🚨(ci) fix the shellcheck job

Get the shellcheck CI job to pass again by addressing the issues it
flagged across our shell scripts.

Note: I am not 100% sure of every fix applied here. Reviewers should
feel free to challenge specific changes and suggest better ones
where relevant.

.codespellrc

@@ -0,0 +1,9 @@
+[codespell]
+# Files that are not English, or generated
+skip = ./.git,*.pdf,*.po,*.pot,*.json,*.lock,package-lock.json,
+  ./LICENSES,
+  ./src/summary/summary/core/locales,
+  ./src/summary/summary/core/prompt.py
+# Valid words in French (connexion) or in the code (statics)
+ignore-words-list = connexion,statics
+check-filenames = true

.github/ISSUE_TEMPLATE/Bug_report.md

@@ -1,28 +0,0 @@
----
-name: 🐛 Bug Report
-about: If something is not working as expected 🤔.
-
----
-
-## Bug Report
-
-**Problematic behavior**
-A clear and concise description of the behavior.
-
-**Expected behavior/code**
-A clear and concise description of what you expected to happen (or code).
-
-**Steps to Reproduce**
-1. Do this...
-2. Then this...
-3. And then the bug happens!
-
-**Environment**
-- Meet version:
-- Platform:
-
-**Possible Solution**
-<!--- Only if you have suggestions on a fix for the bug -->
-
-**Additional context/Screenshots**
-Add any other context about the problem here. If applicable, add screenshots to help explain.

.github/ISSUE_TEMPLATE/Feature_request.md

@@ -1,23 +0,0 @@
----
-name: ✨ Feature Request
-about: I have a suggestion (and may want to build it 💪)!
-
----
-
-## Feature Request
-
-**Is your feature request related to a problem or unsupported use case? Please describe.**
-A clear and concise description of what the problem is. For example: I need to do some task and I have an issue...
-
-**Describe the solution you'd like**
-A clear and concise description of what you want to happen. Add any considered drawbacks.
-
-**Describe alternatives you've considered**
-A clear and concise description of any alternative solutions or features you've considered.
-
-**Discovery, Documentation, Adoption, Migration Strategy**
-If you can, explain how users will be able to use this and possibly write out a version the docs (if applicable).
-Maybe a screenshot or design?
-
-**Do you want to work on it through a Pull Request?**
-<!-- Make sure to coordinate with us before you spend too much time working on an implementation! -->

.github/ISSUE_TEMPLATE/Support_question.md

@@ -1,22 +0,0 @@
----
-name: 🤗 Support Question
-about: If you have a question 💬, or something was not clear from the docs!
-
----
-
-<!-- ^ Click "Preview" for a nicer view! ^
-We primarily use GitHub as an issue tracker. If however you're encountering an issue not covered in the docs, we may be able to help! -->
-
----
-
-Please make sure you have read our [main Readme](https://github.com/numerique-gouv/meet).
-
-Also make sure it was not already answered in [an open or close issue](https://github.com/numerique-gouv/meet/issues).
-
-If your question was not covered, and you feel like it should be, fire away! We'd love to improve our docs! 👌
-
-**Topic**
-What's the general area of your question: for example, docker setup, database schema, search functionality,...
-
-**Question**
-Try to be as specific as possible so we can help you as best we can. Please be patient 🙏

.github/PULL_REQUEST_TEMPLATE.md

@@ -1,11 +0,0 @@
-## Purpose
-
-Description...
-
-
-## Proposal
-
-Description...
-
-- [] item 1...
-- [] item 2...

.github/workflows/changelog.yml

@@ -0,0 +1,19 @@
+name: Changelog Workflow
+
+on:
+  push:
+    branches:
+      - main
+  pull_request:
+    types: [opened, synchronize, reopened, labeled, unlabeled]
+
+permissions:
+  contents: read
+
+concurrency:
+  group: ${{ github.workflow }}-${{ github.ref }}-${{ github.event.pull_request.number || github.sha }}
+  cancel-in-progress: true
+
+jobs:
+  changelog:
+    uses: suitenumerique/ci/.github/workflows/_changelog.yml@main

.github/workflows/ci.yml

@@ -11,180 +11,30 @@ permissions:
   contents: read
 
 jobs:
-  lint-git:
-    runs-on: ubuntu-latest
-    if: github.event_name == 'pull_request' # Makes sense only for pull requests
-    permissions:
-      contents: read
-    steps:
-      - name: Checkout repository
-        uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6.1.0
-        with:
-          fetch-depth: 0
-      - name: show
-        run: git log
-      - name: Enforce absence of print statements in code
-        if: always()
-        run: |
-          ! git diff origin/${{ github.event.pull_request.base.ref }}..HEAD -- . ':(exclude).github/workflows/**' | grep "print("
-      - name: Check absence of fixup commits
-        if: always()
-        run: |
-          ! git log | grep 'fixup!'
-      - name: Install uv
-        if: always()
-        uses: astral-sh/setup-uv@37802adc94f370d6bfd71619e3f0bf239e1f3b78 # v7.6.0
-      - name: Lint commit messages added to main
-        if: always()
-        run: uvx --no-build --from gitlint-core==0.19.1 gitlint --commits origin/${{ github.event.pull_request.base.ref }}..HEAD
 
-  check-changelog:
-    runs-on: ubuntu-latest
-    if: |
-      contains(github.event.pull_request.labels.*.name, 'noChangeLog') == false &&
-      github.event_name == 'pull_request'
-    permissions:
-        contents: read
-    steps:
-      - name: Checkout repository
-        uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6.1.0
-        with:
-          fetch-depth: 50
-      - name: Check that the CHANGELOG has been modified in the current branch
-        run: git diff --name-only ${{ github.event.pull_request.base.sha }} ${{ github.event.after }} | grep 'CHANGELOG.md'
-
-  lint-changelog:
-    runs-on: ubuntu-latest
-    permissions:
-      contents: read
-    steps:
-      - name: Checkout repository
-        uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6.1.0
-      - name: Check CHANGELOG max line length
-        run: |
-          max_line_length=$(cat CHANGELOG.md | grep -Ev "^\[.*\]: https://github.com" | wc -L)
-          if [ $max_line_length -ge 80 ]; then
-            echo "ERROR: CHANGELOG has lines longer than 80 characters."
-            exit 1
-          fi
-
-  build-mails:
-    runs-on: ubuntu-latest
-    permissions:
-      contents: read
-    defaults:
-      run:
-        working-directory: src/mail
-    steps:
-      - name: Checkout repository
-        uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6.1.0
-
-      - name: Install Node.js
-        uses: actions/setup-node@249970729cb0ef3589644e2896645e5dc5ba9c38 # v6.5.0
-        with:
-          node-version: "22"
-
-      - name: Restore the mail templates
-        uses: actions/cache@caa296126883cff596d87d8935842f9db880ef25 # v5.1.0
-        id: mail-templates
-        with:
-          path: "src/backend/core/templates/mail"
-          key: mail-templates-${{ hashFiles('src/mail/mjml') }}
-
-      - name: Install yarn
-        if: steps.mail-templates.outputs.cache-hit != 'true'
-        run: npm install -g --ignore-scripts yarn@1.22.22
-
-      - name: Install node dependencies
-        if: steps.mail-templates.outputs.cache-hit != 'true'
-        run: yarn install --frozen-lockfile --ignore-scripts
-
-      - name: Build mails
-        if: steps.mail-templates.outputs.cache-hit != 'true'
-        run: yarn build
-
-      - name: Cache mail templates
-        if: steps.mail-templates.outputs.cache-hit != 'true'
-        uses: actions/cache@caa296126883cff596d87d8935842f9db880ef25 # v5.1.0
-        with:
-          path: "src/backend/core/templates/mail"
-          key: mail-templates-${{ hashFiles('src/mail/mjml') }}
-
-  lint-back:
-    runs-on: ubuntu-latest
-    permissions:
-      contents: read
-    defaults:
-      run:
-        working-directory: src/backend
-    steps:
-      - name: Checkout repository
-        uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6.1.0
-      - name: Install Python
-        uses: actions/setup-python@ece7cb06caefa5fff74198d8649806c4678c61a1 # v6.3.0
-        with:
-          python-version: "3.13"
-      - name: Install uv
-        uses: astral-sh/setup-uv@37802adc94f370d6bfd71619e3f0bf239e1f3b78 # v7.6.0
-      - name: Install the project
-        run: uv sync --locked --all-extras
-
-      - name: Check code formatting with ruff
-        run: uv run --no-sync --no-build ruff format . --diff
-      - name: Lint code with ruff
-        run: uv run --no-sync --no-build ruff check .
-      - name: Lint code with pylint
-        run: uv run --no-sync --no-build pylint meet demo core
-
-  lint-agents:
-    runs-on: ubuntu-latest
-    permissions:
-      contents: read
-    defaults:
-      run:
-        working-directory: src/agents
-    steps:
-      - name: Checkout repository
-        uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6.1.0
-      - name: Install Python
-        uses: actions/setup-python@ece7cb06caefa5fff74198d8649806c4678c61a1 # v6.3.0
-        with:
-          python-version: "3.13"
-      - name: Install uv
-        uses: astral-sh/setup-uv@37802adc94f370d6bfd71619e3f0bf239e1f3b78 # v7.6.0
-      - name: Install the project
-        run: uv sync --locked --all-extras --no-build
-      - name: Check code formatting with ruff
-        run: uv run --no-sync --no-build ruff format . --diff
-      - name: Lint code with ruff
-        run: uv run --no-sync --no-build ruff check .
-
-  lint-summary:
-    runs-on: ubuntu-latest
-    permissions:
-      contents: read
-    defaults:
-      run:
-        working-directory: src/summary
-    steps:
-      - name: Checkout repository
-        uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6.1.0
-      - name: Install Python
-        uses: actions/setup-python@ece7cb06caefa5fff74198d8649806c4678c61a1 # v6.3.0
-        with:
-          python-version: "3.13"
-      - name: Install uv
-        uses: astral-sh/setup-uv@37802adc94f370d6bfd71619e3f0bf239e1f3b78 # v7.6.0
-      - name: Install the project
-        run: uv sync --locked --all-extras
-      - name: Check code formatting with ruff
-        run: uv run --no-sync --no-build ruff format . --diff
-      - name: Lint code with ruff
-        run: uv run --no-sync --no-build ruff check .
+  lint-python:
+    name: lint ${{ matrix.service }}
+    strategy:
+      fail-fast: false
+      matrix:
+        include:
+          - service: backend
+            working_directory: src/backend
+            pylint_targets: meet demo core
+          - service: agents
+            working_directory: src/agents
+            pylint_targets: ""
+          - service: summary
+            working_directory: src/summary
+            pylint_targets: ""
+    uses: suitenumerique/ci/.github/workflows/_python-lint.yml@main
+    with:
+      working_directory: ${{ matrix.working_directory }}
+      python_version: "3.13"
+      pylint_targets: ${{ matrix.pylint_targets }}
 
   test-back:
     runs-on: ubuntu-latest
-    needs: build-mails
     permissions:
       contents: read
     defaults:
@@ -243,12 +93,8 @@ jobs:
           sudo mkdir -p /data/media && \
           sudo mkdir -p /data/static
 
-      - name: Restore the mail templates
-        uses: actions/cache@caa296126883cff596d87d8935842f9db880ef25 # v5.1.0
-        id: mail-templates
-        with:
-          path: "src/backend/core/templates/mail"
-          key: mail-templates-${{ hashFiles('src/mail/mjml') }}
+      - name: Build or restore the mail templates
+        uses: suitenumerique/ci/actions/mail-templates@main
 
       - name: Start MinIO
         run: |

.github/workflows/code-quality.yml

@@ -0,0 +1,18 @@
+name: Project quality Workflow
+
+on:
+  pull_request:
+
+permissions:
+  contents: read
+
+concurrency:
+  group: ${{ github.workflow }}-${{ github.ref }}-${{ github.event.pull_request.number || github.sha }}
+  cancel-in-progress: true
+
+jobs:
+  quality:
+    uses: suitenumerique/ci/.github/workflows/_project-quality.yml@main
+    with:
+      print_check_paths: src/backend src/summary src/agents
+      codespell_ignore_words: ""

.github/workflows/crowdin-download.yml

@@ -1,33 +0,0 @@
-name: Download Crowdin translations
-
-on:
-  workflow_dispatch:
-    types: [file-fully-translated]
-
-permissions:
-  contents: write
-  pull-requests: write
-
-jobs:
-  crowdin:
-    runs-on: ubuntu-latest
-    steps:
-      - name: Checkout
-        uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6.1.0
-
-      - name: Download Crowdin files
-        uses: crowdin/github-action@c7af9bc98b01694653031fef2a0dc6c7888ce9bc # v2.17.0
-        with:
-          upload_sources: false
-          upload_translations: false
-          download_translations: true
-          localization_branch_name: l10n_crowdin_translations
-          create_pull_request: true
-          pull_request_title: "New Crowdin translations"
-          pull_request_body: "New Crowdin pull request with translations"
-          pull_request_base_branch_name: "main"
-        env:
-          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
-          CROWDIN_PROJECT_ID: ${{ secrets.CROWDIN_PROJECT_ID }}
-          CROWDIN_PERSONAL_TOKEN: ${{ secrets.CROWDIN_PERSONAL_TOKEN }}
-          CROWDIN_BASE_PATH: ${{ github.workspace }}

.github/workflows/docker-hub.yml

@@ -1,5 +1,5 @@
-name: Docker Hub Workflow
-run-name: Docker Hub Workflow
+name: Docker images
+run-name: Docker images
 
 on:
   workflow_dispatch:
@@ -15,265 +15,61 @@ on:
 permissions:
   contents: read
 
-env:
-  DOCKER_USER: 1001:127
-  DOCKER_CONTAINER_REGISTRY_HOSTNAME: docker.io
-  DOCKER_CONTAINER_REGISTRY_NAMESPACE: lasuite
-  IS_MULTI_PLATFORM_BUILD: ${{ startsWith(github.ref, 'refs/tags/v') }}
-  BUILD_PLATFORMS: ${{ startsWith(github.ref, 'refs/tags/v') && 'linux/amd64,linux/arm64' || 'linux/amd64' }}
-
 jobs:
-  build-and-push-backend:
-    runs-on: ubuntu-latest
-    permissions:
-      contents: read
-    steps:
-      -
-        name: Checkout repository
-        uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6.1.0
-      -
-        name: Set up QEMU
-        if: env.IS_MULTI_PLATFORM_BUILD == 'true'
-        uses: docker/setup-qemu-action@c7c53464625b32c7a7e944ae62b3e17d2b600130 # v3.7.0
-      -
-        name: Set up Docker Buildx
-        uses: docker/setup-buildx-action@8d2750c68a42422c14e847fe6c8ac0403b4cbd6f # v3.12.0
-      -
-        name: Docker meta
-        id: meta
-        uses: docker/metadata-action@c299e40c65443455700f0fdfc63efafe5b349051 # v5.10.0
-        with:
-          images: '${{ env.DOCKER_CONTAINER_REGISTRY_NAMESPACE }}/meet-backend'
-      -
-        name: Login to DockerHub
-        if: github.event_name != 'pull_request' || startsWith(github.head_ref, 'integration/')
-        uses: docker/login-action@c94ce9fb468520275223c153574b00df6fe4bcc9 # v3.7.0
-        with:
-          username: ${{ secrets.DOCKER_HUB_USER }}
-          password: ${{ secrets.DOCKER_HUB_PASSWORD }}
-      -
-        name: Run trivy scan
-        uses: numerique-gouv/action-trivy-cache@d6e94cfb488f03a0b3e8b8739aad94e74d24d8da # main
-        with:
-          docker-build-args: '--target backend-production -f Dockerfile'
-          docker-image-name: '${{ env.DOCKER_CONTAINER_REGISTRY_HOSTNAME }}/${{ env.DOCKER_CONTAINER_REGISTRY_NAMESPACE }}/meet-backend:${{ github.sha }}'
-      -
-        name: Build and push
-        uses: docker/build-push-action@10e90e3645eae34f1e60eeb005ba3a3d33f178e8 # v6.19.2
-        with:
-          context: .
-          target: backend-production
-          platforms: ${{ env.BUILD_PLATFORMS }}
-          build-args: DOCKER_USER=${{ env.DOCKER_USER }}:-1000
-          push: ${{ github.event_name != 'pull_request' || startsWith(github.head_ref, 'integration/') }}
-          tags: ${{ steps.meta.outputs.tags }}
-          labels: ${{ steps.meta.outputs.labels }}
-
-  build-and-push-frontend-generic:
-    runs-on: ubuntu-latest
-    permissions:
-      contents: read
-    steps:
-      -
-        name: Checkout repository
-        uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6.1.0
-      -
-        name: Set up QEMU
-        if: env.IS_MULTI_PLATFORM_BUILD == 'true'
-        uses: docker/setup-qemu-action@c7c53464625b32c7a7e944ae62b3e17d2b600130 # v3.7.0
-      -
-        name: Set up Docker Buildx
-        uses: docker/setup-buildx-action@8d2750c68a42422c14e847fe6c8ac0403b4cbd6f # v3.12.0
-      -
-        name: Docker meta
-        id: meta
-        uses: docker/metadata-action@c299e40c65443455700f0fdfc63efafe5b349051 # v5.10.0
-        with:
-          images: '${{ env.DOCKER_CONTAINER_REGISTRY_NAMESPACE }}/meet-frontend'
-      -
-        name: Login to DockerHub
-        if: github.event_name != 'pull_request' || startsWith(github.head_ref, 'integration/')
-        uses: docker/login-action@c94ce9fb468520275223c153574b00df6fe4bcc9 # v3.7.0
-        with:
-          username: ${{ secrets.DOCKER_HUB_USER }}
-          password: ${{ secrets.DOCKER_HUB_PASSWORD }}
-      -
-        name: Run trivy scan
-        uses: numerique-gouv/action-trivy-cache@d6e94cfb488f03a0b3e8b8739aad94e74d24d8da # main
-        with:
-          docker-build-args: '-f src/frontend/Dockerfile --target frontend-production'
-          docker-image-name: '${{ env.DOCKER_CONTAINER_REGISTRY_HOSTNAME }}/${{ env.DOCKER_CONTAINER_REGISTRY_NAMESPACE }}/meet-frontend:${{ github.sha }}'
-      -
-        name: Build and push
-        uses: docker/build-push-action@10e90e3645eae34f1e60eeb005ba3a3d33f178e8 # v6.19.2
-        with:
-          context: .
-          file: ./src/frontend/Dockerfile
-          target: frontend-production
-          platforms: ${{ env.BUILD_PLATFORMS }}
-          build-args: DOCKER_USER=${{ env.DOCKER_USER }}:-1000
-          push: ${{ github.event_name != 'pull_request' || startsWith(github.head_ref, 'integration/') }}
-          tags: ${{ steps.meta.outputs.tags }}
-          labels: ${{ steps.meta.outputs.labels }}
-
-  build-and-push-frontend-dinum:
-    runs-on: ubuntu-latest
-    permissions:
-      contents: read
-    steps:
-      -
-        name: Checkout repository
-        uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6.1.0
-      -
-        name: Set up QEMU
-        if: env.IS_MULTI_PLATFORM_BUILD == 'true'
-        uses: docker/setup-qemu-action@c7c53464625b32c7a7e944ae62b3e17d2b600130 # v3.7.0
-      -
-        name: Set up Docker Buildx
-        uses: docker/setup-buildx-action@8d2750c68a42422c14e847fe6c8ac0403b4cbd6f # v3.12.0
-      -
-        name: Docker meta
-        id: meta
-        uses: docker/metadata-action@c299e40c65443455700f0fdfc63efafe5b349051 # v5.10.0
-        with:
-          images: '${{ env.DOCKER_CONTAINER_REGISTRY_NAMESPACE }}/meet-frontend-dinum'
-      -
-        name: Login to DockerHub
-        if: github.event_name != 'pull_request' || startsWith(github.head_ref, 'integration/')
-        uses: docker/login-action@c94ce9fb468520275223c153574b00df6fe4bcc9 # v3.7.0
-        with:
-          username: ${{ secrets.DOCKER_HUB_USER }}
-          password: ${{ secrets.DOCKER_HUB_PASSWORD }}
-      -
-        name: Run trivy scan
-        uses: numerique-gouv/action-trivy-cache@d6e94cfb488f03a0b3e8b8739aad94e74d24d8da # main
-        with:
-          docker-build-args: '-f docker/dinum-frontend/Dockerfile --target frontend-production'
-          docker-image-name: '${{ env.DOCKER_CONTAINER_REGISTRY_HOSTNAME }}/${{ env.DOCKER_CONTAINER_REGISTRY_NAMESPACE }}/meet-frontend-dinum:${{ github.sha }}'
-      -
-        name: Build and push
-        uses: docker/build-push-action@10e90e3645eae34f1e60eeb005ba3a3d33f178e8 # v6.19.2
-        with:
-          context: .
-          file: ./docker/dinum-frontend/Dockerfile
-          target: frontend-production
-          platforms: ${{ env.BUILD_PLATFORMS }}
-          build-args: DOCKER_USER=${{ env.DOCKER_USER }}:-1000
-          push: ${{ github.event_name != 'pull_request' || startsWith(github.head_ref, 'integration/') }}
-          tags: ${{ steps.meta.outputs.tags }}
-          labels: ${{ steps.meta.outputs.labels }}
-
-  build-and-push-summary:
-    runs-on: ubuntu-latest
-    permissions:
-      contents: read
-    steps:
-      -
-        name: Checkout repository
-        uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6.1.0
-      -
-        name: Set up QEMU
-        if: env.IS_MULTI_PLATFORM_BUILD == 'true'
-        uses: docker/setup-qemu-action@c7c53464625b32c7a7e944ae62b3e17d2b600130 # v3.7.0
-      -
-        name: Set up Docker Buildx
-        uses: docker/setup-buildx-action@8d2750c68a42422c14e847fe6c8ac0403b4cbd6f # v3.12.0
-      -
-        name: Docker meta
-        id: meta
-        uses: docker/metadata-action@c299e40c65443455700f0fdfc63efafe5b349051 # v5.10.0
-        with:
-          images: '${{ env.DOCKER_CONTAINER_REGISTRY_NAMESPACE }}/meet-summary'
-      -
-        name: Login to DockerHub
-        if: github.event_name != 'pull_request' || startsWith(github.head_ref, 'integration/')
-        uses: docker/login-action@c94ce9fb468520275223c153574b00df6fe4bcc9 # v3.7.0
-        with:
-          username: ${{ secrets.DOCKER_HUB_USER }}
-          password: ${{ secrets.DOCKER_HUB_PASSWORD }}
-      -
-        name: Run trivy scan
-        uses: numerique-gouv/action-trivy-cache@d6e94cfb488f03a0b3e8b8739aad94e74d24d8da # main
-        continue-on-error: true
-        with:
-          docker-build-args: '-f src/summary/Dockerfile --target production'
-          docker-image-name: '${{ env.DOCKER_CONTAINER_REGISTRY_HOSTNAME }}/${{ env.DOCKER_CONTAINER_REGISTRY_NAMESPACE }}/meet-summary:${{ github.sha }}'
-          docker-context: './src/summary'
-      -
-        name: Build and push
-        uses: docker/build-push-action@10e90e3645eae34f1e60eeb005ba3a3d33f178e8 # v6.19.2
-        with:
-          context: ./src/summary
-          file: ./src/summary/Dockerfile
-          target: production
-          platforms: ${{ env.BUILD_PLATFORMS }}
-          build-args: DOCKER_USER=${{ env.DOCKER_USER }}:-1000
-          push: ${{ github.event_name != 'pull_request' || startsWith(github.head_ref, 'integration/') }}
-          tags: ${{ steps.meta.outputs.tags }}
-          labels: ${{ steps.meta.outputs.labels }}
-
-  build-and-push-agents:
-    runs-on: ubuntu-latest
-    permissions:
-      contents: read
-    steps:
-      -
-        name: Checkout repository
-        uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6.1.0
-      -
-        name: Set up QEMU
-        if: env.IS_MULTI_PLATFORM_BUILD == 'true'
-        uses: docker/setup-qemu-action@c7c53464625b32c7a7e944ae62b3e17d2b600130 # v3.7.0
-      -
-        name: Set up Docker Buildx
-        uses: docker/setup-buildx-action@8d2750c68a42422c14e847fe6c8ac0403b4cbd6f # v3.12.0
-      -
-        name: Docker meta
-        id: meta
-        uses: docker/metadata-action@c299e40c65443455700f0fdfc63efafe5b349051 # v5.10.0
-        with:
-          images: lasuite/meet-agents
-      -
-        name: Login to DockerHub
-        if: github.event_name != 'pull_request' || startsWith(github.head_ref, 'integration/')
-        uses: docker/login-action@c94ce9fb468520275223c153574b00df6fe4bcc9 # v3.7.0
-        with:
-          username: ${{ secrets.DOCKER_HUB_USER }}
-          password: ${{ secrets.DOCKER_HUB_PASSWORD }}
-      -
-        name: Run trivy scan
-        uses: numerique-gouv/action-trivy-cache@d6e94cfb488f03a0b3e8b8739aad94e74d24d8da # main
-        continue-on-error: true
-        with:
-          docker-build-args: '-f src/agents/Dockerfile --target production'
-          docker-image-name: '${{ env.DOCKER_CONTAINER_REGISTRY_HOSTNAME }}/${{ env.DOCKER_CONTAINER_REGISTRY_NAMESPACE }}/meet-agents:${{ github.sha }}'
-          docker-context: './src/agents'
-      -
-        name: Build and push
-        uses: docker/build-push-action@10e90e3645eae34f1e60eeb005ba3a3d33f178e8 # v6.19.2
-        with:
-          context: ./src/agents
-          file: ./src/agents/Dockerfile
-          target: production
-          platforms: ${{ env.BUILD_PLATFORMS }}
-          build-args: DOCKER_USER=${{ env.DOCKER_USER }}:-1000
-          push: ${{ github.event_name != 'pull_request' || startsWith(github.head_ref, 'integration/') }}
-          tags: ${{ steps.meta.outputs.tags }}
-          labels: ${{ steps.meta.outputs.labels }}
+  build-and-push:
+    name: ${{ matrix.service }}
+    strategy:
+      fail-fast: false
+      matrix:
+        include:
+          - service: backend
+            image_name: lasuite/meet-backend
+            context: .
+            file: ./Dockerfile
+            target: backend-production
+          - service: frontend
+            image_name: lasuite/meet-frontend
+            context: .
+            file: ./src/frontend/Dockerfile
+            target: frontend-production
+          - service: frontend-dinum
+            image_name: lasuite/meet-frontend-dinum
+            context: .
+            file: ./docker/dinum-frontend/Dockerfile
+            target: frontend-production
+          - service: summary
+            image_name: lasuite/meet-summary
+            context: ./src/summary
+            file: ./src/summary/Dockerfile
+            target: production
+          - service: agents
+            image_name: lasuite/meet-agents
+            context: ./src/agents
+            file: ./src/agents/Dockerfile
+            target: production
+    uses: suitenumerique/ci/.github/workflows/_docker-publish.yml@main
+    with:
+      image_name: ${{ matrix.image_name }}
+      context: ${{ matrix.context }}
+      file: ${{ matrix.file }}
+      target: ${{ matrix.target }}
+      docker_user: "1001:127"
+      is_multi_platform: ${{ startsWith(github.ref, 'refs/tags/v') }}
+      should_push: ${{ github.event_name != 'pull_request' || startsWith(github.head_ref, 'integration/') }}
+      trivy_scan: true
+    secrets:
+      DOCKER_HUB_USER: ${{ secrets.DOCKER_HUB_USER }}
+      DOCKER_HUB_PASSWORD: ${{ secrets.DOCKER_HUB_PASSWORD }}
 
   notify-argocd:
     permissions:
       contents: read
     needs:
-      - build-and-push-frontend-generic
-      - build-and-push-frontend-dinum
-      - build-and-push-backend
-      - build-and-push-summary
-      - build-and-push-agents
+      - build-and-push
     runs-on: ubuntu-latest
     if: github.event_name != 'pull_request'
     steps:
-      - uses: numerique-gouv/action-argocd-webhook-notification@cac2ee67896eb13e84e804f60c4271370424eaa8 # main
+      - uses: suitenumerique/ci/actions/argocd-webhook-notification@main
         id: notify
         with:
           deployment_repo_path: "${{ secrets.DEPLOYMENT_REPO_URL }}"

.github/workflows/release-helm-chart.yaml

@@ -1,33 +1,17 @@
-name: Release Chart
-run-name: Release Chart
+name: Release Helm chart
 
 on:
   push:
+    branches:
+      - main
     paths:
       - src/helm/meet/**
 
+permissions:
+  contents: read
+
 jobs:
   release:
     permissions:
       contents: write
-    runs-on: ubuntu-latest
-    steps:
-      - name: Checkout
-        uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6.1.0
-        with:
-          fetch-depth: 0
-
-      - name: Cleanup
-        run: rm -rf ./src/helm/extra
-
-      - name: Install Helm
-        uses: azure/setup-helm@1a275c3b69536ee54be43f2070a358922e12c8d4 # v4.3.1
-        env:
-          GITHUB_TOKEN: "${{ secrets.GITHUB_TOKEN }}"
-
-      - name: Publish Helm charts
-        uses: numerique-gouv/helm-gh-pages@2cf477ae49d7c70037ceb1685803f4f7bad9b981 # add-overwrite-option
-        with:
-          charts_dir: ./src/helm
-          linting: on
-          token: ${{ secrets.GITHUB_TOKEN }}
+    uses: suitenumerique/ci/.github/workflows/_release-helm-chart.yml@main

.github/workflows/security.yml

@@ -0,0 +1,21 @@
+name: Security analysis
+
+on:
+  push:
+    branches:
+      - main
+  pull_request:
+    branches:
+      - "**"
+
+permissions: {}
+
+jobs:
+  zizmor:
+    permissions:
+      contents: read
+      actions: read
+      security-events: write
+    uses: suitenumerique/ci/.github/workflows/_zizmor.yml@main
+    with:
+      config: .github/zizmor.yml

.github/zizmor.yml

@@ -0,0 +1,5 @@
+rules:
+  unpinned-uses:
+    config:
+      policies:
+        "suitenumerique/*": ref-pin

CHANGELOG.md

@@ -8,13 +8,27 @@ and this project adheres to
 
 ## [Unreleased]
 
+## [1.32.1] - 2026-09-25
+
+### Fixed
+
+- 🔒️(backend) fix CVE-2026-73228 and CVE-2026-73229 in drf
+- 🔒️(agent) fix CRITICAL CVE-2026-63072 / CVE-2026-63073 in libssl3t64
+
+## [1.32.0] - 2026-09-25
+
 ### Added
 
 - ✨(backend) make the LiveKit default video codec configurable
 - 🔧(dev) add support for Bureautix workstations
+- ✨(frontend) add screen share zoom controls #1498
 
 ### Changed
 
+- 🔥(backend) remove unused API viewset and permission helpers
+- 🔊(backend) pin the dockerflow logger level to WARNING
+- 🚑️(summary) serve health endpoints with the dockerflow router
+- ♻️(backend) serve the dockerflow views early in the middleware stack
 - 📈(frontend) include LiveKit SIDs in the connection analytics event
 - 🔇(backend) silence expected 401 warnings on /me
 - 🔇(backend) silence noisy request summary info logs
@@ -23,15 +37,26 @@ and this project adheres to
 - ⬆️(frontend) upgrade posthog-js from 1.414.0 to 1.418.10
 - ⬆️(addons) upgrade i18next from 26.3.6 to 26.4.0
 - ⬆️(frontend) upgrade humanize-duration from 3.33.2 to 3.34.1
+- ⬆️(addons) upgrade i18next from 26.4.0 to 26.4.2
+- 🔖(helm) release chart 0.0.28
+- ♻️(backend) decouple recording event handling from LiveKit egress statuses
 
 ### Fixed
 
+- 🐛(helm) probe liveness on __lbheartbeat__ and readiness on __heartbeat__
+- 🐛(helm) render periodSeconds and failureThreshold on probes
 - 🐛(backend) report the app release to Sentry instead of "NA"
 - 🐛(frontend) play the waiting room notification sound on every arrival
+- 🐛(frontend) apply saved reception resolution when joining a meeting #1714
 - 🐛(backend) acknowledge unknown LiveKit webhook events instead of 422
 - 🔒️(backend) enforce display name setting on rename API
 - 🔒️(backend) reject inactive users in resource server backend
 - 🐛(frontend) fix file permissions in the Docker image
+- 🚸(frontend) inform user that recording waits until a track is published
+- 🔒(backend) upgrade base image to python:3.13.5-alpine3.24
+- 🐛(backend) handle failed and aborted egresses
+- 🩹(frontend) notify participants when a recording fails or is aborted
+- 🔒️(frontend) fix HIGH CVE-2026-93990 in libexpat
 
 ## [1.31.0] - 2026-09-08
 
@@ -349,7 +374,7 @@ and this project adheres to
 
 ### Fixed
 
-- ♿️(frontend) improve accessibilty of the Effects panel #1401
+- ♿️(frontend) improve accessibility of the Effects panel #1401
 
