-8fb3-09b5d886f7a8.ogg",
@@ -163,13 +186,13 @@ def test_validate_valid_event(minio_parser):
     assert recording_id == "46d1a121-2426-484d-8fb3-09b5d886f7a8"
 
 
-def test_get_recording_id_success(minio_parser, valid_minio_event):
+def test_minio_get_recording_id_success(minio_parser, valid_minio_event):
     """Test successful extraction of recording ID."""
     recording_id = minio_parser.get_recording_id(valid_minio_event)
     assert recording_id == "46d1a121-2426-484d-8fb3-09b5d886f7a8"
 
 
-def test_validate_filepath_with_folder(minio_parser):
+def test_minio_validate_filepath_with_folder(minio_parser):
     """Test validation of filepath with folder structure."""
     event = StorageEvent(
         filepath="parent_folder%2Frecordings%2F46d1a121-2426-484d-8fb3-09b5d886f7a8.ogg",
@@ -181,41 +204,21 @@ def test_validate_filepath_with_folder(minio_parser):
     assert recording_id == "46d1a121-2426-484d-8fb3-09b5d886f7a8"
 
 
-def test_parse_with_video_type(minio_parser):
-    """Test parsing event with video file type."""
-    video_event = {
-        "Records": [
-            {
-                "s3": {
-                    "bucket": {"name": "test-bucket"},
-                    "object": {
-                        "key": "46d1a121-2426-484d-8fb3-09b5d886f7a8.mp4",
-                        "contentType": "video/mp4",
-                    },
-                }
-            }
-        ]
-    }
-    event = minio_parser.parse(video_event)
-    assert event.filetype == "video/mp4"
-    assert event.filepath.endswith(".mp4")
-
-
-def test_empty_allowed_filetypes():
+def test_minio_empty_allowed_filetypes():
     """Test MinioParser with empty allowed_filetypes."""
     empty_types = set()
     parser = MinioParser(bucket_name="test-bucket", allowed_filetypes=empty_types)
     assert parser._allowed_filetypes == {"audio/ogg", "video/mp4"}
 
 
-def test_custom_allowed_filetypes():
+def test_minio_custom_allowed_filetypes():
     """Test MinioParser with empty allowed_filetypes."""
     custom_types = {"audio/mp3", "video/mov"}
     parser = MinioParser(bucket_name="test-bucket", allowed_filetypes=custom_types)
     assert parser._allowed_filetypes == {"audio/mp3", "video/mov"}
 
 
-def test_validate_custom_filetypes():
+def test_minio_validate_custom_filetypes():
     """Test validation of filepath with folder structure."""
 
     parser = MinioParser(bucket_name="test-bucket", allowed_filetypes={"audio/mp3"})
@@ -229,18 +232,143 @@ def test_validate_custom_filetypes():
     parser.validate(event)
 
 
-def test_constructor_none_bucket():
+def test_minio_constructor_none_bucket():
     """Test MinioParser constructor with None bucket name."""
     with pytest.raises(ValueError, match="Bucket name cannot be None or empty"):
         MinioParser(bucket_name=None)
 
 
-def test_constructor_empty_bucket():
+def test_minio_constructor_empty_bucket():
     """Test MinioParser constructor with empty bucket name."""
     with pytest.raises(ValueError, match="Bucket name cannot be None or empty"):
         MinioParser(bucket_name="")
 
 
+# S3Parser
+
+
+@pytest.fixture
+def valid_s3_event():
+    """Mock a valid S3 event."""
+    return {
+        "Records": [
+            {
+                "s3": {
+                    "bucket": {"name": "test-bucket"},
+                    "object": {
+                        "key": "recordings%2F46d1a121-2426-484d-8fb3-09b5d886f7a8.ogg",
+                    },
+                }
+            }
+        ]
+    }
+
+
+@pytest.fixture
+def s3_parser():
+    """Mock an S3 parser."""
+    return S3Parser(bucket_name="test-bucket")
+
+
+def test_s3_parse_valid_event(s3_parser, valid_s3_event):
+    """Test parsing a valid S3 event."""
+    event = s3_parser.parse(valid_s3_event)
+    assert isinstance(event, StorageEvent)
+    assert event.filepath == "recordings%2F46d1a121-2426-484d-8fb3-09b5d886f7a8.ogg"
+    assert event.filetype == "audio/ogg"
+    assert event.bucket_name == "test-bucket"
+    assert event.metadata is None
+
+
+def test_s3_parse_empty_data(s3_parser):
+    """Test parsing empty S3 event data raises error."""
+    with pytest.raises(ParsingEventDataError, match="Received empty data."):
+        s3_parser.parse({})
+
+
+def test_s3_parse_missing_keys(s3_parser):
+    """Test parsing S3 event with missing key."""
+    invalid_s3_event = {
+        "Records": [
+            {
+                "s3": {
+                    "bucket": {"name": "test-bucket"},
+                    # Missing 'object' key
+                }
+            }
+        ]
+    }
+
+    with pytest.raises(ParsingEventDataError, match="Malformed S3 event:"):
+        s3_parser.parse(invalid_s3_event)
+
+
+def test_s3_parse_none_key(s3_parser):
+    """Test parsing S3 event with None field."""
+    invalid_s3_event = {
+        "Records": [
+            {
+                "s3": {
+                    "bucket": {"name": "test-bucket"},
+                    "object": {
+                        "key": None,
+                    },
+                }
+            }
+        ]
+    }
+
+    with pytest.raises(ParsingEventDataError, match="Missing object key name"):
+        s3_parser.parse(invalid_s3_event)
+
+
+def test_s3_parse_with_video_type(s3_parser):
+    """Test parsing S3 event with mp4 file extension."""
+    video_event = {
+        "Records": [
+            {
+                "s3": {
+                    "bucket": {"name": "test-bucket"},
+                    "object": {
+                        "key": "recordings%2F46d1a121-2426-484d-8fb3-09b5d886f7a8.mp4",
+                    },
+                }
+            }
+        ]
+    }
+    event = s3_parser.parse(video_event)
+    assert event.filetype == "video/mp4"
+    assert event.filepath.endswith(".mp4")
+
+
+def test_s3_parse_unrecognized_extension(s3_parser):
+    """Test parsing S3 event with unrecognized file extension."""
+    event_with_unknown_ext = {
+        "Records": [
+            {
+                "s3": {
+                    "bucket": {"name": "test-bucket"},
+                    "object": {
+                        "key": "recordings%2F46d1a121-2426-484d-8fb3-09b5d886f7a8.zzunknown999",
+                    },
+                }
+            }
+        ]
+    }
+
+    with pytest.raises(TypeError, match="filetype cannot be None"):
+        s3_parser.parse(event_with_unknown_ext)
+
+
+def test_s3_get_recording_id_success(s3_parser, valid_s3_event):
+    """Test successful extraction of recording ID from S3 event."""
+    recording_id = s3_parser.get_recording_id(valid_s3_event)
+    assert recording_id == "46d1a121-2426-484d-8fb3-09b5d886f7a8"
+
+
+# get_parser
+
+
 @pytest.fixture
 def clear_lru_cache():
     """Fixture to clear the LRU cache between tests."""

src/backend/core/tests/rooms/test_api_rooms_participants_management.py

@@ -2,20 +2,23 @@
 Test rooms API endpoints in the Meet core app: participants management.
 """
 
-# pylint: disable=redefined-outer-name,unused-argument,protected-access
+# pylint: disable=redefined-outer-name,unused-argument,protected-access,no-name-in-module,too-many-lines
 
 import random
 from unittest import mock
 from uuid import uuid4
 
+from django.contrib.auth.models import AnonymousUser
 from django.core.exceptions import SuspiciousOperation
 from django.urls import reverse
 
 import pytest
-from livekit.api import TwirpError
+from livekit.api import TwirpError, UpdateParticipantRequest
+from livekit.protocol.models import ParticipantInfo
 from rest_framework import status
 from rest_framework.test import APIClient
 
+from core import utils
 from core.factories import RoomFactory, UserFactory, UserResourceAccessFactory
 from core.services.lobby import LobbyService
 
@@ -31,8 +34,8 @@ def mock_livekit_client():
         yield mock_client
 
 
-def test_mute_participant_success(mock_livekit_client):
-    """Test successful participant muting."""
+def test_mute_participant_success_as_admin(mock_livekit_client):
+    """Admins and owners should be able to mute without a LiveKit token."""
     client = APIClient()
     room = RoomFactory()
     user = UserFactory()
@@ -41,10 +44,12 @@ def test_mute_participant_success(mock_livekit_client):
     )
     client.force_authenticate(user=user)
 
-    payload = {"participant_identity": str(uuid4()), "track_sid": "test-track-sid"}
-
     url = reverse("rooms-mute-participant", kwargs={"pk": room.id})
-    response = client.post(url, payload, format="json")
+    response = client.post(
+        url,
+        {"participant_identity": str(uuid4()), "track_sid": "test-track-sid"},
+        format="json",
+    )
 
     assert response.status_code == status.HTTP_200_OK
     assert response.data == {"status": "success"}
@@ -53,23 +58,131 @@ def test_mute_participant_success(mock_livekit_client):
     mock_livekit_client.aclose.assert_called_once()
 
 
-def test_mute_participant_forbidden_without_access():
-    """Test mute participant returns 403 when user lacks room privileges."""
+def test_mute_participant_anonymous_no_token_forbidden(mock_livekit_client):
+    """Should forbid muting when user is anonymous and no LiveKit token."""
     client = APIClient()
     room = RoomFactory()
-    user = UserFactory()  # User without UserResourceAccess
-    client.force_authenticate(user=user)
-
-    payload = {"participant_identity": str(uuid4()), "track_sid": "test-track-sid"}
 
     url = reverse("rooms-mute-participant", kwargs={"pk": room.id})
-    response = client.post(url, payload, format="json")
+    response = client.post(
+        url,
+        {"participant_identity": str(uuid4()), "track_sid": "test-track-sid"},
+        format="json",
+    )
 
     assert response.status_code == status.HTTP_403_FORBIDDEN
+    mock_livekit_client.room.mute_published_track.assert_not_called()
+
+
+def test_mute_participant_with_livekit_token_for_this_room(mock_livekit_client):
+    """Should allow muting when the LiveKit token is scoped to this room."""
+    client = APIClient()
+    room = RoomFactory()
+
+    user = AnonymousUser()
+    token = utils.generate_token(str(room.id), user, is_admin_or_owner=False)
+
+    url = reverse("rooms-mute-participant", kwargs={"pk": room.id})
+    response = client.post(
+        url,
+        {"participant_identity": str(uuid4()), "track_sid": "test-track-sid"},
+        format="json",
+        HTTP_AUTHORIZATION=f"Bearer {token}",
+    )
+
+    assert response.status_code == status.HTTP_200_OK
+    assert response.data == {"status": "success"}
+
+    mock_livekit_client.room.mute_published_track.assert_called_once()
+
+
+def test_mute_participant_with_livekit_token_for_another_room_forbidden(
+    mock_livekit_client,
+):
+    """Should forbid muting when the LiveKit token is scoped to a different room."""
+
+    client = APIClient()
+    target_room = RoomFactory()
+    other_room = RoomFactory()
+
+    user = AnonymousUser()
+    token = utils.generate_token(str(other_room.id), user, is_admin_or_owner=False)
+
+    url = reverse("rooms-mute-participant", kwargs={"pk": target_room.id})
+    response = client.post(
+        url,
+        {"participant_identity": str(uuid4()), "track_sid": "test-track-sid"},
+        format="json",
+        HTTP_AUTHORIZATION=f"Bearer {token}",
+    )
+
+    assert response.status_code == status.HTTP_403_FORBIDDEN
+    mock_livekit_client.room.mute_published_track.assert_not_called()
+
+
+def test_mute_participant_authenticated_no_role_no_token_forbidden(mock_livekit_client):
+    """Should forbid muting when user has no room role and no LiveKit token."""
+    client = APIClient()
+    room = RoomFactory()  # everyone_can_mute defaults to True
+    user = UserFactory()  # no UserResourceAccess for this room
+    client.force_authenticate(user=user)
+
+    url = reverse("rooms-mute-participant", kwargs={"pk": room.id})
+    response = client.post(
+        url,
+        {"participant_identity": str(uuid4()), "track_sid": "test-track-sid"},
+        format="json",
+    )
+
+    assert response.status_code == status.HTTP_403_FORBIDDEN
+    mock_livekit_client.room.mute_published_track.assert_not_called()
+
+
+def test_mute_participant_everyone_can_mute_disabled_blocks_non_admin(
+    mock_livekit_client,
+):
+    """Should forbid muting when everyone_can_mute is False, even with a LiveKit token."""
+    client = APIClient()
+    room = RoomFactory(configuration={"everyone_can_mute": False})
+
+    user = AnonymousUser()
+    token = utils.generate_token(str(room.id), user, is_admin_or_owner=False)
+
+    url = reverse("rooms-mute-participant", kwargs={"pk": room.id})
+    response = client.post(
+        url,
+        {"participant_identity": str(uuid4()), "track_sid": "test-track-sid"},
+        format="json",
+        HTTP_AUTHORIZATION=f"Bearer {token}",
+    )
+
+    assert response.status_code == status.HTTP_403_FORBIDDEN
+    mock_livekit_client.room.mute_published_track.assert_not_called()
+
+
+def test_mute_participant_everyone_can_mute_disabled_allows_admin(mock_livekit_client):
+    """Should allow admins and owners to mute when everyone_can_mute is False."""
+    client = APIClient()
+    room = RoomFactory(configuration={"everyone_can_mute": False})
+    user = UserFactory()
+    UserResourceAccessFactory(
+        resource=room, user=user, role=random.choice(["administrator", "owner"])
+    )
+    client.force_authenticate(user=user)
+
+    url = reverse("rooms-mute-participant", kwargs={"pk": room.id})
+    response = client.post(
+        url,
+        {"participant_identity": str(uuid4()), "track_sid": "test-track-sid"},
+        format="json",
+    )
+
+    assert response.status_code == status.HTTP_200_OK
+    mock_livekit_client.room.mute_published_track.assert_called_once()
 
 
 def test_mute_participant_invalid_payload():
-    """Test mute participant with invalid payload."""
+    """Should reject muting when the payload is invalid."""
     client = APIClient()
     room = RoomFactory()
     user = UserFactory()
@@ -78,16 +191,16 @@ def test_mute_participant_invalid_payload():
     )
     client.force_authenticate(user=user)
 
-    payload = {"participant_identity": "invalid-uuid", "track_sid": ""}
-
     url = reverse("rooms-mute-participant", kwargs={"pk": room.id})
-    response = client.post(url, payload, format="json")
+    response = client.post(
+        url, {"participant_identity": "invalid-uuid", "track_sid": ""}, format="json"
+    )
 
     assert response.status_code == status.HTTP_400_BAD_REQUEST
 
 
 def test_mute_participant_unexpected_twirp_error(mock_livekit_client):
-    """Test mute participant when LiveKit API raises TwirpError."""
+    """Should return 500 when the LiveKit API raises a TwirpError."""
     client = APIClient()
 
     mock_livekit_client.room.mute_published_track.side_effect = TwirpError(
@@ -101,10 +214,12 @@ def test_mute_participant_unexpected_twirp_error(mock_livekit_client):
     )
     client.force_authenticate(user=user)
 
