🐛(backend) acknowledge unknown LiveKit webhook events instead of 422

Around 0.76% of incoming LiveKit webhooks were being flagged as
unprocessable and returned a 422, even though LiveKit was sending
legitimate data — just with event types we do not handle. This
inflated error metrics and made real webhook issues harder to spot.

Return a 200 for these webhooks instead. When a new, unhandled
event type shows up, log a warning so we can decide whether it is
worth adding explicit handling.

CHANGELOG.md

@@ -8,17 +8,10 @@ and this project adheres to
 
 ## [Unreleased]
 
-### Changed
-
-- 📈(frontend) include LiveKit SIDs in the connection analytics event
-- 🔇(backend) silence expected 401 warnings on /me
-- 🔇(backend) silence noisy request summary info logs
-
 ### Fixed
 
 - 🐛(backend) acknowledge unknown LiveKit webhook events instead of 422
 - 🔒️(backend) enforce display name setting on rename API
-- 🔒️(backend) reject inactive users in resource server backend
 
 ## [1.31.0] - 2026-09-08
 

src/backend/core/external_api/authentication.py

@@ -286,10 +286,6 @@ class ResourceServerBackend(LaSuiteBackend):
         if user is None and settings.OIDC_CREATE_USER:
             user = self.create_user(sub)
 
-        if user is not None and not user.is_active:
-            logger.warning("Inactive user attempted authentication: %s", user.pk)
-            raise SuspiciousOperation("User account is disabled.")
-
         return user
 
     def create_user(self, sub):

src/backend/core/logging_filters.py

@@ -1,25 +0,0 @@
-"""Logging filters for the core application."""
-
-import logging
-
-from django.conf import settings
-
-
-class SilenceExpected401(logging.Filter):
-    """Drop the expected 401 from anonymous hits on the /me endpoint.
-
-    The frontend probes `/users/me/` to check authentication; a 401 for
-    anonymous users is normal, not a warning worth logging.
-    """
-
-    def filter(self, record):
-        """Return False for a 401 on a silenced path, True otherwise."""
-        if getattr(record, "status_code", None) != 401:
-            return True
-
-        request = getattr(record, "request", None)
-        path = getattr(request, "path", None)
-        if not path:
-            return True
-
-        return path not in settings.LOGGING_SILENCED_401_PATHS

src/backend/core/tests/test_external_api_authentication.py

@@ -1,96 +0,0 @@
-"""Tests for the external API ResourceServerBackend."""
-
-from django.core.exceptions import SuspiciousOperation
-
-import pytest
-import responses
-from rest_framework.test import APIClient
-
-from core.external_api.authentication import ResourceServerBackend
-from core.factories import UserFactory
-from core.models import User
-
-pytestmark = pytest.mark.django_db
-
-
-def _payload(sub):
-    return {"sub": sub, "active": True, "scope": "lasuite_meet", "client_id": "app"}
-
-
-def test_resource_server_backend_get_or_create_user_active():
-    """An existing active user matching the sub should be returned."""
-
-    user = UserFactory()
-
-    result = ResourceServerBackend().get_or_create_user(
-        access_token="token", id_token=None, payload=_payload(user.sub)
-    )
-
-    assert result == user
-
-
-def test_resource_server_backend_get_or_create_user_inactive():
-    """An inactive user should be rejected even with a valid token."""
-
-    user = UserFactory(is_active=False)
-
-    with pytest.raises(SuspiciousOperation, match="User account is disabled."):
-        ResourceServerBackend().get_or_create_user(
-            access_token="token", id_token=None, payload=_payload(user.sub)
-        )
-
-
-def test_resource_server_backend_get_or_create_user_creates(settings):
-    """An unknown sub should create an active user when OIDC_CREATE_USER is set."""
-
-    settings.OIDC_CREATE_USER = True
-
-    result = ResourceServerBackend().get_or_create_user(
-        access_token="token", id_token=None, payload=_payload("new-sub")
-    )
-
-    assert result.sub == "new-sub"
-    assert result.is_active is True
-    assert User.objects.filter(sub="new-sub").exists()
-
-
-def test_resource_server_backend_get_or_create_user_no_creation(settings):
-    """An unknown sub should return None when OIDC_CREATE_USER is unset."""
-
-    settings.OIDC_CREATE_USER = False
-
-    result = ResourceServerBackend().get_or_create_user(
-        access_token="token", id_token=None, payload=_payload("new-sub")
-    )
-
-    assert result is None
-    assert not User.objects.filter(sub="new-sub").exists()
-
-
-@responses.activate
-def test_api_rooms_list_resource_server_inactive_user(settings):
-    """End to end: a valid introspected token for an inactive user should get 401."""
-
-    settings.OIDC_OP_INTROSPECTION_ENDPOINT = "https://oidc.example.com/introspect"
-    settings.OIDC_OP_URL = "https://oidc.example.com"
-
-    user = UserFactory(is_active=False)
-
-    responses.add(
-        responses.POST,
-        "https://oidc.example.com/introspect",
-        json={
-            "iss": "https://oidc.example.com",
-            "active": True,
-            "sub": user.sub,
-            "scope": "openid lasuite_meet rooms:list",
-            "client_id": "app",
-        },
-    )
-
-    client = APIClient()
-    client.credentials(HTTP_AUTHORIZATION="Bearer rs-token")
-    response = client.get("/external-api/v1.0/rooms/")
-
-    assert response.status_code == 401
-    assert "login failed" in str(response.data).lower()