 ## [1.20.0] - 2026-06-12
 

Dockerfile

@@ -1,7 +1,7 @@
 # Django Meet
 
 # ---- base image to inherit from ----
-FROM python:3.13.5-alpine3.21 AS base
+FROM python:3.13.15-alpine3.24 AS base
 
 # Upgrade pip to its latest release to speed up dependencies installation
 RUN python -m pip install --upgrade pip

bin/_config.sh

@@ -55,12 +55,12 @@ function _docker_compose() {
 function _dc_run() {
     _set_user
 
-    user_args="--user=$USER_ID"
-    if [ -z $USER_ID ]; then
-        user_args=""
+    user_args=()
+    if [ -n "$USER_ID" ]; then
+        user_args=("--user=$USER_ID")
     fi
 
-    _docker_compose run --rm $user_args "$@"
+    _docker_compose run --rm "${user_args[@]}" "$@"
 }
 
 # _dc_exec: wrap docker compose exec command
@@ -74,12 +74,12 @@ function _dc_exec() {
 
     echo "🐳(compose) exec command: '\$@'"
 
-    user_args="--user=$USER_ID"
-    if [ -z $USER_ID ]; then
-        user_args=""
+    user_args=()
+    if [ -n "$USER_ID" ]; then
+        user_args=("--user=$USER_ID")
     fi
 
-    _docker_compose exec $user_args "$@"
+    _docker_compose exec "${user_args[@]}" "$@"
 }
 
 # _django_manage: wrap django's manage.py command with docker compose

bin/buildpack_postfrontend.sh

@@ -40,7 +40,7 @@ if [ -n "$CUSTOM_LOGO_URL" ]; then
     [[ "$IS_SVG" == false ]] && echo "[custom-logo] ERROR: not a valid SVG file" >&2 && exit 1
 
     mv -f "$TMP_FILE" "$LOGO_FILE"
-    echo "[custom-logo] INFO: Custom logo downloaded successfuly"
+    echo "[custom-logo] INFO: Custom logo downloaded successfully"
 fi
 
 mv src/backend/* ./

bin/buildpack_start.sh

@@ -7,7 +7,7 @@ gunicorn -b 0.0.0.0:8000 meet.wsgi:application --log-file - &
 bin/run &
 
 # if the current shell is killed, also terminate all its children     
-trap "pkill SIGTERM -P $$" SIGTERM
+trap 'pkill -TERM -P $$' SIGTERM
 
 # wait for a single child to finish,
 wait -n

bin/install-external-secrets.sh

@@ -1,7 +1,6 @@
 #!/usr/bin/env bash
 set -o errexit
 
-CURRENT_DIR=$(pwd)
 NAMESPACE=${1:-meet}
 SECRET_NAME=${2:-bitwarden-cli-meet}
 TEMP_SECRET_FILE=$(mktemp)
@@ -30,10 +29,10 @@ check_secret_exists() {
 # Collect user input securely
 get_user_input() {
     echo "Please provide the following information:"
-    read -p "Enter your Vaultwarden email login: " LOGIN
-    read -s -p "Enter your Vaultwarden password: " PASSWORD
+    read -r -p "Enter your Vaultwarden email login: " LOGIN
+    read -r -s -p "Enter your Vaultwarden password: " PASSWORD
     echo
-    read -p "Enter your Vaultwarden server url: " URL
+    read -r -p "Enter your Vaultwarden server url: " URL
 }
 
 # Create and apply the secret
@@ -77,7 +76,7 @@ main() {
         exit 0
     fi
 
-    echo -e ${TEMP_SECRET_FILE}
+    echo -e "${TEMP_SECRET_FILE}"
 
     get_user_input
     echo -e "\nCreating Vaultwarden secret…"

bin/install-hooks.sh

@@ -3,7 +3,7 @@
 mkdir -p "$(dirname -- "${BASH_SOURCE[0]}")/../.git/hooks/"
 PRE_COMMIT_FILE="$(dirname -- "${BASH_SOURCE[0]}")/../.git/hooks/pre-commit"
 
-cat <<'EOF' >$PRE_COMMIT_FILE
+cat <<'EOF' >"$PRE_COMMIT_FILE"
 #!/bin/bash
 
 # directories containing potential secrets
@@ -27,4 +27,4 @@ for d in $DIRS; do
 done
 EOF
 
-chmod +x $PRE_COMMIT_FILE
+chmod +x "$PRE_COMMIT_FILE"

bin/prepare-release.sh

@@ -68,7 +68,7 @@ fi
 
 # Ask user for release version number
 echo ""
-read -p "Enter release version number (e.g., 1.2.3): " VERSION
+read -r -p "Enter release version number (e.g., 1.2.3): " VERSION
 
 # Validate version format (basic semver check)
 if ! [[ $VERSION =~ ^[0-9]+\.[0-9]+\.[0-9]+$ ]]; then

bin/update-git-submodule.sh

@@ -1,4 +1,5 @@
 #!/usr/bin/env bash
 
 git submodule update --init --recursive
+# shellcheck disable=SC2016
 git submodule foreach 'git fetch origin; git checkout $(git rev-parse --abbrev-ref HEAD); git reset --hard origin/$(git rev-parse --abbrev-ref HEAD); git submodule update --recursive; git clean -dfx'

bin/validate-helm-configuration.sh

@@ -8,6 +8,6 @@ environments=$(awk '/environments:/ {flag=1; next} flag && NF {print} !NF {flag=
 
 for env in $environments; do
 	echo "################### $env lint ###################"
-	helmfile -e $env -f src/helm/helmfile.yaml lint || exit 1
+	helmfile -e "$env" -f src/helm/helmfile.yaml lint || exit 1
 	echo -e "\n"
 done

docker/compose.d/compose.bureautix.yml

@@ -1,7 +1,7 @@
 # Bureautix proxy overrides
 #
 # Builds submitted through the Docker API of the Podman service get none of
-# the proxy variables in their RUN steps. We need to pass the http_proxy explicitely
+# the proxy variables in their RUN steps. We need to pass the http_proxy explicitly
 # otherwise all connections fail during the build.
 
 x-proxy-vars: &proxy-vars

docker/dinum-frontend/Dockerfile

@@ -57,7 +57,8 @@ RUN npx webpack --mode production
 FROM nginxinc/nginx-unprivileged:1.30.4-alpine3.24 AS frontend-production
 
 USER root
-RUN apk del curl
+RUN apk upgrade --no-cache libexpat && \
+    apk del curl
 USER nginx
 
 USER nginx

docs/installation/kubernetes.md

@@ -317,7 +317,7 @@ These are the environmental options available on meet backend.
 | DJANGO_ALLOWED_HOSTS                            | Hosts that are allowed                                                                                                                                       | []                                                                                                                                                            |
 | DJANGO_SECRET_KEY                               | Secret key used for Django security                                                                                                                          |                                                                                                                                                               |
 | DJANGO_SILENCED_SYSTEM_CHECKS                   | Silence Django system checks                                                                                                                                 | []                                                                                                                                                            |
-| DJANGO_ALLOW_UNSECURE_USER_LISTING              | Allow unsecure user listing                                                                                                                                  | false                                                                                                                                                         |
+| DJANGO_ALLOW_UNSECURE_USER_LISTING              | Allow insecure user listing                                                                                                                                  | false                                                                                                                                                         |
 | DB_ENGINE                                       | Database engine used                                                                                                                                         | django.db.backends.postgresql_psycopg2                                                                                                                        |
 | DB_NAME                                         | Name of the database                                                                                                                                         | meet                                                                                                                                                          |
 | DB_USER                                         | User used to connect to database                                                                                                                             | dinum                                                                                                                                                         |

renovate.json

@@ -1,5 +1,5 @@
 {
-  "extends": ["github>numerique-gouv/renovate-configuration"],
+  "extends": ["github>suitenumerique/ci//renovate/default"],
   "dependencyDashboard": true,
   "labels": ["dependencies", "noChangeLog"],
   "packageRules": [

src/addons/outlook/package-lock.json

@@ -10,7 +10,7 @@
       "license": "MIT",
       "dependencies": {
         "core-js": "3.50.0",
-        "i18next": "26.4.0",
+        "i18next": "26.4.2",
         "i18next-browser-languagedetector": "8.2.1",
         "regenerator-runtime": "0.14.1"
       },
@@ -9367,9 +9367,9 @@
       }
     },
     "node_modules/i18next": {
-      "version": "26.4.0",
-      "resolved": "https://registry.npmjs.org/i18next/-/i18next-26.4.0.tgz",
-      "integrity": "sha512-rsmK5bFqsD1AetSFSIa43wtNR4WpvvH4p0tLEsTxkC7QTrfdFm06nbQ95bh8Og4wwaCnUEcm9DVYL2cgxitiQg==",
+      "version": "26.4.2",
+      "resolved": "https://registry.npmjs.org/i18next/-/i18next-26.4.2.tgz",
+      "integrity": "sha512-RX+R0VLg13IbvRuJSxnqykUFS9vQZTl8wYpWPCIUDWVrSGjsQywB5Y+pjzrkboxGAuYfJZVH1InFTdgBdxq6ug==",
       "funding": [
         {
           "type": "individual",

src/addons/outlook/package.json

@@ -27,7 +27,7 @@
   },
   "dependencies": {
     "core-js": "3.50.0",
-    "i18next": "26.4.0",
+    "i18next": "26.4.2",
     "i18next-browser-languagedetector": "8.2.1",
     "regenerator-runtime": "0.14.1"
   },

src/addons/outlook/src/success/success.js

@@ -21,7 +21,7 @@ const { initI18n, translateUI } = require("../common/i18n");
         document.querySelector("#close-msg").style.display = "block";
       })
       .catch((e) => {
-        console.error(`Error occured: ${e}`);
+        console.error(`Error occurred: ${e}`);
       })
       .finally(() => {
         // NOTE: doesn't work with the desktop client — the browser considers

src/agents/Dockerfile

@@ -5,6 +5,7 @@ RUN sed -i "s|^URIs: http://|URIs: https://|" /etc/apt/sources.list.d/debian.sou
     && apt-get update && apt-get install -y --no-install-recommends  \
     libglib2.0-0 \
     libgobject-2.0-0 \
+    libssl3t64 \
     && rm -rf /var/lib/apt/lists/*
 
 

src/agents/pyproject.toml

@@ -1,7 +1,7 @@
 
 [project]
 name = "agents"
-version = "1.31.0"
+version = "1.32.1"
 requires-python = ">=3.12"
 dependencies = [
     "livekit-agents==1.6.7",

src/agents/uv.lock

@@ -9,7 +9,7 @@ resolution-markers = [
 
 [[package]]
 name = "agents"
-version = "1.31.0"
+version = "1.32.1"
 source = { virtual = "." }
 dependencies = [
     { name = "httpx" },

src/backend/core/api/feature_flag.py

@@ -17,7 +17,6 @@ class FeatureFlag:
         "application": "APPLICATION_ENABLED",
         "roomkit": "ROOMKIT_ENABLED",
         "connection_test": "CONNECTION_TEST_ENABLED",
-        "user_access_token": "USER_ACCESS_TOKEN_ENABLED",
     }
 
     @classmethod

src/backend/core/api/permissions.py

@@ -12,10 +12,6 @@ from ..services.participants_management import (
     ParticipantsManagementException,
 )
 
-ACTION_FOR_METHOD_TO_PERMISSION = {
-    "versions_detail": {"DELETE": "versions_destroy", "GET": "versions_retrieve"}
-}
-
 
 class IsAuthenticated(permissions.BasePermission):
     """
@@ -27,15 +23,6 @@ class IsAuthenticated(permissions.BasePermission):
         return bool(request.auth) or request.user.is_authenticated
 
 
-class IsAuthenticatedOrSafe(IsAuthenticated):
-    """Allows access to authenticated users (or anonymous users but only on safe methods)."""
-
-    def has_permission(self, request, view):
-        if request.method in permissions.SAFE_METHODS:
-            return True
-        return super().has_permission(request, view)
-
-
 class IsSelf(IsAuthenticated):
     """
     Allows access only to authenticated users. Alternative method checking the presence

src/backend/core/api/serializers.py

@@ -7,7 +7,6 @@ from typing import Literal
 from urllib.parse import quote
 
 from django.conf import settings
-from django.core import signing
 from django.core.exceptions import SuspiciousOperation
 
 # pylint: disable=abstract-method,no-name-in-module
@@ -293,26 +292,6 @@ class RequestEntrySerializer(BaseValidationOnlySerializer):
     """Validate request entry data."""
 
     username = serializers.CharField(required=True)
-    participant_id = serializers.CharField(
-        required=False, allow_null=True, max_length=128
-    )
-
-    @staticmethod
-    def sign_participant_id(participant_id):
-        """Sign with Django's SECRET_KEY and a lobby-specific namespace."""
-        return signing.Signer(salt="core.lobby.participant").sign(participant_id)
-
-    def validate_participant_id(self, value):
-        """Require a valid server signature before looking up a participant."""
-        if value is None:
-            return None
-        try:
-            participant_id = signing.Signer(salt="core.lobby.participant").unsign(value)
-        except signing.BadSignature as exc:
-            raise serializers.ValidationError(
-                "Invalid participant credential."
-            ) from exc
-        return str(serializers.UUIDField().run_validation(participant_id))
 
 
 class ParticipantEntrySerializer(BaseValidationOnlySerializer):
@@ -620,20 +599,3 @@ class ExternalProcessEventSerializer(BaseValidationOnlySerializer):
     # useless bad requests
     type = serializers.CharField(required=False, allow_null=True, allow_blank=True)
     status = serializers.CharField(required=False, allow_null=True, allow_blank=True)
-
-
-class TransitCodeSerializer(BaseValidationOnlySerializer):
-    """Validate the single-use transit code sent to the exchange endpoint."""
-
-    code = serializers.CharField(trim_whitespace=True)
-
-    def validate_code(self, value):
-        """Reject codes whose length cannot match a generated one."""
-
-        # Calculates urlsafe_b64encode length without padding
-        expected_length = (4 * settings.TRANSIT_CODE_NBYTES + 2) // 3
-
-        if len(value) != expected_length:
-            raise serializers.ValidationError("Invalid transit code format.")
-
-        return value

src/backend/core/api/throttling.py

@@ -1,11 +1,11 @@
 """Throttling modules for the API."""
 
+from django.conf import settings
+
 from lasuite.drf.throttling import MonitoredThrottleMixin
 from rest_framework.throttling import AnonRateThrottle, UserRateThrottle
 from sentry_sdk import capture_message
 
-from . import serializers
-
 
 def sentry_monitoring_throttle_failure(message):
     """Log when a failure occurs to detect rate limiting issues."""
@@ -42,14 +42,13 @@ class RequestEntryAnonRateThrottle(MonitoredAnonRateThrottle):
     def get_cache_key(self, request, view):
         """Use the lobby participant cookie ID as the throttle cache key.
 
-        Only throttle requests carrying a participant identifier. The
-        identifier is returned by the first request-entry response and
-        echoed back by the client from the second request onward, which is
-        when throttling starts applying.
+        Only throttle if a cookie is already set. If no cookie exists yet,
+        return None to skip throttling — the cookie will be set on the first
+        response, and throttling will apply from the second request onward.
 
-        Keying on the identifier rather than the IP address prevents
-        penalising multiple users behind the same NAT/proxy, and is
-        consistent with how the lobby identifies participants.
+        Keying on the cookie rather than the IP address prevents penalising
+        multiple users behind the same NAT/proxy, and is consistent with how
+        LobbyService identifies participants.
 
         Note: as per DRF documentation, application-level throttling is not a
         security measure against brute-force or DoS attacks. This throttle exists
@@ -59,14 +58,10 @@ class RequestEntryAnonRateThrottle(MonitoredAnonRateThrottle):
         if request.user and request.user.is_authenticated:
             return None  # Only throttle unauthenticated requests.
 
-        serializer = serializers.RequestEntrySerializer(data=request.data)
-        if not serializer.is_valid():
-            return None
+        participant_id = request.COOKIES.get(settings.LOBBY_COOKIE_NAME)
 
-        participant_id = serializer.validated_data.get("participant_id")
-
-        if not participant_id:
-            return None  # No throttling for unidentified requests
+        if participant_id is None:
+            return None  # No throttling for cookieless requests
 
         return self.cache_format % {
             "scope": self.scope,
@@ -102,14 +97,3 @@ class ConnectionTestAnonRateThrottle(MonitoredAnonRateThrottle):
     """Throttle anonymous users requesting connection test tokens."""
 
     scope = "connection_test"
-
-
-class ExchangeAccessTokenAnonRateThrottle(MonitoredAnonRateThrottle):
-    """Throttle anonymous transit code exchange attempts.
-
-    Abuse mitigation only, not a security boundary: DRF throttling is
-    best-effort. The security of the exchange rests on the codes'
-    entropy and single use.
-    """
-
-    scope = "exchange_access_token"

src/backend/core/api/viewsets.py

@@ -43,7 +43,6 @@ from rest_framework.settings import api_settings
 from core import analytics, enums, models, utils
 from core.api import throttling
 from core.api.filters import ListFileFilter
-from core.authentication.user_token import USER_ACCESS_TOKEN_TYPE_CLAIM
 from core.enums import MEDIA_STORAGE_URL_PATTERN
 from core.recording.enums import FileExtension
 from core.recording.event.authentication import RecordingProcessWebhookAuthentication
@@ -62,7 +61,6 @@ from core.recording.worker.mediator import (
     WorkerServiceMediator,
 )
 from core.services.invitation import InvitationService
-from core.services.jwt_token import JwtTokenService
 from core.services.livekit_events import (
     LiveKitEventsService,
     LiveKitWebhookError,
@@ -83,7 +81,6 @@ from core.services.room_roles import (
     RoomRoleService,
 )
 from core.services.subtitle import SubtitleException, SubtitleService
-from core.services.transit_code import TransitCodeService
 from core.tasks.connection_test import delete_connection_test_room
 from core.tasks.file import process_file_deletion
 from core.utils import generate_token
@@ -98,60 +95,6 @@ from .feature_flag import FeatureFlag
 logger = getLogger(__name__)
 
 
-class NestedGenericViewSet(viewsets.GenericViewSet):
-    """
-    A generic Viewset aims to be used in a nested route context.
-    e.g: `/api/v1.0/resource_1/<resource_1_pk>/resource_2/<resource_2_pk>/`
-
-    It allows to define all url kwargs and lookup fields to perform the lookup.
-    """
-
-    lookup_fields: list[str] = ["pk"]
-    lookup_url_kwargs: list[str] = []
-
-    def __getattribute__(self, file):
-        """
-        This method is overridden to allow to get the last lookup field or lookup url kwarg
-        when accessing the `lookup_field` or `lookup_url_kwarg` attribute. This is useful
-        to keep compatibility with all methods used by the parent class `GenericViewSet`.
-        """
-        if file in ["lookup_field", "lookup_url_kwarg"]:
-            return getattr(self, file + "s", [None])[-1]
-
-        return super().__getattribute__(file)
-
-    def get_queryset(self):
-        """
-        Get the list of files for this view.
-
-        `lookup_fields` attribute is enumerated here to perform the nested lookup.
-        """
-        queryset = super().get_queryset()
-
-        # The last lookup field is removed to perform the nested lookup as it corresponds
-        # to the object pk, it is used within get_object method.
-        lookup_url_kwargs = (
-            self.lookup_url_kwargs[:-1]
-            if self.lookup_url_kwargs
-            else self.lookup_fields[:-1]
-        )
-
-        filter_kwargs = {}
-        for index, lookup_url_kwarg in enumerate(lookup_url_kwargs):
-            if lookup_url_kwarg not in self.kwargs:
-                raise KeyError(
-                    f"Expected view {self.__class__.__name__} to be called with a URL "
-                    f'keyword argument named "{lookup_url_kwarg}". Fix your URL conf, or '
-                    "set the `.lookup_fields` attribute on the view correctly."
-                )
-
-            filter_kwargs.update(
-                {self.lookup_fields[index]: self.kwargs[lookup_url_kwarg]}
-            )
-
-        return queryset.filter(**filter_kwargs)
-
-
 class SerializerPerActionMixin:
     """
     A mixin to allow to define serializer classes for each action.
@@ -222,96 +165,6 @@ class UserViewSet(
             self.serializer_class(request.user, context=context).data
         )
 
-    @decorators.action(
-        detail=False,
-        methods=["post"],
-        url_path="exchange-access-token",
-        permission_classes=[],
-        throttle_classes=[throttling.ExchangeAccessTokenAnonRateThrottle],
-    )
-    @FeatureFlag.require("user_access_token")
-    def exchange_access_token(self, request):
-        """Exchange a single-use transit code for a user access token.
-
-        The endpoint is unauthenticated: the transit code itself, an opaque
-        random string obtained through the external API and delivered to
-        the embedded frontend via a URL fragment, is the credential. Each
-        code can be exchanged exactly once (consuming it deletes it from
-        the cache); replaying a consumed code is denied and logged.
-
-        The issued JWT authenticates the user the code was minted for on
-        the whole core API, exactly like a session cookie would (similar
-        to lib-jitsi-meet's token authentication), and never appears in
-        any URL. Role-based permissions apply unchanged.
-        """
-        if request.user and request.user.is_authenticated:
-            logger.warning(
-                "Transit code exchange refused: request is already "
-                "session-authenticated (user_id=%s)",
-                request.user.id,
-            )
-            raise drf_exceptions.PermissionDenied("Already authenticated.")
-
-        serializer = serializers.TransitCodeSerializer(data=request.data)
-        serializer.is_valid(raise_exception=True)
-
-        code_data = TransitCodeService().consume_code(serializer.validated_data["code"])
-
-        if code_data is None:
-            logger.warning("Invalid, expired or already used transit code")
-            raise drf_exceptions.PermissionDenied(
-                "Invalid, expired or already used transit code."
-            )
-
-        # Re-check the user at exchange time so that a deactivation after
-        # the transit code was minted is taken into account.
-        try:
-            user = models.User.objects.get(id=code_data["user_id"], is_active=True)
-        except models.User.DoesNotExist as excpt:
-            raise drf_exceptions.PermissionDenied(
-                "This account can no longer access the application."
-            ) from excpt
-
-        if not models.Application.has_active_scope(
-            code_data.get("client_id"), models.ApplicationScope.USERS_SESSION
-        ):
-            logger.warning(
-                "Transit code exchange refused: application '%s' no longer "
-                "holds the '%s' grant",
-                code_data.get("client_id"),
-                models.ApplicationScope.USERS_SESSION,
-            )
-            raise drf_exceptions.PermissionDenied(
-                "This application can no longer create user sessions."
-            )
-
-        token_service = JwtTokenService(
-            secret_key=settings.USER_ACCESS_TOKEN_SECRET_KEY,
-            algorithm=settings.USER_ACCESS_TOKEN_ALG,
-            issuer=settings.USER_ACCESS_TOKEN_ISSUER,
-            audience=settings.USER_ACCESS_TOKEN_AUDIENCE,
-            expiration_seconds=settings.USER_ACCESS_TOKEN_TTL,
-            token_type=settings.USER_ACCESS_TOKEN_TYPE,
-        )
-
-        data = token_service.generate_jwt(
-            user,
-            "user:access",
-            {
-                "client_id": code_data.get("client_id", "unknown"),
-                "token_type": USER_ACCESS_TOKEN_TYPE_CLAIM,
-            },
-        )
-
-        # Log for auditing
-        logger.info(
-            "User access token issued from transit code: user_id=%s, client_id=%s",
-            user.id,
-            code_data.get("client_id", "unknown"),
-        )
-
-        return drf_response.Response(data)
-
 
 class RoomViewSet(
     mixins.CreateModelMixin,
@@ -579,18 +432,13 @@ class RoomViewSet(
 
         participant, livekit = lobby_service.request_entry(
             room=room,
-            user=request.user,
+            request=request,
             **serializer.validated_data,
         )
-        return drf_response.Response(
-            {
-                **participant.to_dict(),
-                "id": serializers.RequestEntrySerializer.sign_participant_id(
-                    participant.id
-                ),
-                "livekit": livekit,
-            }
-        )
+        response = drf_response.Response({**participant.to_dict(), "livekit": livekit})
+        lobby_service.prepare_response(response, participant.id)
+
+        return response
 
     @decorators.action(
         detail=True,

src/backend/core/authentication/livekit.py

@@ -9,8 +9,6 @@ from rest_framework import authentication, exceptions
 
 UserModel = get_user_model()
 
-LIVEKIT_AUTH_SCHEME = "X-LiveKit-Token"
-
 
 class LiveKitTokenAuthentication(authentication.BaseAuthentication):
     """Authenticate using LiveKit token and load the associated Django user."""
@@ -22,14 +20,9 @@ class LiveKitTokenAuthentication(authentication.BaseAuthentication):
             return None  # No authentication attempted
 
         parts = auth_header.split()
-        if not parts or parts[0].lower() != LIVEKIT_AUTH_SCHEME.lower():
-            # Not our scheme (e.g. "Bearer <user access token>"): defer, another
-            # backend may recognize it.
-            return None
-
-        if len(parts) != 2:
+        if len(parts) != 2 or parts[0].lower() != "bearer":
             raise exceptions.AuthenticationFailed(
-                f"Authorization header must be: {LIVEKIT_AUTH_SCHEME} <token>"
+                "Authorization header must be: Bearer <token>"
             )
 
         token = parts[1]

src/backend/core/authentication/user_token.py

@@ -1,82 +0,0 @@
-"""User access JWT authentication for the Meet core API.
-
-Allows an embedded frontend (e.g. rendered in an iframe, where third-party
-session cookies are blocked) to authenticate requests on the core API with
-a JWT, obtained by exchanging a single-use transit code (see
-core.services.transit_code and the users exchange-access-token endpoint)
-and passed as a Bearer header. The JWT itself never appears in any URL.
-
-Similar to lib-jitsi-meet's token authentication, the token is bound to a
-user, not to a resource: once authenticated, the request is treated
-exactly like a session-authenticated one, and the existing role-based
-permissions apply unchanged.
-"""
-
-import logging
-
-from django.conf import settings
-
-from rest_framework import exceptions
-
-from core.external_api.authentication import BaseJWTAuthentication
-from core.models import Application, ApplicationScope
-
-logger = logging.getLogger(__name__)
-
-USER_ACCESS_TOKEN_TYPE_CLAIM = "user_access"  # noqa: S105
-
-
-class UserAccessJWTAuthentication(BaseJWTAuthentication):
-    """JWT authentication for user access tokens.
-
-    Validates user access tokens issued by the users exchange-access-token
-    endpoint and authenticates the user they were issued for. A bearer
-    token that does not verify against the user access token secret is
-    deferred to the next authentication backend; a token that does verify
-    but carries wrong claims is rejected.
-
-    When the feature is disabled (USER_ACCESS_TOKEN_ENABLED=False), the
-    backend is entirely inert: `BaseJWTAuthentication.authenticate`
-    returns None before reading the Authorization header, deferring every
-    request to the next authentication backend.
-    """
-
-    def __init__(self):
-        """Initialize the backend with user access token settings."""
-        super().__init__(
-            secret_key=settings.USER_ACCESS_TOKEN_SECRET_KEY,
-            algorithm=settings.USER_ACCESS_TOKEN_ALG,
-            issuer=settings.USER_ACCESS_TOKEN_ISSUER,
-            audience=settings.USER_ACCESS_TOKEN_AUDIENCE,
-            expiration_seconds=settings.USER_ACCESS_TOKEN_TTL,
-            token_type=settings.USER_ACCESS_TOKEN_TYPE,
-            is_enabled=settings.USER_ACCESS_TOKEN_ENABLED,
-        )
-
-    def validate_payload(self, payload):
-        """Validate the token type and the issuance-audit claim.
-
-        Raises:
-            AuthenticationFailed: If the token verified against the user
-                access token secret but does not carry the expected
-                claims, or if the issuing application lost its grant.
-        """
-
-        if payload.get("token_type") != USER_ACCESS_TOKEN_TYPE_CLAIM:
-            logger.warning("Wrong 'token_type' in user access token payload")
-            raise exceptions.AuthenticationFailed("Invalid token type.")
-
-        if not payload.get("client_id"):
-            logger.warning("Missing 'client_id' in user access token payload")
-            raise exceptions.AuthenticationFailed("Invalid token claims.")
-
-        if not Application.has_active_scope(
-            payload["client_id"], ApplicationScope.USERS_SESSION
-        ):
-            logger.warning(
-                "User access token refused: application '%s' no longer "
-                "holds the '%s' grant",
-                payload["client_id"],
-                ApplicationScope.USERS_SESSION,
-            )
-            raise exceptions.AuthenticationFailed("Application access revoked.")

src/backend/core/external_api/permissions.py

@@ -20,60 +20,8 @@ class BaseScopePermission(permissions.BasePermission):
 
     scope_map: Dict[str, str] = {}
 
-    def get_required_scope(self, view):
-        """Return the scope required by the view's current action.
-
-        Returns:
-            The required scope, or None for an unsupported method so
-            DRF's router can answer 405.
-
-        Raises:
-            PermissionDenied: If the action is not in scope_map (deny by
-                default).
-        """
-        # Get the current action (e.g., 'list', 'create'), if None let DRF handle it
-        action = getattr(view, "action", None)
-        if not action:
-            # DRF routers return a 405 for unsupported methods
-            return None
-
-        required_scope = self.scope_map.get(action)
-        if not required_scope:
-            # Action not in scope_map, deny by default
-            raise exceptions.PermissionDenied(
-                f"Insufficient permissions. Required scope: {required_scope}"
-            )
-
-        return required_scope
-
-    def get_token_scopes(self, request):
-        """Extract and normalize the scopes claimed by the token."""
-        token_scopes = (request.auth or {}).get("scope")
-
-        if not token_scopes:
-            return []
-
-        # Ensure scopes is a list (handle both list and space-separated string)
-        if isinstance(token_scopes, str):
-            token_scopes = token_scopes.split()
-
-        # Ensure scopes is a deduplicated list (preserving order) and lowercase all scopes
-        token_scopes = list(dict.fromkeys(scope.lower() for scope in token_scopes))
-
-        return self.strip_scope_prefix(token_scopes)
-
-    @staticmethod
-    def strip_scope_prefix(token_scopes):
-        """Strip the OIDC resource server prefix, when configured."""
-        if settings.OIDC_RS_SCOPES_PREFIX:
-            return [
-                scope.removeprefix(f"{settings.OIDC_RS_SCOPES_PREFIX}:")
-                for scope in token_scopes
-            ]
-        return token_scopes
-
     def has_permission(self, request, view):
-        """Check if the token claims the scope required by this action.
+        """Check if the JWT token contains the required scope for this action.
 
         Args:
             request: DRF request object with authenticated user
@@ -85,15 +33,38 @@ class BaseScopePermission(permissions.BasePermission):
         Raises:
             PermissionDenied: If required scope is missing from token
         """
-        required_scope = self.get_required_scope(view)
-        if required_scope is None:
+        # Get the current action (e.g., 'list', 'create'), if None let DRF handle it
+        action = getattr(view, "action", None)
+        if not action:
+            # DRF routers return a 405 for unsupported methods
             return True
 
-        token_scopes = self.get_token_scopes(request)
+        required_scope = self.scope_map.get(action)
+        if not required_scope:
+            # Action not in scope_map, deny by default
+            raise exceptions.PermissionDenied(
+                f"Insufficient permissions. Required scope: {required_scope}"
+            )
+
+        token_payload = request.auth
+        token_scopes = token_payload.get("scope")
 
         if not token_scopes:
             raise exceptions.PermissionDenied("Insufficient permissions.")
 
+        # Ensure scopes is a list (handle both list and space-separated string)
+        if isinstance(token_scopes, str):
+            token_scopes = token_scopes.split()
+
+        # Ensure scopes is a deduplicated list (preserving order) and lowercase all scopes
+        token_scopes = list(dict.fromkeys(scope.lower() for scope in token_scopes))
+
+        if settings.OIDC_RS_SCOPES_PREFIX:
+            token_scopes = [
+                scope.removeprefix(f"{settings.OIDC_RS_SCOPES_PREFIX}:")
+                for scope in token_scopes
+            ]
+
         if required_scope not in token_scopes:
             raise exceptions.PermissionDenied(
                 f"Insufficient permissions. Required scope: {required_scope}"
@@ -102,37 +73,6 @@ class BaseScopePermission(permissions.BasePermission):
         return True
 
 
-class ApplicationScopePermission(BaseScopePermission):
-    """Scope-based permission for application-authenticated endpoints."""
-
-    @staticmethod
-    def strip_scope_prefix(token_scopes):
-        """Compare application scopes verbatim."""
-        return token_scopes
-
-    def has_permission(self, request, view):
-        """Check the scope claim, then the grant recorded in the database."""
-        granted = super().has_permission(request, view)
-
-        required_scope = self.get_required_scope(view)
-
-        if granted and required_scope:
-            client_id = (request.auth or {}).get("client_id")
-
-            if not models.Application.has_active_scope(client_id, required_scope):
-                logger.warning(
-                    "Application '%s' presented scope '%s' without a matching "
-                    "grant in database",
-                    client_id,
-                    required_scope,
-                )
-                raise exceptions.PermissionDenied(
-                    f"Application is not granted the required scope: {required_scope}"
-                )
-
-        return granted
-
-
 class HasRequiredRoomScope(BaseScopePermission):
     """Permission class for Room-related operations."""
 