-    payload = {"participant_identity": str(uuid4()), "track_sid": "test-track-sid"}
-
     url = reverse("rooms-mute-participant", kwargs={"pk": room.id})
-    response = client.post(url, payload, format="json")
+    response = client.post(
+        url,
+        {"participant_identity": str(uuid4()), "track_sid": "test-track-sid"},
+        format="json",
+    )
 
     assert response.status_code == status.HTTP_500_INTERNAL_SERVER_ERROR
     assert response.data == {"error": "Failed to mute participant"}
@@ -112,6 +227,282 @@ def test_mute_participant_unexpected_twirp_error(mock_livekit_client):
     mock_livekit_client.aclose.assert_called_once()
 
 
+def test_mute_participant_participant_not_found(mock_livekit_client):
+    """Should return 404 when the participant does not exist in the room."""
+    client = APIClient()
+
+    mock_livekit_client.room.mute_published_track.side_effect = TwirpError(
+        msg="participant does not exist", code="not_found", status=404
+    )
+
+    room = RoomFactory()
+    user = UserFactory()
+    UserResourceAccessFactory(
+        resource=room, user=user, role=random.choice(["administrator", "owner"])
+    )
+    client.force_authenticate(user=user)
+
+    url = reverse("rooms-mute-participant", kwargs={"pk": room.id})
+    response = client.post(
+        url,
+        {"participant_identity": str(uuid4()), "track_sid": "test-track-sid"},
+        format="json",
+    )
+
+    assert response.status_code == status.HTTP_404_NOT_FOUND
+    assert response.data == {"error": "Participant not found"}
+
+    mock_livekit_client.aclose.assert_called_once()
+
+
+def test_mute_participant_management_exception(mock_livekit_client):
+    """Should return 500 when ParticipantsManagement raises an unexpected error."""
+    client = APIClient()
+
+    mock_livekit_client.room.mute_published_track.side_effect = TwirpError(
+        msg="boom", code="internal", status=503
+    )
+
+    room = RoomFactory()
+    user = UserFactory()
+    UserResourceAccessFactory(
+        resource=room, user=user, role=random.choice(["administrator", "owner"])
+    )
+    client.force_authenticate(user=user)
+
+    url = reverse("rooms-mute-participant", kwargs={"pk": room.id})
+    response = client.post(
+        url,
+        {"participant_identity": str(uuid4()), "track_sid": "test-track-sid"},
+        format="json",
+    )
+
+    assert response.status_code == status.HTTP_500_INTERNAL_SERVER_ERROR
+    assert response.data == {"error": "Failed to mute participant"}
+
+    mock_livekit_client.aclose.assert_called_once()
+
+
+def test_mute_participant_admin_with_token_for_this_room(mock_livekit_client):
+    """Should allow muting when user is admin and LiveKit token is scoped to this room."""
+    client = APIClient()
+    room = RoomFactory()
+    user = UserFactory()
+    UserResourceAccessFactory(
+        resource=room, user=user, role=random.choice(["administrator", "owner"])
+    )
+    # Token identity matches the admin user so LiveKitTokenAuthentication
+    # resolves request.user back to the admin.
+    token = utils.generate_token(str(room.id), user, is_admin_or_owner=True)
+
+    url = reverse("rooms-mute-participant", kwargs={"pk": room.id})
+    response = client.post(
+        url,
+        {"participant_identity": str(uuid4()), "track_sid": "test-track-sid"},
+        format="json",
+        HTTP_AUTHORIZATION=f"Bearer {token}",
+    )
+
+    assert response.status_code == status.HTTP_200_OK
+    assert response.data == {"status": "success"}
+
+    mock_livekit_client.room.mute_published_track.assert_called_once()
+
+
+def test_mute_participant_admin_with_token_for_another_room(mock_livekit_client):
+    """Should not allow muting when user is admin and the LiveKit token is for another room."""
+    client = APIClient()
+    target_room = RoomFactory()
+    other_room = RoomFactory()
+    user = UserFactory()
+    UserResourceAccessFactory(
+        resource=target_room,
+        user=user,
+        role=random.choice(["administrator", "owner"]),
+    )
+    # Token is scoped to a DIFFERENT room, and admin status must only be
+    # honored when established via session, never via a LiveKit
+    # token, which can be replayed off-host.
+    token = utils.generate_token(str(other_room.id), user, is_admin_or_owner=True)
+
+    url = reverse("rooms-mute-participant", kwargs={"pk": target_room.id})
+    response = client.post(
+        url,
+        {"participant_identity": str(uuid4()), "track_sid": "test-track-sid"},
+        format="json",
+        HTTP_AUTHORIZATION=f"Bearer {token}",
+    )
+
+    assert response.status_code == status.HTTP_403_FORBIDDEN
+    assert response.data == {
+        "detail": "You do not have permission to perform this action."
+    }
+
+    mock_livekit_client.room.mute_published_track.assert_not_called()
+
+
+def test_mute_participant_admin_token_replayed_does_not_grant_admin(
+    mock_livekit_client,
+):
+    """Should forbid muting when a LiveKit token issued for an admin is passed without a session."""
+    client = APIClient()
+    room = RoomFactory(configuration={"everyone_can_mute": False})
+    admin_user = UserFactory()
+    UserResourceAccessFactory(
+        resource=room,
+        user=admin_user,
+        role=random.choice(["administrator", "owner"]),
+    )
+    # The token is the only credential.
+    token = utils.generate_token(str(room.id), admin_user, is_admin_or_owner=True)
+
+    url = reverse("rooms-mute-participant", kwargs={"pk": room.id})
+    response = client.post(
+        url,
+        {"participant_identity": str(uuid4()), "track_sid": "test-track-sid"},
+        format="json",
+        HTTP_AUTHORIZATION=f"Bearer {token}",
+    )
+
+    assert response.status_code == status.HTTP_403_FORBIDDEN
+    mock_livekit_client.room.mute_published_track.assert_not_called()
+
+
+def test_mute_participant_livekit_token_triggers_presence_check(mock_livekit_client):
+    """Should check participant presence when authenticated via LiveKit token only."""
+    client = APIClient()
+    room = RoomFactory()
+
+    user = AnonymousUser()
+    token = utils.generate_token(str(room.id), user, is_admin_or_owner=False)
+
+    url = reverse("rooms-mute-participant", kwargs={"pk": room.id})
+    response = client.post(
+        url,
+        {"participant_identity": str(uuid4()), "track_sid": "test-track-sid"},
+        format="json",
+        HTTP_AUTHORIZATION=f"Bearer {token}",
+    )
+
+    assert response.status_code == status.HTTP_200_OK
+    # Presence is verified against LiveKit before the mute is issued.
+    mock_livekit_client.room.get_participant.assert_called_once()
+    mock_livekit_client.room.mute_published_track.assert_called_once()
+
+
+def test_mute_participant_livekit_token_presence_check_returns_participant(
+    mock_livekit_client,
+):
+    """Should mute when the authentified participant is currently in the room."""
+    client = APIClient()
+    room = RoomFactory()
+
+    # Simulate LiveKit confirming the caller is currently in the room.
+    # State != DISCONNECTED (3) means present.
+    mock_livekit_client.room.get_participant.return_value = ParticipantInfo(
+        identity="caller-identity",
+        state=ParticipantInfo.State.ACTIVE,
+    )
+
+    user = AnonymousUser()
+    token = utils.generate_token(str(room.id), user, is_admin_or_owner=False)
+
+    url = reverse("rooms-mute-participant", kwargs={"pk": room.id})
+    response = client.post(
+        url,
+        {"participant_identity": str(uuid4()), "track_sid": "test-track-sid"},
+        format="json",
+        HTTP_AUTHORIZATION=f"Bearer {token}",
+    )
+
+    assert response.status_code == status.HTTP_200_OK
+    assert response.data == {"status": "success"}
+    mock_livekit_client.room.get_participant.assert_called_once()
+    mock_livekit_client.room.mute_published_track.assert_called_once()
+
+
+def test_mute_participant_livekit_token_presence_check_participant_not_found(
+    mock_livekit_client,
+):
+    """Should not mute when the authentified participant is not found."""
+    client = APIClient()
+    room = RoomFactory()
+
+    mock_livekit_client.room.get_participant.side_effect = TwirpError(
+        msg="participant does not exist", code="not_found", status=404
+    )
+
+    user = AnonymousUser()
+    token = utils.generate_token(str(room.id), user, is_admin_or_owner=False)
+
+    url = reverse("rooms-mute-participant", kwargs={"pk": room.id})
+    response = client.post(
+        url,
+        {"participant_identity": str(uuid4()), "track_sid": "test-track-sid"},
+        format="json",
+        HTTP_AUTHORIZATION=f"Bearer {token}",
+    )
+
+    assert response.status_code == status.HTTP_403_FORBIDDEN
+    assert response.data == {"error": "Could not verify caller presence"}
+    mock_livekit_client.room.get_participant.assert_called_once()
+    # The presence check failed, so we never reach the mute call.
+    mock_livekit_client.room.mute_published_track.assert_not_called()
+
+
+def test_mute_participant_livekit_token_presence_check_twirp_error_forbidden(
+    mock_livekit_client,
+):
+    """Should not mute when the presence check fail."""
+    client = APIClient()
+    room = RoomFactory()
+
+    mock_livekit_client.room.get_participant.side_effect = TwirpError(
+        msg="an error occured", code="not_found", status=500
+    )
+
+    user = AnonymousUser()
+    token = utils.generate_token(str(room.id), user, is_admin_or_owner=False)
+
+    url = reverse("rooms-mute-participant", kwargs={"pk": room.id})
+    response = client.post(
+        url,
+        {"participant_identity": str(uuid4()), "track_sid": "test-track-sid"},
+        format="json",
+        HTTP_AUTHORIZATION=f"Bearer {token}",
+    )
+
+    assert response.status_code == status.HTTP_403_FORBIDDEN
+    assert response.data == {"error": "Could not verify caller presence"}
+    mock_livekit_client.room.get_participant.assert_called_once()
+    # The presence check failed, so we never reach the mute call.
+    mock_livekit_client.room.mute_published_track.assert_not_called()
+
+
+def test_mute_participant_session_auth_skips_presence_check(mock_livekit_client):
+    """Should not check presence of the participant when authentified with a session cookie."""
+    client = APIClient()
+    room = RoomFactory()
+    user = UserFactory()
+    UserResourceAccessFactory(
+        resource=room, user=user, role=random.choice(["administrator", "owner"])
+    )
+    client.force_authenticate(user=user)
+
+    url = reverse("rooms-mute-participant", kwargs={"pk": room.id})
+    response = client.post(
+        url,
+        {"participant_identity": str(uuid4()), "track_sid": "test-track-sid"},
+        format="json",
+    )
+
+    assert response.status_code == status.HTTP_200_OK
+    # Session auth has no LiveKit identity to verify against, so the
+    # stop-gap presence check is skipped.
+    mock_livekit_client.room.get_participant.assert_not_called()
+    mock_livekit_client.room.mute_published_track.assert_called_once()
+
+
 def test_update_participant_success(mock_livekit_client):
     """Test successful participant update."""
     client = APIClient()
@@ -130,8 +521,8 @@ def test_update_participant_success(mock_livekit_client):
             "can_publish": True,
             "can_publish_data": True,
             "can_publish_sources": [
-                "CAMERA",
-                "MICROPHONE",
+                "camera",
+                "microphone",
             ],
             "can_update_metadata": True,
             "can_subscribe_metrics": True,
@@ -158,8 +549,8 @@ def test_update_participant_success(mock_livekit_client):
         {"can_publish_data": True},
         {
             "can_publish_sources": [
-                "CAMERA",
-                "MICROPHONE",
+                "camera",
+                "microphone",
             ]
         },
         {"can_update_metadata": True},
@@ -190,9 +581,41 @@ def test_update_participant_permission_fields_are_optional(
     assert response.data == {"status": "success"}
 
     mock_livekit_client.room.update_participant.assert_called_once()
+
+    (request_arg,), _ = mock_livekit_client.room.update_participant.call_args
+    assert isinstance(request_arg, UpdateParticipantRequest)
+
     mock_livekit_client.aclose.assert_called_once()
 
 
+def test_update_participant_permission_fields_invalid_case(mock_livekit_client):
+    """Should raise bad request when can_publish_sources is uppercase."""
+    client = APIClient()
+    room = RoomFactory()
+    user = UserFactory()
+    UserResourceAccessFactory(
+        resource=room, user=user, role=random.choice(["administrator", "owner"])
+    )
+    client.force_authenticate(user=user)
+
+    payload = {
+        "participant_identity": str(uuid4()),
+        "permission": {
+            "can_publish_sources": [
+                "CAMERA",
+                "microphone",
+            ]
+        },
+    }
+
+    url = reverse("rooms-update-participant", kwargs={"pk": room.id})
+    response = client.post(url, payload, format="json")
+
+    assert response.status_code == status.HTTP_400_BAD_REQUEST
+    mock_livekit_client.room.update_participant.assert_not_called()
+    mock_livekit_client.aclose.assert_not_called()
+
+
 @pytest.mark.parametrize(
     "value,permission_key",
     [

src/backend/core/tests/rooms/test_api_rooms_retrieve.py

@@ -28,6 +28,7 @@ def test_api_rooms_retrieve_anonymous_private_pk():
 
     assert response.status_code == 200
     assert response.json() == {
+        "configuration": {},
         "access_level": "restricted",
         "id": str(room.id),
         "is_administrable": False,
@@ -47,6 +48,7 @@ def test_api_rooms_retrieve_anonymous_trusted_pk():
 
     assert response.status_code == 200
     assert response.json() == {
+        "configuration": {},
         "access_level": "trusted",
         "id": str(room.id),
         "is_administrable": False,
@@ -65,6 +67,7 @@ def test_api_rooms_retrieve_anonymous_private_pk_no_dashes():
 
     assert response.status_code == 200
     assert response.json() == {
+        "configuration": {},
         "access_level": "restricted",
         "id": str(room.id),
         "is_administrable": False,
@@ -81,6 +84,7 @@ def test_api_rooms_retrieve_anonymous_private_slug():
 
     assert response.status_code == 200
     assert response.json() == {
+        "configuration": {},
         "access_level": "restricted",
         "id": str(room.id),
         "is_administrable": False,
@@ -97,6 +101,7 @@ def test_api_rooms_retrieve_anonymous_private_slug_not_normalized():
 
     assert response.status_code == 200
     assert response.json() == {
+        "configuration": {},
         "access_level": "restricted",
         "id": str(room.id),
         "is_administrable": False,
@@ -200,6 +205,7 @@ def test_api_rooms_retrieve_anonymous_public(mock_token):
     assert response.status_code == 200
     expected_name = f"{room.id!s}"
     assert response.json() == {
+        "configuration": {},
         "access_level": str(room.access_level),
         "id": str(room.id),
         "is_administrable": False,
@@ -246,6 +252,7 @@ def test_api_rooms_retrieve_authenticated_public(mock_token):
 
     expected_name = f"{room.id!s}"
     assert response.json() == {
+        "configuration": {"can_publish_sources": ["camera"]},
         "access_level": str(room.access_level),
         "id": str(room.id),
         "is_administrable": False,
@@ -297,6 +304,7 @@ def test_api_rooms_retrieve_authenticated_trusted(mock_token):
 
     expected_name = f"{room.id!s}"
     assert response.json() == {
+        "configuration": {},
         "access_level": str(room.access_level),
         "id": str(room.id),
         "is_administrable": False,
@@ -338,6 +346,7 @@ def test_api_rooms_retrieve_authenticated():
     assert response.status_code == 200
 
     assert response.json() == {
+        "configuration": {},
         "access_level": "restricted",
         "id": str(room.id),
         "is_administrable": False,
@@ -383,6 +392,7 @@ def test_api_rooms_retrieve_members(mock_token, django_assert_num_queries, setti
 
     expected_name = str(room.id)
     assert content_dict == {
+        "configuration": {"can_publish_sources": ["camera"]},
         "access_level": str(room.access_level),
         "id": str(room.id),
         "is_administrable": False,

src/backend/core/tests/rooms/test_api_rooms_update.py

@@ -3,12 +3,18 @@ Test rooms API endpoints in the Meet core app: update.
 """
 
 import random
+from unittest.mock import patch
 
 import pytest
 from rest_framework.test import APIClient
 
 from ...factories import RoomFactory, UserFactory
 from ...models import RoomAccessLevel
+from ...services.room_management import (
+    RoomManagement,
+    RoomManagementException,
+    RoomNotFoundException,
+)
 
 pytestmark = pytest.mark.django_db
 
@@ -79,12 +85,14 @@ def test_api_rooms_update_members():
     assert room.configuration == {}
 