src/backend/meet/settings.py

@@ -1110,12 +1110,6 @@ class Base(Configuration):
         environ_prefix=None,
     )
 
-    LOGGING_SILENCED_401_PATHS = values.ListValue(
-        default=["/api/v1.0/users/me/"],
-        environ_name="LOGGING_SILENCED_401_PATHS",
-        environ_prefix=None,
-    )
-
     # Logging
     # We want to make it easy to log to console but by default we log production
     # to Sentry and don't want to log to console.
@@ -1128,16 +1122,10 @@ class Base(Configuration):
                 "style": "{",
             },
         },
-        "filters": {
-            "silence_expected_401": {
-                "()": "core.logging_filters.SilenceExpected401",
-            },
-        },
         "handlers": {
             "console": {
                 "class": "logging.StreamHandler",
                 "formatter": "simple",
-                "filters": ["silence_expected_401"],
             },
         },
         # Override root logger to send it to console
@@ -1148,13 +1136,6 @@ class Base(Configuration):
             ),
         },
         "loggers": {
-            "request.summary": {
-                "level": values.Value(
-                    "WARNING",
-                    environ_name="LOGGING_LEVEL_REQUEST_SUMMARY",
-                    environ_prefix="",
-                )
-            },
             "core": {
                 "handlers": ["console"],
                 "level": values.Value(

src/frontend/src/features/rooms/livekit/components/ConnectionObserver.tsx

@@ -71,30 +71,20 @@ export const ConnectionObserver = () => {
   useEffect(() => {
     if (!isAnalyticsEnabled) return
 
-    const handleConnection = async () => {
+    const handleConnection = () => {
       // Preserve original connection timestamp across reconnections to measure
       // total session duration from first connect to final disconnect.
       if (connectionStartTimeRef.current != null) return
       connectionStartTimeRef.current = Date.now()
-      const participantSid = room.localParticipant.sid
-      const roomSid = await room.getSid().catch(() => undefined)
-      void captureMediaEvent('connection-event', {
-        livekit_room_sid: roomSid,
-        livekit_participant_sid: participantSid,
-      })
+      void captureMediaEvent('connection-event', {})
     }
 
     const handleReconnect = () => {
       captureEvent('reconnect-event')
     }
 
-    const handleReconnected = async () => {
-      const participantSid = room.localParticipant.sid
-      const roomSid = await room.getSid().catch(() => undefined)
-      captureEvent('reconnected-event', {
-        livekit_room_sid: roomSid,
-        livekit_participant_sid: participantSid,
-      })
+    const handleReconnected = () => {
+      captureEvent('reconnected-event')
     }
 
     const handleSignalingConnect = () => {