@@ -146,14 +86,6 @@ class HasRequiredRoomScope(BaseScopePermission):
     }
 
 
-class HasRequiredUserScope(ApplicationScopePermission):
-    """Scope-based permissions for the external user endpoints."""
-
-    scope_map = {
-        "generate_transit_code": models.ApplicationScope.USERS_SESSION,
-    }
-
-
 class RoomPermissions(permissions.BasePermission):
     """Permissions applying to the room API endpoint."""
 

src/backend/core/external_api/viewsets.py

@@ -27,7 +27,6 @@ from core import analytics, api, models
 from core.api.feature_flag import FeatureFlag
 from core.services.jwt_token import JwtTokenService
 from core.services.room_management import RoomManagement
-from core.services.transit_code import TransitCodeService
 
 from ..services.provisional_user_service import (
     ProvisionalUserCreationDisabledError,
@@ -266,59 +265,3 @@ class RoomViewSet(
             updated_fields=updated_fields,
             previous_access_level=previous_values["access_level"],
         )
-
-
-class UserViewSet(viewsets.GenericViewSet):
-    """Application-delegated API for user operations.
-
-    Provides JWT-authenticated access to user operations for external
-    applications acting on behalf of users. All operations are
-    scope-based. Meant to grow with the other user actions exposed to
-    third parties.
-
-    Supported operations:
-    - transit-code: Mint a single-use transit code for the delegated user
-      (requires 'users:session' scope)
-    """
-
-    authentication_classes = [
-        authentication.ApplicationJWTAuthentication,
-    ]
-    permission_classes = [
-        api.permissions.IsAuthenticated & permissions.HasRequiredUserScope
-    ]
-
-    @decorators.action(
-        detail=False,
-        methods=["post"],
-        url_path="transit-code",
-        url_name="transit-code",
-    )
-    @FeatureFlag.require("user_access_token")
-    def generate_transit_code(self, request):
-        """Mint a transit code for the delegated user.
-
-        Returns a short-lived, single-use opaque code to pass to an embedded
-        frontend (e.g. via a URL fragment when cookies are unavailable). The
-        frontend exchanges it once on
-        POST /api/v1.0/users/exchange-access-token/ for a JWT access token,
-        equivalent to session-cookie authentication and never exposed in a URL.
-        """
-        client_id = (request.auth or {}).get("client_id", "unknown")
-
-        code = TransitCodeService().create_code(request.user, client_id=client_id)
-
-        # Log for auditing
-        logger.info(
-            "Transit code issued: user_id=%s, client_id=%s",
-            request.user.id,
-            client_id,
-        )
-
-        return drf_response.Response(
-            {
-                "transit_code": code,
-                "expires_in": settings.TRANSIT_CODE_TTL,
-            },
-            status=drf_status.HTTP_200_OK,
-        )

src/backend/core/migrations/0022_alter_application_scopes.py

@@ -1,19 +0,0 @@
-# Generated by Django 5.2.14 on 2026-07-31 18:27
-
-import django.contrib.postgres.fields
-from django.db import migrations, models
-
-
-class Migration(migrations.Migration):
-
-    dependencies = [
-        ('core', '0021_recording_external_process_id_alter_recording_status'),
-    ]
-
-    operations = [
-        migrations.AlterField(
-            model_name='application',
-            name='scopes',
-            field=django.contrib.postgres.fields.ArrayField(base_field=models.CharField(choices=[('rooms:create', 'Create rooms'), ('rooms:list', 'List rooms'), ('rooms:retrieve', 'Retrieve room details'), ('rooms:update', 'Update rooms'), ('rooms:delete', 'Delete rooms'), ('users:session', 'Create user session tokens')], max_length=50), blank=True, default=list, size=None),
-        ),
-    ]

src/backend/core/migrations/0022_user_default_room_access_level_and_more.py

@@ -6,7 +6,7 @@ from django.db import migrations, models
 class Migration(migrations.Migration):
 
     dependencies = [
-        ('core', '0022_alter_application_scopes'),
+        ('core', '0021_recording_external_process_id_alter_recording_status'),
     ]
 
     operations = [

src/backend/core/migrations/0023_alter_recording_status.py

@@ -0,0 +1,18 @@
+# Generated by Django 5.2.16 on 2026-09-23 16:49
+
+from django.db import migrations, models
+
+
+class Migration(migrations.Migration):
+
+    dependencies = [
+        ('core', '0022_user_default_room_access_level_and_more'),
+    ]
+
+    operations = [
+        migrations.AlterField(
+            model_name='recording',
+            name='status',
+            field=models.CharField(choices=[('initiated', 'Initiated'), ('active', 'Active'), ('stopped', 'Stopped'), ('saved', 'Saved'), ('aborted', 'Aborted'), ('failed', 'Failed'), ('failed_to_start', 'Failed to Start'), ('failed_to_stop', 'Failed to Stop'), ('notification_succeeded', 'Notification succeeded'), ('external_process_successful', 'External process successful'), ('external_process_failed', 'External process failed')], default='initiated', max_length=50),
+        ),
+    ]

src/backend/core/models.py

@@ -58,6 +58,7 @@ class RecordingStatusChoices(models.TextChoices):
     STOPPED = "stopped", _("Stopped")
     SAVED = "saved", _("Saved")
     ABORTED = "aborted", _("Aborted")
+    FAILED = "failed", _("Failed")
     FAILED_TO_START = "failed_to_start", _("Failed to Start")
     FAILED_TO_STOP = "failed_to_stop", _("Failed to Stop")
     NOTIFICATION_SUCCEEDED = "notification_succeeded", _("Notification succeeded")
@@ -79,17 +80,13 @@ class RecordingStatusChoices(models.TextChoices):
             cls.STOPPED,
             cls.SAVED,
             cls.ABORTED,
+            cls.FAILED,
             cls.EXTERNAL_PROCESS_SUCCESSFUL,
             cls.EXTERNAL_PROCESS_FAILED,
             cls.FAILED_TO_START,
             cls.FAILED_TO_STOP,
         }
 
-    @classmethod
-    def is_unsuccessful(cls, status):
-        """Determine if the recording status represents an unsuccessful state."""
-        return status in {cls.ABORTED, cls.FAILED_TO_START, cls.FAILED_TO_STOP}
-
 
 class RecordingModeChoices(models.TextChoices):
     """Recording mode choices."""
@@ -582,6 +579,7 @@ class Recording(BaseModel):
     4. NOTIFICATION_SUCCEEDED: External service has been notified of this recording
 
     Error States:
+    - FAILED: Egress failed mid-recording
     - FAILED_TO_START: Worker failed to initialize recording
     - FAILED_TO_STOP: Worker failed during stop operation
     - ABORTED: Recording was terminated before completion
@@ -788,7 +786,6 @@ class ApplicationScope(models.TextChoices):
     ROOMS_RETRIEVE = "rooms:retrieve", _("Retrieve room details")
     ROOMS_UPDATE = "rooms:update", _("Update rooms")
     ROOMS_DELETE = "rooms:delete", _("Delete rooms")
-    USERS_SESSION = "users:session", _("Create user session tokens")
 
 
 class Application(BaseModel):
@@ -838,18 +835,6 @@ class Application(BaseModel):
         domain = get_domain_from_email(email)
         return self.allowed_domains.filter(domain__iexact=domain).exists()
 
-    @classmethod
-    def has_active_scope(cls, client_id, scope) -> bool:
-        """Check that an active application holds a scope."""
-        if not client_id or not scope:
-            return False
-
-        return cls.objects.filter(
-            client_id=client_id,
-            is_active=True,
-            scopes__contains=[scope],
-        ).exists()
-
 
 class ApplicationDomain(BaseModel):
     """Domain authorized for application delegation."""

src/backend/core/recording/enums.py

@@ -8,3 +8,50 @@ class FileExtension(Enum):
 
     OGG = "ogg"
     MP4 = "mp4"
+
+
+class RecordingWorkerEvent(Enum):
+    """Lifecycle events a recording worker reports about a recording.
+
+    It is intended to be free of SFU-specific vocabulary.
+    """
+
+    # The worker accepted the request but is not recording yet.
+    STARTING = "starting"
+    # The worker is recording.
+    STARTED = "started"
+    # The worker stopped recording and is flushing the media file.
+    SAVING = "saving"
+
+    # The recording ended, its media file is available.
+    COMPLETED = "completed"
+    # The recording ended on its configured limit, its media file is available.
+    LIMIT_REACHED = "limit reached"
+    # The worker stopped before it ever started recording, there is no media file.
+    ABORTED = "aborted"
+    # The worker hit a runtime error once recording had started; its media file
+    # may be available.
+    FAILED = "failed"
+
+    @classmethod
+    def is_terminal(cls, event):
+        """Determine if the event ends the recording's lifecycle (successful or not)."""
+
+        return event in TERMINAL_EVENTS
+
+
+SUCCESSFUL_EVENTS = frozenset(
+    {
+        RecordingWorkerEvent.COMPLETED,
+        RecordingWorkerEvent.LIMIT_REACHED,
+    }
+)
+
+UNSUCCESSFUL_EVENTS = frozenset(
+    {
+        RecordingWorkerEvent.ABORTED,
+        RecordingWorkerEvent.FAILED,
+    }
+)
+
+TERMINAL_EVENTS = SUCCESSFUL_EVENTS | UNSUCCESSFUL_EVENTS

src/backend/core/recording/services/recording_events.py

@@ -1,13 +1,13 @@
-"""Recording-related LiveKit Events Service"""
-
-# pylint: disable=no-member
+"""Recording-related Events Service"""
 
 from logging import getLogger
 
-from livekit import api
-
 from core import models, utils
 from core.models import Recording
+from core.recording.enums import (
+    UNSUCCESSFUL_EVENTS,
+    RecordingWorkerEvent,
+)
 from core.recording.event.notification import notification_service
 from core.services.room_management import (
     RoomManagement,
@@ -26,22 +26,110 @@ class RecordingNotSavableError(Exception):
     """Recording cannot be saved because it is either in an error state or has already been saved"""
 
 
+# Notification sent to the room's participants, per event and recording mode.
+NOTIFICATION_PREFIXES = {
+    models.RecordingModeChoices.SCREEN_RECORDING: "screenRecording",
+    models.RecordingModeChoices.TRANSCRIPT: "transcription",
+}
+NOTIFICATION_SUFFIXES = {
+    RecordingWorkerEvent.LIMIT_REACHED: "LimitReached",
+    RecordingWorkerEvent.FAILED: "Failed",
+    RecordingWorkerEvent.ABORTED: "Aborted",
+}
+
+
+def get_notification_type(recording_mode, event):
+    """Generate corresponding notification type string."""
+    try:
+        return f"{NOTIFICATION_PREFIXES[recording_mode]}{NOTIFICATION_SUFFIXES[event]}"
+    except KeyError:
+        return None
+
+
+# Recording status in the room's metadata, per event.
+ROOM_METADATA_RECORDING_STATUSES = {
+    RecordingWorkerEvent.STARTED: "started",
+    RecordingWorkerEvent.SAVING: "saving",
+}
+
+
 class RecordingEventsService:
-    """Handles recording-related LiveKit webhook events."""
+    """Handles recording-related worker events.
+
+    Two entry points: `handle_update` for the events a running recording
+    reports, and `handle_terminal_event` for the one ending it.
+    """
 
     @staticmethod
-    def handle_update(recording: Recording, egress_status):
-        """Handle egress status updates and sync recording state to room metadata."""
+    def log_worker_error(recording, event, error=None, error_code=None):
+        """Log FAILED at error level and expected ABORTED outcomes at info level."""
+
+        if event == RecordingWorkerEvent.FAILED:
+            log = logger.error
+        elif event == RecordingWorkerEvent.ABORTED:
+            log = logger.info
+        else:
+            return
+
+        log(
+            "Recording worker reported %s for recording %s (room=%s, mode=%s): %s (error_code=%s)",
+            event.value,
+            recording.id,
+            recording.room.id,
+            recording.mode,
+            error or "no error reported",
+            error_code or "no error_code reported",
+        )
+
+    @staticmethod
+    def _notify_participants(recording: Recording, event: RecordingWorkerEvent):
+        """Notify the room's participants that a recording ended on the given event."""
+        recording_mode = recording.options.get("original_mode", None) or recording.mode
+
+        notification_type = get_notification_type(recording_mode, event)
+        if not notification_type:
+            logger.warning(
+                "Could not find notification type for: "
+                "room=%s, recording_id=%s, mode=%s, event=%s",
+                recording.room.id,
+                recording.id,
+                recording_mode,
+                event.value,
+            )
+            return
+
+        try:
+            utils.notify_participants(
+                room_name=str(recording.room.id),
+                notification_data={"type": notification_type},
+            )
+        except utils.NotificationError as e:
+            raise RecordingEventsError(
+                f"Failed to notify participants in room '{recording.room.id}' about "
+                f"recording {event.value} (recording_id={recording.id})"
+            ) from e
+
+    @staticmethod
+    def _log_notification_failure(recording, event: RecordingWorkerEvent):
+        """Log a participant notification error on an unsuccessful recording."""
+
+        logger.exception(
+            "Failed to notify participants that recording %s %s (room=%s)",
+            recording.id,
+            event.value,
+            recording.room.id,
+        )
+
+    @staticmethod
+    def handle_update(recording: Recording, event: RecordingWorkerEvent):
+        """Handle non-terminal worker events and sync recording state to room metadata.
+
+        Terminal events are dispatched through `handle_terminal_event` instead.
+        """
 
         room_name = str(recording.room.id)
 
-        status_mapping = {
-            api.EgressStatus.EGRESS_ACTIVE: "started",
-            api.EgressStatus.EGRESS_ENDING: "saving",
-            api.EgressStatus.EGRESS_ABORTED: "aborted",
-        }
-
-        recording_status = status_mapping.get(egress_status)
+        recording_status = ROOM_METADATA_RECORDING_STATUSES.get(event)
         if recording_status:
             try:
                 RoomManagement.update_metadata(
@@ -55,42 +143,113 @@ class RecordingEventsService:
             except RoomManagementException as e:
                 logger.exception("Failed to update room's metadata: %s", e)
 
-    @staticmethod
-    def handle_limit_reached(recording: Recording):
+    def handle_terminal_event(self, recording: Recording, event: RecordingWorkerEvent):
+        """Run the appropriate handlers for a terminal event, given the recording's state."""
+
+        if not RecordingWorkerEvent.is_terminal(event):
+            logger.warning(
+                "Ignoring non-terminal event %s dispatched as a terminal event "
+                "for recording %s.",
+                event.value,
+                recording.id,
+            )
+            return
+
+        if event in UNSUCCESSFUL_EVENTS:
+            self._flag_unsuccessful_recording(recording, event)
+        else:
+            self._save_successful_recording(recording, event)
+
+    def _flag_unsuccessful_recording(
+        self, recording: Recording, event: RecordingWorkerEvent
+    ):
+        """Persist the outcome of a recording the worker announced as unsuccessful."""
+
+        # Aborted
+        if event == RecordingWorkerEvent.ABORTED:
+            if recording.status == models.RecordingStatusChoices.ACTIVE:
+                self._apply_outcome(recording, event, self._handle_aborted)
+            return
+
+        # Failed
+        if event == RecordingWorkerEvent.FAILED:
+            if recording.is_savable():
+                self._apply_outcome(recording, event, self._handle_failed)
+            return
+
+        logger.error(
+            "Unsuccessful event %s has no handler; recording %s keeps status '%s'.",
+            event.value,
+            recording.id,
+            recording.status,
+        )
+
+    def _save_successful_recording(
+        self, recording: Recording, event: RecordingWorkerEvent
+    ):
+        """Save a recording whose media file the worker made available."""
+
+        # Limit reached
+        if (
+            event == RecordingWorkerEvent.LIMIT_REACHED
+            and recording.status == models.RecordingStatusChoices.ACTIVE
+        ):
+            self._apply_outcome(recording, event, self._handle_limit_reached)
+
+        try:
+            self._handle_successful(recording)
+        except RecordingNotSavableError:
+            logger.warning(
+                "Recording %s is not savable on a completed recording "
+                "(already saved or in an error state); ignoring.",
+                recording.id,
+            )
+
+    def _apply_outcome(
+        self, recording: Recording, event: RecordingWorkerEvent, handler
+    ):
+        """Keep notification failure non-fatal."""
+
+        try:
+            handler(recording)
+        except RecordingEventsError:
+            self._log_notification_failure(recording, event)
+
+    @classmethod
+    def _handle_limit_reached(cls, recording: Recording):
         """Stop recording and notify participants when limit is reached."""
 
         recording.status = models.RecordingStatusChoices.STOPPED
         recording.save()
 
-        notification_mapping = {
-            models.RecordingModeChoices.SCREEN_RECORDING: "screenRecordingLimitReached",
-            models.RecordingModeChoices.TRANSCRIPT: "transcriptionLimitReached",
-        }
+        cls._notify_participants(recording, RecordingWorkerEvent.LIMIT_REACHED)
 
-        notification_type = notification_mapping.get(recording.mode)
-        if not notification_type:
-            return
+    @classmethod
+    def _handle_failed(cls, recording: Recording):
+        """Set recording status to failed, matching the worker event, and notify participants.
 
-        try:
-            utils.notify_participants(
-                room_name=str(recording.room.id),
-                notification_data={"type": notification_type},
-            )
-        except utils.NotificationError as e:
-            logger.exception(
-                "Failed to notify participants about recording limit reached: "
-                "room=%s, recording_id=%s, mode=%s",
-                recording.room.id,
-                recording.id,
-                recording.mode,
-            )
-            raise RecordingEventsError(
-                f"Failed to notify participants in room '{recording.room.id}' about "
-                f"recording limit reached (recording_id={recording.id})"
-            ) from e
+        FAILED: used when an actual runtime/pipeline error occurs after the
+        recording has started
+        """
+        recording.status = models.RecordingStatusChoices.FAILED
+        recording.save()
+
+        cls._notify_participants(recording, RecordingWorkerEvent.FAILED)
+
+    @classmethod
+    def _handle_aborted(cls, recording: Recording):
+        """Set recording status to aborted, matching the worker event, and notify participants.
+
+        ABORTED: used when the worker stops before it ever became
+        active/recording
+        """
+        recording.status = models.RecordingStatusChoices.ABORTED
+        recording.save()
+
+        cls._notify_participants(recording, RecordingWorkerEvent.ABORTED)
 
     @staticmethod
-    def handle_complete(recording: Recording):
+    def _handle_successful(recording: Recording):
         """Notify external services and save recording."""
 
         if not recording.is_savable():

src/backend/core/recording/worker/services.py

@@ -2,6 +2,8 @@
 
 # pylint: disable=no-member
 
+import logging
+
 from asgiref.sync import async_to_sync
 from livekit import api as livekit_api
 
@@ -10,6 +12,8 @@ from ..enums import FileExtension
 from .exceptions import WorkerConnectionError, WorkerResponseError
 from .factories import WorkerServiceConfig
 
+logger = logging.getLogger(__name__)
+
 
 class BaseEgressService:
     """Base egress defining common methods to manage and interact with LiveKit egress processes."""
@@ -20,7 +24,7 @@ class BaseEgressService:
 
     def _get_filepath(self, filename: str, extension: str) -> str:
         """Construct the file path for a given filename and extension.
-        Unsecure method, doesn't handle paths robustly and securely.
+        Insecure method, doesn't handle paths robustly and securely.
         """
         return f"{self._config.output_folder}/{filename}.{extension}"
 
@@ -49,6 +53,22 @@ class BaseEgressService:
         finally:
             await lkapi.aclose()
 
+    @staticmethod
+    def _log_egress_error(response, event: str):
+        """Log the reason LiveKit reported an unsuccessful egress on stop.
+
+        Mirrors the logging done in the 'egress_ended' webhook. The
+        StopEgress response carries the same error fields.
+        """
+        logger.error(
+            "Egress %s on stop (egress_id=%s, status=%s): %s (error_code=%s)",
+            event,
+            response.egress_id,
+            livekit_api.EgressStatus.Name(response.status),
+            response.error or "no error reported",
+            response.error_code or "no error_code reported",
+        )
+
     def stop(self, worker_id: str) -> str:
         """Stop an ongoing egress worker.
         The StopEgressRequest is shared among all types of egress,
@@ -66,14 +86,26 @@ class BaseEgressService:
                 "LiveKit response is missing the recording status."
             )
 
-        # To avoid exposing EgressStatus values and coupling with LiveKit outside of this class,
-        # the response status is mapped to simpler "ABORTED", "STOPPED" or "FAILED_TO_STOP" strings.
-        if response.status == livekit_api.EgressStatus.EGRESS_ABORTED:
-            return "ABORTED"
-
         if response.status == livekit_api.EgressStatus.EGRESS_ENDING:
             return "STOPPED"
 
+        if response.status == livekit_api.EgressStatus.EGRESS_LIMIT_REACHED:
+            return "STOPPED"
+
+        # Cases below should be very infrequent as status changes should be
+        # received and processed by `handle_ended`, thus `stop` would not
+        # be called (unless failure and stop are very close in time).
+        # We therefore accept not to notify the user in this code branch.
+        # This could be fixed in a future refactoring.
+        if response.status == livekit_api.EgressStatus.EGRESS_ABORTED:
+            self._log_egress_error(response, "aborted")
+            return "ABORTED"
+
+        if response.status == livekit_api.EgressStatus.EGRESS_FAILED:
+            self._log_egress_error(response, "failed")
+            return "FAILED"
+
+        self._log_egress_error(response, "failed to stop")
         return "FAILED_TO_STOP"
 
     def start(self, room_name, recording_id):

src/backend/core/services/livekit_events.py

@@ -12,15 +12,12 @@ from django.conf import settings
 from livekit import api
 
 from core import models
+from core.recording.enums import RecordingWorkerEvent
 from core.recording.services.metadata_collector import (
     MetadataCollectorException,
     MetadataCollectorService,
 )
-from core.recording.services.recording_events import (
-    RecordingEventsError,
-    RecordingEventsService,
-    RecordingNotSavableError,
-)
+from core.recording.services.recording_events import RecordingEventsService
 
 from .lobby import LobbyService
 from .presence import PresenceCache
@@ -84,6 +81,30 @@ class LiveKitWebhookEventType(Enum):
     INGRESS_ENDED = "ingress_ended"
 
 
+# LiveKit egress statuses mapped to recording worker event statuses
+EGRESS_STATUS_TO_RECORDING_EVENT = {
+    api.EgressStatus.EGRESS_STARTING: RecordingWorkerEvent.STARTING,
+    api.EgressStatus.EGRESS_ACTIVE: RecordingWorkerEvent.STARTED,
+    api.EgressStatus.EGRESS_ENDING: RecordingWorkerEvent.SAVING,
+    api.EgressStatus.EGRESS_COMPLETE: RecordingWorkerEvent.COMPLETED,
+    api.EgressStatus.EGRESS_LIMIT_REACHED: RecordingWorkerEvent.LIMIT_REACHED,
+    api.EgressStatus.EGRESS_ABORTED: RecordingWorkerEvent.ABORTED,
+    api.EgressStatus.EGRESS_FAILED: RecordingWorkerEvent.FAILED,
+}
+
+
+def to_recording_event(egress_status):
+    """Translate a LiveKit egress status into a recording worker event."""
+
+    event = EGRESS_STATUS_TO_RECORDING_EVENT.get(egress_status)
+    if event is None:
+        logger.warning(
+            "Unmapped LiveKit egress status '%s', ignoring the event.",
+            egress_status,
+        )
+    return event
+
+
 class LiveKitEventsService:
     """Service for processing and handling LiveKit webhook events and notifications."""
 
@@ -173,12 +194,20 @@ class LiveKitEventsService:
                 f"Recording with worker ID {egress_id} does not exist"
             ) from err
 
-        egress_status = data.egress_info.status
-        self.recording_events.handle_update(recording, egress_status)
+        event = to_recording_event(data.egress_info.status)
+        if event is None:
+            return
+
+        self.recording_events.handle_update(recording, event)
 
     def _handle_egress_ended(self, data):
-        """Handle 'egress_ended' event."""
+        """Handle 'egress_ended' event.
 
+        Egress ended is sent with one of these statuses:
+        EGRESS_COMPLETE, EGRESS_FAILED, EGRESS_ABORTED, EGRESS_LIMIT_REACHED
+        """
+
+        # Fetch recording
         try:
             recording = models.Recording.objects.select_related("room").get(
                 worker_id=data.egress_info.egress_id
@@ -188,6 +217,17 @@ class LiveKitEventsService:
                 f"Recording with worker ID {data.egress_info.egress_id} does not exist"
             ) from err
 
+        event = to_recording_event(data.egress_info.status)
+
+        # Log if/why the recording failed
+        self.recording_events.log_worker_error(
+            recording,
+            event,
+            error=data.egress_info.error,
+            error_code=data.egress_info.error_code,
+        )
+
+        # Update room
         try:
             room_name = str(recording.room.id)
             RoomManagement.update_metadata(
@@ -201,38 +241,17 @@ class LiveKitEventsService:
         except RoomManagementException as e:
             logger.exception("Failed to update room's metadata: %s", e)
 
+        # Stop metadata collector
         if recording.options.get("metadata_collector_dispatch_id", None) is not None:
             try:
                 MetadataCollectorService().stop(recording)
             except MetadataCollectorException:
                 logger.warning("Failed to stop the MetadataCollectorService")
 
-        if (
-            data.egress_info.status == api.EgressStatus.EGRESS_LIMIT_REACHED
-            and recording.status == models.RecordingStatusChoices.ACTIVE
-        ):
-            try:
-                self.recording_events.handle_limit_reached(recording)
-            except RecordingEventsError as e:
-                raise ActionFailedError(
-                    f"Failed to process limit reached event for recording {recording}"
-                ) from e
+        if event is None:
+            return
 
-        # Finalize the recording, the egress has uploaded the file to the storage
-        if data.egress_info.status in [
-            api.EgressStatus.EGRESS_COMPLETE,
-            api.EgressStatus.EGRESS_LIMIT_REACHED,
-        ]:
-            try:
-                self.recording_events.handle_complete(recording)
-            except RecordingNotSavableError:
-                logger.warning(
-                    "Recording %s is not savable on egress complete "
-                    "(already saved or in an error state); ignoring.",
-                    recording.id,
-                )
-
-        # Silently ignoring EGRESS_ABORTED, EGRESS_FAILED
+        self.recording_events.handle_terminal_event(recording, event)
 
     @staticmethod
     def _is_connection_test_room(room_name: str) -> bool:

src/backend/core/services/lobby.py

@@ -131,6 +131,23 @@ class LobbyService:
         if participant_ids:
             self._redis().srem(self._get_index_key(room_id), *participant_ids)
 
+    @staticmethod
+    def _get_or_create_participant_id(request) -> str:
+        """Extract unique participant identifier from the request."""
+        return request.COOKIES.get(settings.LOBBY_COOKIE_NAME, str(uuid.uuid4()))
+
+    @staticmethod
+    def prepare_response(response, participant_id):
+        """Set participant cookie if needed."""
+        if not response.cookies.get(settings.LOBBY_COOKIE_NAME):
+            response.set_cookie(
+                key=settings.LOBBY_COOKIE_NAME,
+                value=participant_id,
+                httponly=True,
+                secure=True,
+                samesite="Lax",
+            )
+
     @staticmethod
     def can_bypass_lobby(room, user, role) -> bool:
         """Determines if a user can bypass the waiting lobby and join a room directly.
@@ -161,9 +178,8 @@ class LobbyService:
     def request_entry(
         self,
         room: models.Room,
-        user,
+        request,
         username: str,
-        participant_id: Optional[uuid.UUID] = None,
     ) -> Tuple[LobbyParticipant, Optional[Dict]]:
         """Request entry to a room for a participant.
 
@@ -178,51 +194,52 @@ class LobbyService:
         5. If denied, do nothing.
         """
 
-        participant = None
-        if participant_id:
-            participant = self._get_participant(room.id, participant_id)
-
-        is_new_participant = participant is None
-        if is_new_participant:
-            participant = self._create_participant(username)
+        participant_id = self._get_or_create_participant_id(request)
+        participant = self._get_participant(room.id, participant_id)
 
         room_id = str(room.id)
-        user_role = room.get_role(user)
+        user_role = room.get_role(request.user)
 
-        if self.can_bypass_lobby(room=room, user=user, role=user_role):
-            if not is_new_participant:
-                self.clear_participant_cache(room.id, participant.id)
-            participant.status = LobbyParticipantStatus.ACCEPTED
+        if self.can_bypass_lobby(room=room, user=request.user, role=user_role):
+            if participant is None:
+                participant = LobbyParticipant(
+                    status=LobbyParticipantStatus.ACCEPTED,
+                    username=username,
+                    id=participant_id,
+                    color=utils.generate_color(participant_id),
+                    entered_at=timezone.now().isoformat(),
+                )
+            else:
+                participant.status = LobbyParticipantStatus.ACCEPTED
 
             livekit_config = utils.generate_livekit_config(
                 room_id=room_id,
-                user=user,
-                username=participant.username,
+                user=request.user,
+                username=username,
                 color=participant.color,
                 configuration=room.configuration,
-                participant_id=participant.id,
+                participant_id=participant_id,
                 role=user_role,
             )
             return participant, livekit_config
 
         livekit_config = None
 
-        if is_new_participant:
-            self._save_participant(room.id, participant)
-            self._notify_entry_request(room_id)
+        if participant is None:
+            participant = self.enter(room.id, participant_id, username)
 
         elif participant.status == LobbyParticipantStatus.WAITING:
-            self.refresh_waiting_status(room.id, participant.id)
+            self.refresh_waiting_status(room.id, participant_id)
 
         elif participant.status == LobbyParticipantStatus.ACCEPTED:
             # wrongly named, contains access token to join a room
             livekit_config = utils.generate_livekit_config(
                 room_id=room_id,
-                user=user,
-                username=participant.username,
+                user=request.user,
+                username=username,
                 color=participant.color,
                 configuration=room.configuration,
-                participant_id=participant.id,
+                participant_id=participant_id,
                 role=user_role,
             )
 
@@ -240,35 +257,24 @@ class LobbyService:
         )
         self._index_touch(room_id)
 
-    def _create_participant(self, username: str) -> LobbyParticipant:
-        """Create a new waiting participant without persisting it.
+    def enter(
+        self, room_id: UUID, participant_id: str, username: str
+    ) -> LobbyParticipant:
+        """Add participant to waiting lobby."""
+
+        color = utils.generate_color(participant_id)
 
-        Participant identifiers are minted here, server-side, exclusively.
-        """
-        participant_id = str(uuid.uuid4())
         participant = LobbyParticipant(
             status=LobbyParticipantStatus.WAITING,
             username=username,
             id=participant_id,
+            color=color,
             entered_at=timezone.now().isoformat(),
-            color=utils.generate_color(participant_id),
         )
-        return participant
 
-    def _save_participant(self, room_id: UUID, participant: LobbyParticipant):
-        """Persist a participant in the room's lobby."""
-        cache.set(
-            self._get_cache_key(room_id, participant.id),
-            participant.to_dict(),
-            timeout=settings.LOBBY_WAITING_TIMEOUT,
-        )
-        self._index_add(room_id, participant.id)
-
-    def _notify_entry_request(self, room_id: str):
-        """Notify room participants of a new entry request."""
         try:
             utils.notify_participants(
-                room_name=room_id,
+                room_name=str(room_id),
                 notification_data={
                     "type": settings.LOBBY_NOTIFICATION_TYPE,
                 },
@@ -277,6 +283,16 @@ class LobbyService:
             # If room not created yet, there is no participants to notify
             logger.exception("Failed to notify room participants")
 
+        cache_key = self._get_cache_key(room_id, participant_id)
+        cache.set(
+            cache_key,
+            participant.to_dict(),
+            timeout=settings.LOBBY_WAITING_TIMEOUT,
+        )
+        self._index_add(room_id, participant_id)
+
+        return participant
+
     def _get_participant(
         self, room_id: UUID, participant_id: str
     ) -> Optional[LobbyParticipant]:
@@ -337,7 +353,7 @@ class LobbyService:
         room_id: UUID,
         participant_id: str,
         allow_entry: bool,
-    ) -> LobbyParticipant:
+    ) -> None:
         """Handle decision on participant entry.
 