 
-def test_api_rooms_update_administrators():
-    """Administrators or owners of a room should be allowed to update it."""
+@patch.object(RoomManagement, "update_metadata")
+def test_api_rooms_update_administrators(mock_update_metadata):
+    """Should sync LiveKit metadata when both configuration and access level change."""
     user = UserFactory()
     room = RoomFactory(
         access_level=RoomAccessLevel.RESTRICTED,
         users=[(user, random.choice(["administrator", "owner"]))],
+        configuration={"can_publish_sources": ["camera"]},
     )
     client = APIClient()
     client.force_login(user)
@@ -106,11 +114,120 @@ def test_api_rooms_update_administrators():
     assert room.access_level == RoomAccessLevel.PUBLIC
     assert room.configuration == {"can_publish_sources": ["camera", "microphone"]}
 
+    mock_update_metadata.assert_called_once_with(
+        room_name=str(room.id),
+        metadata={
+            "access_level": "public",
+            "configuration": {"can_publish_sources": ["camera", "microphone"]},
+        },
+    )
+
+
+@patch.object(RoomManagement, "update_metadata")
+def test_api_rooms_update_administrators_configuration_only(mock_update_metadata):
+    """Should sync LiveKit metadata when only configuration changes."""
+    user = UserFactory()
+    room = RoomFactory(
+        access_level=RoomAccessLevel.RESTRICTED,
+        users=[(user, random.choice(["administrator", "owner"]))],
+        configuration={},
+    )
+    client = APIClient()
+    client.force_login(user)
+
+    response = client.put(
+        f"/api/v1.0/rooms/{room.id!s}/",
+        {
+            "name": "New name",
+            "slug": "should-be-ignored",
+            "configuration": {"can_publish_sources": ["camera", "microphone"]},
+        },
+        format="json",
+    )
+    assert response.status_code == 200
+    room.refresh_from_db()
+    assert room.name == "New name"
+    assert room.slug == "new-name"
+    assert room.access_level == RoomAccessLevel.RESTRICTED
+    assert room.configuration == {"can_publish_sources": ["camera", "microphone"]}
+
+    mock_update_metadata.assert_called_once_with(
+        room_name=str(room.id),
+        metadata={
+            "access_level": "restricted",
+            "configuration": {"can_publish_sources": ["camera", "microphone"]},
+        },
+    )
+
+
+@patch.object(RoomManagement, "update_metadata")
+def test_api_rooms_update_administrators_access_level_only(mock_update_metadata):
+    """Should sync LiveKit metadata when only access level changes."""
+    user = UserFactory()
+    room = RoomFactory(
+        access_level=RoomAccessLevel.RESTRICTED,
+        users=[(user, random.choice(["administrator", "owner"]))],
+        configuration={"can_publish_sources": ["camera"]},
+    )
+    client = APIClient()
+    client.force_login(user)
+
+    response = client.put(
+        f"/api/v1.0/rooms/{room.id!s}/",
+        {
+            "name": "New name",
+            "access_level": RoomAccessLevel.PUBLIC,
+        },
+        format="json",
+    )
+    assert response.status_code == 200
+    room.refresh_from_db()
+    assert room.name == "New name"
+    assert room.slug == "new-name"
+    assert room.access_level == RoomAccessLevel.PUBLIC
+    assert room.configuration == {"can_publish_sources": ["camera"]}
+
+    mock_update_metadata.assert_called_once_with(
+        room_name=str(room.id),
+        metadata={
+            "access_level": "public",
+            "configuration": {"can_publish_sources": ["camera"]},
+        },
+    )
+
+
+@patch.object(RoomManagement, "update_metadata")
+def test_api_rooms_update_administrators_name_only(mock_update_metadata):
+    """Should not sync LiveKit metadata when neither configuration nor access level changes."""
+    user = UserFactory()
+    room = RoomFactory(
+        name="Old name",
+        access_level=RoomAccessLevel.PUBLIC,
+        configuration={"can_publish_sources": ["camera"]},
+        users=[(user, random.choice(["administrator", "owner"]))],
+    )
+    client = APIClient()
+    client.force_login(user)
+
+    response = client.patch(
+        f"/api/v1.0/rooms/{room.id!s}/",
+        {"name": "New name"},
+        format="json",
+    )
+    assert response.status_code == 200
+    room.refresh_from_db()
+    assert room.name == "New name"
+    assert room.slug == "new-name"
+    # Unrelated fields untouched
+    assert room.access_level == RoomAccessLevel.PUBLIC
+    assert room.configuration == {"can_publish_sources": ["camera"]}
+
+    mock_update_metadata.assert_not_called()
+
 
 @pytest.mark.parametrize(
     "configuration",
     [
-        {},
         {"can_publish_sources": ["camera", "microphone"]},
         {
             "can_publish_sources": [
@@ -122,12 +239,17 @@ def test_api_rooms_update_administrators():
         },
         {"can_publish_sources": []},
         {"can_publish_sources": None},
+        {"can_publish_sources": None, "everyone_can_mute": True},
+        {"can_publish_sources": None, "everyone_can_mute": False},
+        {"can_publish_sources": None, "everyone_can_mute": "yes"},
+        {"can_publish_sources": None, "everyone_can_mute": "1"},
     ],
 )
-def test_api_rooms_update_configuration_valid(configuration):
+@patch.object(RoomManagement, "update_metadata")
+def test_api_rooms_update_configuration_valid(mock_update_metadata, configuration):
     """Administrators should be allowed to set valid configurations."""
     user = UserFactory()
-    room = RoomFactory(users=[(user, "owner")])
+    room = RoomFactory(users=[(user, "owner")], configuration={})
     client = APIClient()
     client.force_login(user)
 
@@ -140,6 +262,28 @@ def test_api_rooms_update_configuration_valid(configuration):
     room.refresh_from_db()
     assert room.configuration == configuration
 
+    mock_update_metadata.assert_called_once()
+
+
+@patch.object(RoomManagement, "update_metadata")
+def test_api_rooms_update_configuration_unchanged_empty(mock_update_metadata):
+    """Should not sync LiveKit metadata when patching an already empty configuration."""
+    user = UserFactory()
+    room = RoomFactory(users=[(user, "owner")], configuration={})
+    client = APIClient()
+    client.force_login(user)
+
+    response = client.patch(
+        f"/api/v1.0/rooms/{room.id!s}/",
+        {"configuration": {}},
+        format="json",
+    )
+    assert response.status_code == 200
+    room.refresh_from_db()
+    assert room.configuration == {}
+
+    mock_update_metadata.assert_not_called()
+
 
 def test_api_rooms_update_configuration_extra_keys_rejected():
     """Extra keys in configuration should be rejected."""
@@ -198,6 +342,24 @@ def test_api_rooms_update_configuration_wrong_type():
     assert room.configuration == {}
 
 
+@pytest.mark.parametrize("invalid_value", ["test", [], {}])
+def test_api_rooms_update_configuration_everyone_can_mute_wrong_type(invalid_value):
+    """everyone_can_mute values with wrong types should be rejected."""
+    user = UserFactory()
+    room = RoomFactory(users=[(user, "owner")])
+    client = APIClient()
+    client.force_login(user)
+
+    response = client.patch(
+        f"/api/v1.0/rooms/{room.id!s}/",
+        {"configuration": {"everyone_can_mute": invalid_value}},
+        format="json",
+    )
+    assert response.status_code == 400
+    room.refresh_from_db()
+    assert room.configuration == {}
+
+
 def test_api_rooms_update_administrators_of_another():
     """
     Being administrator or owner of a room should not grant authorization to update
@@ -217,3 +379,61 @@ def test_api_rooms_update_administrators_of_another():
     other_room.refresh_from_db()
     assert other_room.name == "Old name"
     assert other_room.slug == "old-name"
+
+
+@patch.object(RoomManagement, "update_metadata", side_effect=RoomNotFoundException)
+def test_api_rooms_update_livekit_room_not_found(mock_update_metadata):
+    """Should not fail the API request when the LiveKit room does not exist yet."""
+    user = UserFactory()
+    room = RoomFactory(
+        users=[(user, random.choice(["administrator", "owner"]))],
+        configuration={},
+    )
+    client = APIClient()
+    client.force_login(user)
+
+    response = client.patch(
+        f"/api/v1.0/rooms/{room.id!s}/",
+        {"configuration": {"can_publish_sources": ["camera"]}},
+        format="json",
+    )
+    assert response.status_code == 200
+    room.refresh_from_db()
+    assert room.configuration == {"can_publish_sources": ["camera"]}
+
+    mock_update_metadata.assert_called_once_with(
+        room_name=str(room.id),
+        metadata={
+            "access_level": room.access_level,
+            "configuration": {"can_publish_sources": ["camera"]},
+        },
+    )
+
+
+@patch.object(RoomManagement, "update_metadata", side_effect=RoomManagementException)
+def test_api_rooms_update_livekit_sync_failure(mock_update_metadata):
+    """Should not fail the API request when the LiveKit metadata sync fails."""
+    user = UserFactory()
+    room = RoomFactory(
+        users=[(user, random.choice(["administrator", "owner"]))],
+        configuration={},
+    )
+    client = APIClient()
+    client.force_login(user)
+
+    response = client.patch(
+        f"/api/v1.0/rooms/{room.id!s}/",
+        {"configuration": {"can_publish_sources": ["camera"]}},
+        format="json",
+    )
+    assert response.status_code == 200
+    room.refresh_from_db()
+    assert room.configuration == {"can_publish_sources": ["camera"]}
+
+    mock_update_metadata.assert_called_once_with(
+        room_name=str(room.id),
+        metadata={
+            "access_level": room.access_level,
+            "configuration": {"can_publish_sources": ["camera"]},
+        },
+    )

src/backend/core/tests/swagger/test_openapi_schema.py

@@ -4,6 +4,7 @@ Test suite for generated openapi schema.
 
 import json
 from io import StringIO
+from unittest.mock import patch
 
 from django.core.management import call_command
 from django.test import Client
@@ -33,10 +34,26 @@ def test_openapi_client_schema():
     )
     assert output.getvalue() == ""
 
-    response = Client().get("/v1.0/swagger.json")
+    response = Client().get("/api/v1.0/swagger.json")
 
     assert response.status_code == 200
     with open(
         "core/tests/swagger/swagger.json", "r", encoding="utf-8"
     ) as expected_schema:
         assert response.json() == json.load(expected_schema)
+
+
+@patch(
+    "django.contrib.staticfiles.storage.staticfiles_storage.url",
+    side_effect=lambda name: f"/static/{name}",
+)
+# pylint: disable=unused-argument
+def test_openapi_documentation_routes(mock_staticfiles):
+    """Swagger and ReDoc documentation should be served on canonical URLs."""
+    client = Client()
+
+    swagger_response = client.get("/api/v1.0/swagger/")
+    redoc_response = client.get("/api/v1.0/redoc/")
+
+    assert swagger_response.status_code == 200
+    assert redoc_response.status_code == 200

src/backend/core/tests/test_external_api_rooms.py

@@ -250,6 +250,112 @@ def test_api_rooms_list_filters_by_user():
     assert str(room2.id) not in returned_ids
 
 
+def test_api_rooms_list_access_level_in_results():
+    """Rooms should include the correct access_level for each room."""
+    user = UserFactory()
+    room_trusted = RoomFactory(
+        users=[(user, RoleChoices.OWNER)], access_level=RoomAccessLevel.TRUSTED
+    )
+    room_restricted = RoomFactory(
+        users=[(user, RoleChoices.OWNER)], access_level=RoomAccessLevel.RESTRICTED
+    )
+
+    token = generate_test_token(user, [ApplicationScope.ROOMS_LIST])
+
+    client = APIClient()
+    client.credentials(HTTP_AUTHORIZATION=f"Bearer {token}")
+    response = client.get("/external-api/v1.0/rooms/")
+
+    assert response.status_code == 200
+    results = {r["id"]: r for r in response.data["results"]}
+    assert results[str(room_trusted.id)]["access_level"] == RoomAccessLevel.TRUSTED
+    assert (
+        results[str(room_restricted.id)]["access_level"] == RoomAccessLevel.RESTRICTED
+    )
+
+
+def test_api_rooms_list_does_not_expose_sensitive_fields():
+    """Rooms should not expose pin_code or accesses."""
+    user = UserFactory()
+    RoomFactory(users=[(user, RoleChoices.OWNER)])
+
+    token = generate_test_token(user, [ApplicationScope.ROOMS_LIST])
+
+    client = APIClient()
+    client.credentials(HTTP_AUTHORIZATION=f"Bearer {token}")
+    response = client.get("/external-api/v1.0/rooms/")
+
+    assert response.status_code == 200
+    result = response.data["results"][0]
+    assert "pin_code" not in result
+    assert "accesses" not in result
+    assert "livekit" not in result
+
+
+def test_api_rooms_list_expected_fields(settings):
+    """Rooms should expose exactly the expected fields."""
+
+    settings.APPLICATION_BASE_URL = "https://example.com"
+    settings.ROOM_TELEPHONY_ENABLED = True
+
+    user = UserFactory()
+    RoomFactory(users=[(user, RoleChoices.OWNER)])
+
+    token = generate_test_token(user, [ApplicationScope.ROOMS_LIST])
+
+    client = APIClient()
+    client.credentials(HTTP_AUTHORIZATION=f"Bearer {token}")
+    response = client.get("/external-api/v1.0/rooms/")
+
+    assert response.status_code == 200
+    assert set(response.data["results"][0].keys()) == {
+        "id",
+        "name",
+        "slug",
+        "access_level",
+        "configuration",
+        "telephony",
+        "url",
+    }
+
+
+def test_api_rooms_list_expected_fields_without_telephony(settings):
+    """Rooms shouldn't expose telephony related fields when disabled."""
+
+    settings.APPLICATION_BASE_URL = "https://example.com"
+    settings.ROOM_TELEPHONY_ENABLED = False
+
+    user = UserFactory()
+    RoomFactory(users=[(user, RoleChoices.OWNER)])
+
+    token = generate_test_token(user, [ApplicationScope.ROOMS_LIST])
+
+    client = APIClient()
+    client.credentials(HTTP_AUTHORIZATION=f"Bearer {token}")
+    response = client.get("/external-api/v1.0/rooms/")
+
+    assert response.status_code == 200
+    assert "telephony" not in set(response.data["results"][0].keys())
+
+
+def test_api_rooms_list_expected_fields_missing_base_url(settings):
+    """Rooms shouldn't expose URL field when the application base url is missing."""
+
+    settings.APPLICATION_BASE_URL = None
+
+    user = UserFactory()
+    RoomFactory(users=[(user, RoleChoices.OWNER)])
+
+    token = generate_test_token(user, [ApplicationScope.ROOMS_LIST])
+
+    client = APIClient()
+    client.credentials(HTTP_AUTHORIZATION=f"Bearer {token}")
+    response = client.get("/external-api/v1.0/rooms/")
+
+    assert response.status_code == 200
+    assert "url" not in set(response.data["results"][0].keys())
+
+
 def test_api_rooms_retrieve_requires_authentication():
     """Retrieving rooms without authentication should return 401."""
 
@@ -383,6 +489,7 @@ def test_api_rooms_retrieve_success(settings):
         "name": room.name,
         "slug": room.slug,
         "access_level": str(room.access_level),
+        "configuration": room.configuration,
         "url": f"http://your-application.com/{room.slug}",
         "telephony": {
             "enabled": True,
@@ -565,11 +672,40 @@ def test_api_rooms_create_success():
     assert "slug" in response.data
     assert "name" in response.data
     assert response.data["name"] == response.data["slug"]
+    assert response.data["configuration"] == {}
 
     # Verify room was created with user as owner
     room = Room.objects.get(id=response.data["id"])
     assert room.get_role(user) == RoleChoices.OWNER
     assert room.access_level == "trusted"
+    assert room.configuration == {}
+
+
+def test_api_rooms_create_with_configuration_success():
+    """Creating a room with a validated configuration should succeed."""
+
+    user = UserFactory()
+
+    token = generate_test_token(
+        user, [ApplicationScope.ROOMS_CREATE, ApplicationScope.ROOMS_LIST]
+    )
+
+    client = APIClient()
+    client.credentials(HTTP_AUTHORIZATION=f"Bearer {token}")
+    response = client.post(
+        "/external-api/v1.0/rooms/",
+        {
+            "access_level": RoomAccessLevel.RESTRICTED,
+            "configuration": {"can_publish_sources": ["camera"]},
+        },
+        format="json",
+    )
+
+    assert response.status_code == 201
+    room = Room.objects.get(id=response.data["id"])
+    assert room.access_level == RoomAccessLevel.RESTRICTED
+    assert room.configuration == {"can_publish_sources": ["camera"]}
+    assert response.data["configuration"] == {"can_publish_sources": ["camera"]}
 
 
 def test_api_rooms_create_readonly_enforcement():
@@ -587,7 +723,6 @@ def test_api_rooms_create_readonly_enforcement():
             "id": "fake-id",
             "slug": "fake-slug",
             "name": "fake-name",
-            "access_level": "public",
         },
         format="json",
     )
@@ -599,41 +734,150 @@ def test_api_rooms_create_readonly_enforcement():
     assert response.data["slug"] != "fake-slug"
     assert "id" in response.data
     assert response.data["name"] != "fake-name"
+    assert response.data["configuration"] == {}
 
     # Verify room was created with user as owner
     room = Room.objects.get(id=response.data["id"])
     assert room.get_role(user) == RoleChoices.OWNER
     assert room.access_level == "trusted"
+    assert room.configuration == {}
 
 
-def test_api_rooms_unknown_actions():
-    """Updating or deleting a room are not supported yet."""
+def test_api_rooms_create_rejects_invalid_configuration():
+    """Creating a room with unsupported configuration keys should fail."""
 
     user = UserFactory()
-    room = RoomFactory(users=[(user, RoleChoices.OWNER)])
+    token = generate_test_token(user, [ApplicationScope.ROOMS_CREATE])
 
-    token = generate_test_token(
-        user,
-        [
-            ApplicationScope.ROOMS_RETRIEVE,
-            ApplicationScope.ROOMS_DELETE,
-            ApplicationScope.ROOMS_UPDATE,
-        ],
+    client = APIClient()
+    client.credentials(HTTP_AUTHORIZATION=f"Bearer {token}")
+    response = client.post(
+        "/external-api/v1.0/rooms/",
+        {
+            "configuration": {
+                "unsupported_flag": True,
+            }
+        },
+        format="json",
     )
 
-    client = APIClient()
-    client.credentials(HTTP_AUTHORIZATION=f"Bearer {token}")
-    response = client.delete(f"/external-api/v1.0/rooms/{room.id}/")
+    assert response.status_code == 400
+    assert "extra inputs are not permitted" in str(response.data).lower()
 
-    assert response.status_code == 405
-    assert 'method "delete" not allowed.' in str(response.data).lower()
+
+@pytest.mark.parametrize(
+    "invalid_configuration",
+    [
+        {"can_publish_sources": ["invalid-source"]},
+        {"everyone_can_mute": "invalid-value"},
+    ],
+)
+def test_api_rooms_create_rejects_invalid_configuration_values(invalid_configuration):
+    """Creating a room with invalid configuration values should fail."""
+
+    user = UserFactory()
+    token = generate_test_token(user, [ApplicationScope.ROOMS_CREATE])
 
     client = APIClient()
     client.credentials(HTTP_AUTHORIZATION=f"Bearer {token}")
-    response = client.patch(f"/external-api/v1.0/rooms/{room.id}/")
+    response = client.post(
+        "/external-api/v1.0/rooms/",
+        {"configuration": invalid_configuration},
+        format="json",
+    )
 
-    assert response.status_code == 405
-    assert 'method "patch" not allowed.' in str(response.data).lower()
+    assert response.status_code == 400
+
+
+def test_api_rooms_create_public_access_disabled_by_default():
+    """Public rooms should be disabled for the external API by default."""
+
+    user = UserFactory()
+    token = generate_test_token(user, [ApplicationScope.ROOMS_CREATE])
+
+    client = APIClient()
+    client.credentials(HTTP_AUTHORIZATION=f"Bearer {token}")
+    response = client.post(
+        "/external-api/v1.0/rooms/",
+        {"access_level": RoomAccessLevel.PUBLIC},
+        format="json",
+    )
+
+    assert response.status_code == 400
+    assert "public rooms are disabled" in str(response.data).lower()
+
+
+def test_api_rooms_create_public_access_enabled_with_settings(settings):
+    """Public rooms should be creatable when explicitly enabled."""
+
+    settings.EXTERNAL_API_ALLOW_PUBLIC_ACCESS = True
+
+    user = UserFactory()
+    token = generate_test_token(user, [ApplicationScope.ROOMS_CREATE])
+
+    client = APIClient()
+    client.credentials(HTTP_AUTHORIZATION=f"Bearer {token}")
+    response = client.post(
+        "/external-api/v1.0/rooms/",
+        {"access_level": RoomAccessLevel.PUBLIC},
+        format="json",
+    )
+
+    assert response.status_code == 201
+    room = Room.objects.get(id=response.data["id"])
+    assert room.access_level == RoomAccessLevel.PUBLIC
+    assert response.data["access_level"] == RoomAccessLevel.PUBLIC
+
+
+def test_api_rooms_create_default_access_level_respects_settings(settings):
+    """Room creation should reflect the EXTERNAL_API_DEFAULT_ACCESS_LEVEL setting."""
+
+    user = UserFactory()
+    token = generate_test_token(user, [ApplicationScope.ROOMS_CREATE])
+
+    client = APIClient()
+    client.credentials(HTTP_AUTHORIZATION=f"Bearer {token}")
+    response = client.post(
+        "/external-api/v1.0/rooms/",
+        format="json",
+    )
+    assert response.status_code == 201
+    assert response.data["access_level"] == RoomAccessLevel.TRUSTED
+
+    settings.EXTERNAL_API_DEFAULT_ACCESS_LEVEL = "public"
+
+    response = client.post(
+        "/external-api/v1.0/rooms/",
+        format="json",
+    )
+    assert response.status_code == 201
+    assert response.data["access_level"] == RoomAccessLevel.PUBLIC
+
+
+def test_api_rooms_create_public_access_level_when_default_is_public(settings):
+    """Explicit public access_level is accepted when the default is already public."""
+    settings.EXTERNAL_API_ALLOW_PUBLIC_ACCESS = False
+    settings.EXTERNAL_API_DEFAULT_ACCESS_LEVEL = "public"
+
+    user = UserFactory()
+    token = generate_test_token(user, [ApplicationScope.ROOMS_CREATE])
+
+    client = APIClient()
+    client.credentials(HTTP_AUTHORIZATION=f"Bearer {token}")
+
+    # No access_level in body — default kicks in, public room is created.
+    response = client.post("/external-api/v1.0/rooms/", {}, format="json")
+    assert response.status_code == 201
+    assert response.data["access_level"] == RoomAccessLevel.PUBLIC
+
+    # Explicit access_level=public in body — still rejected.
+    response = client.post(
+        "/external-api/v1.0/rooms/",
+        {"access_level": RoomAccessLevel.PUBLIC},
+        format="json",
+    )
+    assert response.status_code == 201
+    assert response.data["access_level"] == RoomAccessLevel.PUBLIC
 
 
 def test_api_rooms_response_no_url(settings):

src/backend/core/tests/test_external_api_token.py

@@ -4,6 +4,8 @@ Tests for external API /token endpoint
 
 # pylint: disable=W0621
 
+from unittest import mock
+
 import jwt
 import pytest
 from freezegun import freeze_time
@@ -15,6 +17,7 @@ from core.factories import (
     UserFactory,
 )
 from core.models import ApplicationScope, User
+from core.services import provisional_user_service
 
 pytestmark = pytest.mark.django_db
 
@@ -436,3 +439,88 @@ def test_api_applications_token_existing_user(settings):
         "delegated": True,
         "scope": "rooms:list rooms:create",
     }
+
+
+@mock.patch.object(provisional_user_service.ProvisionalUserService, "_get_by_email")
+def test_api_applications_token_new_user_race_condition(mock_get_by_email, settings):
+    """Should handle race condition where two concurrent requests create the same user."""
+    settings.APPLICATION_ALLOW_USER_CREATION = True
+    settings.OIDC_FALLBACK_TO_EMAIL_FOR_IDENTIFICATION = True
+    settings.OIDC_USER_SUB_FIELD_IMMUTABLE = False
+
+    application = ApplicationFactory(
+        is_active=True, scopes=[ApplicationScope.ROOMS_LIST]
+    )
+    plain_secret = "test-secret-123"
+    application.client_secret = plain_secret
+    application.save()
+
+    email = "john.doe@example.com"
+
+    # First call: lie and say user doesn't exist, simulating the race window
+    # Second call (recovery path): return the real user
+    existing_user = UserFactory(sub=None, email=email)
+    mock_get_by_email.side_effect = [None, existing_user]
+
+    client = APIClient()
+    response = client.post(
+        "/external-api/v1.0/application/token/",
+        {
+            "client_id": application.client_id,
+            "client_secret": plain_secret,
+            "grant_type": "client_credentials",
+            "scope": email,
+        },
+        format="json",
+    )
+
+    assert response.status_code == 200
+    assert mock_get_by_email.call_count == 2
+
+    token = response.data["access_token"]
+    payload = jwt.decode(
+        token,
+        settings.APPLICATION_JWT_SECRET_KEY,
+        algorithms=[settings.APPLICATION_JWT_ALG],
+        issuer=settings.APPLICATION_JWT_ISSUER,
+        audience=settings.APPLICATION_JWT_AUDIENCE,
+    )
+    assert payload["user_id"] == str(existing_user.id)
+    assert User.objects.filter(email=email).count() == 1
+
+
+@mock.patch.object(
+    provisional_user_service.ProvisionalUserService,
+    "get_or_create",
+    side_effect=provisional_user_service.ProvisionalUserIntegrityError,
+)
+def test_api_applications_token_new_user_race_condition_unrecoverable(
+    mock_get_or_create, settings
+):
+    """Should return 500 when ProvisionalUserIntegrityError is raised."""
+
+    settings.APPLICATION_ALLOW_USER_CREATION = True
+    settings.OIDC_FALLBACK_TO_EMAIL_FOR_IDENTIFICATION = True
+    settings.OIDC_USER_SUB_FIELD_IMMUTABLE = False
+
+    application = ApplicationFactory(
+        is_active=True, scopes=[ApplicationScope.ROOMS_LIST]
+    )
+    plain_secret = "test-secret-123"
+    application.client_secret = plain_secret
+    application.save()
+
+    client = APIClient()
+    response = client.post(
+        "/external-api/v1.0/application/token/",
+        {
+            "client_id": application.client_id,
+            "client_secret": plain_secret,
+            "grant_type": "client_credentials",
+            "scope": "john.doe@example.com",
+        },
+        format="json",
+    )
+
+    assert response.status_code == 409
+    assert mock_get_or_create.call_count == 1

src/backend/core/tests/test_models_users.py

@@ -44,3 +44,73 @@ def test_models_users_send_mail_main_missing():
         user.email_user("my subject", "my message")
 