         Updates participant status based on allow_entry:
@@ -355,7 +371,7 @@ class LobbyService:
                 "timeout": settings.LOBBY_DENIED_TIMEOUT,
             }
 
-        return self._update_participant_status(room_id, participant_id, **decision)
+        self._update_participant_status(room_id, participant_id, **decision)
 
     def _update_participant_status(
         self,
@@ -363,7 +379,7 @@ class LobbyService:
         participant_id: str,
         status: LobbyParticipantStatus,
         timeout: int,
-    ) -> LobbyParticipant:
+    ) -> None:
         """Update participant status with appropriate timeout."""
 
         cache_key = self._get_cache_key(room_id, participant_id)
@@ -386,8 +402,6 @@ class LobbyService:
         cache.set(cache_key, participant.to_dict(), timeout=timeout)
         self._index_touch(room_id)
 
-        return participant
-
     def clear_room_cache(self, room_id: UUID) -> None:
         """Clear all participant entries from the cache for a specific room."""
 

src/backend/core/services/room_management.py

@@ -76,10 +76,6 @@ class RoomManagement:
 
         except TwirpError as e:
             if e.code == "not_found":
-                logger.warning(
-                    "Room %s not found in LiveKit, skipping metadata update",
-                    room_name,
-                )
                 raise RoomNotFoundException("Room does not exist") from e
 
             logger.exception(

src/backend/core/services/transit_code.py

@@ -1,74 +0,0 @@
-"""Service handling the lifecycle of transit codes.
-
-A transit code is an opaque, cryptographically random, single-use code
-handed to an embedded frontend (through a URL fragment) so it can obtain a
-user access token on the core API without a session cookie. The code
-carries no information by itself: everything it references (user, client)
-is stored server-side in the cache, and consumed atomically on exchange.
-"""
-
-import hashlib
-import secrets
-
-from django.conf import settings
-from django.core.cache import cache
-
-
-class TransitCodeService:
-    """Create and consume single-use transit codes."""
-
-    @staticmethod
-    def _cache_key(code):
-        """Build the cache key for a code.
-
-        The code is hashed so that a dump of the cache never reveals
-        directly usable codes.
-        """
-        digest = hashlib.sha256(code.encode("utf-8")).hexdigest()
-        return f"{settings.TRANSIT_CODE_CACHE_PREFIX}:{digest}"
-
-    def create_code(self, user, client_id="unknown"):
-        """Generate a transit code for a user, and store it.
-
-        The code expires after TRANSIT_CODE_TTL seconds.
-
-        Returns:
-            str: The opaque code to hand to the client.
-        """
-        # Default 48 random bytes -> 64 url-safe characters, 384 bits of
-        # entropy: unguessable and safe to transit through a URL fragment.
-        code = secrets.token_urlsafe(settings.TRANSIT_CODE_NBYTES)
-
-        cache.set(
-            self._cache_key(code),
-            {
-                "user_id": str(user.id),
-                "client_id": client_id,
-            },
-            timeout=settings.TRANSIT_CODE_TTL,
-        )
-
-        return code
-
-    def consume_code(self, code):
-        """Consume a transit code, enforcing single use.
-
-        The code is deleted from the cache upon consumption. `cache.delete`
-        returns whether a key was actually deleted, so if two requests race
-        on the same code, only one of them wins.
-
-        Returns:
-            dict | None: The data stored at creation time ('user_id',
-                'client_id'), or None if the code is unknown, expired or
-                already consumed.
-        """
-        if not code:
-            return None
-
-        key = self._cache_key(code)
-        data = cache.get(key)
-
-        if data is None or not cache.delete(key):
-            return None
-
-        return data

src/backend/core/tests/files/test_api_files_list.py

@@ -27,7 +27,7 @@ def test_api_files_list_anonymous_not_allowed():
 
 def test_api_files_list_authentificated_user_allowed():
     """
-    Authentificated users should be allowed to list files
+    Authenticated users should be allowed to list files
     """
     user = factories.UserFactory()
     client = APIClient()

src/backend/core/tests/recording/service/test_recording_events.py

@@ -2,18 +2,23 @@
 Test RecordingEventsService service.
 """
 
-# pylint: disable=redefined-outer-name
+# pylint: disable=redefined-outer-name,protected-access
 
+import logging
 from unittest import mock
 
 import pytest
 
 from core.factories import RecordingFactory
+from core.recording.enums import RecordingWorkerEvent
 from core.recording.services.recording_events import (
     RecordingEventsError,
     RecordingEventsService,
     RecordingNotSavableError,
 )
+from core.services.room_management import (
+    RoomManagementException,
+)
 from core.utils import NotificationError
 
 pytestmark = pytest.mark.django_db
@@ -34,10 +39,10 @@ def service():
 )
 @mock.patch("core.utils.notify_participants")
 def test_handle_limit_reached_success(mock_notify, mode, notification_type, service):
-    """Test handle_limit_reached stops recording and notifies participants."""
+    """Test _handle_limit_reached stops recording and notifies participants."""
 
     recording = RecordingFactory(status="active", mode=mode)
-    service.handle_limit_reached(recording)
+    service._handle_limit_reached(recording)
 
     assert recording.status == "stopped"
     mock_notify.assert_called_once_with(
@@ -48,13 +53,69 @@ def test_handle_limit_reached_success(mock_notify, mode, notification_type, serv
 @pytest.mark.parametrize(
     ("mode", "notification_type"),
     (
-        ("screen_recording", "screenRecordingLimitReached"),
-        ("transcript", "transcriptionLimitReached"),
+        ("screen_recording", "screenRecordingFailed"),
+        ("transcript", "transcriptionFailed"),
     ),
 )
 @mock.patch("core.utils.notify_participants")
-def test_handle_limit_reached_error(mock_notify, mode, notification_type, service):
-    """Test handle_limit_reached raises RecordingEventsError when notification fails."""
+def test_handle_failed_success(mock_notify, mode, notification_type, service):
+    """Test _handle_failed marks recording as failed and notifies participants."""
+
+    recording = RecordingFactory(status="active", mode=mode)
+    service._handle_failed(recording)
+
+    assert recording.status == "failed"
+    mock_notify.assert_called_once_with(
+        room_name=str(recording.room.id), notification_data={"type": notification_type}
+    )
+
+
+@pytest.mark.parametrize(
+    ("mode", "notification_type"),
+    (
+        ("screen_recording", "screenRecordingAborted"),
+        ("transcript", "transcriptionAborted"),
+    ),
+)
+@mock.patch("core.utils.notify_participants")
+def test_handle_aborted_success(mock_notify, mode, notification_type, service):
+    """Test _handle_aborted marks recording as aborted and notifies participants."""
+
+    recording = RecordingFactory(status="active", mode=mode)
+    service._handle_aborted(recording)
+
+    assert recording.status == "aborted"
+    mock_notify.assert_called_once_with(
+        room_name=str(recording.room.id), notification_data={"type": notification_type}
+    )
+
+
+@pytest.mark.parametrize(
+    ("mode", "notification_prefix"),
+    (("screen_recording", "screenRecording"), ("transcript", "transcription")),
+)
+@pytest.mark.parametrize(
+    ("handler", "expected_status", "event", "notification_suffix"),
+    (
+        ("_handle_limit_reached", "stopped", "limit reached", "LimitReached"),
+        ("_handle_failed", "failed", "failed", "Failed"),
+        ("_handle_aborted", "aborted", "aborted", "Aborted"),
+    ),
+)
+@mock.patch("core.utils.notify_participants")
+def test_handle_event_notification_error(  # noqa: PLR0913, PLR0917
+    mock_notify,
+    handler,
+    expected_status,
+    event,
+    notification_suffix,
+    mode,
+    notification_prefix,
+    service,
+):  # pylint: disable=too-many-arguments,too-many-positional-arguments
+    """Test handlers raise RecordingEventsError when notifying participants fails,
+    while still applying the recording status of their event.
+    """
 
     mock_notify.side_effect = NotificationError("Error notifying")
 
@@ -62,14 +123,15 @@ def test_handle_limit_reached_error(mock_notify, mode, notification_type, servic
 
     with pytest.raises(
         RecordingEventsError,
-        match=r"Failed to notify participants in room '.+' "
-        r"about recording limit reached \(recording_id=.+\)",
+        match=rf"Failed to notify participants in room '.+' "
+        rf"about recording {event} \(recording_id=.+\)",
     ):
-        service.handle_limit_reached(recording)
+        getattr(service, handler)(recording)
 
-    assert recording.status == "stopped"
+    assert recording.status == expected_status
     mock_notify.assert_called_once_with(
-        room_name=str(recording.room.id), notification_data={"type": notification_type}
+        room_name=str(recording.room.id),
+        notification_data={"type": f"{notification_prefix}{notification_suffix}"},
     )
 
 
@@ -82,19 +144,19 @@ def test_handle_limit_reached_error(mock_notify, mode, notification_type, servic
     "core.recording.services.recording_events.notification_service."
     "notify_external_services"
 )
-def test_handle_complete_saves_recording(  # pylint: disable=too-many-arguments, too-many-positional-arguments
+def test_handle_successful_saves_recording(  # pylint: disable=too-many-arguments, too-many-positional-arguments
     mock_notify_external_services,
     notify_return_value,
     expected_status,
     status,
     service,
 ):
-    """Test handle_complete notifies external services and saves a savable recording."""
+    """Test _handle_successful notifies external services and saves a savable recording."""
 
     mock_notify_external_services.return_value = notify_return_value
 
     recording = RecordingFactory(status=status)
-    service.handle_complete(recording)
+    service._handle_successful(recording)
 
     mock_notify_external_services.assert_called_once_with(recording)
 
@@ -104,23 +166,293 @@ def test_handle_complete_saves_recording(  # pylint: disable=too-many-arguments,
 
 @pytest.mark.parametrize(
     "status",
-    ["initiated", "saved", "notification_succeeded", "aborted", "failed_to_start"],
+    [
+        "initiated",
+        "saved",
+        "notification_succeeded",
+        "aborted",
+        "failed",
+        "failed_to_start",
+    ],
 )
 @mock.patch(
     "core.recording.services.recording_events.notification_service."
     "notify_external_services"
 )
-def test_handle_complete_non_savable_recording(
+def test_handle_successful_non_savable_recording(
     mock_notify_external_services, status, service
 ):
-    """Test handle_complete refuses recordings that are already saved or in error."""
+    """Test _handle_successful refuses recordings that are already saved or in error."""
 
     recording = RecordingFactory(status=status)
 
     with pytest.raises(RecordingNotSavableError):
-        service.handle_complete(recording)
+        service._handle_successful(recording)
 
     mock_notify_external_services.assert_not_called()
 
     recording.refresh_from_db()
     assert recording.status == status
+
+
+@pytest.mark.parametrize(
+    ("event", "recording_status"),
+    (
+        (RecordingWorkerEvent.STARTED, "started"),
+        (RecordingWorkerEvent.SAVING, "saving"),
+    ),
+)
+@mock.patch("core.services.room_management.RoomManagement.update_metadata")
+def test_handle_update_syncs_room_metadata(
+    mock_update_metadata, event, recording_status, service
+):
+    """Test handle_update updates the room's metadata."""
+
+    recording = RecordingFactory(status="active")
+    service.handle_update(recording, event)
+
+    mock_update_metadata.assert_called_once_with(
+        str(recording.room.id), {"recording_status": recording_status}
+    )
+
+
+@pytest.mark.parametrize(
+    "event",
+    (
+        RecordingWorkerEvent.STARTING,
+        RecordingWorkerEvent.COMPLETED,
+        RecordingWorkerEvent.LIMIT_REACHED,
+        RecordingWorkerEvent.ABORTED,
+        RecordingWorkerEvent.FAILED,
+    ),
+)
+@mock.patch("core.services.room_management.RoomManagement.update_metadata")
+def test_handle_update_ignores_events_without_a_metadata_status(
+    mock_update_metadata, event, service
+):
+    """Test handle_update doesn't update metadata for events it doesn't match."""
+
+    recording = RecordingFactory(status="active")
+    service.handle_update(recording, event)
+
+    mock_update_metadata.assert_not_called()
+
+
+@pytest.mark.parametrize(
+    ("event", "initial_status", "expected_status", "notification_type"),
+    (
+        (RecordingWorkerEvent.LIMIT_REACHED, "active", "saved", "LimitReached"),
+        (RecordingWorkerEvent.LIMIT_REACHED, "stopped", "saved", None),
+        (RecordingWorkerEvent.LIMIT_REACHED, "saved", "saved", None),
+        (RecordingWorkerEvent.ABORTED, "active", "aborted", "Aborted"),
+        (RecordingWorkerEvent.ABORTED, "failed_to_stop", "failed_to_stop", None),
+        (RecordingWorkerEvent.FAILED, "active", "failed", "Failed"),
+        (RecordingWorkerEvent.FAILED, "stopped", "failed", "Failed"),
+        (RecordingWorkerEvent.FAILED, "aborted", "aborted", None),
+        (RecordingWorkerEvent.COMPLETED, "active", "saved", None),
+        (RecordingWorkerEvent.COMPLETED, "saved", "saved", None),
+    ),
+)
+@mock.patch(
+    "core.recording.services.recording_events.notification_service."
+    "notify_external_services"
+)
+@mock.patch("core.utils.notify_participants")
+def test_handle_terminal_event_dispatches_on_event_and_status(  # noqa: PLR0913, PLR0917
+    mock_notify,
+    mock_notify_external_services,
+    event,
+    initial_status,
+    expected_status,
+    notification_type,
+    service,
+):  # pylint: disable=too-many-arguments,too-many-positional-arguments
+    """Test handle_terminal_event chooses the right handler from the event and status."""
+
+    mock_notify_external_services.return_value = False
+
+    recording = RecordingFactory(status=initial_status, mode="screen_recording")
+    service.handle_terminal_event(recording, event)
+
+    recording.refresh_from_db()
+    assert recording.status == expected_status
+
+    if notification_type is None:
+        mock_notify.assert_not_called()
+    else:
+        mock_notify.assert_called_once_with(
+            room_name=str(recording.room.id),
+            notification_data={"type": f"screenRecording{notification_type}"},
+        )
+
+
+@pytest.mark.parametrize(
+    "event",
+    (
+        RecordingWorkerEvent.STARTING,
+        RecordingWorkerEvent.STARTED,
+        RecordingWorkerEvent.SAVING,
+    ),
+)
+@mock.patch(
+    "core.recording.services.recording_events.notification_service."
+    "notify_external_services"
+)
+@mock.patch("core.utils.notify_participants")
+def test_handle_terminal_event_ignores_non_terminal_events(
+    mock_notify, mock_notify_external_services, event, service, caplog
+):
+    """Test handle_terminal_event refuses non-terminal events."""
+
+    recording = RecordingFactory(status="active")
+
+    with caplog.at_level(logging.WARNING):
+        service.handle_terminal_event(recording, event)
+
+    assert f"Ignoring non-terminal event {event.value}" in caplog.text
+    mock_notify.assert_not_called()
+    mock_notify_external_services.assert_not_called()
+
+    recording.refresh_from_db()
+    assert recording.status == "active"
+
+
+@pytest.mark.parametrize(
+    ("event", "expected_status"),
+    (
+        (RecordingWorkerEvent.LIMIT_REACHED, "saved"),
+        (RecordingWorkerEvent.ABORTED, "aborted"),
+        (RecordingWorkerEvent.FAILED, "failed"),
+    ),
+)
+@mock.patch(
+    "core.recording.services.recording_events.notification_service."
+    "notify_external_services"
+)
+@mock.patch("core.utils.notify_participants")
+def test_handle_terminal_event_survives_a_notification_failure(  # noqa: PLR0913, PLR0917
+    mock_notify,
+    mock_notify_external_services,
+    event,
+    expected_status,
+    service,
+    caplog,
+):  # pylint: disable=too-many-arguments,too-many-positional-arguments
+    """Test handle_terminal_event logs a notification failure instead of raising.
+
+    The recording status must still be persisted: participants missing their
+    notification should not disturb recording.
+    """
+
+    mock_notify_external_services.return_value = False
+    mock_notify.side_effect = NotificationError("Error notifying")
+
+    recording = RecordingFactory(status="active")
+
+    with caplog.at_level(logging.ERROR):
+        service.handle_terminal_event(recording, event)
+
+    assert f"Failed to notify participants that recording {recording.id}" in caplog.text
+
+    recording.refresh_from_db()
+    assert recording.status == expected_status
+
+
+@pytest.mark.parametrize(
+    "status",
+    ["failed_to_start", "aborted", "failed", "failed_to_stop", "saved", "initiated"],
+)
+@mock.patch(
+    "core.recording.services.recording_events.notification_service."
+    "notify_external_services"
+)
+def test_handle_terminal_event_ignores_a_non_savable_recording(
+    mock_notify_external_services, status, service, caplog
+):
+    """Test handle_terminal_event handles a redelivered event idempotently.
+
+    A terminal event may be redelivered for an already finalized recording;
+    this must not raise, otherwise the webhook would 500 and be retried.
+    """
+
+    recording = RecordingFactory(status=status)
+
+    with caplog.at_level(logging.WARNING):
+        service.handle_terminal_event(recording, RecordingWorkerEvent.COMPLETED)
+
+    assert f"Recording {recording.id} is not savable" in caplog.text
+    mock_notify_external_services.assert_not_called()
+
+    recording.refresh_from_db()
+    assert recording.status == status
+
+
+@mock.patch("core.services.room_management.RoomManagement.update_metadata")
+def test_handle_update_survives_a_metadata_failure(
+    mock_update_metadata, service, caplog
+):
+    """Test handle_update logs a metadata failure instead of raising."""
+
+    mock_update_metadata.side_effect = RoomManagementException("Error updating")
+
+    recording = RecordingFactory(status="active")
+
+    with caplog.at_level(logging.ERROR):
+        service.handle_update(recording, RecordingWorkerEvent.SAVING)
+
+    assert "Failed to update room's metadata" in caplog.text
+
+
+@pytest.mark.parametrize(
+    ("event", "expected_level"),
+    (
+        (RecordingWorkerEvent.ABORTED, logging.INFO),
+        (RecordingWorkerEvent.FAILED, logging.ERROR),
+    ),
+)
+def test_log_worker_error_reports_an_unsuccessful_event(
+    event, expected_level, service, caplog
+):
+    """Test log_worker_error records the reason the recording did not succeed."""
+
+    recording = RecordingFactory(status="active", mode="screen_recording")
+
+    with caplog.at_level(logging.INFO):
+        service.log_worker_error(
+            recording, event, error="could not connect to the room", error_code=500
+        )
+
+    assert (
+        f"Recording worker reported {event.value} for recording {recording.id}"
+        in caplog.text
+    )
+    assert "could not connect to the room" in caplog.text
+    assert "error_code=500" in caplog.text
+    worker_logs = [
+        record
+        for record in caplog.records
+        if record.name == "core.recording.services.recording_events"
+    ]
+    assert [record.levelno for record in worker_logs] == [expected_level]
+
+
+@pytest.mark.parametrize(
+    "event",
+    (
+        RecordingWorkerEvent.STARTING,
+        RecordingWorkerEvent.STARTED,
+        RecordingWorkerEvent.SAVING,
+        RecordingWorkerEvent.COMPLETED,
+        RecordingWorkerEvent.LIMIT_REACHED,
+        None,
+    ),
+)
+def test_log_worker_error_stays_quiet_on_anything_else(event, service, caplog):
+    """Test log_worker_error ignores events other than FAILED and ABORTED."""
+
+    recording = RecordingFactory(status="active")
+
+    with caplog.at_level(logging.INFO):
+        service.log_worker_error(recording, event, error="some error", error_code=500)
+
+    assert "Recording worker reported" not in caplog.text

src/backend/core/tests/recording/test_api_recordings_retrieve.py

@@ -224,6 +224,7 @@ def test_api_recording_retrieve_expired(settings):
         RecordingStatusChoices.INITIATED,
         RecordingStatusChoices.ACTIVE,
         RecordingStatusChoices.SAVED,
+        RecordingStatusChoices.FAILED,
         RecordingStatusChoices.FAILED_TO_START,
         RecordingStatusChoices.FAILED_TO_STOP,
         RecordingStatusChoices.ABORTED,

src/backend/core/tests/recording/worker/test_services.py

@@ -4,6 +4,7 @@ Test worker service classes.
 
 # pylint: disable=protected-access,redefined-outer-name,unused-argument,no-member
 
+import logging
 from unittest.mock import AsyncMock, Mock, patch
 
 import pytest
@@ -154,9 +155,9 @@ def test_base_egress_filepath_construction(service, filename, extension, expecte
     "response_status,expected_result",
     [
         (livekit_api.EgressStatus.EGRESS_ABORTED, "ABORTED"),
+        (livekit_api.EgressStatus.EGRESS_FAILED, "FAILED"),
         (livekit_api.EgressStatus.EGRESS_COMPLETE, "FAILED_TO_STOP"),
         (livekit_api.EgressStatus.EGRESS_ENDING, "STOPPED"),
-        (livekit_api.EgressStatus.EGRESS_FAILED, "FAILED_TO_STOP"),
     ],
 )
 def test_base_egress_stop_with_status(service, response_status, expected_result):
@@ -175,6 +176,32 @@ def test_base_egress_stop_with_status(service, response_status, expected_result)
     assert result == expected_result
 
 
+@pytest.mark.parametrize(
+    "response_status,event",
+    [
+        (livekit_api.EgressStatus.EGRESS_ABORTED, "aborted"),
+        (livekit_api.EgressStatus.EGRESS_FAILED, "failed"),
+        (livekit_api.EgressStatus.EGRESS_COMPLETE, "failed to stop"),
+    ],
+)
+def test_base_egress_stop_logs_livekit_error(service, response_status, event, caplog):
+    """Should log the reason LiveKit reported for an unsuccessful stop."""
+    mock_response = Mock(
+        status=response_status,
+        egress_id="test_worker_id",
+        error="could not connect to the room",
+        error_code=500,
+    )
+    service._handle_request = Mock(return_value=mock_response)
+
+    with caplog.at_level(logging.ERROR):
+        service.stop("test_worker_id")
+
+    assert f"Egress {event} on stop (egress_id=test_worker_id" in caplog.text
+    assert "could not connect to the room" in caplog.text
+    assert "error_code=500" in caplog.text
+
+
 def test_base_egress_stop_missing_status(service):
     """Test stop method when response is missing status"""
     # Mock _handle_request with missing status

src/backend/core/tests/rooms/test_api_rooms_create.py

@@ -2,18 +2,15 @@
 Test rooms API endpoints in the Meet core app: create.
 """
 
-from datetime import datetime, timedelta, timezone
-
 # pylint: disable=redefined-outer-name,unused-argument
 from django.conf import settings
 from django.core.cache import cache
 
-import jwt
 import pytest
 from rest_framework.test import APIClient
 
-from ...factories import ApplicationFactory, RoomFactory, UserFactory
-from ...models import ApplicationScope, Room, RoomAccessLevel
+from ...factories import RoomFactory, UserFactory
+from ...models import Room, RoomAccessLevel
 
 pytestmark = pytest.mark.django_db
 
@@ -315,39 +312,3 @@ def test_api_rooms_create_authenticated_blank_user_default_access_level():
     assert response.status_code == 201
     room = Room.objects.get()
     assert room.access_level == settings.RESOURCE_DEFAULT_ACCESS_LEVEL
-
-
-def generate_user_access_token(user):
-    """Generate a valid user access JWT signed with the token secret."""
-    now = datetime.now(timezone.utc)
-    application = ApplicationFactory(scopes=[ApplicationScope.USERS_SESSION])
-
-    payload = {
-        "iss": settings.USER_ACCESS_TOKEN_ISSUER,
-        "aud": settings.USER_ACCESS_TOKEN_AUDIENCE,
-        "iat": now,
-        "exp": now + timedelta(seconds=settings.USER_ACCESS_TOKEN_TTL),
-        "user_id": str(user.id),
-        "token_type": "user_access",
-        "client_id": application.client_id,
-        "scope": "user:access",
-    }
-
-    return jwt.encode(
-        payload,
-        settings.USER_ACCESS_TOKEN_SECRET_KEY,
-        algorithm=settings.USER_ACCESS_TOKEN_ALG,
-    )
-
-
-def test_api_rooms_create_authenticated_with_user_access_token():
-    """A user access token should create a room exactly like a session would."""
-    user = UserFactory()
-
-    client = APIClient()
-    client.credentials(HTTP_AUTHORIZATION=f"Bearer {generate_user_access_token(user)}")
-    response = client.post("/api/v1.0/rooms/", {"name": "my room"})
-
-    assert response.status_code == 201
-    room = Room.objects.get()
-    assert room.accesses.filter(role="owner", user=user).exists()

src/backend/core/tests/rooms/test_api_rooms_list.py

@@ -2,18 +2,14 @@
 Test rooms API endpoints in the Meet core app: list.
 """
 
-from datetime import datetime, timedelta, timezone
 from unittest import mock
 
-from django.conf import settings as django_settings
-
-import jwt
 import pytest
 from rest_framework.pagination import PageNumberPagination
 from rest_framework.test import APIClient
 
-from ...factories import ApplicationFactory, RoomFactory, UserFactory
-from ...models import ApplicationScope, RoomAccessLevel
+from ...factories import RoomFactory, UserFactory
+from ...models import RoomAccessLevel
 
 pytestmark = pytest.mark.django_db
 
@@ -160,41 +156,3 @@ def test_api_rooms_list_pagination_page_size():
     assert len(content["results"]) == 3
     assert content["next"] == "http://testserver/api/v1.0/rooms/?page=2&page_size=3"
     assert content["previous"] is None
-
-
-def generate_user_access_token(user):
-    """Generate a valid user access JWT signed with the token secret."""
-    now = datetime.now(timezone.utc)
-    application = ApplicationFactory(scopes=[ApplicationScope.USERS_SESSION])
-
-    payload = {
-        "iss": django_settings.USER_ACCESS_TOKEN_ISSUER,
-        "aud": django_settings.USER_ACCESS_TOKEN_AUDIENCE,
-        "iat": now,
-        "exp": now + timedelta(seconds=django_settings.USER_ACCESS_TOKEN_TTL),
-        "user_id": str(user.id),
-        "token_type": "user_access",
-        "client_id": application.client_id,
-        "scope": "user:access",
-    }
-
-    return jwt.encode(
-        payload,
-        django_settings.USER_ACCESS_TOKEN_SECRET_KEY,
-        algorithm=django_settings.USER_ACCESS_TOKEN_ALG,
-    )
-
-
-def test_api_rooms_list_authenticated_with_user_access_token():
-    """A user access token should list rooms exactly like a session would."""
-    user = UserFactory()
-    room = RoomFactory(users=[(user, "owner")])
-    RoomFactory()  # another user's room, not listed
-
-    client = APIClient()
-    client.credentials(HTTP_AUTHORIZATION=f"Bearer {generate_user_access_token(user)}")
-    response = client.get("/api/v1.0/rooms/")
-
-    assert response.status_code == 200
-    assert response.data["count"] == 1
-    assert response.data["results"][0]["id"] == str(room.id)

src/backend/core/tests/rooms/test_api_rooms_lobby.py

@@ -6,7 +6,6 @@ Test rooms API endpoints in the Meet core app: lobby functionality.
 import uuid
 from unittest import mock
 
-from django.core import signing
 from django.core.cache import cache
 
 import pytest
@@ -16,16 +15,13 @@ from rest_framework.test import APIClient
 from ... import utils
 from ...factories import RoomFactory, UserFactory
 from ...models import RoomAccessLevel
-from ...services.lobby import LobbyService
+from ...services.lobby import (
+    LobbyService,
+)
 
 pytestmark = pytest.mark.django_db
 
 
-def _lobby_signer():
-    """Use the polling credential's dedicated signing namespace."""
-    return signing.Signer(salt="core.lobby.participant")
-
-
 # Tests for request_entry endpoint
 
 
@@ -35,6 +31,7 @@ def test_request_entry_anonymous(settings):
     room = RoomFactory(access_level=RoomAccessLevel.RESTRICTED)
     client = APIClient()
 
+    settings.LOBBY_COOKIE_NAME = "mocked-cookie"
     settings.LOBBY_KEY_PREFIX = "mocked-cache-prefix"
 
     # Lobby cache should be empty before the request
@@ -52,10 +49,11 @@ def test_request_entry_anonymous(settings):
 
     assert response.status_code == 200
 
-    # The participant identifier is returned in the response body; no
-    # cookie is involved anymore
-    assert not response.cookies
-    participant_id = response.json()["id"]
+    # Verify the lobby cookie was properly set
+    cookie = response.cookies.get("mocked-cookie")
+    assert cookie is not None
+
+    participant_id = cookie.value
 
     # Verify response content matches expected structure and values
     assert response.json() == {
@@ -72,8 +70,7 @@ def test_request_entry_anonymous(settings):
     assert len(lobby_keys) == 1
 
     # Verify participant data was correctly stored in cache
-    raw_id = _lobby_signer().unsign(participant_id)
-    participant_data = cache.get(f"mocked-cache-prefix_{room.id!s}_{raw_id}")
+    participant_data = cache.get(f"mocked-cache-prefix_{room.id!s}_{participant_id}")
     assert participant_data.get("username") == "test_user"
 
 
@@ -85,6 +82,7 @@ def test_request_entry_authenticated_user(settings):
     client = APIClient()
     client.force_login(user)
 
+    settings.LOBBY_COOKIE_NAME = "mocked-cookie"
     settings.LOBBY_KEY_PREFIX = "mocked-cache-prefix"
 
     # Lobby cache should be empty before the request
@@ -102,10 +100,11 @@ def test_request_entry_authenticated_user(settings):
 
     assert response.status_code == 200
 
-    # The participant identifier is returned in the response body; no
-    # cookie is involved anymore
-    assert not response.cookies
-    participant_id = response.json()["id"]
+    # Verify the lobby cookie was properly set
+    cookie = response.cookies.get("mocked-cookie")
+    assert cookie is not None
+
+    participant_id = cookie.value
 
     # Verify response content matches expected structure and values
     assert response.json() == {
@@ -122,8 +121,7 @@ def test_request_entry_authenticated_user(settings):
     assert len(lobby_keys) == 1
 
     # Verify participant data was correctly stored in cache
-    raw_id = _lobby_signer().unsign(participant_id)
-    participant_data = cache.get(f"mocked-cache-prefix_{room.id!s}_{raw_id}")
+    participant_data = cache.get(f"mocked-cache-prefix_{room.id!s}_{participant_id}")
     assert participant_data.get("username") == "test_user"
 
 
@@ -135,6 +133,7 @@ def test_request_entry_with_existing_participants(settings):
     client = APIClient()
 
     # Configure test settings for cookies and cache
+    settings.LOBBY_COOKIE_NAME = "mocked-cookie"
     settings.LOBBY_KEY_PREFIX = "mocked-cache-prefix"
 
     # Add two participants already waiting in the lobby
@@ -177,10 +176,11 @@ def test_request_entry_with_existing_participants(settings):
     # Verify successful response
     assert response.status_code == 200
 
-    # The participant identifier is returned in the response body; no
-    # cookie is involved anymore
-    assert not response.cookies
-    participant_id = response.json()["id"]
+    # Verify the lobby cookie was properly set for the new participant
+    cookie = response.cookies.get("mocked-cookie")
+    assert cookie is not None
+
+    participant_id = cookie.value
 
     # Verify response content matches expected structure and values
     assert response.json() == {
@@ -197,8 +197,7 @@ def test_request_entry_with_existing_participants(settings):
     assert len(lobby_keys) == 3
 
     # Verify the new participant data was correctly stored in cache
-    raw_id = _lobby_signer().unsign(participant_id)
-    participant_data = cache.get(f"mocked-cache-prefix_{room.id!s}_{raw_id}")
+    participant_data = cache.get(f"mocked-cache-prefix_{room.id!s}_{participant_id}")
     assert participant_data.get("username") == "test_user"
 
 
@@ -208,6 +207,7 @@ def test_request_entry_public_room(settings):
     room = RoomFactory(access_level=RoomAccessLevel.PUBLIC)
     client = APIClient()
 
+    settings.LOBBY_COOKIE_NAME = "mocked-cookie"
     settings.LOBBY_KEY_PREFIX = "mocked-cache-prefix"
 
     # Lobby cache should be empty before the request
@@ -216,9 +216,8 @@ def test_request_entry_public_room(settings):
 
     with (
         mock.patch.object(utils, "notify_participants", return_value=None),
-        mock.patch(
-            "core.services.lobby.uuid.uuid4",
-            return_value="2f7f162f-e7d1-421b-90e7-02bfbfbf8def",
+        mock.patch.object(
+            LobbyService, "_get_or_create_participant_id", return_value="123"
         ),
         mock.patch.object(
             utils, "generate_livekit_config", return_value={"token": "test-token"}
@@ -232,9 +231,14 @@ def test_request_entry_public_room(settings):
 
     assert response.status_code == 200
 
+    # Verify the lobby cookie was set
+    cookie = response.cookies.get("mocked-cookie")
+    assert cookie is not None
+    assert cookie.value == "123"
+
     # Verify response content matches expected structure and values
     assert response.json() == {
-        "id": _lobby_signer().sign("2f7f162f-e7d1-421b-90e7-02bfbfbf8def"),
+        "id": "123",
         "username": "test_user",
         "entered_at": "2025-01-01T10:00:00+00:00",
         "status": "accepted",
@@ -242,8 +246,9 @@ def test_request_entry_public_room(settings):
         "livekit": {"token": "test-token"},
     }
 
-    assert not cache.keys(f"mocked-cache-prefix_{room.id}_*")
-    assert not LobbyService()._index_members(room.id)
+    # Verify lobby cache is still empty after the request
+    lobby_keys = cache.keys(f"mocked-cache-prefix_{room.id}_*")
+    assert not lobby_keys
 
 
 @freeze_time("2025-01-01 10:00:00")
@@ -254,6 +259,7 @@ def test_request_entry_authenticated_user_public_room(settings):
     client = APIClient()
     client.force_login(user)
 
+    settings.LOBBY_COOKIE_NAME = "mocked-cookie"
     settings.LOBBY_KEY_PREFIX = "mocked-cache-prefix"
 