     assert str(excinfo.value) == "User has no email address."
+
+
+def test_models_users_email_unique_when_sub_is_null():
+    """Email should be unique among users with no sub (pending users)."""
+    user = factories.UserFactory(sub=None, email="test@example.com")
+    with pytest.raises(
+        ValidationError, match="Constraint “unique_email_when_sub_is_null” is violated."
+    ):
+        factories.UserFactory(sub=None, email=user.email)
+
+
+def test_models_users_email_unique_case_insensitive_when_sub_is_null():
+    """Email uniqueness should be case-insensitive among users with no sub (pending users)."""
+    factories.UserFactory(sub=None, email="Test@example.com")
+    with pytest.raises(
+        ValidationError, match="Constraint “unique_email_when_sub_is_null” is violated."
+    ):
+        factories.UserFactory(sub=None, email="test@example.com")
+
+
+def test_models_users_email_not_unique_when_sub_is_set():
+    """Email uniqueness should not be enforced when users have a sub."""
+    user = factories.UserFactory(sub="sub-1", email="test@example.com")
+    user2 = factories.UserFactory(sub="sub-2", email=user.email)
+    assert user2.email == user.email
+
+
+def test_models_users_email_not_unique_between_sub_null_and_sub_set():
+    """A user with a sub and a pending user (sub=None) can share the same email."""
+    user = factories.UserFactory(sub="sub-1", email="test@example.com")
+    user2 = factories.UserFactory(sub=None, email=user.email)
+    assert user2.email == user.email
+
+
+def test_models_users_email_unique_constraint_allows_multiple_null_emails():
+    """Multiple users with sub=None and email=None should be allowed."""
+    factories.UserFactory(sub=None, email=None)
+    factories.UserFactory(sub=None, email=None)
+
+
+def test_models_users_sub_null_email_null_does_not_prevent_creation():
+    """Multiple pending users (sub=None, email=None) can be created without conflict.
+
+    sub=None is not unique-constrained. email uniqueness is only enforced among
+    sub=None users with a non-null email, so email=None bypasses it (NULL != NULL in SQL).
+    """
+    # Ghost row can still appear from bad code path
+    u1 = factories.UserFactory(sub=None, email=None)
+    u2 = factories.UserFactory(sub=None, email=None)
+    assert u1.pk != u2.pk
+
+
+def test_models_users_sub_can_be_null():
+    """sub is nullable: pending users exist before OIDC activation."""
+    user = factories.UserFactory(sub=None)
+    user.refresh_from_db()
+    assert user.sub is None
+
+
+def test_models_users_sub_null_does_not_prevent_creation():
+    """Multiple users can be created with sub=None (pending state)."""
+    u1 = factories.UserFactory(sub=None)
+    u2 = factories.UserFactory(sub=None)
+    assert u1.pk != u2.pk
+
+
+def test_models_users_sub_blank_is_accepted():
+    """sub='' passes validation because blank=True; null is preferred but not enforced."""
+    user = factories.UserFactory.build(sub="")
+    user.full_clean()

src/backend/core/tests/test_utils_build_telephony_config.py

@@ -0,0 +1,58 @@
+"""
+Test utils.build_telephony_config
+"""
+
+import logging
+
+from core.utils import build_telephony_config
+
+
+def test_build_telephony_config_disabled(settings):
+    """Returns {"enabled": False} when telephony is disabled."""
+    settings.ROOM_TELEPHONY_ENABLED = False
+    config = build_telephony_config()
+    assert config == {"enabled": False}
+
+
+def test_build_telephony_config_enabled_with_valid_number(settings):
+    """Returns full config with country and international number when telephony is enabled."""
+    settings.ROOM_TELEPHONY_ENABLED = True
+    settings.ROOM_TELEPHONY_PHONE_NUMBER = "0123456789"
+    settings.ROOM_TELEPHONY_DEFAULT_COUNTRY = "FR"
+    config = build_telephony_config()
+    assert config == {
+        "enabled": True,
+        "default_country": "FR",
+        "international_phone_number": "+33 1 23 45 67 89",
+    }
+
+
+def test_build_telephony_config_enabled_with_invalid_number(settings):
+    """Returns {"enabled": False} when phone number cannot be parsed."""
+    settings.ROOM_TELEPHONY_ENABLED = True
+    settings.ROOM_TELEPHONY_PHONE_NUMBER = "not-a-number"
+    settings.ROOM_TELEPHONY_DEFAULT_COUNTRY = "FR"
+    config = build_telephony_config()
+    assert config == {"enabled": False}
+
+
+def test_build_telephony_config_enabled_with_missing_number(settings):
+    """Returns {"enabled": False} when phone number is not configured."""
+    settings.ROOM_TELEPHONY_ENABLED = True
+    settings.ROOM_TELEPHONY_PHONE_NUMBER = ""
+    settings.ROOM_TELEPHONY_DEFAULT_COUNTRY = "FR"
+    config = build_telephony_config()
+    assert config == {"enabled": False}
+
+
+def test_build_telephony_config_enabled_with_missing_number_warns(settings, caplog):
+    """Logs a warning when telephony is enabled but phone number is not configured."""
+
+    settings.ROOM_TELEPHONY_ENABLED = True
+    settings.ROOM_TELEPHONY_PHONE_NUMBER = ""
+    settings.ROOM_TELEPHONY_DEFAULT_COUNTRY = "FR"
+
+    with caplog.at_level(logging.WARNING):
+        build_telephony_config()
+
+    assert "ROOM_TELEPHONY_PHONE_NUMBER" in caplog.text

src/backend/core/tests/test_utils_format_telephony_phone_number.py

@@ -0,0 +1,102 @@
+"""
+Test utils._format_telephony_phone_number
+"""
+
+import logging
+
+import pytest
+
+from core.utils import _format_telephony_phone_number
+
+
+@pytest.fixture(autouse=True)
+def clear_lru_cache():
+    """Clear the lru_cache before each test to ensure isolation."""
+    _format_telephony_phone_number.cache_clear()
+    yield
+    _format_telephony_phone_number.cache_clear()
+
+
+def test_format_telephony_phone_number_missing_raw_number():
+    """Returns (None, None) when raw_number is empty."""
+    country, international = _format_telephony_phone_number("", "FR")
+    assert country is None
+    assert international is None
+
+
+def test_format_telephony_phone_number_none_raw_number():
+    """Returns (None, None) when raw_number is None."""
+    country, international = _format_telephony_phone_number(None, "FR")
+    assert country is None
+    assert international is None
+
+
+def test_format_telephony_phone_number_missing_default_country():
+    """Returns (None, None) when default_country is empty."""
+    country, international = _format_telephony_phone_number("+33123456789", "")
+    assert country is None
+    assert international is None
+
+
+def test_format_telephony_phone_number_none_default_country():
+    """Returns (None, None) when default_country is None."""
+    country, international = _format_telephony_phone_number("+33123456789", None)
+    assert country is None
+    assert international is None
+
+
+def test_format_telephony_phone_number_both_missing():
+    """Returns (None, None) when both inputs are missing."""
+    country, international = _format_telephony_phone_number(None, None)
+    assert country is None
+    assert international is None
+
+
+def test_format_telephony_phone_number_invalid_number(caplog):
+    """Returns (None, None) and logs a warning when the number cannot be parsed."""
+
+    with caplog.at_level(logging.WARNING):
+        country, international = _format_telephony_phone_number("not-a-number", "FR")
+
+    assert country is None
+    assert international is None
+    assert "not-a-number" in caplog.text
+    assert "FR" in caplog.text
+
+
+def test_format_telephony_phone_number_valid_french_number():
+    """Returns correct country and international format for a valid French number."""
+    country, international = _format_telephony_phone_number("0123456789", "FR")
+    assert country == "FR"
+    assert international == "+33 1 23 45 67 89"
+
+
+def test_format_telephony_phone_number_valid_e164_number():
+    """Returns correct result for an E.164-formatted number (no default country needed)."""
+    country, international = _format_telephony_phone_number("+33123456789", "US")
+    assert country == "FR"
+    assert international == "+33 1 23 45 67 89"
+
+
+def test_format_telephony_phone_number_valid_us_number():
+    """Returns correct country and international format for a valid US number."""
+    country, international = _format_telephony_phone_number("2025550123", "US")
+    assert country == "US"
+    assert international == "+1 202-555-0123"
+
+
+def test_format_telephony_phone_number_valid_german_number():
+    """Returns correct country and international format for a valid German number."""
+    country, international = _format_telephony_phone_number("03012345678", "DE")
+    assert country == "DE"
+    assert international == "+49 30 12345678"
+
+
+def test_format_telephony_phone_number_lru_cache():
+    """Results are cached: the same inputs return the same object."""
+    result1 = _format_telephony_phone_number("0123456789", "FR")
+    result2 = _format_telephony_phone_number("0123456789", "FR")
+    assert result1 is result2
+    # pylint: disable=no-value-for-parameter
+    cache_info = _format_telephony_phone_number.cache_info()
+    assert cache_info.hits >= 1

src/backend/core/utils.py

@@ -12,6 +12,7 @@ import mimetypes
 import random
 import secrets
 import string
+from functools import lru_cache
 from typing import List, Optional
 from uuid import uuid4
 
@@ -22,6 +23,7 @@ import aiohttp
 import boto3
 import botocore
 import magic
+import phonenumbers
 from asgiref.sync import async_to_sync
 from livekit.api import (  # pylint: disable=E0611
     AccessToken,
@@ -424,7 +426,7 @@ def generate_upload_policy(file):
         Originally taken from https://github.com/suitenumerique/drive/blob/564822d31f071c6dfacd112ef4b7146c73077cd9/src/backend/core/api/utils.py#L102  # pylint: disable=line-too-long
     """
 
-    key = file.file_key
+    key = file.temporary_file_key
 
     # This settings should be used if the backend application and the frontend application
     # can't connect to the object storage with the same domain. This is the case in the
@@ -455,3 +457,58 @@ def generate_upload_policy(file):
     )
 
     return policy
+
+
+@lru_cache(maxsize=1)
+def _format_telephony_phone_number(raw_number, default_country):
+    """Parse a configured phone number and return (country, international_format).
+
+    Returns (None, None) if the inputs are missing or the number cannot be
+    parsed. Logs a warning on parse failure so operators see the misconfiguration.
+    """
+    if not raw_number or not default_country:
+        return None, None
+
+    try:
+        parsed = phonenumbers.parse(raw_number, default_country)
+    except phonenumbers.NumberParseException:
+        logger.warning(
+            "ROOM_TELEPHONY_PHONE_NUMBER %r is not a valid phone number for "
+            "default country %r; telephony block will be returned without "
+            "formatted number.",
+            raw_number,
+            default_country,
+        )
+        return None, None
+
+    country = phonenumbers.region_code_for_number(parsed)
+    international = phonenumbers.format_number(
+        parsed, phonenumbers.PhoneNumberFormat.INTERNATIONAL
+    )
+    return country, international
+
+
+def build_telephony_config():
+    """Build the telephony block of the frontend configuration."""
+    if not settings.ROOM_TELEPHONY_ENABLED:
+        return {"enabled": False}
+
+    country, international = _format_telephony_phone_number(
+        settings.ROOM_TELEPHONY_PHONE_NUMBER,
+        settings.ROOM_TELEPHONY_DEFAULT_COUNTRY,
+    )
+
+    if international is None:
+        logger.warning(
+            "Telephony is enabled but ROOM_TELEPHONY_PHONE_NUMBER %r with "
+            "default country %r could not be formatted; telephony will be disabled.",
+            settings.ROOM_TELEPHONY_PHONE_NUMBER,
+            settings.ROOM_TELEPHONY_DEFAULT_COUNTRY,
+        )
+        return {"enabled": False}
+
+    return {
+        "enabled": True,
+        "default_country": country,
+        "international_phone_number": international,
+    }

src/backend/meet/settings.py

@@ -186,6 +186,9 @@ class Base(Configuration):
     FILE_UPLOAD_PATH = values.Value(
         "files", environ_name="FILE_UPLOAD_PATH", environ_prefix=None
     )
+    FILE_UPLOAD_TMP_PATH = values.Value(
+        "tmp/files", environ_name="FILE_UPLOAD_TMP_PATH", environ_prefix=None
+    )
 
     FILE_UPLOAD_APPLY_RESTRICTIONS = values.BooleanValue(
         default=True, environ_name="FILE_UPLOAD_APPLY_RESTRICTIONS", environ_prefix=None
@@ -908,6 +911,18 @@ class Base(Configuration):
         environ_name="APPLICATION_BASE_URL",
         environ_prefix=None,
     )
+    # Warning: EXTERNAL_API_ALLOW_PUBLIC_ACCESS is ignored when
+    # EXTERNAL_API_DEFAULT_ACCESS_LEVEL=public.
+    EXTERNAL_API_ALLOW_PUBLIC_ACCESS = values.BooleanValue(
+        False,
+        environ_name="EXTERNAL_API_ALLOW_PUBLIC_ACCESS",
+        environ_prefix=None,
+    )
+    EXTERNAL_API_DEFAULT_ACCESS_LEVEL = values.Value(
+        "trusted",
+        environ_name="EXTERNAL_API_DEFAULT_ACCESS_LEVEL",
+        environ_prefix=None,
+    )
     # Allows third-party platforms to create users with email-only identification.
     # Required for external integrations, but fragile due to deferred user reconciliation
     # on sub. Enable it with care /!\
@@ -999,6 +1014,44 @@ class Base(Configuration):
         environ_prefix=None,
     )
 
+    # Logging
+    # We want to make it easy to log to console but by default we log production
+    # to Sentry and don't want to log to console.
+    LOGGING = {
+        "version": 1,
+        "disable_existing_loggers": False,
+        "formatters": {
+            "simple": {
+                "format": "{asctime} {name} {levelname} {message}",
+                "style": "{",
+            },
+        },
+        "handlers": {
+            "console": {
+                "class": "logging.StreamHandler",
+                "formatter": "simple",
+            },
+        },
+        # Override root logger to send it to console
+        "root": {
+            "handlers": ["console"],
+            "level": values.Value(
+                "INFO", environ_name="LOGGING_LEVEL_LOGGERS_ROOT", environ_prefix=None
+            ),
+        },
+        "loggers": {
+            "core": {
+                "handlers": ["console"],
+                "level": values.Value(
+                    "INFO",
+                    environ_name="LOGGING_LEVEL_LOGGERS_APP",
+                    environ_prefix=None,
+                ),
+                "propagate": False,
+            },
+        },
+    }
+
     # pylint: disable=invalid-name
     @property
     def ENVIRONMENT(self):
@@ -1037,6 +1090,11 @@ class Base(Configuration):
         """
         super().post_setup()
 
+        if cls.FILE_UPLOAD_TMP_PATH == cls.FILE_UPLOAD_PATH:
+            raise ValueError(
+                "FILE_UPLOAD_TMP_PATH cannot be the same as FILE_UPLOAD_PATH"
+            )
+
         # The SENTRY_DSN setting should be available to activate sentry for an environment
         if cls.SENTRY_DSN is not None:
             sentry_sdk.init(

src/backend/meet/urls.py

@@ -4,7 +4,7 @@ from django.conf import settings
 from django.conf.urls.static import static
 from django.contrib import admin
 from django.contrib.staticfiles.urls import staticfiles_urlpatterns
-from django.urls import include, path, re_path
+from django.urls import include, path
 
 from drf_spectacular.views import (
     SpectacularJSONAPIView,
@@ -29,7 +29,7 @@ if settings.DEBUG:
 if settings.USE_SWAGGER or settings.DEBUG:
     urlpatterns += [
         path(
-            f"{settings.API_VERSION}/swagger.json",
+            f"api/{settings.API_VERSION}/swagger.json",
             SpectacularJSONAPIView.as_view(
                 api_version=settings.API_VERSION,
                 urlconf="core.urls",
@@ -37,12 +37,12 @@ if settings.USE_SWAGGER or settings.DEBUG:
             name="client-api-schema",
         ),
         path(
-            f"{settings.API_VERSION}//swagger/",
+            f"api/{settings.API_VERSION}/swagger/",
             SpectacularSwaggerView.as_view(url_name="client-api-schema"),
             name="swagger-ui-schema",
         ),
-        re_path(
-            f"{settings.API_VERSION}//redoc/",
+        path(
+            f"api/{settings.API_VERSION}/redoc/",
             SpectacularRedocView.as_view(url_name="client-api-schema"),
             name="redoc-schema",
         ),

src/backend/pyproject.toml

@@ -7,7 +7,7 @@ build-backend = "uv_build"
 
 [project]
 name = "meet"
-version = "1.15.0"
+version = "1.18.0"
 authors = [{ "name" = "DINUM", "email" = "dev@mail.numerique.gouv.fr" }]
 classifiers = [
     "Development Status :: 5 - Production/Stable",
@@ -61,6 +61,8 @@ dependencies = [
     "mozilla-django-oidc==5.0.2",
     "livekit-api==1.1.0",
     "aiohttp==3.13.4",
+    "urllib3==2.7.0",
+    "phonenumbers==9.0.30",
 ]
 
 [project.urls]

src/backend/uv.lock

@@ -1173,7 +1173,7 @@ wheels = [
 
 [[package]]
 name = "meet"
-version = "1.15.0"
+version = "1.18.0"
 source = { editable = "." }
 dependencies = [
     { name = "aiohttp" },
@@ -1204,6 +1204,7 @@ dependencies = [
     { name = "markdown" },
     { name = "mozilla-django-oidc" },
     { name = "nested-multipart-parser" },
+    { name = "phonenumbers" },
     { name = "psycopg", extra = ["binary"] },
     { name = "pydantic" },
     { name = "pyjwt" },
@@ -1212,6 +1213,7 @@ dependencies = [
     { name = "redis" },
     { name = "requests" },
     { name = "sentry-sdk" },
+    { name = "urllib3" },
     { name = "whitenoise" },
 ]
 
@@ -1265,6 +1267,7 @@ requires-dist = [
     { name = "markdown", specifier = "==3.10.2" },
     { name = "mozilla-django-oidc", specifier = "==5.0.2" },
     { name = "nested-multipart-parser", specifier = "==1.6.0" },
+    { name = "phonenumbers", specifier = "==9.0.30" },
     { name = "psycopg", extras = ["binary"], specifier = "==3.3.3" },
     { name = "pydantic", specifier = "==2.12.5" },
     { name = "pyjwt", specifier = "==2.12.1" },
@@ -1273,6 +1276,7 @@ requires-dist = [
     { name = "redis", specifier = "==5.2.1" },
     { name = "requests", specifier = "==2.33.0" },
     { name = "sentry-sdk", specifier = "==2.54.0" },
+    { name = "urllib3", specifier = "==2.7.0" },
     { name = "whitenoise", specifier = "==6.12.0" },
 ]
 
@@ -1428,6 +1432,15 @@ wheels = [
     { url = "https://files.pythonhosted.org/packages/9e/c3/059298687310d527a58bb01f3b1965787ee3b40dce76752eda8b44e9a2c5/pexpect-4.9.0-py2.py3-none-any.whl", hash = "sha256:7236d1e080e4936be2dc3e326cec0af72acf9212a7e1d060210e70a47e253523", size = 63772, upload-time = "2023-11-25T06:56:14.81Z" },
 ]
 
+[[package]]
+name = "phonenumbers"
+version = "9.0.30"
+source = { registry = "https://pypi.org/simple" }
+sdist = { url = "https://files.pythonhosted.org/packages/a6/f1/249f843f4107c6a6ed17e5ece17620d75e532c2a355106e26d889a0c72c7/phonenumbers-9.0.30.tar.gz", hash = "sha256:d42d232ccde69c1af1bb5916a7e46f4edbcc72975b02759830f4ea1fba7b00c9", size = 2306521, upload-time = "2026-05-07T10:20:38.884Z" }
+wheels = [
+    { url = "https://files.pythonhosted.org/packages/83/22/e4442aabea04daf16fda50d89bce2ff585e44f204089986b2cc6679cae10/phonenumbers-9.0.30-py2.py3-none-any.whl", hash = "sha256:e0890d4cda206ef6ac18ef07e8f3ab225c31c7edce237ac870b4729d4c1d2520", size = 2595222, upload-time = "2026-05-07T10:20:35.387Z" },
+]
+
 [[package]]
 name = "pillow"
 version = "12.2.0"
@@ -2260,11 +2273,11 @@ wheels = [
 
 [[package]]
 name = "urllib3"
-version = "2.6.3"
+version = "2.7.0"
 source = { registry = "https://pypi.org/simple" }
-sdist = { url = "https://files.pythonhosted.org/packages/c7/24/5f1b3bdffd70275f6661c76461e25f024d5a38a46f04aaca912426a2b1d3/urllib3-2.6.3.tar.gz", hash = "sha256:1b62b6884944a57dbe321509ab94fd4d3b307075e0c2eae991ac71ee15ad38ed", size = 435556, upload-time = "2026-01-07T16:24:43.925Z" }
+sdist = { url = "https://files.pythonhosted.org/packages/53/0c/06f8b233b8fd13b9e5ee11424ef85419ba0d8ba0b3138bf360be2ff56953/urllib3-2.7.0.tar.gz", hash = "sha256:231e0ec3b63ceb14667c67be60f2f2c40a518cb38b03af60abc813da26505f4c", size = 433602, upload-time = "2026-05-07T16:13:18.596Z" }
 wheels = [
-    { url = "https://files.pythonhosted.org/packages/39/08/aaaad47bc4e9dc8c725e68f9d04865dbcb2052843ff09c97b08904852d84/urllib3-2.6.3-py3-none-any.whl", hash = "sha256:bf272323e553dfb2e87d9bfd225ca7b0f467b919d7bbd355436d3fd37cb0acd4", size = 131584, upload-time = "2026-01-07T16:24:42.685Z" },
+    { url = "https://files.pythonhosted.org/packages/7f/3e/5db95bcf282c52709639744ca2a8b149baccf648e39c8cc87553df9eae0c/urllib3-2.7.0-py3-none-any.whl", hash = "sha256:9fb4c81ebbb1ce9531cce37674bbc6f1360472bc18ca9a553ede278ef7276897", size = 131087, upload-time = "2026-05-07T16:13:17.151Z" },
 ]
 
 [[package]]

src/frontend/@types/react-aria-overlays.d.ts

@@ -1,18 +0,0 @@
-import type * as React from 'react';
-
-declare module '@react-aria/overlays' {
-  export type PortalProviderContextValue = {
-    getContainer: () => HTMLElement | null;
-  };
-
-  export type PortalProviderProps = {
-    getContainer: () => HTMLElement | null;
-    children: React.ReactNode;
-  };
-
-  export function useUNSAFE_PortalContext(): PortalProviderContextValue;
-  export function UNSAFE_PortalProvider(
-    props: PortalProviderProps,
-  ): JSX.Element;
-}
-

src/frontend/index.html

@@ -6,22 +6,6 @@
     <link rel="icon" type="image/png" sizes="32x32" href="/favicon-32x32.png">
     <link rel="icon" type="image/png" sizes="16x16" href="/favicon-16x16.png">
     <link rel="manifest" href="/site.webmanifest">
-    <!-- Font URLs are resolved and replaced by Vite during the build process. Font loading failures will not break the application. -->
-    <link
-      rel="preload"
-      as="font"
-      crossorigin="anonymous"
-      href="/node_modules/@fontsource/material-icons-outlined/files/material-icons-outlined-latin-400-normal.woff2"
-      type="font/woff2"
-    />
-    <!-- Font URLs are resolved and replaced by Vite during the build process. Font loading failures will not break the application. -->
-    <link
-      rel="preload"
-      as="font"
-      crossorigin="anonymous"
-      href="/node_modules/@fontsource-variable/material-symbols-outlined/files/material-symbols-outlined-latin-wght-normal.woff2"
-      type="font/woff2"
-    />
     <meta name="viewport" content="width=device-width, initial-scale=1.0" />
     <title>%VITE_APP_TITLE%</title>
   </head>

src/frontend/package.json

@@ -1,11 +1,12 @@
 {
   "name": "meet",
   "private": true,
-  "version": "1.15.0",
+  "version": "1.18.0",
   "type": "module",
   "scripts": {
     "dev": "panda codegen && vite",
     "build": "panda codegen && tsc -b && vite build",
+    "build:debug": "VITE_ANALYZE=true npm run build -- --debug",
     "lint": "eslint . --ext ts,tsx --report-unused-disable-directives --max-warnings 0",
     "preview": "vite preview",
     "i18n:extract": "npx i18next -c i18next-parser.config.json",
@@ -15,8 +16,6 @@
   "dependencies": {
     "@fontsource-variable/atkinson-hyperlegible-next": "5.2.6",
     "@fontsource-variable/lexend": "5.2.11",
-    "@fontsource-variable/material-symbols-outlined": "5.2.34",
-    "@fontsource/material-icons-outlined": "5.2.6",
     "@fontsource/opendyslexic": "5.2.5",
     "@livekit/components-react": "2.9.19",
     "@livekit/components-styles": "1.2.0",
@@ -35,7 +34,6 @@
     "i18next-browser-languagedetector": "8.2.1",
     "i18next-parser": "9.3.0",
     "i18next-resources-to-backend": "1.2.1",
-    "libphonenumber-js": "1.12.10",
     "livekit-client": "2.17.1",
     "posthog-js": "1.342.1",
     "react": "18.3.1",
@@ -47,7 +45,7 @@
     "wouter": "3.9.0"
   },
   "devDependencies": {
-    "@pandacss/dev": "1.8.2",
+    "@pandacss/dev": "1.11.1",
     "@tanstack/eslint-plugin-query": "5.91.4",
     "@tanstack/react-query-devtools": "5.91.3",
     "@types/humanize-duration": "3.27.4",
@@ -62,10 +60,12 @@
     "eslint-plugin-jsx-a11y": "6.10.2",
     "eslint-plugin-react-hooks": "5.2.0",
     "eslint-plugin-react-refresh": "0.4.20",
-    "postcss": "8.5.10",
+    "postcss": "8.5.14",
     "prettier": "3.8.1",
+    "rollup-plugin-visualizer": "7.0.1",
     "typescript": "5.8.3",
     "vite": "7.3.2",
+    "vite-plugin-svgr": "5.2.0",
     "vite-tsconfig-paths": "6.1.1"
   }
 }

src/frontend/panda.config.ts

@@ -279,6 +279,7 @@ const config: Config = {
         'room-side-panel-margin': { value: '1.5rem' },
         'room-control-bar': { value: '80px' },
         'room-reaction-toolbar-height': { value: '42px' },
+        'tooltip-spacing': { value: '8px' },
       },
       spacing,
     }),

src/frontend/src/App.tsx

@@ -1,4 +1,3 @@
-import '@livekit/components-styles'
 import '@/styles/index.css'
 import { Suspense } from 'react'
 import { ReactQueryDevtools } from '@tanstack/react-query-devtools'

src/frontend/src/api/useConfig.ts

@@ -2,6 +2,8 @@ import { fetchApi } from './fetchApi'
 import { keys } from './queryKeys'
 import { useQuery } from '@tanstack/react-query'
 import { RecordingMode } from '@/features/recording'
+import type { Track } from 'livekit-client'
+type Source = Track.Source
 
 export interface ApiConfig {
   analytics?: {
@@ -42,7 +44,7 @@ export interface ApiConfig {
   }
   telephony: {
     enabled: boolean
-    phone_number?: string
+    international_phone_number?: string
     default_country?: string
   }
   manifest_link?: string
@@ -50,7 +52,7 @@ export interface ApiConfig {
     url: string
     force_wss_protocol: boolean
     enable_firefox_proxy_workaround: boolean
-    default_sources: string[]
+    default_sources: Source[]
   }
   transcription_destination?: string
 }

src/frontend/src/assets/icons/article.svg

@@ -0,0 +1 @@
+<svg xmlns="http://www.w3.org/2000/svg" height="24px" viewBox="0 -960 960 960" width="24px" fill="#1f1f1f"><path d="M280-280h280v-80H280v80Zm0-160h400v-80H280v80Zm0-160h400v-80H280v80Zm-80 480q-33 0-56.5-23.5T120-200v-560q0-33 23.5-56.5T200-840h560q33 0 56.5 23.5T840-760v560q0 33-23.5 56.5T760-120H200Zm0-80h560v-560H200v560Zm0-560v560-560Z"/></svg>

src/frontend/src/assets/icons/chevron_forward.svg

@@ -0,0 +1 @@
+<svg xmlns="http://www.w3.org/2000/svg" height="24px" viewBox="0 -960 960 960" width="24px" fill="#1f1f1f"><path d="M504-480 320-664l56-56 240 240-240 240-56-56 184-184Z"/></svg>

src/frontend/src/assets/icons/cloud_download.svg

@@ -0,0 +1 @@
+<svg xmlns="http://www.w3.org/2000/svg" height="24px" viewBox="0 -960 960 960" width="24px" fill="#1f1f1f"><path d="M260-160q-91 0-155.5-63T40-377q0-78 47-139t123-78q17-72 85-137t145-65q33 0 56.5 23.5T520-716v242l64-62 56 56-160 160-160-160 56-56 64 62v-242q-76 14-118 73.5T280-520h-20q-58 0-99 41t-41 99q0 58 41 99t99 41h480q42 0 71-29t29-71q0-42-29-71t-71-29h-60v-80q0-48-22-89.5T600-680v-93q74 35 117 103.5T760-520q69 8 114.5 59.5T920-340q0 75-52.5 127.5T740-160H260Zm220-358Z"/></svg>

src/frontend/src/assets/icons/language.svg

@@ -0,0 +1 @@
+<svg xmlns="http://www.w3.org/2000/svg" height="24px" viewBox="0 -960 960 960" width="24px" fill="#1f1f1f"><path d="M325-111.5q-73-31.5-127.5-86t-86-127.5Q80-398 80-480.5t31.5-155q31.5-72.5 86-127t127.5-86Q398-880 480.5-880t155 31.5q72.5 31.5 127 86t86 127Q880-563 880-480.5T848.5-325q-31.5 73-86 127.5t-127 86Q563-80 480.5-80T325-111.5ZM480-162q26-36 45-75t31-83H404q12 44 31 83t45 75Zm-104-16q-18-33-31.5-68.5T322-320H204q29 50 72.5 87t99.5 55Zm208 0q56-18 99.5-55t72.5-87H638q-9 38-22.5 73.5T584-178ZM170-400h136q-3-20-4.5-39.5T300-480q0-21 1.5-40.5T306-560H170q-5 20-7.5 39.5T160-480q0 21 2.5 40.5T170-400Zm216 0h188q3-20 4.5-39.5T580-480q0-21-1.5-40.5T574-560H386q-3 20-4.5 39.5T380-480q0 21 1.5 40.5T386-400Zm268 0h136q5-20 7.5-39.5T800-480q0-21-2.5-40.5T790-560H654q3 20 4.5 39.5T660-480q0 21-1.5 40.5T654-400Zm-16-240h118q-29-50-72.5-87T584-782q18 33 31.5 68.5T638-640Zm-234 0h152q-12-44-31-83t-45-75q-26 36-45 75t-31 83Zm-200 0h118q9-38 22.5-73.5T376-782q-56 18-99.5 55T204-640Z"/></svg>