     # Lobby cache should be empty before the request
@@ -262,8 +268,9 @@ def test_request_entry_authenticated_user_public_room(settings):
 
     with (
         mock.patch.object(utils, "notify_participants", return_value=None),
-        mock.patch(
-            "core.services.lobby.uuid.uuid4",
+        mock.patch.object(
+            LobbyService,
+            "_get_or_create_participant_id",
             return_value="2f7f162f-e7d1-421b-90e7-02bfbfbf8def",
         ),
         mock.patch.object(
@@ -278,9 +285,14 @@ def test_request_entry_authenticated_user_public_room(settings):
 
     assert response.status_code == 200
 
+    # Verify the lobby cookie was set
+    cookie = response.cookies.get("mocked-cookie")
+    assert cookie is not None
+    assert cookie.value == "2f7f162f-e7d1-421b-90e7-02bfbfbf8def"
+
     # Verify response content matches expected structure and values
     assert response.json() == {
-        "id": _lobby_signer().sign("2f7f162f-e7d1-421b-90e7-02bfbfbf8def"),
+        "id": "2f7f162f-e7d1-421b-90e7-02bfbfbf8def",
         "username": "test_user",
         "entered_at": "2025-01-01T10:00:00+00:00",
         "status": "accepted",
@@ -288,8 +300,9 @@ def test_request_entry_authenticated_user_public_room(settings):
         "livekit": {"token": "test-token"},
     }
 
-    assert not cache.keys(f"mocked-cache-prefix_{room.id}_*")
-    assert not LobbyService()._index_members(room.id)
+    # Verify lobby cache is still empty after the request
+    lobby_keys = cache.keys(f"mocked-cache-prefix_{room.id}_*")
+    assert not lobby_keys
 
 
 @freeze_time("2025-01-01 10:00:00")
@@ -298,6 +311,7 @@ def test_request_entry_waiting_participant_public_room(settings):
     room = RoomFactory(access_level=RoomAccessLevel.PUBLIC)
     client = APIClient()
 
+    settings.LOBBY_COOKIE_NAME = "mocked-cookie"
     settings.LOBBY_KEY_PREFIX = "mocked-cache-prefix"
 
     # Add a waiting participant to the room's lobby cache
@@ -312,9 +326,9 @@ def test_request_entry_waiting_participant_public_room(settings):
         },
     )
 
-    LobbyService()._index_add(room.id, "2f7f162f-e7d1-421b-90e7-02bfbfbf8def")
+    # Simulate a browser with existing participant cookie
+    client.cookies.load({"mocked-cookie": "2f7f162f-e7d1-421b-90e7-02bfbfbf8def"})
 
-    # Simulate a returning participant echoing its identifier
     with (
         mock.patch.object(utils, "notify_participants", return_value=None),
         mock.patch.object(
@@ -323,19 +337,19 @@ def test_request_entry_waiting_participant_public_room(settings):
     ):
         response = client.post(
             f"/api/v1.0/rooms/{room.id}/request-entry/",
-            {
-                "username": "user1",
-                "participant_id": _lobby_signer().sign(
-                    "2f7f162f-e7d1-421b-90e7-02bfbfbf8def"
-                ),
-            },
+            {"username": "user1"},
         )
 
     assert response.status_code == 200
 
+    # Verify the lobby cookie was set
+    cookie = response.cookies.get("mocked-cookie")
+    assert cookie is not None
+    assert cookie.value == "2f7f162f-e7d1-421b-90e7-02bfbfbf8def"
+
     # Verify response content matches expected structure and values
     assert response.json() == {
-        "id": _lobby_signer().sign("2f7f162f-e7d1-421b-90e7-02bfbfbf8def"),
+        "id": "2f7f162f-e7d1-421b-90e7-02bfbfbf8def",
         "username": "user1",
         "status": "accepted",
         "color": "#123456",
@@ -343,8 +357,9 @@ def test_request_entry_waiting_participant_public_room(settings):
         "livekit": {"token": "test-token"},
     }
 
-    assert not cache.keys(f"mocked-cache-prefix_{room.id}_*")
-    assert not LobbyService()._index_members(room.id)
+    # Verify participant remains in the lobby cache after acceptance
+    lobby_keys = cache.keys(f"mocked-cache-prefix_{room.id}_*")
+    assert len(lobby_keys) == 1
 
 
 def test_request_entry_invalid_data():
@@ -647,14 +662,15 @@ def test_list_waiting_participants_empty(settings):
 @mock.patch.object(
     utils, "generate_livekit_config", return_value={"token": "test-token"}
 )
-def test_request_entry_throttling_anonymous_unidentified(
+def test_request_entry_throttling_anonymous_without_cookie(
     mock_notify_participants, mock_generate_livekit_config, settings
 ):
-    """Requests without a participant identifier should not be throttled."""
+    """Anonymous users without a cookie should not be throttled."""
 
     room = RoomFactory(access_level=RoomAccessLevel.RESTRICTED)
     client = APIClient()
 
+    settings.LOBBY_COOKIE_NAME = "mocked-cookie"
     settings.REST_FRAMEWORK["DEFAULT_THROTTLE_RATES"]["request_entry"] = "1/minute"
 
     response = client.post(
@@ -663,6 +679,9 @@ def test_request_entry_throttling_anonymous_unidentified(
     )
 
     assert response.status_code == 200
+    assert response.cookies.get("mocked-cookie") is not None
+
+    client.cookies.clear()  # Simulate a new cookieless request
 
     response = client.post(
         f"/api/v1.0/rooms/{room.id}/request-entry/",
@@ -676,32 +695,34 @@ def test_request_entry_throttling_anonymous_unidentified(
 @mock.patch.object(
     utils, "generate_livekit_config", return_value={"token": "test-token"}
 )
-def test_request_entry_throttling_anonymous_identified(
+def test_request_entry_throttling_anonymous_with_cookie(
     mock_notify_participants, mock_generate_livekit_config, settings
 ):
-    """Identified requests should be throttled after exceeding the rate limit."""
+    """Anonymous users with a cookie should be throttled after exceeding the rate limit."""
     room = RoomFactory(access_level=RoomAccessLevel.RESTRICTED)
     client = APIClient()
 
+    settings.LOBBY_COOKIE_NAME = "mocked-cookie"
     settings.REST_FRAMEWORK["DEFAULT_THROTTLE_RATES"]["request_entry"] = "2/minute"
 
-    participant_id = _lobby_signer().sign(str(uuid.uuid4()))
+    participant_id = str(uuid.uuid4())
+    client.cookies.load({"mocked-cookie": participant_id})
 
     response = client.post(
         f"/api/v1.0/rooms/{room.id}/request-entry/",
-        {"username": "test_user", "participant_id": participant_id},
+        {"username": "test_user"},
     )
     assert response.status_code == 200
 
     response = client.post(
         f"/api/v1.0/rooms/{room.id}/request-entry/",
-        {"username": "test_user", "participant_id": participant_id},
+        {"username": "test_user"},
     )
     assert response.status_code == 200
 
     response = client.post(
         f"/api/v1.0/rooms/{room.id}/request-entry/",
-        {"username": "test_user", "participant_id": participant_id},
+        {"username": "test_user"},
     )
 
     assert response.status_code == 429
@@ -720,6 +741,7 @@ def test_request_entry_throttling_authenticated_user(
     client = APIClient()
     client.force_login(user)
 
+    settings.LOBBY_COOKIE_NAME = "mocked-cookie"
     settings.REST_FRAMEWORK["DEFAULT_THROTTLE_RATES"]["request_entry"] = "2/minute"
 
     response = client.post(
@@ -740,237 +762,3 @@ def test_request_entry_throttling_authenticated_user(
     )
 
     assert response.status_code == 429
-
-
-def test_request_entry_with_participant_id(settings):
-    """Echoing the previously issued identifier preserves the lobby identity across requests."""
-    room = RoomFactory(access_level=RoomAccessLevel.RESTRICTED)
-    client = APIClient()
-
-    settings.LOBBY_KEY_PREFIX = "mocked-cache-prefix"
-
-    with (
-        mock.patch.object(utils, "notify_participants", return_value=None),
-        mock.patch.object(utils, "generate_color", return_value="mocked-color"),
-    ):
-        response = client.post(
-            f"/api/v1.0/rooms/{room.id}/request-entry/",
-            {"username": "test_user"},
-        )
-
-        assert response.status_code == 200
-        participant_id = response.json()["id"]
-
-        # Echoing the identifier must be recognized as the same
-        # participant: no duplicate in the lobby
-        response = client.post(
-            f"/api/v1.0/rooms/{room.id}/request-entry/",
-            {"username": "test_user", "participant_id": participant_id},
-        )
-
-    assert response.status_code == 200
-    assert response.json()["id"] == participant_id
-    assert response.json()["status"] == "waiting"
-
-    lobby_keys = cache.keys(f"mocked-cache-prefix_{room.id}_*")
-    assert len(lobby_keys) == 1
-
-
-def test_request_entry_unknown_participant_id_not_seeded(settings):
-    """A valid signed credential with no cached record creates a new participant."""
-    room = RoomFactory(access_level=RoomAccessLevel.RESTRICTED)
-    client = APIClient()
-
-    settings.LOBBY_KEY_PREFIX = "mocked-cache-prefix"
-
-    forged_id = str(uuid.uuid4())
-
-    with (
-        mock.patch.object(utils, "notify_participants", return_value=None),
-        mock.patch.object(utils, "generate_color", return_value="mocked-color"),
-    ):
-        response = client.post(
-            f"/api/v1.0/rooms/{room.id}/request-entry/",
-            {
-                "username": "test_user",
-                "participant_id": _lobby_signer().sign(forged_id),
-            },
-        )
-
-    assert response.status_code == 200
-    assert _lobby_signer().unsign(response.json()["id"]) != forged_id
-
-    # Nothing was stored under the forged identifier
-    assert cache.get(f"mocked-cache-prefix_{room.id}_{forged_id}") is None
-
-
-def test_request_entry_participant_id_bound_to_room(settings):
-    """An identifier minted for one room must not be honored in another."""
-    room = RoomFactory(access_level=RoomAccessLevel.RESTRICTED)
-    other_room = RoomFactory(access_level=RoomAccessLevel.RESTRICTED)
-    client = APIClient()
-
-    with (
-        mock.patch.object(utils, "notify_participants", return_value=None),
-        mock.patch.object(utils, "generate_color", return_value="mocked-color"),
-    ):
-        response = client.post(
-            f"/api/v1.0/rooms/{room.id}/request-entry/",
-            {"username": "test_user"},
-        )
-        participant_id = response.json()["id"]
-
-        response = client.post(
-            f"/api/v1.0/rooms/{other_room.id}/request-entry/",
-            {"username": "test_user", "participant_id": participant_id},
-        )
-
-    assert response.status_code == 200
-    assert response.json()["id"] != participant_id
-
-
-def test_request_entry_legacy_cookie_ignored():
-    """The retired cookie channel must not be honored anymore."""
-    room = RoomFactory(access_level=RoomAccessLevel.RESTRICTED)
-    client = APIClient()
-
-    legacy_participant_id = str(uuid.uuid4())
-    client.cookies["lobbyParticipantId"] = legacy_participant_id
-
-    with (
-        mock.patch.object(utils, "notify_participants", return_value=None),
-        mock.patch.object(utils, "generate_color", return_value="mocked-color"),
-    ):
-        response = client.post(
-            f"/api/v1.0/rooms/{room.id}/request-entry/",
-            {"username": "test_user"},
-        )
-
-    assert response.status_code == 200
-    returned_id = response.json()["id"]
-    assert returned_id != legacy_participant_id
-    uuid.UUID(_lobby_signer().unsign(returned_id))
-
-
-def test_request_entry_malformed_participant_id(settings):
-    """A malformed polling credential is rejected with a 400."""
-    room = RoomFactory(access_level=RoomAccessLevel.RESTRICTED)
-    client = APIClient()
-
-    response = client.post(
-        f"/api/v1.0/rooms/{room.id}/request-entry/",
-        {"username": "test_user", "participant_id": "../../../evil-key"},
-    )
-
-    assert response.status_code == 400
-    assert "participant_id" in response.json()
-
-
-@mock.patch.object(utils, "notify_participants", return_value=None)
-@mock.patch.object(utils, "generate_livekit_config")
-def test_request_entry_rejects_unsigned_id(generate_config, _notify):
-    """Knowing the public UUID must not grant admission."""
-    room = RoomFactory(access_level=RoomAccessLevel.RESTRICTED)
-    client = APIClient()
-
-    response = client.post(
-        f"/api/v1.0/rooms/{room.id}/request-entry/", {"username": "Guest"}
-    )
-    assert response.status_code == 200
-    public_id = _lobby_signer().unsign(response.json()["id"])
-    LobbyService().handle_participant_entry(room.id, public_id, True)
-
-    response = APIClient().post(
-        f"/api/v1.0/rooms/{room.id}/request-entry/",
-        {"username": "Impersonator", "participant_id": public_id},
-    )
-
-    assert response.status_code == 400
-    assert "participant_id" in response.json()
-    generate_config.assert_not_called()
-
-
-@mock.patch.object(utils, "notify_participants", return_value=None)
-@mock.patch.object(utils, "generate_livekit_config")
-def test_request_entry_rejects_tampered_credential(generate_config, _notify):
-    """Modifying a signed credential must invalidate it."""
-    room = RoomFactory(access_level=RoomAccessLevel.RESTRICTED)
-    client = APIClient()
-
-    response = client.post(
-        f"/api/v1.0/rooms/{room.id}/request-entry/", {"username": "Guest"}
-    )
-    assert response.status_code == 200
-    credential = response.json()["id"]
-    public_id = _lobby_signer().unsign(credential)
-    LobbyService().handle_participant_entry(room.id, public_id, True)
-
-    response = APIClient().post(
-        f"/api/v1.0/rooms/{room.id}/request-entry/",
-        {"username": "Impersonator", "participant_id": credential + "x"},
-    )
-
-    assert response.status_code == 400
-    assert "participant_id" in response.json()
-    generate_config.assert_not_called()
-
-
-@mock.patch.object(utils, "notify_participants", return_value=None)
-@mock.patch.object(utils, "generate_livekit_config")
-def test_request_entry_rejects_wrong_signing_secret(generate_config, _notify):
-    """A credential signed with another secret must not grant admission."""
-    room = RoomFactory(access_level=RoomAccessLevel.RESTRICTED)
-    client = APIClient()
-
-    response = client.post(
-        f"/api/v1.0/rooms/{room.id}/request-entry/", {"username": "Guest"}
-    )
-    assert response.status_code == 200
-    public_id = _lobby_signer().unsign(response.json()["id"])
-    LobbyService().handle_participant_entry(room.id, public_id, True)
-
-    forged = signing.Signer(
-        key="incorrect-test-signing-secret",
-        salt="core.lobby.participant",
-        fallback_keys=[],
-    ).sign(public_id)
-
-    response = APIClient().post(
-        f"/api/v1.0/rooms/{room.id}/request-entry/",
-        {"username": "Impersonator", "participant_id": forged},
-    )
-
-    assert response.status_code == 400
-    assert "participant_id" in response.json()
-    generate_config.assert_not_called()
-
-
-@mock.patch.object(utils, "notify_participants", return_value=None)
-@mock.patch.object(
-    utils, "generate_livekit_config", return_value={"token": "test-token"}
-)
-def test_request_entry_accepts_signed_credential(generate_config, _notify):
-    """The signed credential grants admission using the public LiveKit UUID."""
-    room = RoomFactory(access_level=RoomAccessLevel.RESTRICTED)
-    client = APIClient()
-
-    response = client.post(
-        f"/api/v1.0/rooms/{room.id}/request-entry/", {"username": "Guest"}
-    )
-    assert response.status_code == 200
-    credential = response.json()["id"]
-    public_id = _lobby_signer().unsign(credential)
-    assert credential != public_id
-    LobbyService().handle_participant_entry(room.id, public_id, True)
-
-    response = client.post(
-        f"/api/v1.0/rooms/{room.id}/request-entry/",
-        {"username": "Guest", "participant_id": credential},
-    )
-
-    assert response.status_code == 200
-    assert response.json()["status"] == "accepted"
-    assert response.json()["id"] == credential
-    assert response.json()["livekit"] == {"token": "test-token"}
-    generate_config.assert_called_once()
-    assert generate_config.call_args.kwargs["participant_id"] == public_id

src/backend/core/tests/rooms/test_api_rooms_participants_management.py

@@ -5,16 +5,13 @@ Test rooms API endpoints in the Meet core app: participants management.
 # pylint: disable=redefined-outer-name,unused-argument,protected-access,no-name-in-module,too-many-lines
 
 import random
-from datetime import datetime, timedelta, timezone
 from unittest import mock
 from uuid import uuid4
 
-from django.conf import settings as django_settings
 from django.contrib.auth.models import AnonymousUser
 from django.core.exceptions import SuspiciousOperation
 from django.urls import reverse
 
-import jwt
 import pytest
 from livekit.api import TwirpError, UpdateParticipantRequest
 from livekit.protocol.models import ParticipantInfo
@@ -22,18 +19,8 @@ from rest_framework import status
 from rest_framework.test import APIClient
 
 from core import utils
-from core.factories import (
-    ApplicationFactory,
-    RoomFactory,
-    UserFactory,
-    UserResourceAccessFactory,
-)
-from core.models import ApplicationScope
-from core.services.lobby import (
-    LobbyParticipant,
-    LobbyParticipantStatus,
-    LobbyService,
-)
+from core.factories import RoomFactory, UserFactory, UserResourceAccessFactory
+from core.services.lobby import LobbyService
 
 pytestmark = pytest.mark.django_db
 
@@ -100,7 +87,7 @@ def test_mute_participant_with_livekit_token_for_this_room(mock_livekit_client):
         url,
         {"participant_identity": str(uuid4()), "track_sid": "test-track-sid"},
         format="json",
-        HTTP_AUTHORIZATION=f"X-LiveKit-Token {token}",
+        HTTP_AUTHORIZATION=f"Bearer {token}",
     )
 
     assert response.status_code == status.HTTP_200_OK
@@ -126,7 +113,7 @@ def test_mute_participant_with_livekit_token_for_another_room_forbidden(
         url,
         {"participant_identity": str(uuid4()), "track_sid": "test-track-sid"},
         format="json",
-        HTTP_AUTHORIZATION=f"X-LiveKit-Token {token}",
+        HTTP_AUTHORIZATION=f"Bearer {token}",
     )
 
     assert response.status_code == status.HTTP_403_FORBIDDEN
@@ -166,7 +153,7 @@ def test_mute_participant_everyone_can_mute_disabled_blocks_non_admin(
         url,
         {"participant_identity": str(uuid4()), "track_sid": "test-track-sid"},
         format="json",
-        HTTP_AUTHORIZATION=f"X-LiveKit-Token {token}",
+        HTTP_AUTHORIZATION=f"Bearer {token}",
     )
 
     assert response.status_code == status.HTTP_403_FORBIDDEN
@@ -313,7 +300,7 @@ def test_mute_participant_admin_with_token_for_this_room(mock_livekit_client):
         url,
         {"participant_identity": str(uuid4()), "track_sid": "test-track-sid"},
         format="json",
-        HTTP_AUTHORIZATION=f"X-LiveKit-Token {token}",
+        HTTP_AUTHORIZATION=f"Bearer {token}",
     )
 
     assert response.status_code == status.HTTP_200_OK
@@ -343,7 +330,7 @@ def test_mute_participant_admin_with_token_for_another_room(mock_livekit_client)
         url,
         {"participant_identity": str(uuid4()), "track_sid": "test-track-sid"},
         format="json",
-        HTTP_AUTHORIZATION=f"X-LiveKit-Token {token}",
+        HTTP_AUTHORIZATION=f"Bearer {token}",
     )
 
     assert response.status_code == status.HTTP_403_FORBIDDEN
@@ -374,7 +361,7 @@ def test_mute_participant_admin_token_replayed_does_not_grant_admin(
         url,
         {"participant_identity": str(uuid4()), "track_sid": "test-track-sid"},
         format="json",
-        HTTP_AUTHORIZATION=f"X-LiveKit-Token {token}",
+        HTTP_AUTHORIZATION=f"Bearer {token}",
     )
 
     assert response.status_code == status.HTTP_403_FORBIDDEN
@@ -394,7 +381,7 @@ def test_mute_participant_livekit_token_triggers_presence_check(mock_livekit_cli
         url,
         {"participant_identity": str(uuid4()), "track_sid": "test-track-sid"},
         format="json",
-        HTTP_AUTHORIZATION=f"X-LiveKit-Token {token}",
+        HTTP_AUTHORIZATION=f"Bearer {token}",
     )
 
     assert response.status_code == status.HTTP_200_OK
@@ -425,7 +412,7 @@ def test_mute_participant_livekit_token_presence_check_returns_participant(
         url,
         {"participant_identity": str(uuid4()), "track_sid": "test-track-sid"},
         format="json",
-        HTTP_AUTHORIZATION=f"X-LiveKit-Token {token}",
+        HTTP_AUTHORIZATION=f"Bearer {token}",
     )
 
     assert response.status_code == status.HTTP_200_OK
@@ -453,7 +440,7 @@ def test_mute_participant_livekit_token_presence_check_participant_not_found(
         url,
         {"participant_identity": str(uuid4()), "track_sid": "test-track-sid"},
         format="json",
-        HTTP_AUTHORIZATION=f"X-LiveKit-Token {token}",
+        HTTP_AUTHORIZATION=f"Bearer {token}",
     )
 
     assert response.status_code == status.HTTP_403_FORBIDDEN
@@ -471,7 +458,7 @@ def test_mute_participant_livekit_token_presence_check_twirp_error_forbidden(
     room = RoomFactory()
 
     mock_livekit_client.room.get_participant.side_effect = TwirpError(
-        msg="an error occured", code="not_found", status=500
+        msg="an error occurred", code="not_found", status=500
     )
 
     user = AnonymousUser()
@@ -482,7 +469,7 @@ def test_mute_participant_livekit_token_presence_check_twirp_error_forbidden(
         url,
         {"participant_identity": str(uuid4()), "track_sid": "test-track-sid"},
         format="json",
-        HTTP_AUTHORIZATION=f"X-LiveKit-Token {token}",
+        HTTP_AUTHORIZATION=f"Bearer {token}",
     )
 
     assert response.status_code == status.HTTP_403_FORBIDDEN
@@ -862,16 +849,7 @@ def test_remove_participant_success_lobby_cache(mock_livekit_client):
     participant_identity = str(uuid4())
 
     # Create participant in lobby cache first
-    LobbyService()._save_participant(
-        room.id,
-        LobbyParticipant(
-            id=participant_identity,
-            username="John doe",
-            status=LobbyParticipantStatus.WAITING,
-            color="#123456",
-            entered_at="2025-01-01T10:00:00+00:00",
-        ),
-    )
+    LobbyService().enter(room.id, participant_identity, "John doe")
 
     # Accept participant
     LobbyService().handle_participant_entry(room.id, participant_identity, True)
@@ -1042,142 +1020,3 @@ def test_remove_participant_not_found(mock_livekit_client):
     assert response.data == {"error": "Participant not found"}
 
     mock_livekit_client.aclose.assert_called_once()
-
-
-def generate_user_access_token(user):
-    """Generate a valid user access JWT signed with the token secret."""
-    now = datetime.now(timezone.utc)
-    application = ApplicationFactory(scopes=[ApplicationScope.USERS_SESSION])
-
-    payload = {
-        "iss": django_settings.USER_ACCESS_TOKEN_ISSUER,
-        "aud": django_settings.USER_ACCESS_TOKEN_AUDIENCE,
-        "iat": now,
-        "exp": now + timedelta(seconds=django_settings.USER_ACCESS_TOKEN_TTL),
-        "user_id": str(user.id),
-        "token_type": "user_access",
-        "client_id": application.client_id,
-        "scope": "user:access",
-    }
-
-    return jwt.encode(
-        payload,
-        django_settings.USER_ACCESS_TOKEN_SECRET_KEY,
-        algorithm=django_settings.USER_ACCESS_TOKEN_ALG,
-    )
-
-
-def test_mute_participant_bearer_scheme_defers_to_next_authentication(
-    mock_livekit_client,
-):
-    """Should defer a "Bearer" header to the next authentication backend.
-
-    The LiveKit backend only claims the "X-LiveKit-Token" scheme. Any other
-    scheme must be left untouched so the backends declared after it get a
-    chance to authenticate the request.
-    """
-    client = APIClient()
-    room = RoomFactory()
-    user = UserFactory()
-    UserResourceAccessFactory(
-        resource=room, user=user, role=random.choice(["administrator", "owner"])
-    )
-    client.credentials(HTTP_AUTHORIZATION=f"Bearer {generate_user_access_token(user)}")
-
-    url = reverse("rooms-mute-participant", kwargs={"pk": room.id})
-    response = client.post(
-        url,
-        {"participant_identity": str(uuid4()), "track_sid": "test-track-sid"},
-        format="json",
-    )
-
-    assert response.status_code == status.HTTP_200_OK
-    assert response.data == {"status": "success"}
-
-    mock_livekit_client.room.get_participant.assert_not_called()
-    mock_livekit_client.room.mute_published_track.assert_called_once()
-
-
-def test_mute_participant_bearer_scheme_defers_role_permissions_still_apply(
-    mock_livekit_client,
-):
-    """Should still enforce room privileges once another backend authenticated."""
-    client = APIClient()
-    room = RoomFactory(configuration={"everyone_can_mute": False})
-    user = UserFactory()  # no UserResourceAccess for this room
-    client.credentials(HTTP_AUTHORIZATION=f"Bearer {generate_user_access_token(user)}")
-
-    url = reverse("rooms-mute-participant", kwargs={"pk": room.id})
-    response = client.post(
-        url,
-        {"participant_identity": str(uuid4()), "track_sid": "test-track-sid"},
-        format="json",
-    )
-
-    assert response.status_code == status.HTTP_403_FORBIDDEN
-    mock_livekit_client.room.mute_published_track.assert_not_called()
-
-
-def test_mute_participant_unknown_scheme_defers_and_stays_anonymous(
-    mock_livekit_client,
-):
-    """Should leave the request unauthenticated when no backend claims the scheme."""
-    client = APIClient()
-    room = RoomFactory()
-
-    url = reverse("rooms-mute-participant", kwargs={"pk": room.id})
-    response = client.post(
-        url,
-        {"participant_identity": str(uuid4()), "track_sid": "test-track-sid"},
-        format="json",
-        HTTP_AUTHORIZATION="Basic dXNlcjpwYXNzd29yZA==",
-    )
-
-    assert response.status_code == status.HTTP_403_FORBIDDEN
-    mock_livekit_client.room.mute_published_track.assert_not_called()
-
-
-def test_mute_participant_livekit_scheme_is_case_insensitive(mock_livekit_client):
-    """Should claim the LiveKit scheme whatever its casing, and not defer it."""
-    client = APIClient()
-    room = RoomFactory()
-
-    token = utils.generate_token(str(room.id), AnonymousUser())
-
-    url = reverse("rooms-mute-participant", kwargs={"pk": room.id})
-    response = client.post(
-        url,
-        {"participant_identity": str(uuid4()), "track_sid": "test-track-sid"},
-        format="json",
-        HTTP_AUTHORIZATION=f"x-livekit-token {token}",
-    )
-
-    assert response.status_code == status.HTTP_200_OK
-    assert response.data == {"status": "success"}
-
-    mock_livekit_client.room.get_participant.assert_called_once()
-    mock_livekit_client.room.mute_published_track.assert_called_once()
-
-
-def test_mute_participant_livekit_scheme_malformed_header_is_rejected(
-    mock_livekit_client,
-):
-    """Should reject a malformed header once the LiveKit scheme is claimed."""
-    client = APIClient()
-    room = RoomFactory()
-
-    token = utils.generate_token(str(room.id), AnonymousUser())
-
-    url = reverse("rooms-mute-participant", kwargs={"pk": room.id})
-    response = client.post(
-        url,
-        {"participant_identity": str(uuid4()), "track_sid": "test-track-sid"},
-        format="json",
-        HTTP_AUTHORIZATION=f"X-LiveKit-Token {token} extra-part",
-    )
-
-    assert response.status_code == status.HTTP_403_FORBIDDEN
-    assert response.data == {
-        "detail": "Authorization header must be: X-LiveKit-Token <token>"
-    }
-    mock_livekit_client.room.mute_published_track.assert_not_called()

src/backend/core/tests/rooms/test_api_rooms_rename_toggle.py

@@ -4,15 +4,12 @@ Test rooms API endpoints: toggle hand and rename participant.
 