src/frontend/src/assets/icons/login.svg

@@ -0,0 +1 @@
+<svg xmlns="http://www.w3.org/2000/svg" height="24px" viewBox="0 -960 960 960" width="24px" fill="#1f1f1f"><path d="M480-120v-80h280v-560H480v-80h280q33 0 56.5 23.5T840-760v560q0 33-23.5 56.5T760-120H480Zm-80-160-55-58 102-102H120v-80h327L345-622l55-58 200 200-200 200Z"/></svg>

src/frontend/src/assets/icons/mail.svg

@@ -0,0 +1 @@
+<svg xmlns="http://www.w3.org/2000/svg" height="24px" viewBox="0 -960 960 960" width="24px" fill="#1f1f1f"><path d="M160-160q-33 0-56.5-23.5T80-240v-480q0-33 23.5-56.5T160-800h640q33 0 56.5 23.5T880-720v480q0 33-23.5 56.5T800-160H160Zm320-280L160-640v400h640v-400L480-440Zm0-80 320-200H160l320 200ZM160-640v-80 480-400Z"/></svg>

src/frontend/src/assets/icons/mode_standby.svg

@@ -0,0 +1 @@
+<svg xmlns="http://www.w3.org/2000/svg" height="24px" viewBox="0 -960 960 960" width="24px" fill="#1f1f1f"><path d="M565-395q35-35 35-85t-35-85q-35-35-85-35t-85 35q-35 35-35 85t35 85q35 35 85 35t85-35ZM480-80q-83 0-156-31.5T197-197q-54-54-85.5-127T80-480q0-83 31.5-156T197-763q54-54 127-85.5T480-880q83 0 156 31.5T763-763q54 54 85.5 127T880-480q0 83-31.5 156T763-197q-54 54-127 85.5T480-80Zm0-80q134 0 227-93t93-227q0-134-93-227t-227-93q-134 0-227 93t-93 227q0 134 93 227t227 93Zm0-320Z"/></svg>

src/frontend/src/assets/icons/person_raised_hand.svg

@@ -0,0 +1 @@
+<svg xmlns="http://www.w3.org/2000/svg" height="24px" viewBox="0 -960 960 960" width="24px" fill="#1f1f1f"><path d="M80-40v-80h800v80H80Zm80-120v-240q-33-54-51-114.5T91-638q0-61 15.5-120T143-874q8-21 26-33.5t40-12.5q31 0 53 21t18 50l-11 91q-6 48 8.5 91t43.5 75.5q29 32.5 70 52t89 19.5q60 0 120.5 12.5T706-472q45 23 69.5 58.5T800-326v166H160Zm80-80h480v-86q0-24-12-42.5T674-398q-41-20-95-31t-99-11q-66 0-122.5-27t-96-72.5Q222-585 202-644.5T190-768q-10 30-14.5 64t-4.5 66q0 58 20.5 111.5T240-422v182Zm127-367q-47-47-47-113t47-113q47-47 113-47t113 47q47 47 47 113t-47 113q-47 47-113 47t-113-47Zm169.5-56.5Q560-687 560-720t-23.5-56.5Q513-800 480-800t-56.5 23.5Q400-753 400-720t23.5 56.5Q447-640 480-640t56.5-23.5ZM320-160v-37q0-67 46.5-115T480-360h160v80H480q-34 0-57 24.5T400-197v37h-80Zm160-80Zm0-480Z"/></svg>

src/frontend/src/assets/icons/screen_record.svg

@@ -0,0 +1 @@
+<svg xmlns="http://www.w3.org/2000/svg" height="24px" viewBox="0 -960 960 960" width="24px" fill="#1f1f1f"><path d="M158-242q-37-50-57.5-110.5T80-480q0-67 20-127t57-110l58 57q-26 38-40.5 83.5T160-480q0 51 14.5 97t40.5 84l-57 57ZM480-80q-67 0-127-20t-110-57l57-58q38 26 83.5 40.5T480-160q51 0 96.5-14.5T660-215l57 58q-50 37-110 57T480-80Zm322-162-57-57q26-38 40.5-84t14.5-97q0-51-14.5-96.5T745-660l58-57q37 50 57 110t20 127q0 67-20.5 127.5T802-242ZM299-745l-57-57q50-37 110.5-57.5T480-880q68 0 128 20.5T718-802l-57 57q-38-26-84-40.5T480-800q-51 0-97 14.5T299-745Zm181 465q-83 0-141.5-58.5T280-480q0-83 58.5-141.5T480-680q83 0 141.5 58.5T680-480q0 83-58.5 141.5T480-280Z"/></svg>

src/frontend/src/assets/icons/speech_to_text.svg

@@ -0,0 +1 @@
+<svg xmlns="http://www.w3.org/2000/svg" height="24px" viewBox="0 -960 960 960" width="24px" fill="#1f1f1f"><path d="M680-560q-33 0-56.5-23T600-640v-160q0-34 23.5-57t56.5-23q34 0 57 23t23 57v160q0 34-23 57t-57 23ZM200-80q-33 0-56.5-23.5T120-160v-640q0-33 23.5-56.5T200-880h320v80H200v640h440v-80h80v80q0 33-23.5 56.5T640-80H200Zm80-160v-80h280v80H280Zm0-120v-80h200v80H280Zm440 40h-80v-104q-77-14-128.5-74.5T460-640h80q0 58 41 99t99 41q59 0 99.5-41t40.5-99h80q0 81-51 141.5T720-424v104Z"/></svg>

src/frontend/src/components/AppInitialization.tsx

@@ -1,20 +1,14 @@
-import { silenceLiveKitLogs } from '@/utils/livekit'
 import { useConfig } from '@/api/useConfig'
 import { useAnalytics } from '@/features/analytics/hooks/useAnalytics'
 import { useSupport } from '@/features/support/hooks/useSupport'
-import { useSyncUserPreferencesWithBackend } from '@/features/auth'
+import { useSyncUserPreferencesWithBackend } from '@/features/auth/api/useSyncUserPreferencesWithBackend'
 import { useEffect } from 'react'
 
 export const AppInitialization = () => {
   const { data } = useConfig()
   useSyncUserPreferencesWithBackend()
 
-  const {
-    analytics = {},
-    support = {},
-    silence_livekit_debug_logs = false,
-    custom_css_url = '',
-  } = data ?? {}
+  const { analytics = {}, support = {}, custom_css_url = '' } = data ?? {}
 
   useAnalytics(analytics)
   useSupport(support)
@@ -29,7 +23,5 @@ export const AppInitialization = () => {
     }
   }, [custom_css_url])
 
-  silenceLiveKitLogs(silence_livekit_debug_logs)
-
   return null
 }

src/frontend/src/components/LoginButton.tsx

@@ -1,8 +1,8 @@
 import { LinkButton } from '@/primitives'
-import { authUrl } from '@/features/auth'
 import { useTranslation } from 'react-i18next'
 import { useConfig } from '@/api/useConfig'
 import { ProConnectButton } from './ProConnectButton'
+import { authUrl } from '@/features/auth/utils/authUrl'
 
 type LoginButtonProps = {
   proConnectHint?: boolean // Hide hint in layouts where space doesn't allow it.

src/frontend/src/features/analytics/hooks/useAnalytics.ts

@@ -1,17 +1,28 @@
 import { useEffect } from 'react'
 import { useLocation } from 'wouter'
-import posthog from 'posthog-js'
-import { ApiUser } from '@/features/auth/api/ApiUser'
+import { type PostHog } from 'posthog-js'
+import { type ApiUser } from '@/features/auth/api/ApiUser'
+import { useUser } from '@/features/auth/api/useUser'
 
-export const startAnalyticsSession = (data: ApiUser) => {
-  if (posthog._isIdentified()) return
-  const { id, email } = data
-  posthog.identify(id, { email })
+let posthog: PostHog | null = null
+
+const getPosthog = async () => {
+  if (!posthog) posthog = (await import('posthog-js')).default
+  return posthog
 }
 
-export const terminateAnalyticsSession = () => {
-  if (!posthog._isIdentified()) return
-  posthog.reset()
+export const startAnalyticsSession = (data: ApiUser) => {
+  getPosthog().then((ph) => {
+    if (ph._isIdentified()) return
+    const { id, email } = data
+    ph.identify(id, { email })
+  })
+}
+
+export const terminateAnalyticsSession = async () => {
+  const ph = await getPosthog()
+  if (!ph._isIdentified()) return
+  ph.reset()
 }
 
 export type useAnalyticsProps = {
@@ -22,18 +33,26 @@ export type useAnalyticsProps = {
 
 export const useAnalytics = ({ id, host, isDisabled }: useAnalyticsProps) => {
   const [location] = useLocation()
+  const { user } = useUser()
+
   useEffect(() => {
     if (!id || !host || isDisabled) return
-    if (posthog.__loaded) return
-    posthog.init(id, {
-      api_host: host,
-      person_profiles: 'always',
+    getPosthog().then((ph) => {
+      if (ph.__loaded) return
+      ph.init(id, { api_host: host, person_profiles: 'always' })
     })
   }, [id, host, isDisabled])
 
+  useEffect(() => {
+    if (!user) return
+    startAnalyticsSession(user)
+  }, [user])
+
   // From PostHog tutorial on PageView tracking in a Single Page Application (SPA) context.
   useEffect(() => {
-    posthog.capture('$pageview')
+    getPosthog().then((ph) => {
+      ph.capture('$pageview')
+    })
   }, [location])
 
   return null

src/frontend/src/features/auth/api/useUser.tsx

@@ -2,16 +2,7 @@ import { useQuery } from '@tanstack/react-query'
 import { keys } from '@/api/queryKeys'
 import { fetchUser } from './fetchUser'
 import { type ApiUser } from './ApiUser'
-import { useEffect, useMemo } from 'react'
-import {
-  startAnalyticsSession,
-  terminateAnalyticsSession,
-} from '@/features/analytics/hooks/useAnalytics'
-import {
-  initializeSupportSession,
-  terminateSupportSession,
-} from '@/features/support/hooks/useSupport'
-import { logoutUrl } from '../utils/logoutUrl'
+import { useMemo } from 'react'
 import { useConfig } from '@/api/useConfig'
 
 /**
@@ -45,19 +36,6 @@ export const useUser = (
     enabled: !isConfigLoading,
   })
 
-  useEffect(() => {
-    if (query?.data) {
-      startAnalyticsSession(query.data)
-      initializeSupportSession(query.data)
-    }
-  }, [query.data])
-
-  const logout = () => {
-    terminateAnalyticsSession()
-    terminateSupportSession()
-    window.location.href = logoutUrl()
-  }
-
   const isLoggedIn =
     query.status === 'success' ? query.data !== false : undefined
   const isLoggedOut = isLoggedIn === false
@@ -67,6 +45,5 @@ export const useUser = (
     user: isLoggedOut ? undefined : (query.data as ApiUser | undefined),
     isLoggedIn,
     isLoading: query.isLoading,
-    logout,
   }
 }

src/frontend/src/features/auth/components/UserAware.tsx

@@ -1,4 +1,4 @@
-import { useUser } from '@/features/auth'
+import { useUser } from '../api/useUser'
 import { LoadingScreen } from '@/components/LoadingScreen'
 
 /**

src/frontend/src/features/auth/index.ts

@@ -1,4 +0,0 @@
-export { useUser } from './api/useUser'
-export { useSyncUserPreferencesWithBackend } from './api/useSyncUserPreferencesWithBackend'
-export { authUrl } from './utils/authUrl'
-export { UserAware } from './components/UserAware'

src/frontend/src/features/auth/utils/logout.ts

@@ -0,0 +1,13 @@
+import { apiUrl } from '@/api/apiUrl'
+import { terminateSupportSession } from '@/features/support/hooks/useSupport'
+import { terminateAnalyticsSession } from '@/features/analytics/hooks/useAnalytics'
+
+const logoutUrl = () => {
+  return apiUrl('/logout')
+}
+
+export const logout = async () => {
+  await terminateAnalyticsSession()
+  terminateSupportSession()
+  window.location.href = logoutUrl()
+}

src/frontend/src/features/auth/utils/logoutUrl.ts

@@ -1,5 +0,0 @@
-import { apiUrl } from '@/api/apiUrl'
-
-export const logoutUrl = () => {
-  return apiUrl('/logout')
-}

src/frontend/src/features/auth/utils/silentLogin.ts

@@ -1,4 +1,4 @@
-import { authUrl } from '@/features/auth'
+import { authUrl } from './authUrl'
 
 const SILENT_LOGIN_RETRY_KEY = 'silent-login-retry'
 

src/frontend/src/features/files/api/listFiles.ts

@@ -6,7 +6,7 @@ import {
   ApiFileType,
   ApiFileUploadState,
 } from '@/features/files/api/types.ts'
-import { useUser } from '@/features/auth'
+import { useUser } from '@/features/auth/api/useUser'
 import { useConfig } from '@/api/useConfig.ts'
 
 type ListFilesResponse = {

src/frontend/src/features/home/components/CreateMeetingMenu.tsx

@@ -0,0 +1,62 @@
+import { useTranslation } from 'react-i18next'
+import { MenuItem, Menu as RACMenu } from 'react-aria-components'
+import { Button, Menu } from '@/primitives'
+import { navigateTo } from '@/navigation/navigateTo'
+import { generateRoomId, useCreateRoom } from '@/features/rooms'
+import { RiAddLine, RiLink } from '@remixicon/react'
+import { LaterMeetingDialog } from '@/features/home/components/LaterMeetingDialog'
+import { useState } from 'react'
+
+import { menuRecipe } from '@/primitives/menuRecipe'
+import { ApiRoom } from '@/features/rooms/api/ApiRoom'
+import { loadUserChoices } from '@livekit/components-core'
+
+export const CreateMeetingMenu = () => {
+  const { username } = loadUserChoices()
+
+  const { t } = useTranslation('home')
+  const { mutateAsync: createRoom } = useCreateRoom()
+  const [laterRoom, setLaterRoom] = useState<null | ApiRoom>(null)
+
+  return (
+    <>
+      <Menu>
+        <Button variant="primary" data-attr="create-meeting">
+          {t('createMeeting')}
+        </Button>
+        <RACMenu>
+          <MenuItem
+            className={menuRecipe({ icon: true, variant: 'light' }).item}
+            onAction={() => {
+              const slug = generateRoomId()
+              createRoom({ slug, username }).then((data) =>
+                navigateTo('room', data.slug, {
+                  state: { create: true, initialRoomData: data },
+                })
+              )
+            }}
+            data-attr="create-option-instant"
+          >
+            <RiAddLine size={18} />
+            {t('createMenu.instantOption')}
+          </MenuItem>
+          <MenuItem
+            className={menuRecipe({ icon: true, variant: 'light' }).item}
+            onAction={() => {
+              const slug = generateRoomId()
+              createRoom({ slug, username }).then(setLaterRoom)
+            }}
+            data-attr="create-option-later"
+          >
+            <RiLink size={18} />
+            {t('createMenu.laterOption')}
+          </MenuItem>
+        </RACMenu>
+      </Menu>
+      <LaterMeetingDialog
+        room={laterRoom}
+        onOpenChange={() => setLaterRoom(null)}
+      />
+    </>
+  )
+}

src/frontend/src/features/home/index.ts

@@ -1 +0,0 @@
-export { Home as HomeRoute } from './routes/Home'

src/frontend/src/features/home/routes/Home.tsx

@@ -1,24 +1,19 @@
 import { useTranslation } from 'react-i18next'
-import { DialogTrigger, MenuItem, Menu as RACMenu } from 'react-aria-components'
-import { Button, Menu } from '@/primitives'
+import { DialogTrigger } from 'react-aria-components'
+import { Button } from '@/primitives'
 import { styled } from '@/styled-system/jsx'
-import { navigateTo } from '@/navigation/navigateTo'
 import { Screen } from '@/layout/Screen'
-import { generateRoomId, useCreateRoom } from '@/features/rooms'
-import { useUser, UserAware } from '@/features/auth'
+import { UserAware } from '@/features/auth/components/UserAware'
+import { useUser } from '@/features/auth/api/useUser'
 import { JoinMeetingDialog } from '../components/JoinMeetingDialog'
-import { RiAddLine, RiLink } from '@remixicon/react'
-import { LaterMeetingDialog } from '@/features/home/components/LaterMeetingDialog'
-import { IntroSlider } from '@/features/home/components/IntroSlider'
-import { MoreLink } from '@/features/home/components/MoreLink'
+import { IntroSlider } from '../components/IntroSlider'
+import { MoreLink } from '../components/MoreLink'
+import { CreateMeetingMenu } from '../components/CreateMeetingMenu'
 import { ReactNode, useEffect, useState } from 'react'
 
 import { css } from '@/styled-system/css'
-import { menuRecipe } from '@/primitives/menuRecipe.ts'
-import { usePersistentUserChoices } from '@/features/rooms/livekit/hooks/usePersistentUserChoices'
 import { useConfig } from '@/api/useConfig'
 import { LoginButton } from '@/components/LoginButton'
-import { ApiRoom } from '@/features/rooms/api/ApiRoom'
 import { LoadingScreen } from '@/components/LoadingScreen'
 
 const Columns = ({ children }: { children?: ReactNode }) => {
@@ -146,18 +141,11 @@ const IntroText = styled('div', {
   },
 })
 