 # pylint: disable=redefined-outer-name,unused-argument,protected-access
 
-from datetime import datetime, timedelta, timezone
 from unittest import mock
 from uuid import uuid4
 
-from django.conf import settings as django_settings
 from django.contrib.auth.models import AnonymousUser
 from django.urls import reverse
 
-import jwt
 import pytest
 from freezegun import freeze_time
 from livekit.api import TwirpError
@@ -20,13 +17,7 @@ from rest_framework import status
 from rest_framework.test import APIClient
 
 from core import utils
-from core.factories import (
-    ApplicationFactory,
-    RoomFactory,
-    UserFactory,
-    UserResourceAccessFactory,
-)
-from core.models import ApplicationScope
+from core.factories import RoomFactory, UserFactory
 
 pytestmark = pytest.mark.django_db
 
@@ -78,10 +69,7 @@ def test_toggle_hand_raise_success(mock_livekit_client, room, token):
     client = APIClient()
     url = reverse("rooms-toggle-hand", kwargs={"pk": room.id})
     response = client.post(
-        url,
-        {"raised": True},
-        format="json",
-        HTTP_AUTHORIZATION=f"X-LiveKit-token {token}",
+        url, {"raised": True}, format="json", HTTP_AUTHORIZATION=f"Bearer {token}"
     )
 
     assert response.status_code == status.HTTP_200_OK
@@ -96,10 +84,7 @@ def test_toggle_hand_lower_success(mock_livekit_client, room, token):
     client = APIClient()
     url = reverse("rooms-toggle-hand", kwargs={"pk": room.id})
     response = client.post(
-        url,
-        {"raised": False},
-        format="json",
-        HTTP_AUTHORIZATION=f"X-LiveKit-Token {token}",
+        url, {"raised": False}, format="json", HTTP_AUTHORIZATION=f"Bearer {token}"
     )
 
     assert response.status_code == status.HTTP_200_OK
@@ -116,10 +101,7 @@ def test_toggle_hand_raise_sets_timestamp(mock_livekit_client, room, token):
     client = APIClient()
     url = reverse("rooms-toggle-hand", kwargs={"pk": room.id})
     response = client.post(
-        url,
-        {"raised": True},
-        format="json",
-        HTTP_AUTHORIZATION=f"X-LiveKit-Token {token}",
+        url, {"raised": True}, format="json", HTTP_AUTHORIZATION=f"Bearer {token}"
     )
 
     assert response.status_code == status.HTTP_200_OK
@@ -135,10 +117,7 @@ def test_toggle_hand_identity_derived_from_token(
     client = APIClient()
     url = reverse("rooms-toggle-hand", kwargs={"pk": room.id})
     client.post(
-        url,
-        {"raised": True},
-        format="json",
-        HTTP_AUTHORIZATION=f"X-LiveKit-Token {token}",
+        url, {"raised": True}, format="json", HTTP_AUTHORIZATION=f"Bearer {token}"
     )
 
     call_kwargs = mock_livekit_client.room.update_participant.call_args
@@ -149,9 +128,7 @@ def test_toggle_hand_missing_raised_field(room, token):
     """Test toggle hand with missing raised field returns 400."""
     client = APIClient()
     url = reverse("rooms-toggle-hand", kwargs={"pk": room.id})
-    response = client.post(
-        url, {}, format="json", HTTP_AUTHORIZATION=f"X-LiveKit-Token {token}"
-    )
+    response = client.post(url, {}, format="json", HTTP_AUTHORIZATION=f"Bearer {token}")
 
     assert response.status_code == status.HTTP_400_BAD_REQUEST
     assert "raised" in response.data
@@ -165,7 +142,7 @@ def test_toggle_hand_invalid_raised_field(room, token):
         url,
         {"raised": "not-a-boolean"},
         format="json",
-        HTTP_AUTHORIZATION=f"X-LiveKit-Token {token}",
+        HTTP_AUTHORIZATION=f"Bearer {token}",
     )
 
     assert response.status_code == status.HTTP_400_BAD_REQUEST
@@ -189,10 +166,7 @@ def test_toggle_hand_forbidden_token_for_wrong_room(user):
     client = APIClient()
     url = reverse("rooms-toggle-hand", kwargs={"pk": target_room.id})
     response = client.post(
-        url,
-        {"raised": True},
-        format="json",
-        HTTP_AUTHORIZATION=f"X-LiveKit-Token {wrong_token}",
+        url, {"raised": True}, format="json", HTTP_AUTHORIZATION=f"Bearer {wrong_token}"
     )
 
     assert response.status_code == status.HTTP_403_FORBIDDEN
@@ -207,10 +181,7 @@ def test_toggle_hand_unexpected_twirp_error(mock_livekit_client, room, token):
     client = APIClient()
     url = reverse("rooms-toggle-hand", kwargs={"pk": room.id})
     response = client.post(
-        url,
-        {"raised": True},
-        format="json",
-        HTTP_AUTHORIZATION=f"X-LiveKit-Token {token}",
+        url, {"raised": True}, format="json", HTTP_AUTHORIZATION=f"Bearer {token}"
     )
 
     assert response.status_code == status.HTTP_500_INTERNAL_SERVER_ERROR
@@ -229,7 +200,7 @@ def test_toggle_hand_raise_success_anonymous(
         url,
         {"raised": True},
         format="json",
-        HTTP_AUTHORIZATION=f"X-LiveKit-Token {anonymous_token}",
+        HTTP_AUTHORIZATION=f"Bearer {anonymous_token}",
     )
 
     assert response.status_code == status.HTTP_200_OK
@@ -249,7 +220,7 @@ def test_toggle_hand_lower_success_anonymous(
         url,
         {"raised": False},
         format="json",
-        HTTP_AUTHORIZATION=f"X-LiveKit-Token {anonymous_token}",
+        HTTP_AUTHORIZATION=f"Bearer {anonymous_token}",
     )
 
     assert response.status_code == status.HTTP_200_OK
@@ -269,7 +240,7 @@ def test_toggle_hand_identity_derived_from_token_anonymous(
         url,
         {"raised": True},
         format="json",
-        HTTP_AUTHORIZATION=f"X-LiveKit-Token {anonymous_token}",
+        HTTP_AUTHORIZATION=f"Bearer {anonymous_token}",
     )
 
     call_kwargs = mock_livekit_client.room.update_participant.call_args
@@ -286,10 +257,7 @@ def test_rename_participant_success(mock_livekit_client, room, token):
     client = APIClient()
     url = reverse("rooms-rename", kwargs={"pk": room.id})
     response = client.post(
-        url,
-        {"name": "John Doe"},
-        format="json",
-        HTTP_AUTHORIZATION=f"X-LiveKit-Token {token}",
+        url, {"name": "John Doe"}, format="json", HTTP_AUTHORIZATION=f"Bearer {token}"
     )
 
     assert response.status_code == status.HTTP_200_OK
@@ -304,10 +272,7 @@ def test_rename_participant_sets_correct_name(mock_livekit_client, room, token):
     client = APIClient()
     url = reverse("rooms-rename", kwargs={"pk": room.id})
     client.post(
-        url,
-        {"name": "Jane Doe"},
-        format="json",
-        HTTP_AUTHORIZATION=f"X-LiveKit-Token {token}",
+        url, {"name": "Jane Doe"}, format="json", HTTP_AUTHORIZATION=f"Bearer {token}"
     )
 
     call_kwargs = mock_livekit_client.room.update_participant.call_args
@@ -321,10 +286,7 @@ def test_rename_participant_uses_identity_from_token(
     client = APIClient()
     url = reverse("rooms-rename", kwargs={"pk": room.id})
     client.post(
-        url,
-        {"name": "John Doe"},
-        format="json",
-        HTTP_AUTHORIZATION=f"X-LiveKit-Token {token}",
+        url, {"name": "John Doe"}, format="json", HTTP_AUTHORIZATION=f"Bearer {token}"
     )
 
     call_kwargs = mock_livekit_client.room.update_participant.call_args
@@ -336,7 +298,7 @@ def test_rename_participant_empty_name(room, token):
     client = APIClient()
     url = reverse("rooms-rename", kwargs={"pk": room.id})
     response = client.post(
-        url, {"name": ""}, format="json", HTTP_AUTHORIZATION=f"X-LiveKit-Token {token}"
+        url, {"name": ""}, format="json", HTTP_AUTHORIZATION=f"Bearer {token}"
     )
 
     assert response.status_code == status.HTTP_400_BAD_REQUEST
@@ -347,9 +309,7 @@ def test_rename_participant_missing_name(room, token):
     """Test rename with missing name field returns 400."""
     client = APIClient()
     url = reverse("rooms-rename", kwargs={"pk": room.id})
-    response = client.post(
-        url, {}, format="json", HTTP_AUTHORIZATION=f"X-LiveKit-Token {token}"
-    )
+    response = client.post(url, {}, format="json", HTTP_AUTHORIZATION=f"Bearer {token}")
 
     assert response.status_code == status.HTTP_400_BAD_REQUEST
     assert "name" in response.data
@@ -360,10 +320,7 @@ def test_rename_participant_name_too_long(room, token):
     client = APIClient()
     url = reverse("rooms-rename", kwargs={"pk": room.id})
     response = client.post(
-        url,
-        {"name": "a" * 256},
-        format="json",
-        HTTP_AUTHORIZATION=f"X-LiveKit-Token {token}",
+        url, {"name": "a" * 256}, format="json", HTTP_AUTHORIZATION=f"Bearer {token}"
     )
 
     assert response.status_code == status.HTTP_400_BAD_REQUEST
@@ -391,7 +348,7 @@ def test_rename_participant_forbidden_token_for_wrong_room(user):
         url,
         {"name": "John Doe"},
         format="json",
-        HTTP_AUTHORIZATION=f"X-LiveKit-Token {wrong_token}",
+        HTTP_AUTHORIZATION=f"Bearer {wrong_token}",
     )
 
     assert response.status_code == status.HTTP_403_FORBIDDEN
@@ -406,10 +363,7 @@ def test_rename_participant_unexpected_twirp_error(mock_livekit_client, room, to
     client = APIClient()
     url = reverse("rooms-rename", kwargs={"pk": room.id})
     response = client.post(
-        url,
-        {"name": "John Doe"},
-        format="json",
-        HTTP_AUTHORIZATION=f"X-LiveKit-Token {token}",
+        url, {"name": "John Doe"}, format="json", HTTP_AUTHORIZATION=f"Bearer {token}"
     )
 
     assert response.status_code == status.HTTP_500_INTERNAL_SERVER_ERROR
@@ -431,10 +385,7 @@ def test_rename_participant_forbidden_when_display_name_edit_disabled(
     client = APIClient()
     url = reverse("rooms-rename", kwargs={"pk": room.id})
     response = client.post(
-        url,
-        {"name": name},
-        format="json",
-        HTTP_AUTHORIZATION=f"X-LiveKit-Token {token}",
+        url, {"name": name}, format="json", HTTP_AUTHORIZATION=f"Bearer {token}"
     )
 
     assert response.status_code == status.HTTP_403_FORBIDDEN
@@ -453,10 +404,7 @@ def test_rename_participant_allowed_when_display_name_edit_enabled(
     client = APIClient()
     url = reverse("rooms-rename", kwargs={"pk": room.id})
     response = client.post(
-        url,
-        {"name": "John Doe"},
-        format="json",
-        HTTP_AUTHORIZATION=f"X-LiveKit-Token {token}",
+        url, {"name": "John Doe"}, format="json", HTTP_AUTHORIZATION=f"Bearer {token}"
     )
 
     assert response.status_code == status.HTTP_200_OK
@@ -478,7 +426,7 @@ def test_rename_participant_anonymous_allowed_when_display_name_edit_disabled(
         url,
         {"name": "Guest User"},
         format="json",
-        HTTP_AUTHORIZATION=f"X-LiveKit-Token {anonymous_token}",
+        HTTP_AUTHORIZATION=f"Bearer {anonymous_token}",
     )
 
     assert response.status_code == status.HTTP_200_OK
@@ -495,7 +443,7 @@ def test_rename_participant_success_anonymous(
         url,
         {"name": "Guest User"},
         format="json",
-        HTTP_AUTHORIZATION=f"X-LiveKit-Token {anonymous_token}",
+        HTTP_AUTHORIZATION=f"Bearer {anonymous_token}",
     )
 
     assert response.status_code == status.HTTP_200_OK
@@ -515,7 +463,7 @@ def test_rename_participant_uses_identity_from_token_anonymous(
         url,
         {"name": "Guest User"},
         format="json",
-        HTTP_AUTHORIZATION=f"X-LiveKit-Token {anonymous_token}",
+        HTTP_AUTHORIZATION=f"Bearer {anonymous_token}",
     )
 
     call_kwargs = mock_livekit_client.room.update_participant.call_args
@@ -532,7 +480,7 @@ def test_rename_participant_sets_correct_name_anonymous(
         url,
         {"name": "Guest User"},
         format="json",
-        HTTP_AUTHORIZATION=f"X-LiveKit-Token {anonymous_token}",
+        HTTP_AUTHORIZATION=f"Bearer {anonymous_token}",
     )
 
     call_kwargs = mock_livekit_client.room.update_participant.call_args
@@ -549,7 +497,7 @@ def test_rename_participant_forbidden_anonymous_token_for_wrong_room(anonymous_t
         url,
         {"name": "Guest User"},
         format="json",
-        HTTP_AUTHORIZATION=f"X-LiveKit-Token {anonymous_token}",
+        HTTP_AUTHORIZATION=f"Bearer {anonymous_token}",
     )
 
     assert response.status_code == status.HTTP_403_FORBIDDEN
@@ -575,7 +523,7 @@ def test_toggle_hand_expired_token(room, expired_token):
         url,
         {"raised": True},
         format="json",
-        HTTP_AUTHORIZATION=f"X-LiveKit-Token {expired_token}",
+        HTTP_AUTHORIZATION=f"Bearer {expired_token}",
     )
 
     assert response.status_code == status.HTTP_403_FORBIDDEN
@@ -589,7 +537,7 @@ def test_rename_participant_expired_token(room, expired_token):
         url,
         {"name": "John Doe"},
         format="json",
-        HTTP_AUTHORIZATION=f"X-LiveKit-Token {expired_token}",
+        HTTP_AUTHORIZATION=f"Bearer {expired_token}",
     )
 
     assert response.status_code == status.HTTP_403_FORBIDDEN
@@ -603,7 +551,7 @@ def test_toggle_hand_malformed_token(room):
         url,
         {"raised": True},
         format="json",
-        HTTP_AUTHORIZATION="X-LiveKit-Token this-is-not-a-valid-jwt",
+        HTTP_AUTHORIZATION="Bearer this-is-not-a-valid-jwt",
     )
 
     assert response.status_code == status.HTTP_403_FORBIDDEN
@@ -617,10 +565,7 @@ def test_toggle_hand_room_not_found(user):
     client = APIClient()
     url = reverse("rooms-toggle-hand", kwargs={"pk": non_existent_room_id})
     response = client.post(
-        url,
-        {"raised": True},
-        format="json",
-        HTTP_AUTHORIZATION=f"X-LiveKit-Token {token}",
+        url, {"raised": True}, format="json", HTTP_AUTHORIZATION=f"Bearer {token}"
     )
 
     assert response.status_code == status.HTTP_404_NOT_FOUND
@@ -635,10 +580,7 @@ def test_toggle_hand_participant_not_found(mock_livekit_client, room, token):
     client = APIClient()
     url = reverse("rooms-toggle-hand", kwargs={"pk": room.id})
     response = client.post(
-        url,
-        {"raised": True},
-        format="json",
-        HTTP_AUTHORIZATION=f"X-LiveKit-Token {token}",
+        url, {"raised": True}, format="json", HTTP_AUTHORIZATION=f"Bearer {token}"
     )
 
     assert response.status_code == status.HTTP_404_NOT_FOUND
@@ -655,7 +597,7 @@ def test_rename_participant_malformed_token(room):
         url,
         {"name": "John Doe"},
         format="json",
-        HTTP_AUTHORIZATION="X-LiveKit-Token this-is-not-a-valid-jwt",
+        HTTP_AUTHORIZATION="Bearer this-is-not-a-valid-jwt",
     )
 
     assert response.status_code == status.HTTP_403_FORBIDDEN
@@ -669,10 +611,7 @@ def test_rename_participant_room_not_found(user):
     client = APIClient()
     url = reverse("rooms-rename", kwargs={"pk": non_existent_room_id})
     response = client.post(
-        url,
-        {"name": "John Doe"},
-        format="json",
-        HTTP_AUTHORIZATION=f"X-LiveKit-Token {token}",
+        url, {"name": "John Doe"}, format="json", HTTP_AUTHORIZATION=f"Bearer {token}"
     )
 
     assert response.status_code == status.HTTP_404_NOT_FOUND
@@ -687,206 +626,10 @@ def test_rename_participant_not_found(mock_livekit_client, room, token):
     client = APIClient()
     url = reverse("rooms-rename", kwargs={"pk": room.id})
     response = client.post(
-        url,
-        {"name": "John Doe"},
-        format="json",
-        HTTP_AUTHORIZATION=f"X-LiveKit-Token {token}",
+        url, {"name": "John Doe"}, format="json", HTTP_AUTHORIZATION=f"Bearer {token}"
     )
 
     assert response.status_code == status.HTTP_404_NOT_FOUND
     assert response.data == {"error": "Participant not found"}
 
     mock_livekit_client.aclose.assert_called_once()
-
-
-@pytest.fixture
-def user_access_token(user):
-    """Generate a valid user access JWT, sent with the "X-LiveKit-Token" scheme."""
-    now = datetime.now(timezone.utc)
-    application = ApplicationFactory(scopes=[ApplicationScope.USERS_SESSION])
-
-    payload = {
-        "iss": django_settings.USER_ACCESS_TOKEN_ISSUER,
-        "aud": django_settings.USER_ACCESS_TOKEN_AUDIENCE,
-        "iat": now,
-        "exp": now + timedelta(seconds=django_settings.USER_ACCESS_TOKEN_TTL),
-        "user_id": str(user.id),
-        "token_type": "user_access",
-        "client_id": application.client_id,
-        "scope": "user:access",
-    }
-
-    return jwt.encode(
-        payload,
-        django_settings.USER_ACCESS_TOKEN_SECRET_KEY,
-        algorithm=django_settings.USER_ACCESS_TOKEN_ALG,
-    )
-
-
-def test_toggle_hand_bearer_scheme_defers_to_next_authentication(
-    mock_livekit_client, room, user, user_access_token
-):
-    """Test toggle hand defers a "Bearer" header instead of failing on it."""
-    UserResourceAccessFactory(resource=room, user=user, role="owner")
-
-    client = APIClient()
-    url = reverse("rooms-toggle-hand", kwargs={"pk": room.id})
-    response = client.post(
-        url,
-        {"raised": True},
-        format="json",
-        HTTP_AUTHORIZATION=f"Bearer {user_access_token}",
-    )
-
-    assert response.status_code == status.HTTP_403_FORBIDDEN
-    assert response.data == {"detail": "Authentication credentials were not provided."}
-
-    mock_livekit_client.room.update_participant.assert_not_called()
-
-
-def test_rename_participant_bearer_scheme_defers_to_next_authentication(
-    mock_livekit_client, room, user, user_access_token
-):
-    """Test rename defers a "Bearer" header instead of failing on it."""
-    UserResourceAccessFactory(resource=room, user=user, role="owner")
-
-    client = APIClient()
-    url = reverse("rooms-rename", kwargs={"pk": room.id})
-    response = client.post(
-        url,
-        {"name": "John Doe"},
-        format="json",
-        HTTP_AUTHORIZATION=f"Bearer {user_access_token}",
-    )
-
-    assert response.status_code == status.HTTP_403_FORBIDDEN
-    assert response.data == {"detail": "Authentication credentials were not provided."}
-
-    mock_livekit_client.room.update_participant.assert_not_called()
-
-
-def test_toggle_hand_unknown_scheme_defers(mock_livekit_client, room):
-    """Test toggle hand defers a scheme no backend recognizes."""
-    client = APIClient()
-    url = reverse("rooms-toggle-hand", kwargs={"pk": room.id})
-    response = client.post(
-        url,
-        {"raised": True},
-        format="json",
-        HTTP_AUTHORIZATION="Basic dXNlcjpwYXNzd29yZA==",
-    )
-
-    assert response.status_code == status.HTTP_403_FORBIDDEN
-    assert response.data == {"detail": "Authentication credentials were not provided."}
-
-    mock_livekit_client.room.update_participant.assert_not_called()
-
-
-def test_rename_participant_unknown_scheme_defers(mock_livekit_client, room):
-    """Test rename defers a scheme no backend recognizes."""
-    client = APIClient()
-    url = reverse("rooms-rename", kwargs={"pk": room.id})
-    response = client.post(
-        url,
-        {"name": "John Doe"},
-        format="json",
-        HTTP_AUTHORIZATION="Basic dXNlcjpwYXNzd29yZA==",
-    )
-
-    assert response.status_code == status.HTTP_403_FORBIDDEN
-    assert response.data == {"detail": "Authentication credentials were not provided."}
-
-    mock_livekit_client.room.update_participant.assert_not_called()
-
-
-def test_toggle_hand_session_authentication_is_not_accepted(
-    mock_livekit_client, room, user
-):
-    """Test toggle hand is not granted by a session, whatever the user's room role."""
-    UserResourceAccessFactory(resource=room, user=user, role="owner")
-
-    client = APIClient()
-    client.force_authenticate(user=user)
-
-    url = reverse("rooms-toggle-hand", kwargs={"pk": room.id})
-    response = client.post(url, {"raised": True}, format="json")
-
-    assert response.status_code == status.HTTP_403_FORBIDDEN
-    mock_livekit_client.room.update_participant.assert_not_called()
-
-
-def test_rename_participant_session_authentication_is_not_accepted(
-    mock_livekit_client, room, user
-):
-    """Test rename is not granted by a session, whatever the user's room role."""
-    UserResourceAccessFactory(resource=room, user=user, role="owner")
-
-    client = APIClient()
-    client.force_authenticate(user=user)
-
-    url = reverse("rooms-rename", kwargs={"pk": room.id})
-    response = client.post(url, {"name": "John Doe"}, format="json")
-
-    assert response.status_code == status.HTTP_403_FORBIDDEN
-    mock_livekit_client.room.update_participant.assert_not_called()
-
-
-def test_rename_participant_livekit_scheme_is_case_insensitive(
-    mock_livekit_client, room, token
-):
-    """Test rename claims the LiveKit scheme whatever its casing."""
-    client = APIClient()
-    url = reverse("rooms-rename", kwargs={"pk": room.id})
-    response = client.post(
-        url,
-        {"name": "John Doe"},
-        format="json",
-        HTTP_AUTHORIZATION=f"x-livekit-token {token}",
-    )
-
-    assert response.status_code == status.HTTP_200_OK
-    assert response.data == {"status": "success"}
-
-    mock_livekit_client.room.update_participant.assert_called_once()
-
-
-def test_toggle_hand_livekit_scheme_malformed_header_is_rejected(
-    mock_livekit_client, room, token
-):
-    """Test toggle hand rejects a malformed header once the LiveKit scheme is claimed."""
-    client = APIClient()
-    url = reverse("rooms-toggle-hand", kwargs={"pk": room.id})
-    response = client.post(
-        url,
-        {"raised": True},
-        format="json",
-        HTTP_AUTHORIZATION=f"X-LiveKit-Token {token} extra-part",
-    )
-
-    assert response.status_code == status.HTTP_403_FORBIDDEN
-    assert response.data == {
-        "detail": "Authorization header must be: X-LiveKit-Token <token>"
-    }
-
-    mock_livekit_client.room.update_participant.assert_not_called()
-
-
-def test_rename_participant_livekit_scheme_malformed_header_is_rejected(
-    mock_livekit_client, room, token
-):
-    """Test rename rejects a malformed header once the LiveKit scheme is claimed."""
-    client = APIClient()
-    url = reverse("rooms-rename", kwargs={"pk": room.id})
-    response = client.post(
-        url,
-        {"name": "John Doe"},
-        format="json",
-        HTTP_AUTHORIZATION=f"X-LiveKit-Token {token} extra-part",
-    )
-
-    assert response.status_code == status.HTTP_403_FORBIDDEN
-    assert response.data == {
-        "detail": "Authorization header must be: X-LiveKit-Token <token>"
-    }
-
-    mock_livekit_client.room.update_participant.assert_not_called()

src/backend/core/tests/rooms/test_api_rooms_retrieve.py

@@ -3,24 +3,16 @@ Test rooms API endpoints in the Meet core app: retrieve.
 """
 
 import random
-from datetime import datetime, timedelta, timezone
 from unittest import mock
 
-from django.conf import settings as django_settings
 from django.contrib.auth.models import AnonymousUser
 from django.test.utils import override_settings
 
-import jwt
 import pytest
 from rest_framework.test import APIClient
 
-from ...factories import (
-    ApplicationFactory,
-    RoomFactory,
-    UserFactory,
-    UserResourceAccessFactory,
-)
-from ...models import ApplicationScope, RoleChoices, RoomAccessLevel
+from ...factories import RoomFactory, UserFactory, UserResourceAccessFactory
+from ...models import RoleChoices, RoomAccessLevel
 
 pytestmark = pytest.mark.django_db
 
@@ -515,41 +507,3 @@ def test_api_rooms_retrieve_administrators(
         role=str(user_access.role),
         participant_id=None,
     )
-
-
-def generate_user_access_token(user):
-    """Generate a valid user access JWT signed with the token secret."""
-    now = datetime.now(timezone.utc)
-    application = ApplicationFactory(scopes=[ApplicationScope.USERS_SESSION])
-
-    payload = {
-        "iss": django_settings.USER_ACCESS_TOKEN_ISSUER,
-        "aud": django_settings.USER_ACCESS_TOKEN_AUDIENCE,
-        "iat": now,
-        "exp": now + timedelta(seconds=django_settings.USER_ACCESS_TOKEN_TTL),
-        "user_id": str(user.id),
-        "token_type": "user_access",
-        "client_id": application.client_id,
-        "scope": "user:access",
-    }
-
-    return jwt.encode(
-        payload,
-        django_settings.USER_ACCESS_TOKEN_SECRET_KEY,
-        algorithm=django_settings.USER_ACCESS_TOKEN_ALG,
-    )
-
-
-def test_api_rooms_retrieve_authenticated_with_user_access_token():
-    """A user access token should retrieve a room exactly like a session would."""
-    user = UserFactory()
-    room = RoomFactory(users=[(user, "owner")])
-
-    client = APIClient()
-    client.credentials(HTTP_AUTHORIZATION=f"Bearer {generate_user_access_token(user)}")
-    response = client.get(f"/api/v1.0/rooms/{room.id!s}/")
-
-    assert response.status_code == 200
-    assert response.data["id"] == str(room.id)
-    assert response.data["pin_code"] == room.pin_code
-    assert "accesses" in response.data

src/backend/core/tests/rooms/test_api_rooms_subtitle.py

@@ -4,18 +4,15 @@ Test rooms API endpoints in the Meet core app: start subtitle.
 # pylint: disable=W0621
 
 import uuid
-from datetime import datetime, timedelta, timezone
 from unittest import mock
 
 from django.conf import settings
 
-import jwt
 import pytest
 from livekit.api import AccessToken, TwirpError, VideoGrants
 from rest_framework.test import APIClient
 
-from ...factories import ApplicationFactory, RoomFactory, UserFactory
-from ...models import ApplicationScope
+from ...factories import RoomFactory, UserFactory
 
 pytestmark = pytest.mark.django_db
 
@@ -113,7 +110,7 @@ def test_start_subtitle_invalid_token():
     response = client.post(
         f"/api/v1.0/rooms/{room.id}/start-subtitle/",
         {},
-        HTTP_AUTHORIZATION="X-LiveKit-Token invalid-token",
+        HTTP_AUTHORIZATION="Bearer invalid-token",
     )
 
     assert response.status_code == 403
@@ -133,7 +130,7 @@ def test_start_subtitle_disabled_by_default(mock_livekit_token, settings):
     response = client.post(
         f"/api/v1.0/rooms/{room.id}/start-subtitle/",
         {},
-        HTTP_AUTHORIZATION=f"X-LiveKit-Token {mock_livekit_token}",
+        HTTP_AUTHORIZATION=f"Bearer {mock_livekit_token}",
     )
 
     assert response.status_code == 404
@@ -153,7 +150,7 @@ def test_start_subtitle_valid_token(
     response = client.post(
         f"/api/v1.0/rooms/{room.id}/start-subtitle/",
         {},
-        HTTP_AUTHORIZATION=f"X-LiveKit-Token {mock_livekit_token}",
+        HTTP_AUTHORIZATION=f"Bearer {mock_livekit_token}",
     )
 
     assert response.status_code == 200
@@ -183,7 +180,7 @@ def test_start_subtitle_twirp_error(
     response = client.post(
         f"/api/v1.0/rooms/{room.id}/start-subtitle/",
         {},
-        HTTP_AUTHORIZATION=f"X-LiveKit-Token {mock_livekit_token}",
+        HTTP_AUTHORIZATION=f"Bearer {mock_livekit_token}",
     )
 
     assert response.status_code == 500
@@ -203,7 +200,7 @@ def test_start_subtitle_wrong_room(settings, mock_livekit_token):
     response = client.post(
         f"/api/v1.0/rooms/{room.id}/start-subtitle/",
         {},
-        HTTP_AUTHORIZATION=f"X-LiveKit-Token {mock_livekit_token}",
+        HTTP_AUTHORIZATION=f"Bearer {mock_livekit_token}",
     )
 
     assert response.status_code == 403
@@ -224,133 +221,10 @@ def test_start_subtitle_wrong_signature(settings, mock_livekit_token):
     response = client.post(
         f"/api/v1.0/rooms/{room.id}/start-subtitle/",
         {},
-        HTTP_AUTHORIZATION=f"X-LiveKit-Token {mock_livekit_token}",
+        HTTP_AUTHORIZATION=f"Bearer {mock_livekit_token}",
     )
 
     assert response.status_code == 403
     assert response.json() == {
         "detail": "Invalid LiveKit token: Signature verification failed"
     }
-
-
-@pytest.fixture
-def user_access_token():
-    """Generate a valid user access JWT, sent with the "Bearer" scheme."""
-    user = UserFactory()
-    now = datetime.now(timezone.utc)
-    application = ApplicationFactory(scopes=[ApplicationScope.USERS_SESSION])
-
-    payload = {
-        "iss": settings.USER_ACCESS_TOKEN_ISSUER,
-        "aud": settings.USER_ACCESS_TOKEN_AUDIENCE,
-        "iat": now,
-        "exp": now + timedelta(seconds=settings.USER_ACCESS_TOKEN_TTL),
-        "user_id": str(user.id),
-        "token_type": "user_access",
-        "client_id": application.client_id,
-        "scope": "user:access",
-    }
-
-    return jwt.encode(
-        payload,
-        settings.USER_ACCESS_TOKEN_SECRET_KEY,
-        algorithm=settings.USER_ACCESS_TOKEN_ALG,
-    )
-
-
-def test_start_subtitle_bearer_scheme_defers_to_next_authentication(
-    settings, mock_livekit_client, user_access_token
-):
-    """Test that a "Bearer" header is deferred instead of failing on the LiveKit backend.
-
-    The action declares LiveKitTokenAuthentication as its only backend, so a
-    scheme it does not own must be left to the next one. None follows, so the
-    request ends up unauthenticated: the body reports missing credentials
-    rather than an invalid LiveKit token.
-    """
-
-    settings.ROOM_SUBTITLE_ENABLED = True
-
-    room = RoomFactory()
-    client = APIClient()
-
-    response = client.post(
-        f"/api/v1.0/rooms/{room.id}/start-subtitle/",
-        {},
-        HTTP_AUTHORIZATION=f"Bearer {user_access_token}",
-    )
-
-    assert response.status_code == 403
-    assert response.json() == {
-        "detail": "Authentication credentials were not provided."
-    }
-
-    mock_livekit_client.agent_dispatch.create_dispatch.assert_not_called()
-
-
-def test_start_subtitle_unknown_scheme_defers(settings, mock_livekit_client):
-    """Test that a scheme no backend recognizes is deferred, not rejected."""
-
-    settings.ROOM_SUBTITLE_ENABLED = True
-
-    room = RoomFactory()
-    client = APIClient()
-
-    response = client.post(
-        f"/api/v1.0/rooms/{room.id}/start-subtitle/",
-        {},
-        HTTP_AUTHORIZATION="Basic dXNlcjpwYXNzd29yZA==",
-    )
-
-    assert response.status_code == 403
-    assert response.json() == {
-        "detail": "Authentication credentials were not provided."
-    }
-
-    mock_livekit_client.agent_dispatch.create_dispatch.assert_not_called()
-
-
-def test_start_subtitle_scheme_is_case_insensitive(
-    settings, mock_livekit_client, mock_livekit_token, mock_room_id
-):
-    """Test that the LiveKit scheme is claimed whatever its casing."""
-
-    settings.ROOM_SUBTITLE_ENABLED = True
-
-    room = RoomFactory(id=mock_room_id)
-    client = APIClient()
-
-    response = client.post(
-        f"/api/v1.0/rooms/{room.id}/start-subtitle/",
-        {},
-        HTTP_AUTHORIZATION=f"x-livekit-token {mock_livekit_token}",
-    )
-
-    assert response.status_code == 200
-    assert response.json() == {"status": "success"}
-
-    mock_livekit_client.agent_dispatch.create_dispatch.assert_called_once()
-
-
-def test_start_subtitle_malformed_header_is_rejected(
-    settings, mock_livekit_client, mock_livekit_token
-):
-    """Test that a malformed header is rejected once the LiveKit scheme is claimed."""
-
-    settings.ROOM_SUBTITLE_ENABLED = True
-
-    room = RoomFactory()
-    client = APIClient()
-
-    response = client.post(
-        f"/api/v1.0/rooms/{room.id}/start-subtitle/",
-        {},
-        HTTP_AUTHORIZATION=f"X-LiveKit-Token {mock_livekit_token} extra-part",
-    )
-
-    assert response.status_code == 403
-    assert response.json() == {
-        "detail": "Authorization header must be: X-LiveKit-Token <token>"
-    }
-
-    mock_livekit_client.agent_dispatch.create_dispatch.assert_not_called()

src/backend/core/tests/rooms/test_api_rooms_update.py

@@ -3,17 +3,13 @@ Test rooms API endpoints in the Meet core app: update.
 """
 
 import random
-from datetime import datetime, timedelta, timezone
 from unittest.mock import patch
 
-from django.conf import settings as django_settings
-
-import jwt
 import pytest
 from rest_framework.test import APIClient
 
-from ...factories import ApplicationFactory, RoomFactory, UserFactory
-from ...models import ApplicationScope, RoomAccessLevel
+from ...factories import RoomFactory, UserFactory
+from ...models import RoomAccessLevel
 from ...services.room_management import (
     RoomManagement,
     RoomManagementException,
@@ -414,46 +410,3 @@ def test_api_rooms_update_livekit_sync_failure(mock_update_metadata, exception):
             "configuration": {"can_publish_sources": ["camera"]},
         },
     )
-
-
-def generate_user_access_token(user):
-    """Generate a valid user access JWT signed with the token secret."""
-    now = datetime.now(timezone.utc)
-    application = ApplicationFactory(scopes=[ApplicationScope.USERS_SESSION])
-
-    payload = {
-        "iss": django_settings.USER_ACCESS_TOKEN_ISSUER,
-        "aud": django_settings.USER_ACCESS_TOKEN_AUDIENCE,
-        "iat": now,
-        "exp": now + timedelta(seconds=django_settings.USER_ACCESS_TOKEN_TTL),
-        "user_id": str(user.id),
-        "token_type": "user_access",
-        "client_id": application.client_id,
-        "scope": "user:access",
-    }
-
-    return jwt.encode(
-        payload,
-        django_settings.USER_ACCESS_TOKEN_SECRET_KEY,
-        algorithm=django_settings.USER_ACCESS_TOKEN_ALG,
-    )
-
-
-def test_api_rooms_update_authenticated_with_user_access_token():
-    """Role-based permissions apply unchanged with a user access token."""
-    user = UserFactory()
-    room = RoomFactory(users=[(user, "member")])
-
-    client = APIClient()
-    client.credentials(HTTP_AUTHORIZATION=f"Bearer {generate_user_access_token(user)}")
-
-    # A simple member cannot update the room
-    response = client.patch(f"/api/v1.0/rooms/{room.id!s}/", {"name": "new name"})
-    assert response.status_code == 403
-
-    # An administrator can
-    room.accesses.filter(user=user).update(role="administrator")
-    response = client.patch(f"/api/v1.0/rooms/{room.id!s}/", {"name": "new name"})
-    assert response.status_code == 200
-    room.refresh_from_db()
-    assert room.name == "new name"

src/backend/core/tests/services/test_livekit_events.py

@@ -3,6 +3,7 @@ Test LiveKitEvents service.
 """
 # pylint: disable=W0621,W0613, W0212, E0611
 
+import logging
 import uuid
 from unittest import mock
 
@@ -10,13 +11,16 @@ import pytest
 from livekit.api import EgressStatus
 
 from core.factories import RecordingFactory, RoomFactory
+from core.recording.enums import RecordingWorkerEvent
 from core.recording.services.recording_events import RecordingEventsService
 from core.services.livekit_events import (
+    EGRESS_STATUS_TO_RECORDING_EVENT,
     ActionFailedError,
     AuthenticationError,
     InvalidPayloadError,
     LiveKitEventsService,
     api,
+    to_recording_event,
 )
 from core.services.lobby import LobbyService
 from core.services.room_management import RoomManagementException
@@ -77,7 +81,7 @@ def test_initialization(
 def test_handle_egress_ended_success(  # pylint: disable=too-many-arguments, too-many-positional-arguments
     mock_update_metadata, mock_notify, mode, notification_type, service
 ):
-    """Should successfully stop recording and notifies all participant."""
+    """Should successfully stop recording and notify all participant."""
 
     recording = RecordingFactory(worker_id="worker-1", mode=mode, status="active")
     mock_data = mock.MagicMock()
@@ -104,7 +108,6 @@ def test_handle_egress_ended_success(  # pylint: disable=too-many-arguments, too
     (
         (EgressStatus.EGRESS_ACTIVE, "started"),
         (EgressStatus.EGRESS_ENDING, "saving"),
-        (EgressStatus.EGRESS_ABORTED, "aborted"),
     ),
 )
 @mock.patch("core.services.room_management.RoomManagement.update_metadata")
@@ -125,29 +128,6 @@ def test_handle_egress_updated_success(
     )
 
 
-@pytest.mark.parametrize(
-    "egress_status",
-    (
-        EgressStatus.EGRESS_FAILED,
-        EgressStatus.EGRESS_LIMIT_REACHED,
-    ),
-)
-@mock.patch("core.services.room_management.RoomManagement.update_metadata")
-def test_handle_egress_updated_non_handled(
-    mock_update_metadata, egress_status, service
-):
-    """Should ignore certain egress status and don't trigger metadata updates."""
-
-    recording = RecordingFactory(worker_id="worker-1", status="initiated")
-    mock_data = mock.MagicMock()
-    mock_data.egress_info.egress_id = recording.worker_id
-    mock_data.egress_info.status = egress_status
-
-    service._handle_egress_updated(mock_data)
-
-    mock_update_metadata.assert_not_called()
-
-
 @pytest.mark.parametrize(
     ("mode", "notification_type"),
     (
@@ -180,33 +160,38 @@ def test_handle_egress_ended_metadata_update_fails(  # pylint: disable=too-many-
     assert recording.status == "saved"
 
 
+@mock.patch(
+    "core.recording.services.recording_events.notification_service."
+    "notify_external_services"
+)
 @mock.patch("core.utils.notify_participants")
 @mock.patch("core.services.room_management.RoomManagement.update_metadata")
 def test_handle_egress_ended_notification_fails(
-    mock_update_metadata, mock_notify, service
+    mock_update_metadata, mock_notify, mock_notify_external_services, service
 ):
-    """Should raise ActionFailedError when notification fails but still stop recording."""
+    """Should still stop and save the recording when notifying participants fails."""
+
+    mock_notify_external_services.return_value = False
+    mock_notify.side_effect = NotificationError("Error notifying")
 
     recording = RecordingFactory(worker_id="worker-1", status="active")
     mock_data = mock.MagicMock()
     mock_data.egress_info.egress_id = recording.worker_id
     mock_data.egress_info.status = EgressStatus.EGRESS_LIMIT_REACHED
 
-    mock_notify.side_effect = NotificationError("Error notifying")
-
-    with pytest.raises(
-        ActionFailedError,
-        match=r"Failed to process limit reached event for recording .+",
-    ):
-        service._handle_egress_ended(mock_data)
-
-    recording.refresh_from_db()
-    assert recording.status == "stopped"
+    service._handle_egress_ended(mock_data)
 
+    mock_notify.assert_called_once_with(
+        room_name=str(recording.room.id),
+        notification_data={"type": "screenRecordingLimitReached"},
+    )
     mock_update_metadata.assert_called_once_with(
         str(recording.room.id), remove_keys=["recording_mode", "recording_status"]
     )
 
+    recording.refresh_from_db()
+    assert recording.status == "saved"
+
 
 @mock.patch("core.utils.notify_participants")
 @mock.patch("core.services.room_management.RoomManagement.update_metadata")
@@ -232,17 +217,25 @@ def test_handle_egress_ended_recording_not_found(
     assert recording.status == "active"
 
 
+@pytest.mark.parametrize(
+    "egress_status",
+    (
+        EgressStatus.EGRESS_FAILED,
+        EgressStatus.EGRESS_ABORTED,
+        EgressStatus.EGRESS_LIMIT_REACHED,
+    ),
+)
 @mock.patch("core.utils.notify_participants")
 @mock.patch("core.services.room_management.RoomManagement.update_metadata")
-def test_handle_egress_ended_recording_not_active(
-    mock_update_metadata, mock_notify, service
+def test_handle_egress_ended_recording_should_not_be_saved(
+    mock_update_metadata, mock_notify, egress_status, service
 ):
-    """Should ignore non-active recordings."""
+    """Don't update status for recordings that must not be saved."""
 
     recording = RecordingFactory(worker_id="worker-1", status="failed_to_stop")
     mock_data = mock.MagicMock()
     mock_data.egress_info.egress_id = "worker-1"
-    mock_data.egress_info.status = EgressStatus.EGRESS_LIMIT_REACHED
+    mock_data.egress_info.status = egress_status
 
     service._handle_egress_ended(mock_data)
 
@@ -255,12 +248,24 @@ def test_handle_egress_ended_recording_not_active(
     assert recording.status == "failed_to_stop"
 
 
+@mock.patch(
+    "core.recording.services.recording_events.notification_service."
+    "notify_external_services"
+)
 @mock.patch("core.utils.notify_participants")
 @mock.patch("core.services.room_management.RoomManagement.update_metadata")
-def test_handle_egress_ended_recording_not_limit_reached(
-    mock_update_metadata, mock_notify, service
+def test_handle_egress_ended_complete_does_not_notify_participants(
+    mock_update_metadata, mock_notify, mock_notify_external_services, service
 ):
-    """Should ignore egress non-limit-reached statuses."""
+    """Shouldn't notify participants on a successful egress.
+
+    EGRESS_COMPLETE is the only ended status that notifies no one: limit
+    reached, aborted and failed egresses each send their own notification.
+    A stopped recording is simply finalized, which is the nominal flow once
+    the egress uploaded the file of a user-initiated stop.
+    """
+
+    mock_notify_external_services.return_value = False
 
     recording = RecordingFactory(worker_id="worker-1", status="stopped")
     mock_data = mock.MagicMock()
@@ -273,7 +278,10 @@ def test_handle_egress_ended_recording_not_limit_reached(
     mock_update_metadata.assert_called_once_with(
         str(recording.room.id), remove_keys=["recording_mode", "recording_status"]
     )
-    assert recording.status == "stopped"
+    mock_notify_external_services.assert_called_once_with(recording)
+
+    recording.refresh_from_db()
+    assert recording.status == "saved"
 
 
 @mock.patch("core.services.livekit_events.MetadataCollectorService")
@@ -333,96 +341,163 @@ def test_handle_egress_ended_does_not_call_metadata_collector_stop_when_conditio
     mock_collector.stop.assert_not_called()
 
 
+@pytest.mark.parametrize(
+    ("egress_status", "recording_status", "event", "expected_level"),
+    (
+        (EgressStatus.EGRESS_ABORTED, "active", "aborted", logging.INFO),
+        (EgressStatus.EGRESS_FAILED, "active", "failed", logging.ERROR),
+        # The synchronous stop may already have persisted the terminal status,
+        # and the error details exist only in the webhook payload.
+        (EgressStatus.EGRESS_ABORTED, "aborted", "aborted", logging.INFO),
+        (EgressStatus.EGRESS_FAILED, "failed", "failed", logging.ERROR),
+    ),
+)
+@mock.patch("core.utils.notify_participants")
+@mock.patch("core.services.room_management.RoomManagement.update_metadata")
+def test_handle_egress_ended_logs_livekit_error(  # noqa: PLR0913, PLR0917
+    mock_update_metadata,
+    mock_notify,
+    egress_status,
+    recording_status,
+    event,
+    expected_level,
+    service,
+    caplog,
+):  # pylint: disable=too-many-arguments,too-many-positional-arguments
+    """Should log the reason LiveKit reported an unsuccessful egress."""
+
+    recording = RecordingFactory(worker_id="worker-1", status=recording_status)
+    mock_data = mock.MagicMock()
+    mock_data.egress_info.egress_id = recording.worker_id
+    mock_data.egress_info.status = egress_status
+    mock_data.egress_info.error = "could not connect to the room"
+    mock_data.egress_info.error_code = 500
+
+    with caplog.at_level(logging.INFO):
+        service._handle_egress_ended(mock_data)
+
+    assert (
+        f"Recording worker reported {event} for recording {recording.id}" in caplog.text
+    )
+    assert "could not connect to the room" in caplog.text
+    assert "error_code=500" in caplog.text
+
+    worker_logs = [
+        record
+        for record in caplog.records
+        if record.name == "core.recording.services.recording_events"
+    ]
+    assert [record.levelno for record in worker_logs] == [expected_level]
+
+
+@pytest.mark.parametrize(
+    "egress_status",
+    (EgressStatus.EGRESS_COMPLETE, EgressStatus.EGRESS_LIMIT_REACHED),
+)
 @mock.patch(
     "core.recording.services.recording_events.notification_service."
     "notify_external_services"
 )
 @mock.patch("core.utils.notify_participants")
 @mock.patch("core.services.room_management.RoomManagement.update_metadata")
-@pytest.mark.parametrize(
-    "egress_status",
-    [EgressStatus.EGRESS_COMPLETE, EgressStatus.EGRESS_LIMIT_REACHED],
-)
-@pytest.mark.parametrize(
-    "notify_return_value, recording_status",
-    [(True, "notification_succeeded"), (False, "saved")],
-)
-def test_handle_egress_ended_finalizes_recording(  # noqa: PLR0913, PLR0917
+def test_handle_egress_ended_does_not_log_error_on_successful_egress(  # noqa: PLR0913, PLR0917
     mock_update_metadata,
     mock_notify,
     mock_notify_external_services,
-    notify_return_value,
-    recording_status,
     egress_status,
     service,
+    caplog,
 ):  # pylint: disable=too-many-arguments,too-many-positional-arguments
-    """Should notify external services and save the recording on egress completion
-    (EGRESS_COMPLETE or EGRESS_LIMIT_REACHED).
-    """
-    mock_notify_external_services.return_value = notify_return_value
+    """Shouldn't log an egress error when LiveKit reports a successful egress."""
 
     recording = RecordingFactory(worker_id="worker-1", status="active")
     mock_data = mock.MagicMock()
     mock_data.egress_info.egress_id = recording.worker_id
     mock_data.egress_info.status = egress_status
 
-    service._handle_egress_ended(mock_data)
+    with caplog.at_level(logging.ERROR):
+        service._handle_egress_ended(mock_data)
 
-    mock_notify_external_services.assert_called_once_with(recording)
-
-    recording.refresh_from_db()
-    assert recording.status == recording_status
+    assert "Recording worker reported" not in caplog.text
 
 
-@pytest.mark.parametrize(
-    "egress_status",
-    [
-        EgressStatus.EGRESS_STARTING,
-        EgressStatus.EGRESS_ACTIVE,
-        EgressStatus.EGRESS_ENDING,
-        EgressStatus.EGRESS_FAILED,
-        EgressStatus.EGRESS_ABORTED,
-    ],
-)
+@mock.patch("core.utils.notify_participants")
 @mock.patch("core.services.room_management.RoomManagement.update_metadata")
-def test_handle_egress_ended_does_not_save_on_wrong_status(
-    mock_update_metadata, egress_status, service
+def test_handle_egress_ended_logs_livekit_error_before_cleaning_up(
+    mock_update_metadata, mock_notify, service, caplog
 ):
-    """Shouldn't save on invalid status."""
+    """Should log the failure reason even when the cleanup fails afterwards."""
+
+    mock_update_metadata.side_effect = RuntimeError("LiveKit is unreachable")
 
     recording = RecordingFactory(worker_id="worker-1", status="active")
     mock_data = mock.MagicMock()
     mock_data.egress_info.egress_id = recording.worker_id
-    mock_data.egress_info.status = egress_status
+    mock_data.egress_info.status = EgressStatus.EGRESS_FAILED
+    mock_data.egress_info.error = "could not connect to the room"
+    mock_data.egress_info.error_code = 500
 
-    service._handle_egress_ended(mock_data)
+    with caplog.at_level(logging.ERROR), pytest.raises(RuntimeError):
+        service._handle_egress_ended(mock_data)
 
-    recording.refresh_from_db()
-    assert recording.status == "active"
+    assert (
+        f"Recording worker reported failed for recording {recording.id}" in caplog.text
+    )
+    assert "could not connect to the room" in caplog.text
+
+
+def test_egress_status_mapping_covers_every_livekit_status():
+    """Every egress status LiveKit can report must translate to a recording event."""
+
+    unmapped = [
+        name
+        for name in EgressStatus.keys()
+        if getattr(EgressStatus, name) not in EGRESS_STATUS_TO_RECORDING_EVENT
+    ]
+
+    assert not unmapped
 
 
 @pytest.mark.parametrize(
-    "status", ["failed_to_start", "aborted", "failed_to_stop", "saved", "initiated"]
+    ("egress_status", "expected_event"),
+    (
+        (EgressStatus.EGRESS_STARTING, RecordingWorkerEvent.STARTING),
+        (EgressStatus.EGRESS_ACTIVE, RecordingWorkerEvent.STARTED),
+        (EgressStatus.EGRESS_ENDING, RecordingWorkerEvent.SAVING),
+        (EgressStatus.EGRESS_COMPLETE, RecordingWorkerEvent.COMPLETED),
+        (EgressStatus.EGRESS_LIMIT_REACHED, RecordingWorkerEvent.LIMIT_REACHED),
+        (EgressStatus.EGRESS_ABORTED, RecordingWorkerEvent.ABORTED),
+        (EgressStatus.EGRESS_FAILED, RecordingWorkerEvent.FAILED),
+    ),
 )
+def test_to_recording_event_translates_egress_status(egress_status, expected_event):
+    """Should translate a LiveKit egress status into a recording worker event."""
+
+    assert to_recording_event(egress_status) == expected_event
+
+
+def test_to_recording_event_returns_none_on_unmapped_status(caplog):
+    """Should warn and return None when LiveKit reports an unknown status."""
+
+    with caplog.at_level(logging.WARNING):
+        event = to_recording_event(999)
+
+    assert event is None
+    assert "Unmapped LiveKit egress status" in caplog.text
+
+
 @mock.patch("core.services.room_management.RoomManagement.update_metadata")
-def test_handle_egress_ended_ignores_non_savable_recording(
-    mock_update_metadata, status, service
-):
-    """Should handle non-savable recordings idempotently without raising.
+def test_handle_egress_updated_ignores_unmapped_status(mock_update_metadata, service):
+    """Shouldn't touch the room's metadata when the egress status is unknown."""
 
-    'egress_ended' may be redelivered (e.g. for an already-saved recording);
-    this must not raise, otherwise the webhook would 500 and LiveKit would retry.
-    """
-
-    recording = RecordingFactory(worker_id="worker-1", status=status)
+    RecordingFactory(worker_id="worker-1", status="active")
     mock_data = mock.MagicMock()
-    mock_data.egress_info.egress_id = recording.worker_id
-    mock_data.egress_info.status = EgressStatus.EGRESS_COMPLETE
+    mock_data.egress_info.egress_id = "worker-1"
+    mock_data.egress_info.status = 999
 
-    service._handle_egress_ended(mock_data)
+    service._handle_egress_updated(mock_data)
 
-    recording.refresh_from_db()
-    assert recording.status == status
+    mock_update_metadata.assert_not_called()
 
 
 @mock.patch.object(LobbyService, "clear_room_cache")

src/backend/core/tests/services/test_lobby.py

@@ -2,20 +2,20 @@
 Test lobby service.
 """
 
-# pylint: disable=W0621,W0613, W0212, R0913, C0302, R0917
+# pylint: disable=W0621,W0613, W0212, R0913, C0302
 # ruff: noqa: PLR0913, PLR0917
 
 import uuid
 from unittest import mock
 
-from django.conf import settings as django_settings
+from django.conf import settings
 from django.contrib.auth.models import AnonymousUser
 from django.core.cache import cache
+from django.http import HttpResponse
 
 import pytest
 from freezegun import freeze_time
 
-from core import utils
 from core.factories import RoomFactory, UserFactory, UserResourceAccessFactory
 from core.models import RoleChoices, RoomAccessLevel
 from core.services.lobby import (
@@ -151,10 +151,63 @@ def test_get_cache_key(lobby_service, participant_id):
     room = RoomFactory(access_level=RoomAccessLevel.RESTRICTED)
     cache_key = lobby_service._get_cache_key(room.id, participant_id)
 
-    expected_key = f"{django_settings.LOBBY_KEY_PREFIX}_{room.id!s}_{participant_id}"
+    expected_key = f"{settings.LOBBY_KEY_PREFIX}_{room.id!s}_{participant_id}"
     assert cache_key == expected_key
 
 
+def test_get_or_create_participant_id_from_cookie(lobby_service):
+    """Test extracting participant ID from cookie."""
+    request = mock.Mock()
+    request.COOKIES = {settings.LOBBY_COOKIE_NAME: "existing-id"}
+
+    participant_id = lobby_service._get_or_create_participant_id(request)
+
+    assert participant_id == "existing-id"
+
+
+@mock.patch.object(uuid, "uuid4", return_value="generated-id")
+def test_get_or_create_participant_id_new(mock_uuid4, lobby_service):
+    """Test creating new participant ID when cookie is missing."""
+    request = mock.Mock()
+    request.COOKIES = {}
+
+    participant_id = lobby_service._get_or_create_participant_id(request)
+
+    assert participant_id == "generated-id"
+    mock_uuid4.assert_called_once()
+
+
+def test_prepare_response_existing_cookie(lobby_service, participant_id):
+    """Test response preparation with existing cookie."""
+    response = HttpResponse()
+    response.cookies[settings.LOBBY_COOKIE_NAME] = "existing-cookie"
+
+    lobby_service.prepare_response(response, participant_id)
+
+    # Verify cookie wasn't set again
+    cookie = response.cookies.get(settings.LOBBY_COOKIE_NAME)
+    assert cookie.value == "existing-cookie"
+    assert cookie.value != participant_id
+
+
+def test_prepare_response_new_cookie(lobby_service, participant_id):
+    """Test response preparation with new cookie."""
+    response = HttpResponse()
+
+    lobby_service.prepare_response(response, participant_id)
+
+    # Verify cookie was set
+    cookie = response.cookies.get(settings.LOBBY_COOKIE_NAME)
+    assert cookie is not None
+    assert cookie.value == participant_id
+    assert cookie["httponly"] is True
+    assert cookie["secure"] is True
+    assert cookie["samesite"] == "Lax"
+
+    # It's a session cookies (no max_age specified):
+    assert not cookie["max-age"]
+
+
 def test_can_bypass_lobby_public_room(lobby_service):
     """Should return True for public rooms regardless of user auth and role."""
     room = RoomFactory(access_level=RoomAccessLevel.PUBLIC)
@@ -218,99 +271,94 @@ def test_can_bypass_lobby_private_room_with_any_role(role, lobby_service):
 
 @mock.patch("core.utils.generate_livekit_config")
 def test_request_entry_public_room(
-    mock_generate_config, lobby_service, participant_id, username, settings
+    mock_generate_config, lobby_service, participant_id, username
 ):
     """Test requesting entry to a public room."""
-    settings.LOBBY_KEY_PREFIX = "mocked-cache-prefix"
-
-    user = AnonymousUser()
+    request = mock.Mock()
+    request.user = AnonymousUser()
 
     room = RoomFactory(access_level=RoomAccessLevel.PUBLIC)
 
-    cache.set(
-        f"mocked-cache-prefix_{room.id}_{participant_id}",
-        {
-            "id": participant_id,
-            "username": username,
-            "status": "waiting",
-            "color": "#123456",
-            "entered_at": "2025-01-01T10:00:00+00:00",
-        },
+    mocked_participant = LobbyParticipant(
+        status=LobbyParticipantStatus.UNKNOWN,
+        username=username,
+        id=participant_id,
+        color="#123456",
+        entered_at="2025-01-01T10:00:00+00:00",
     )
 
+    lobby_service._get_or_create_participant_id = mock.Mock(return_value=participant_id)
+    lobby_service._get_participant = mock.Mock(return_value=mocked_participant)
     mock_generate_config.return_value = {"token": "test-token"}
 
-    participant, livekit_config = lobby_service.request_entry(
-        room, user, username, participant_id=participant_id
-    )
+    participant, livekit_config = lobby_service.request_entry(room, request, username)
 
     assert participant.status == LobbyParticipantStatus.ACCEPTED
     assert livekit_config == {"token": "test-token"}
     mock_generate_config.assert_called_once_with(
         room_id=str(room.id),
-        user=user,
+        user=request.user,
         username=username,
         color=participant.color,
         configuration=room.configuration,
-        participant_id=participant_id,
+        participant_id="test-participant-id",
         role=None,
     )
 
+    lobby_service._get_participant.assert_called_once_with(room.id, participant_id)
+
 
 @mock.patch("core.utils.generate_livekit_config")
 def test_request_entry_trusted_room(
-    mock_generate_config, lobby_service, participant_id, username, settings
+    mock_generate_config, lobby_service, participant_id, username
 ):
     """Test requesting entry to a trusted room when the user is authenticated."""
-    settings.LOBBY_KEY_PREFIX = "mocked-cache-prefix"
-
-    user = UserFactory()
+    request = mock.Mock()
+    request.user = UserFactory()
 
     room = RoomFactory(access_level=RoomAccessLevel.TRUSTED)
 
-    cache.set(
-        f"mocked-cache-prefix_{room.id}_{participant_id}",
-        {
-            "id": participant_id,
-            "username": username,
-            "status": "waiting",
-            "color": "#123456",
-            "entered_at": "2025-01-01T10:00:00+00:00",
-        },
+    mocked_participant = LobbyParticipant(
+        status=LobbyParticipantStatus.UNKNOWN,
+        username=username,
+        id=participant_id,
+        color="#123456",
+        entered_at="2025-01-01T10:00:00+00:00",
     )
 
+    lobby_service._get_or_create_participant_id = mock.Mock(return_value=participant_id)
+    lobby_service._get_participant = mock.Mock(return_value=mocked_participant)
     mock_generate_config.return_value = {"token": "test-token"}
 
-    participant, livekit_config = lobby_service.request_entry(
-        room, user, username, participant_id=participant_id
-    )
+    participant, livekit_config = lobby_service.request_entry(room, request, username)
 
     assert participant.status == LobbyParticipantStatus.ACCEPTED
     assert livekit_config == {"token": "test-token"}
     mock_generate_config.assert_called_once_with(
         room_id=str(room.id),
-        user=user,
+        user=request.user,
         username=username,
         color=participant.color,
         configuration=room.configuration,
-        participant_id=participant_id,
+        participant_id="test-participant-id",
         role=None,
     )
 
+    lobby_service._get_participant.assert_called_once_with(room.id, participant_id)
 
-@mock.patch("core.services.lobby.LobbyService._notify_entry_request")
-@mock.patch("core.services.lobby.LobbyService._create_participant")
+
+@mock.patch("core.services.lobby.LobbyService.enter")
 def test_request_entry_new_participant(
-    mock_create, mock_notify, lobby_service, participant_id, username
+    mock_enter, lobby_service, participant_id, username
 ):
-    """A new participant gets a server-minted identifier - any provided
-    one is unknown to the lobby and therefore discarded - and the room is
-    notified of the entry request."""
-
-    user = AnonymousUser()
+    """Test requesting entry for a new participant."""
+    request = mock.Mock()
+    request.COOKIES = {settings.LOBBY_COOKIE_NAME: participant_id}
+    request.user = AnonymousUser()
 
     room = RoomFactory(access_level=RoomAccessLevel.RESTRICTED)
 
+    lobby_service._get_or_create_participant_id = mock.Mock(return_value=participant_id)
     lobby_service._get_participant = mock.Mock(return_value=None)
 
     participant_data = LobbyParticipant(
@@ -320,20 +368,14 @@ def test_request_entry_new_participant(
         color="#123456",
         entered_at="2025-01-01T10:00:00+00:00",
     )
-    mock_create.return_value = participant_data
+    mock_enter.return_value = participant_data
 
-    forged_id = str(uuid.uuid4())
-    participant, livekit_config = lobby_service.request_entry(
-        room, user, username, participant_id=forged_id
-    )
+    participant, livekit_config = lobby_service.request_entry(room, request, username)
 
     assert participant == participant_data
     assert livekit_config is None
-    # The provided identifier was looked up, found unknown, and replaced
-    # by a freshly minted participant
-    lobby_service._get_participant.assert_called_once_with(room.id, forged_id)
-    mock_create.assert_called_once_with(username)
-    mock_notify.assert_called_once_with(str(room.id))
+    mock_enter.assert_called_once_with(room.id, participant_id, username)
+    lobby_service._get_participant.assert_called_once_with(room.id, participant_id)
 
 
 @mock.patch("core.services.lobby.LobbyService.refresh_waiting_status")
@@ -341,7 +383,9 @@ def test_request_entry_waiting_participant(
     mock_refresh, lobby_service, participant_id, username
 ):
     """Test requesting entry for a waiting participant."""
-    user = AnonymousUser()
+    request = mock.Mock()
+    request.COOKIES = {settings.LOBBY_COOKIE_NAME: participant_id}
+    request.user = AnonymousUser()
 
     room = RoomFactory(access_level=RoomAccessLevel.RESTRICTED)
 
@@ -352,11 +396,10 @@ def test_request_entry_waiting_participant(
         color="#123456",
         entered_at="2025-01-01T10:00:00+00:00",
     )
+    lobby_service._get_or_create_participant_id = mock.Mock(return_value=participant_id)
     lobby_service._get_participant = mock.Mock(return_value=mocked_participant)
 
-    participant, livekit_config = lobby_service.request_entry(
-        room, user, username, participant_id=participant_id
-    )
+    participant, livekit_config = lobby_service.request_entry(room, request, username)
 
     assert participant.status == LobbyParticipantStatus.WAITING
     assert livekit_config is None
@@ -366,122 +409,82 @@ def test_request_entry_waiting_participant(
 
 @mock.patch("core.utils.generate_livekit_config")
 def test_request_entry_accepted_participant(
-    mock_generate_config, lobby_service, participant_id, username, settings
+    mock_generate_config, lobby_service, participant_id, username
 ):
     """Test requesting entry for an accepted participant."""
-    settings.LOBBY_KEY_PREFIX = "mocked-cache-prefix"
-    user = AnonymousUser()
+    request = mock.Mock()
+    request.user = AnonymousUser()
+    request.COOKIES = {settings.LOBBY_COOKIE_NAME: participant_id}
 
     room = RoomFactory(access_level=RoomAccessLevel.RESTRICTED)
 
-    cache.set(
-        f"mocked-cache-prefix_{room.id}_{participant_id}",
-        {
-            "id": participant_id,
-            "username": username,
-            "status": "accepted",
-            "color": "#123456",
-            "entered_at": "2025-01-01T10:00:00+00:00",
-        },
+    mocked_participant = LobbyParticipant(
+        status=LobbyParticipantStatus.ACCEPTED,
+        username=username,
+        id=participant_id,
+        color="#123456",
+        entered_at="2025-01-01T10:00:00+00:00",
     )
+    lobby_service._get_or_create_participant_id = mock.Mock(return_value=participant_id)
+    lobby_service._get_participant = mock.Mock(return_value=mocked_participant)
 
     mock_generate_config.return_value = {"token": "test-token"}
 
-    participant, livekit_config = lobby_service.request_entry(
-        room, user, username, participant_id=participant_id
-    )
+    participant, livekit_config = lobby_service.request_entry(room, request, username)
 
     assert participant.status == LobbyParticipantStatus.ACCEPTED
     assert livekit_config == {"token": "test-token"}
     mock_generate_config.assert_called_once_with(
         room_id=str(room.id),
-        user=user,
+        user=request.user,
         username=username,
         color="#123456",
         configuration=room.configuration,
         participant_id="test-participant-id",
         role=None,
     )
-
-
-@mock.patch("core.utils.generate_livekit_config")
-def test_request_entry_accepted_participant_username_is_bound(
-    mock_generate_config, lobby_service, participant_id, settings
-):
-    """An accepted identifier must join under the username the host accepted.
-
-    The participant identifier is a bearer value: a stolen or replayed
-    identifier must not be able to enter the room under a different
-    display name than the one the acceptance decision was made on.
-    """
-    settings.LOBBY_KEY_PREFIX = "mocked-cache-prefix"
-    user = AnonymousUser()
-
-    room = RoomFactory(access_level=RoomAccessLevel.RESTRICTED)
-
-    lobby_service._save_participant(
-        room.id,
-        LobbyParticipant(
-            id=participant_id,
-            username="accepted-name",
-            status=LobbyParticipantStatus.ACCEPTED,
-            color="#123456",
-            entered_at="2025-01-01T10:00:00+00:00",
-        ),
-    )
-
-    mock_generate_config.return_value = {"token": "test-token"}
-
-    participant, livekit_config = lobby_service.request_entry(
-        room, user, "spoofed-name", participant_id=participant_id
-    )
-
-    assert participant.status == LobbyParticipantStatus.ACCEPTED
-    assert livekit_config == {"token": "test-token"}
-    assert mock_generate_config.call_args.kwargs["username"] == "accepted-name"
+    lobby_service._get_participant.assert_called_once_with(room.id, participant_id)
 
 
 @mock.patch("core.utils.generate_livekit_config")
 def test_request_entry_participant_with_role(
-    mock_generate_config, lobby_service, participant_id, username, settings
+    mock_generate_config, lobby_service, participant_id, username
 ):
     """Test requesting entry for a participant with a role on the room."""
-    settings.LOBBY_KEY_PREFIX = "mocked-cache-prefix"
-
-    user = UserFactory()
+    request = mock.Mock()
+    request.user = UserFactory()
+    request.COOKIES = {settings.LOBBY_COOKIE_NAME: participant_id}
 
     room = RoomFactory(access_level=RoomAccessLevel.RESTRICTED)
 
-    UserResourceAccessFactory(resource=room, user=user, role="administrator")
+    UserResourceAccessFactory(resource=room, user=request.user, role="administrator")
 
-    cache.set(
-        f"mocked-cache-prefix_{room.id}_{participant_id}",
-        {
-            "id": participant_id,
-            "username": username,
-            "status": "accepted",
-            "color": "#123456",
-            "entered_at": "2025-01-01T10:00:00+00:00",
-        },
+    mocked_participant = LobbyParticipant(
+        status=LobbyParticipantStatus.ACCEPTED,
+        username=username,
+        id=participant_id,
+        color="#123456",
+        entered_at="2025-01-01T10:00:00+00:00",
     )
+    lobby_service._get_or_create_participant_id = mock.Mock(return_value=participant_id)
+    lobby_service._get_participant = mock.Mock(return_value=mocked_participant)
 
     mock_generate_config.return_value = {"token": "test-token"}
 
-    participant, livekit_config = lobby_service.request_entry(
-        room, user, username, participant_id=participant_id
-    )
+    participant, livekit_config = lobby_service.request_entry(room, request, username)
 
     assert participant.status == LobbyParticipantStatus.ACCEPTED
     assert livekit_config == {"token": "test-token"}
     mock_generate_config.assert_called_once_with(
         room_id=str(room.id),
-        user=user,
+        user=request.user,
         username=username,
         color="#123456",
         configuration=room.configuration,
         participant_id="test-participant-id",
         role="administrator",
     )
+    lobby_service._get_participant.assert_called_once_with(room.id, participant_id)
 
 
 @mock.patch("core.services.lobby.cache")
@@ -492,70 +495,87 @@ def test_refresh_waiting_status(mock_cache, lobby_service, participant_id):
     room = RoomFactory(access_level=RoomAccessLevel.RESTRICTED)
     lobby_service.refresh_waiting_status(room.id, participant_id)
     mock_cache.touch.assert_called_once_with(
-        "mocked_cache_key", django_settings.LOBBY_WAITING_TIMEOUT
+        "mocked_cache_key", settings.LOBBY_WAITING_TIMEOUT
     )
     lobby_service._index_touch.assert_called_once_with(room.id)
 
 
+# pylint: disable=R0917
 @mock.patch("core.services.lobby.cache")
 @mock.patch("core.utils.generate_color")
 @mock.patch("core.utils.notify_participants")
 @mock.patch("core.services.lobby.LobbyService._index_add")
 @freeze_time("2025-01-01 10:00:00")
-def test_create_participant_not_persisted_until_saved(
+def test_enter_success(
     mock_index_add,
     mock_notify,
     mock_generate_color,
     mock_cache,
     lobby_service,
+    participant_id,
     username,
 ):
-    """Creation is in-memory; explicitly saving persists and indexes the participant."""
+    """Test successful participant entry."""
     mock_generate_color.return_value = "#123456"
     lobby_service._get_cache_key = mock.Mock(return_value="mocked_cache_key")
 
     room = RoomFactory(access_level=RoomAccessLevel.RESTRICTED)
-    participant = lobby_service._create_participant(username)
+    participant = lobby_service.enter(room.id, participant_id, username)
 
-    # The identifier is minted server-side
-    uuid.UUID(participant.id)
-    mock_generate_color.assert_called_once_with(participant.id)
+    mock_generate_color.assert_called_once_with(participant_id)
     assert participant.status == LobbyParticipantStatus.WAITING
     assert participant.username == username
+    assert participant.id == participant_id
     assert participant.color == "#123456"
     assert participant.entered_at == "2025-01-01T10:00:00+00:00"
 