-export const Home = () => {
+const Home = () => {
   const { t } = useTranslation('home')
   const { isLoggedIn } = useUser()
 
-  const {
-    userChoices: { username },
-  } = usePersistentUserChoices()
-
-  const { mutateAsync: createRoom } = useCreateRoom()
-  const [laterRoom, setLaterRoom] = useState<null | ApiRoom>(null)
   const [redirectFailed, setRedirectFailed] = useState(false)
-
   const { data } = useConfig()
 
   useEffect(() => {
@@ -200,45 +188,7 @@ export const Home = () => {
               })}
             >
               {isLoggedIn ? (
-                <Menu>
-                  <Button variant="primary" data-attr="create-meeting">
-                    {t('createMeeting')}
-                  </Button>
-                  <RACMenu>
-                    <MenuItem
-                      className={
-                        menuRecipe({ icon: true, variant: 'light' }).item
-                      }
-                      onAction={async () => {
-                        const slug = generateRoomId()
-                        createRoom({ slug, username }).then((data) =>
-                          navigateTo('room', data.slug, {
-                            state: { create: true, initialRoomData: data },
-                          })
-                        )
-                      }}
-                      data-attr="create-option-instant"
-                    >
-                      <RiAddLine size={18} />
-                      {t('createMenu.instantOption')}
-                    </MenuItem>
-                    <MenuItem
-                      className={
-                        menuRecipe({ icon: true, variant: 'light' }).item
-                      }
-                      onAction={() => {
-                        const slug = generateRoomId()
-                        createRoom({ slug, username }).then((data) =>
-                          setLaterRoom(data)
-                        )
-                      }}
-                      data-attr="create-option-later"
-                    >
-                      <RiLink size={18} />
-                      {t('createMenu.laterOption')}
-                    </MenuItem>
-                  </RACMenu>
-                </Menu>
+                <CreateMeetingMenu />
               ) : (
                 <LoginButton proConnectHint={false} />
               )}
@@ -264,11 +214,9 @@ export const Home = () => {
             <IntroSlider />
           </RightColumn>
         </Columns>
-        <LaterMeetingDialog
-          room={laterRoom}
-          onOpenChange={() => setLaterRoom(null)}
-        />
       </Screen>
     </UserAware>
   )
 }
+
+export default Home

src/frontend/src/features/layout/components/ControlBarRegion.tsx

@@ -12,7 +12,7 @@ const controlBarRegion = cva({
   variants: {
     mobile: {
       true: {
-        justifyContent: 'space-between',
+        justifyContent: 'center',
         width: '330px',
       },
     },
@@ -22,6 +22,8 @@ const controlBarRegion = cva({
   },
 })
 
+export const CONTROL_BAR_REGION_ID = 'control-bar-region'
+
 export type ControlBarRegionProps = React.HTMLAttributes<HTMLDivElement> &
   RecipeVariantProps<typeof controlBarRegion>
 
@@ -34,6 +36,7 @@ export function ControlBarRegion({
   return (
     <div
       role="region"
+      id={CONTROL_BAR_REGION_ID}
       aria-label={t('controls.region')}
       className={controlBarRegion({ mobile })}
       {...props}

src/frontend/src/features/legalsTerms/Accessibility.tsx

@@ -3,7 +3,7 @@ import { H, P, A, Italic, Ul } from '@/primitives'
 import { HStack } from '@/styled-system/jsx'
 import { useTranslation } from 'react-i18next'
 
-export const AccessibilityRoute = () => {
+const AccessibilityRoute = () => {
   const { t } = useTranslation('accessibility', { keyPrefix: 'accessibility' })
 
   return (
@@ -78,3 +78,5 @@ export const AccessibilityRoute = () => {
     </Screen>
   )
 }
+
+export default AccessibilityRoute

src/frontend/src/features/legalsTerms/LegalTermsRoute.tsx

@@ -4,7 +4,7 @@ import { css } from '@/styled-system/css'
 import { HStack } from '@/styled-system/jsx'
 import { useTranslation } from 'react-i18next'
 
-export const LegalTermsRoute = () => {
+const LegalTermsRoute = () => {
   const { t } = useTranslation('legals')
 
   const indentedStyle = css({
@@ -72,3 +72,5 @@ export const LegalTermsRoute = () => {
     </Screen>
   )
 }
+
+export default LegalTermsRoute

src/frontend/src/features/legalsTerms/TermsOfService.tsx

@@ -12,7 +12,7 @@ const ensureArray = (value: any) => {
 }
 /* eslint-enable @typescript-eslint/no-explicit-any */
 
-export const TermsOfServiceRoute = () => {
+const TermsOfServiceRoute = () => {
   const { t } = useTranslation('termsOfService')
 
   return (
@@ -199,3 +199,5 @@ export const TermsOfServiceRoute = () => {
     </Screen>
   )
 }
+
+export default TermsOfServiceRoute

src/frontend/src/features/notifications/MainNotificationToast.tsx

@@ -1,24 +1,19 @@
-import { useCallback, useEffect, useRef } from 'react'
+import { useCallback, useEffect } from 'react'
 import { useRoomContext } from '@livekit/components-react'
 import { Participant, RemoteParticipant, RoomEvent } from 'livekit-client'
-import { ChatMessage, isMobileBrowser } from '@livekit/components-core'
+import { type ChatMessage, isMobileBrowser } from '@livekit/components-core'
 import { useTranslation } from 'react-i18next'
-import { Div } from '@/primitives'
 import { NotificationType } from './NotificationType'
 import { NotificationDuration } from './NotificationDuration'
 import { decodeNotificationDataReceived } from './utils'
 import { useNotificationSound } from '@/features/notifications/hooks/useSoundNotification'
-import { ToastProvider, toastQueue } from './components/ToastProvider'
-import { WaitingParticipantNotification } from './components/WaitingParticipantNotification'
+import { toastQueue } from './components/ToastProvider'
 import { layoutStore } from '@/stores/layout'
 import { PanelId } from '@/features/rooms/livekit/hooks/useSidePanel'
 import { useScreenReaderAnnounce } from '@/hooks/useScreenReaderAnnounce'
 import { Emoji } from '@/features/reactions/types'
 import { useReactions } from '@/features/reactions/hooks/useReactions'
-
-// Sliding window of recent chat ids kept for deduplication. Sized to comfortably
-// cover bursts and re-emits while staying negligible in memory.
-const MAX_TRACKED_CHAT_IDS = 16
+import { NotificationProvider } from './NotificationProvider'
 
 export const MainNotificationToast = () => {
   const room = useRoomContext()
@@ -28,23 +23,12 @@ export const MainNotificationToast = () => {
 
   const { appendReaction } = useReactions()
 
-  // Multiple Chat instances may re-emit the same RoomEvent.ChatMessage.
-  // Dedupe against a small ring of recent ids.
-  const seenChatMsgIdsRef = useRef<string[]>([])
-
   useEffect(() => {
     const handleChatMessage = (
       chatMessage: ChatMessage,
       participant?: Participant | undefined
     ) => {
       if (!participant || participant.isLocal) return
-      const id = chatMessage.id
-      if (id) {
-        const seen = seenChatMsgIdsRef.current
-        if (seen.includes(id)) return
-        seen.push(id)
-        if (seen.length > MAX_TRACKED_CHAT_IDS) seen.shift()
-      }
       triggerNotificationSound(NotificationType.MessageReceived)
       toastQueue.add(
         {
@@ -248,10 +232,5 @@ export const MainNotificationToast = () => {
   // the 'notifications' namespace might not be loaded yet
   useTranslation(['notifications'])
 
-  return (
-    <Div position="absolute" bottom={0} right={5} zIndex={1000}>
-      <ToastProvider />
-      <WaitingParticipantNotification />
-    </Div>
-  )
+  return <NotificationProvider />
 }

src/frontend/src/features/notifications/NotificationPayload.ts

@@ -1,4 +1,4 @@
-import { NotificationType } from './NotificationType'
+import type { NotificationType } from './NotificationType'
 
 export interface NotificationPayload {
   type: NotificationType

src/frontend/src/features/notifications/NotificationProvider.tsx

@@ -0,0 +1,16 @@
+import { Div } from '@/primitives'
+import { ToastProvider } from './components/ToastProvider'
+import { WaitingParticipantNotification } from './components/WaitingParticipantNotification'
+
+export const NotificationProvider = ({
+  bottom = 0,
+  right = 5,
+}: {
+  bottom?: number
+  right?: number
+}) => (
+  <Div position="absolute" bottom={bottom} right={right} zIndex={1000}>
+    <ToastProvider />
+    <WaitingParticipantNotification />
+  </Div>
+)

src/frontend/src/features/notifications/components/Toast.tsx

@@ -1,10 +1,10 @@
 import { useToast } from '@react-aria/toast'
 import { Button } from '@/primitives'
 import { RiCloseLine } from '@remixicon/react'
-import { ToastState } from '@react-stately/toast'
 import { styled } from '@/styled-system/jsx'
 import { useRef } from 'react'
-import { ToastData } from './ToastProvider'
+import type { ToastState } from '@react-stately/toast'
+import type { ToastData } from './ToastProvider'
 import type { QueuedToast } from '@react-stately/toast'
 
 export const StyledToastContainer = styled('div', {

src/frontend/src/features/notifications/components/ToastAnyRecording.tsx

@@ -1,7 +1,7 @@
 import { useToast } from '@react-aria/toast'
 import { useMemo, useRef } from 'react'
 
-import { StyledToastContainer, ToastProps } from './Toast'
+import { StyledToastContainer, type ToastProps } from './Toast'
 import { HStack } from '@/styled-system/jsx'
 import { useTranslation } from 'react-i18next'
 import { NotificationType } from '../NotificationType'

src/frontend/src/features/notifications/components/ToastJoined.tsx

@@ -6,7 +6,7 @@ import Source = Track.Source
 
 import { useMaybeLayoutContext } from '@livekit/components-react'
 import { ParticipantTile } from '@/features/rooms/livekit/components/ParticipantTile'
-import { StyledToastContainer, ToastProps } from './Toast'
+import { StyledToastContainer, type ToastProps } from './Toast'
 import { HStack, styled } from '@/styled-system/jsx'
 import { Div } from '@/primitives'
 import { useTranslation } from 'react-i18next'

src/frontend/src/features/notifications/components/ToastLowerHand.tsx

@@ -1,7 +1,7 @@
 import { useToast } from '@react-aria/toast'
 import { useRef } from 'react'
 
-import { StyledToastContainer, ToastProps } from './Toast'
+import { StyledToastContainer, type ToastProps } from './Toast'
 import { HStack } from '@/styled-system/jsx'
 import { useTranslation } from 'react-i18next'
 import { Button } from '@/primitives'

src/frontend/src/features/notifications/components/ToastMessageReceived.tsx

@@ -1,7 +1,7 @@
 import { useToast } from '@react-aria/toast'
 import { useEffect, useRef } from 'react'
 
-import { StyledToastContainer, ToastProps } from './Toast'
+import { StyledToastContainer, type ToastProps } from './Toast'
 import { Text } from '@/primitives'
 import { RiMessage2Line } from '@remixicon/react'
 import { useSidePanel } from '@/features/rooms/livekit/hooks/useSidePanel'

src/frontend/src/features/notifications/components/ToastMuted.tsx

@@ -1,7 +1,7 @@
 import { useToast } from '@react-aria/toast'
 import { useRef } from 'react'
 
-import { StyledToastContainer, ToastProps } from './Toast'
+import { StyledToastContainer, type ToastProps } from './Toast'
 import { HStack } from '@/styled-system/jsx'
 import { useTranslation } from 'react-i18next'
 

src/frontend/src/features/notifications/components/ToastPermissionsRemoved.tsx

@@ -1,7 +1,7 @@
 import { useToast } from '@react-aria/toast'
 import { useMemo, useRef } from 'react'
 
-import { StyledToastContainer, ToastProps } from './Toast'
+import { StyledToastContainer, type ToastProps } from './Toast'
 import { HStack } from '@/styled-system/jsx'
 import { useTranslation } from 'react-i18next'
 

src/frontend/src/features/notifications/components/ToastProvider.tsx

@@ -2,7 +2,7 @@
 import { ToastQueue, useToastQueue } from '@react-stately/toast'
 import { ToastRegion } from './ToastRegion'
 import { Participant } from 'livekit-client'
-import { NotificationType } from '../NotificationType'
+import type { NotificationType } from '../NotificationType'
 
 export interface ToastData {
   participant?: Participant

src/frontend/src/features/notifications/components/ToastRaised.tsx

@@ -1,7 +1,7 @@
 import { useToast } from '@react-aria/toast'
 import { useRef } from 'react'
 
-import { StyledToastContainer, ToastProps } from './Toast'
+import { StyledToastContainer, type ToastProps } from './Toast'
 import { HStack } from '@/styled-system/jsx'
 import { Button, Div } from '@/primitives'
 import { useTranslation } from 'react-i18next'