-    mock_cache.set.assert_not_called()
-    mock_index_add.assert_not_called()
-    lobby_service._save_participant(room.id, participant)
-
-    lobby_service._get_cache_key.assert_called_once_with(room.id, participant.id)
+    lobby_service._get_cache_key.assert_called_once_with(room.id, participant_id)
 
     mock_cache.set.assert_called_once_with(
         "mocked_cache_key",
         participant.to_dict(),
-        timeout=django_settings.LOBBY_WAITING_TIMEOUT,
+        timeout=settings.LOBBY_WAITING_TIMEOUT,
     )
-    mock_index_add.assert_called_once_with(room.id, participant.id)
+    mock_notify.assert_called_once_with(
+        room_name=str(room.pk), notification_data={"type": "participantWaiting"}
+    )
+    mock_index_add.assert_called_once_with(room.id, participant_id)
 
 
+# pylint: disable=R0917
+@mock.patch("core.services.lobby.cache")
+@mock.patch("core.utils.generate_color")
 @mock.patch("core.utils.notify_participants")
 @mock.patch("core.services.lobby.LobbyService._index_add")
 def test_enter_with_notification_error(
     mock_index_add,
     mock_notify,
+    mock_generate_color,
+    mock_cache,
     lobby_service,
     participant_id,
     username,
 ):
-    """A notification error must not break the entry request flow."""
+    """Test participant entry with notification error."""
+    mock_generate_color.return_value = "#123456"
     mock_notify.side_effect = NotificationError("Error notifying")
+    lobby_service._get_cache_key = mock.Mock(return_value="mocked_cache_key")
 
-    lobby_service._notify_entry_request("room-id")
+    room = RoomFactory(access_level=RoomAccessLevel.RESTRICTED)
+    participant = lobby_service.enter(room.id, participant_id, username)
 
-    mock_notify.assert_called_once_with(
-        room_name="room-id", notification_data={"type": "participantWaiting"}
+    mock_generate_color.assert_called_once_with(participant_id)
+    assert participant.status == LobbyParticipantStatus.WAITING
+    assert participant.username == username
+
+    lobby_service._get_cache_key.assert_called_once_with(room.id, participant_id)
+
+    mock_cache.set.assert_called_once_with(
+        "mocked_cache_key",
+        participant.to_dict(),
+        timeout=settings.LOBBY_WAITING_TIMEOUT,
     )
+    mock_index_add.assert_called_once_with(room.id, participant_id)
 
 
 @mock.patch("core.services.lobby.cache")
@@ -607,9 +627,7 @@ def test_list_waiting_participants_empty(mock_cache, lobby_service):
 
 
 @mock.patch("core.services.lobby.cache")
-def test_list_waiting_participants(
-    mock_cache, lobby_service, participant_dict, settings
-):
+def test_list_waiting_participants(mock_cache, lobby_service, participant_dict):
     """Test listing waiting participants with valid data."""
     room = RoomFactory(access_level=RoomAccessLevel.RESTRICTED)
     cache_key = f"{settings.LOBBY_KEY_PREFIX}_{room.id!s}_participant1"
@@ -631,8 +649,8 @@ def test_list_waiting_participants(
 def test_list_waiting_participants_multiple(mock_cache, lobby_service):
     """Test listing multiple waiting participants with valid data."""
     room = RoomFactory(access_level=RoomAccessLevel.RESTRICTED)
-    cache_key1 = f"{django_settings.LOBBY_KEY_PREFIX}_{room.id!s}_participant1"
-    cache_key2 = f"{django_settings.LOBBY_KEY_PREFIX}_{room.id!s}_participant2"
+    cache_key1 = f"{settings.LOBBY_KEY_PREFIX}_{room.id!s}_participant1"
+    cache_key2 = f"{settings.LOBBY_KEY_PREFIX}_{room.id!s}_participant2"
 
     participant1 = {
         "status": "waiting",
@@ -676,7 +694,7 @@ def test_list_waiting_participants_multiple(mock_cache, lobby_service):
 
 
 @mock.patch("core.services.lobby.cache")
-def test_list_waiting_participants_corrupted_data(mock_cache, lobby_service, settings):
+def test_list_waiting_participants_corrupted_data(mock_cache, lobby_service):
     """Test listing waiting participants with corrupted data."""
     room = RoomFactory(access_level=RoomAccessLevel.RESTRICTED)
     cache_key = f"{settings.LOBBY_KEY_PREFIX}_{room.id!s}_participant1"
@@ -694,8 +712,8 @@ def test_list_waiting_participants_corrupted_data(mock_cache, lobby_service, set
 def test_list_waiting_participants_partially_corrupted(mock_cache, lobby_service):
     """Test listing waiting participants with one valid and one corrupted entry."""
     room = RoomFactory(access_level=RoomAccessLevel.RESTRICTED)
-    cache_key1 = f"{django_settings.LOBBY_KEY_PREFIX}_{room.id!s}_participant1"
-    cache_key2 = f"{django_settings.LOBBY_KEY_PREFIX}_{room.id!s}_participant2"
+    cache_key1 = f"{settings.LOBBY_KEY_PREFIX}_{room.id!s}_participant1"
+    cache_key2 = f"{settings.LOBBY_KEY_PREFIX}_{room.id!s}_participant2"
 
     valid_participant = {
         "status": "waiting",
@@ -735,8 +753,8 @@ def test_list_waiting_participants_partially_corrupted(mock_cache, lobby_service
 def test_list_waiting_participants_non_waiting(mock_cache, lobby_service):
     """Test listing only waiting participants (not accepted/denied)."""
     room = RoomFactory(access_level=RoomAccessLevel.RESTRICTED)
-    cache_key1 = f"{django_settings.LOBBY_KEY_PREFIX}_{room.id!s}_participant1"
-    cache_key2 = f"{django_settings.LOBBY_KEY_PREFIX}_{room.id!s}_participant2"
+    cache_key1 = f"{settings.LOBBY_KEY_PREFIX}_{room.id!s}_participant1"
+    cache_key2 = f"{settings.LOBBY_KEY_PREFIX}_{room.id!s}_participant2"
 
     participant1 = {
         "status": "waiting",
@@ -779,7 +797,7 @@ def test_handle_participant_entry_allow(mock_update, lobby_service, participant_
         room.id,
         participant_id,
         status=LobbyParticipantStatus.ACCEPTED,
-        timeout=django_settings.LOBBY_ACCEPTED_TIMEOUT,
+        timeout=settings.LOBBY_ACCEPTED_TIMEOUT,
     )
 
 
@@ -793,7 +811,7 @@ def test_handle_participant_entry_deny(mock_update, lobby_service, participant_i
         room.id,
         participant_id,
         status=LobbyParticipantStatus.DENIED,
-        timeout=django_settings.LOBBY_DENIED_TIMEOUT,
+        timeout=settings.LOBBY_DENIED_TIMEOUT,
     )
 
 
@@ -940,12 +958,12 @@ def test_clear_room_empty(settings, lobby_service):
     assert cache.keys(f"test-lobby_{room_id!s}_*") == []
 
 
-def test_clear_participant_cache(lobby_service, settings):
+def test_clear_participant_cache(lobby_service):
     """Test clearing a specific participant entry from cache."""
     room_id = uuid.uuid4()
     participant_id = "test-participant-id"
 
-    cache_key = f"{django_settings.LOBBY_KEY_PREFIX}_{room_id!s}_{participant_id}"
+    cache_key = f"{settings.LOBBY_KEY_PREFIX}_{room_id!s}_{participant_id}"
     participant_data = {
         "status": "waiting",
         "username": "test-username",
@@ -968,7 +986,7 @@ def test_clear_participant_cache_nonexistent(lobby_service):
     room_id = uuid.uuid4()
     participant_id = "nonexistent-participant"
 
-    cache_key = f"{django_settings.LOBBY_KEY_PREFIX}_{room_id!s}_{participant_id}"
+    cache_key = f"{settings.LOBBY_KEY_PREFIX}_{room_id!s}_{participant_id}"
     assert cache.get(cache_key) is None
 
     lobby_service.clear_participant_cache(room_id, participant_id)
@@ -976,7 +994,7 @@ def test_clear_participant_cache_nonexistent(lobby_service):
     assert cache.get(cache_key) is None
 
 
-def test_index_add_members_remove_roundtrip(lobby_service, settings):
+def test_index_add_members_remove_roundtrip(lobby_service):
     """The room index records, lists and forgets participant ids."""
     room_id = uuid.uuid4()
 
@@ -1005,10 +1023,9 @@ def test_enter_registers_participant_in_room_index(
     """Entering the lobby must index the participant id for the room."""
     room_id = uuid.uuid4()
 
-    participant = lobby_service._create_participant(username)
-    lobby_service._save_participant(room_id, participant)
+    lobby_service.enter(room_id, participant_id, username)
 
-    assert lobby_service._index_members(room_id) == frozenset([participant.id])
+    assert lobby_service._index_members(room_id) == frozenset([participant_id])
 
 
 def test_list_waiting_participants_prunes_stale_index_ids(settings, lobby_service):
@@ -1057,70 +1074,3 @@ def test_refresh_waiting_status_rearms_room_index_ttl(lobby_service, participant
 
     assert redis_client.ttl(index_key) > 10
     assert lobby_service._index_members(room_id) == frozenset([participant_id])
-
-
-@pytest.mark.parametrize(
-    "cached_status",
-    [None, LobbyParticipantStatus.WAITING, LobbyParticipantStatus.ACCEPTED],
-)
-def test_bypass_clears_lobby_admission_before_room_becomes_restricted(
-    lobby_service, cached_status
-):
-    """Bypass writes no admission; later restricted entry requires approval."""
-    room = RoomFactory(access_level=RoomAccessLevel.PUBLIC)
-    user = AnonymousUser()
-    participant_id = None
-    if cached_status is not None:
-        participant_id = str(uuid.uuid4())
-        participant = LobbyParticipant(
-            status=cached_status,
-            username="Guest",
-            id=participant_id,
-            color="#123456",
-            entered_at="2025-01-01T10:00:00+00:00",
-        )
-        lobby_service._save_participant(room.id, participant)
-
-    with (
-        mock.patch.object(
-            utils, "generate_livekit_config", return_value={"token": "test"}
-        ) as generate_config,
-        mock.patch.object(lobby_service, "_notify_entry_request") as notify,
-        mock.patch.object(
-            lobby_service, "_save_participant", wraps=lobby_service._save_participant
-        ) as save,
-        mock.patch.object(
-            lobby_service,
-            "clear_participant_cache",
-            wraps=lobby_service.clear_participant_cache,
-        ) as clear,
-    ):
-        admitted, config = lobby_service.request_entry(
-            room, user, "Guest", participant_id=participant_id
-        )
-        assert admitted.status == LobbyParticipantStatus.ACCEPTED
-        assert config == {"token": "test"}
-        assert lobby_service._get_participant(room.id, admitted.id) is None
-        assert admitted.id not in lobby_service._index_members(room.id)
-        notify.assert_not_called()
-        save.assert_not_called()
-        if cached_status is None:
-            clear.assert_not_called()
-        else:
-            clear.assert_called_once_with(room.id, participant_id)
-
-        room.access_level = RoomAccessLevel.RESTRICTED
-        generate_config.reset_mock()
-        waiting, config = lobby_service.request_entry(
-            room, user, "Guest", participant_id=admitted.id
-        )
-
-        assert waiting.status == LobbyParticipantStatus.WAITING
-        assert config is None
-        generate_config.assert_not_called()
-        notify.assert_called_once_with(str(room.id))
-        save.assert_called_once_with(room.id, waiting)
-        cached = lobby_service._get_participant(room.id, waiting.id)
-        assert cached is not None
-        assert cached.status == LobbyParticipantStatus.WAITING
-        assert waiting.id in lobby_service._index_members(room.id)

src/backend/core/tests/services/test_sip_management.py

@@ -1,5 +1,5 @@
 """
-Test SIP mamagement service.
+Test SIP management service.
 """
 
 # pylint: disable=W0212

src/backend/core/tests/services/test_transit_code.py

@@ -1,58 +0,0 @@
-"""
-Unit tests for the TransitCodeService.
-"""
-
-from unittest.mock import patch
-
-import pytest
-
-from core.factories import UserFactory
-from core.services.transit_code import TransitCodeService
-
-pytestmark = pytest.mark.django_db
-
-
-def test_create_code_returns_unique_opaque_codes():
-    """Each created code should be a distinct high-entropy string."""
-    user = UserFactory()
-    service = TransitCodeService()
-
-    codes = {service.create_code(user) for _ in range(5)}
-
-    assert len(codes) == 5
-    for code in codes:
-        assert len(code) >= 43
-
-
-def test_consume_code_returns_stored_data_once():
-    """Consuming a code should return its data exactly once."""
-    user = UserFactory()
-    service = TransitCodeService()
-
-    code = service.create_code(user, client_id="my-app")
-
-    assert service.consume_code(code) == {
-        "user_id": str(user.id),
-        "client_id": "my-app",
-    }
-    # Single use: a second consumption fails
-    assert service.consume_code(code) is None
-
-
-def test_consume_code_unknown_or_empty():
-    """Unknown or empty codes should not be consumable."""
-    service = TransitCodeService()
-
-    assert service.consume_code("unknown-code") is None
-    assert service.consume_code("") is None
-    assert service.consume_code(None) is None
-
-
-@patch("core.services.transit_code.cache.delete", return_value=False)
-def test_consume_code_returns_none_when_delete_loses_the_race(mock_delete):
-    """If the code was already deleted by a concurrent request, consumption fails."""
-    user = UserFactory()
-    service = TransitCodeService()
-    code = service.create_code(user, client_id="my-app")
-    assert service.consume_code(code) is None
-    mock_delete.assert_called_once()

src/backend/core/tests/test_api_user_access_token_authentication.py

@@ -1,270 +0,0 @@
-"""
-Tests for user access JWT authentication on the core API.
-
-The token authenticates the user on the whole API, exactly like a session
-cookie would (similar to lib-jitsi-meet's token authentication): the
-existing role-based permissions apply unchanged. Room endpoint coverage
-with a user access token lives in the room test files.
-"""
-
-from datetime import datetime, timedelta, timezone
-
-from django.conf import settings as django_settings
-
-import jwt
-import pytest
-from rest_framework.test import APIClient
-
-from core.factories import ApplicationFactory, RoomFactory, UserFactory
-from core.models import ApplicationScope, RoleChoices
-
-pytestmark = pytest.mark.django_db
-
-
-def generate_user_access_token(user, application=None, **overrides):
-    """Generate a valid user access JWT signed with the token secret."""
-    now = datetime.now(timezone.utc)
-
-    if application is None:
-        application = ApplicationFactory(scopes=[ApplicationScope.USERS_SESSION])
-
-    payload = {
-        "iss": django_settings.USER_ACCESS_TOKEN_ISSUER,
-        "aud": django_settings.USER_ACCESS_TOKEN_AUDIENCE,
-        "iat": now,
-        "exp": now + timedelta(seconds=django_settings.USER_ACCESS_TOKEN_TTL),
-        "user_id": str(user.id),
-        "token_type": "user_access",
-        "client_id": application.client_id,
-        "scope": "user:access",
-    }
-    payload.update(overrides)
-    payload = {key: value for key, value in payload.items() if value is not None}
-
-    return jwt.encode(
-        payload,
-        django_settings.USER_ACCESS_TOKEN_SECRET_KEY,
-        algorithm=django_settings.USER_ACCESS_TOKEN_ALG,
-    )
-
-
-def test_user_access_token_users_me():
-    """A user access token should authenticate the user on /users/me/."""
-    user = UserFactory()
-
-    client = APIClient()
-    client.credentials(HTTP_AUTHORIZATION=f"Bearer {generate_user_access_token(user)}")
-
-    response = client.get("/api/v1.0/users/me/")
-
-    assert response.status_code == 200
-    assert response.data["email"] == user.email
-
-
-def test_user_access_token_expired():
-    """An expired user access token should be rejected."""
-    user = UserFactory()
-
-    now = datetime.now(timezone.utc)
-    token = generate_user_access_token(
-        user,
-        iat=now - timedelta(hours=3),
-        exp=now - timedelta(hours=1),
-    )
-    client = APIClient()
-    client.credentials(HTTP_AUTHORIZATION=f"Bearer {token}")
-
-    response = client.get("/api/v1.0/users/me/")
-
-    assert response.status_code == 401
-    assert "token expired" in str(response.data).lower()
-
-
-def test_user_access_token_wrong_token_type():
-    """A verified token with the wrong 'token_type' claim should be rejected."""
-    user = UserFactory()
-
-    token = generate_user_access_token(user, token_type="addons")
-    client = APIClient()
-    client.credentials(HTTP_AUTHORIZATION=f"Bearer {token}")
-
-    response = client.get("/api/v1.0/users/me/")
-
-    assert response.status_code == 401
-    assert "invalid token type" in str(response.data).lower()
-
-
-def test_user_access_token_invalid_signature():
-    """A token signed with the wrong key should defer and end unauthenticated."""
-    user = UserFactory()
-
-    now = datetime.now(timezone.utc)
-    token = jwt.encode(
-        {
-            "iss": django_settings.USER_ACCESS_TOKEN_ISSUER,
-            "aud": django_settings.USER_ACCESS_TOKEN_AUDIENCE,
-            "iat": now,
-            "exp": now + timedelta(seconds=600),
-            "user_id": str(user.id),
-            "token_type": "user_access",
-            "client_id": "test-app",
-        },
-        "wrong-secret-key-padded-for-minimum-len!",
-        algorithm=django_settings.USER_ACCESS_TOKEN_ALG,
-    )
-    client = APIClient()
-    client.credentials(HTTP_AUTHORIZATION=f"Bearer {token}")
-
-    # UserAccessJWTAuthentication defers, session auth finds no session
-    response = client.get("/api/v1.0/users/me/")
-
-    assert response.status_code == 401
-
-
-def test_user_access_token_missing_client_id_claim():
-    """A token without the issuance-audit claim should be rejected."""
-    user = UserFactory()
-
-    token = generate_user_access_token(user, client_id=None)
-    client = APIClient()
-    client.credentials(HTTP_AUTHORIZATION=f"Bearer {token}")
-
-    response = client.get("/api/v1.0/users/me/")
-
-    assert response.status_code == 401
-    assert "invalid token claims" in str(response.data).lower()
-
-
-def test_user_access_token_inactive_user():
-    """A user access token for an inactive user should be rejected."""
-    user = UserFactory(is_active=False)
-
-    client = APIClient()
-    client.credentials(HTTP_AUTHORIZATION=f"Bearer {generate_user_access_token(user)}")
-
-    response = client.get("/api/v1.0/users/me/")
-
-    assert response.status_code == 401
-
-
-def test_user_access_token_feature_disabled(settings):
-    """When the feature is disabled, user access tokens should be ignored."""
-    settings.USER_ACCESS_TOKEN_ENABLED = False
-
-    user = UserFactory()
-
-    client = APIClient()
-    client.credentials(HTTP_AUTHORIZATION=f"Bearer {generate_user_access_token(user)}")
-
-    response = client.get("/api/v1.0/users/me/")
-
-    assert response.status_code == 401
-
-
-def test_user_access_token_does_not_break_session_authentication():
-    """A session-authenticated user should keep full access to the API."""
-    user = UserFactory()
-    RoomFactory(users=[(user, RoleChoices.OWNER)])
-
-    client = APIClient()
-    client.force_login(user)
-    response = client.get("/api/v1.0/rooms/")
-
-    assert response.status_code == 200
-    assert response.data["count"] == 1
-
-
-def test_user_access_token_application_jwt_not_accepted_on_core_api():
-    """An application-delegation JWT must not authenticate on the core API."""
-    user = UserFactory()
-
-    now = datetime.now(timezone.utc)
-    token = jwt.encode(
-        {
-            "iss": django_settings.APPLICATION_JWT_ISSUER,
-            "aud": django_settings.APPLICATION_JWT_AUDIENCE,
-            "iat": now,
-            "exp": now + timedelta(seconds=600),
-            "user_id": str(user.id),
-            "client_id": "some-client",
-            "delegated": True,
-            "scope": "rooms:retrieve",
-        },
-        django_settings.APPLICATION_JWT_SECRET_KEY,
-        algorithm=django_settings.APPLICATION_JWT_ALG,
-    )
-    client = APIClient()
-    client.credentials(HTTP_AUTHORIZATION=f"Bearer {token}")
-
-    # The user token backend must defer (wrong signature) and the request
-    # must end up unauthenticated.
-    response = client.get("/api/v1.0/users/me/")
-
-    assert response.status_code == 401
-
-
-def test_user_access_token_application_scope_revoked():
-    """Revoking the application's grant invalidates its outstanding tokens."""
-    user = UserFactory()
-    application = ApplicationFactory(scopes=[ApplicationScope.USERS_SESSION])
-
-    token = generate_user_access_token(user, application=application)
-
-    application.scopes = []
-    application.save()
-
-    client = APIClient()
-    client.credentials(HTTP_AUTHORIZATION=f"Bearer {token}")
-    response = client.get("/api/v1.0/users/me/")
-
-    assert response.status_code == 401
-    assert "application access revoked" in str(response.data).lower()
-
-
-def test_user_access_token_application_deactivated():
-    """Deactivating the application invalidates its outstanding tokens."""
-    user = UserFactory()
-    application = ApplicationFactory(scopes=[ApplicationScope.USERS_SESSION])
-
-    token = generate_user_access_token(user, application=application)
-
-    application.is_active = False
-    application.save()
-
-    client = APIClient()
-    client.credentials(HTTP_AUTHORIZATION=f"Bearer {token}")
-    response = client.get("/api/v1.0/users/me/")
-
-    assert response.status_code == 401
-    assert "application access revoked" in str(response.data).lower()
-
-
-def test_user_access_token_unknown_application():
-    """A token whose client_id matches no application is refused."""
-    user = UserFactory()
-
-    token = generate_user_access_token(user, client_id="not-an-application")
-    client = APIClient()
-    client.credentials(HTTP_AUTHORIZATION=f"Bearer {token}")
-
-    response = client.get("/api/v1.0/users/me/")
-
-    assert response.status_code == 401
-    assert "application access revoked" in str(response.data).lower()
-
-
-def test_user_access_token_does_not_override_existing_session():
-    """A Bearer token must not override the identity of a live session."""
-    session_user = UserFactory()
-    token_user = UserFactory()
-
-    client = APIClient()
-    client.force_login(session_user)
-    client.credentials(
-        HTTP_AUTHORIZATION=f"Bearer {generate_user_access_token(token_user)}"
-    )
-
-    response = client.get("/api/v1.0/users/me/")
-
-    assert response.status_code == 200
-    assert response.data["email"] == session_user.email

src/backend/core/tests/test_api_users_exchange_access_token.py

@@ -1,262 +0,0 @@
-"""
-Test users API endpoints in the Meet core app: exchange transit code.
-"""
-
-# pylint: disable=W0621
-
-import secrets
-
-import jwt
-import pytest
-from rest_framework.test import APIClient
-
-from core.factories import ApplicationFactory, UserFactory
-from core.models import ApplicationScope
-from core.services.transit_code import TransitCodeService
-
-pytestmark = pytest.mark.django_db
-
-
-def decode_user_access_token(token, settings):
-    """Decode a user access token with the token secret."""
-    return jwt.decode(
-        token,
-        settings.USER_ACCESS_TOKEN_SECRET_KEY,
-        algorithms=[settings.USER_ACCESS_TOKEN_ALG],
-        issuer=settings.USER_ACCESS_TOKEN_ISSUER,
-        audience=settings.USER_ACCESS_TOKEN_AUDIENCE,
-    )
-
-
-def generate_unknown_code(settings):
-    """Generate a well-formed code that was never stored."""
-    return secrets.token_urlsafe(settings.TRANSIT_CODE_NBYTES)
-
-
-@pytest.fixture
-def client():
-    """Return an anonymous API client with a random source IP.
-
-    A fresh IP per test isolates the anonymous throttle history, both
-    between the tests of this module and between test runs.
-    """
-    # `secrets` rather than `random`: the global random module is seeded
-    # deterministically by the factories, its sequence repeats across runs.
-    remote_addr = (
-        f"10.{secrets.randbelow(256)}.{secrets.randbelow(256)}"
-        f".{secrets.randbelow(254) + 1}"
-    )
-    return APIClient(REMOTE_ADDR=remote_addr)
-
-
-def test_exchange_access_token_missing_code(client):
-    """The exchange endpoint should validate its input."""
-    response = client.post("/api/v1.0/users/exchange-access-token/")
-
-    assert response.status_code == 400
-    assert "code" in response.data
-
-
-def test_exchange_access_token_get_method(client):
-    """The exchange endpoint should not accept GET."""
-
-    response = client.get("/api/v1.0/users/exchange-access-token/")
-    assert response.status_code == 405
-
-
-def test_exchange_access_token_malformed_code(client):
-    """A code whose length cannot match a generated one should be a 400."""
-    response = client.post(
-        "/api/v1.0/users/exchange-access-token/",
-        {"code": "not-a-valid-code"},
-    )
-
-    assert response.status_code == 400
-    assert "invalid transit code format" in str(response.data).lower()
-
-
-def test_exchange_access_token_unknown_code(client, settings):
-    """A well-formed but unknown code should be denied."""
-    response = client.post(
-        "/api/v1.0/users/exchange-access-token/",
-        {"code": generate_unknown_code(settings)},
-    )
-
-    assert response.status_code == 403
-    assert "invalid, expired or already used" in str(response.data).lower()
-
-
-def test_exchange_access_token_success(client, settings):
-    """A valid transit code should be exchangeable for an access token."""
-    user = UserFactory()
-
-    application = ApplicationFactory(scopes=[ApplicationScope.USERS_SESSION])
-    code = TransitCodeService().create_code(user, client_id=application.client_id)
-
-    response = client.post("/api/v1.0/users/exchange-access-token/", {"code": code})
-
-    assert response.status_code == 200
-    assert response.data["token_type"] == settings.USER_ACCESS_TOKEN_TYPE
-    assert response.data["expires_in"] == settings.USER_ACCESS_TOKEN_TTL
-    assert response.data["scope"] == "user:access"
-
-    payload = decode_user_access_token(response.data["access_token"], settings)
-    assert payload["user_id"] == str(user.id)
-    assert payload["client_id"] == application.client_id
-    assert payload["exp"] - payload["iat"] == settings.USER_ACCESS_TOKEN_TTL
-
-
-def test_exchange_access_token_single_use(client):
-    """A transit code should be exchangeable exactly once."""
-    user = UserFactory()
-
-    application = ApplicationFactory(scopes=[ApplicationScope.USERS_SESSION])
-    code = TransitCodeService().create_code(user, client_id=application.client_id)
-
-    response = client.post("/api/v1.0/users/exchange-access-token/", {"code": code})
-    assert response.status_code == 200
-
-    # Replaying the same code must be denied
-    response = client.post("/api/v1.0/users/exchange-access-token/", {"code": code})
-    assert response.status_code == 403
-    assert "invalid, expired or already used" in str(response.data).lower()
-
-
-def test_exchange_access_token_inactive_user(client):
-    """A code minted for a now-inactive user should be denied."""
-    user = UserFactory()
-
-    application = ApplicationFactory(scopes=[ApplicationScope.USERS_SESSION])
-    code = TransitCodeService().create_code(user, client_id=application.client_id)
-
-    user.is_active = False
-    user.save()
-
-    response = client.post("/api/v1.0/users/exchange-access-token/", {"code": code})
-
-    assert response.status_code == 403
-    assert "no longer access" in str(response.data).lower()
-
-
-def test_exchange_access_token_feature_disabled(client, settings):
-    """The exchange endpoint should return 404 when the feature is disabled."""
-    settings.USER_ACCESS_TOKEN_ENABLED = False
-
-    user = UserFactory()
-    application = ApplicationFactory(scopes=[ApplicationScope.USERS_SESSION])
-    code = TransitCodeService().create_code(user, client_id=application.client_id)
-
-    response = client.post("/api/v1.0/users/exchange-access-token/", {"code": code})
-
-    assert response.status_code == 404
-
-
-def test_exchange_access_token_throttled(client, settings):
-    """Anonymous exchange attempts should be rate limited."""
-    throttle_rates = settings.REST_FRAMEWORK["DEFAULT_THROTTLE_RATES"]
-    initial_rate = throttle_rates["exchange_access_token"]
-    # The rates dict is mutated in place: restore it explicitly, the
-    # `settings` fixture only rolls back attribute assignments.
-    throttle_rates["exchange_access_token"] = "2/minute"
-
-    try:
-        for _ in range(2):
-            response = client.post(
-                "/api/v1.0/users/exchange-access-token/",
-                {"code": generate_unknown_code(settings)},
-            )
-            assert response.status_code == 403
-
-        response = client.post(
-            "/api/v1.0/users/exchange-access-token/",
-            {"code": generate_unknown_code(settings)},
-        )
-        assert response.status_code == 429
-    finally:
-        throttle_rates["exchange_access_token"] = initial_rate
-
-
-def test_exchange_access_token_refused_when_already_authenticated(client):
-    """A session-authenticated browser must not exchange a transit code."""
-    user = UserFactory()
-    session_user = UserFactory()
-
-    application = ApplicationFactory(scopes=[ApplicationScope.USERS_SESSION])
-    code = TransitCodeService().create_code(user, client_id=application.client_id)
-
-    client.force_login(session_user)
-    response = client.post("/api/v1.0/users/exchange-access-token/", {"code": code})
-
-    assert response.status_code == 403
-    assert "already authenticated" in str(response.data).lower()
-
-    # The code was not consumed: it stays valid for its intended,
-    # cookieless embedded context.
-    client.logout()
-    response = client.post("/api/v1.0/users/exchange-access-token/", {"code": code})
-    assert response.status_code == 200
-
-
-def test_exchange_access_token_application_scope_revoked(client):
-    """A code is refused once the application's grant is revoked."""
-    user = UserFactory()
-
-    application = ApplicationFactory(scopes=[ApplicationScope.USERS_SESSION])
-    code = TransitCodeService().create_code(user, client_id=application.client_id)
-
-    application.scopes = []
-    application.save()
-
-    response = client.post("/api/v1.0/users/exchange-access-token/", {"code": code})
-
-    assert response.status_code == 403
-    assert "no longer create user sessions" in str(response.data).lower()
-
-
-def test_exchange_access_token_application_deactivated(client):
-    """A code is refused once the application is disabled."""
-    user = UserFactory()
-
-    application = ApplicationFactory(scopes=[ApplicationScope.USERS_SESSION])
-    code = TransitCodeService().create_code(user, client_id=application.client_id)
-
-    application.is_active = False
-    application.save()
-
-    response = client.post("/api/v1.0/users/exchange-access-token/", {"code": code})
-
-    assert response.status_code == 403
-    assert "no longer create user sessions" in str(response.data).lower()
-
-
-def test_exchange_access_token_unknown_application(client):
-    """A code whose client_id matches no application is refused."""
-    user = UserFactory()
-
-    code = TransitCodeService().create_code(user, client_id="not-an-application")
-
-    response = client.post("/api/v1.0/users/exchange-access-token/", {"code": code})
-
-    assert response.status_code == 403
-    assert "no longer create user sessions" in str(response.data).lower()
-
-
-def test_exchange_access_token_end_to_end(client):
-    """A token obtained from the exchange must authenticate on the core API.
-
-    Regression test: token issuance and token validation must stay in
-    sync on the claims they set and require (e.g. 'token_type').
-    """
-    user = UserFactory()
-    application = ApplicationFactory(scopes=[ApplicationScope.USERS_SESSION])
-    code = TransitCodeService().create_code(user, client_id=application.client_id)
-
-    response = client.post("/api/v1.0/users/exchange-access-token/", {"code": code})
-    assert response.status_code == 200
-
-    api_client = APIClient()
-    api_client.credentials(HTTP_AUTHORIZATION=f"Bearer {response.data['access_token']}")
-    me = api_client.get("/api/v1.0/users/me/")
-
-    assert me.status_code == 200
-    assert me.data["email"] == user.email

src/backend/core/tests/test_dockerflow.py

@@ -0,0 +1,78 @@
+"""Tests for the Dockerflow health endpoints backing the Kubernetes probes."""
+
+from unittest import mock
+
+from django.core import checks
+from django.test.utils import override_settings
+
+import pytest
+from dockerflow.django.views import django_check_registry
+
+pytestmark = pytest.mark.django_db
+
+
+@pytest.mark.parametrize("path", ["/__lbheartbeat__", "/__heartbeat__"])
+def test_dockerflow_endpoints_are_anonymous(client, path):
+    """Both endpoints answer without authentication."""
+    response = client.get(path)
+
+    assert response.status_code == 200
+
+
+def test_dockerflow_lbheartbeat_is_a_liveness_signal(client, django_assert_num_queries):
+    """The load balancer heartbeat answers 200 without touching the database."""
+    with django_assert_num_queries(0):
+        response = client.get("/__lbheartbeat__")
+
+    assert response.status_code == 200
+
+
+def test_dockerflow_lbheartbeat_ignores_allowed_hosts(client):
+    """The probes are served before ALLOWED_HOSTS is enforced."""
+    response = client.get("/__lbheartbeat__", headers={"host": "1.2.3.4:8000"})
+
+    assert response.status_code == 200
+
+
+def test_dockerflow_heartbeat_reports_the_configured_checks(client):
+    """The heartbeat runs the database, migrations and redis checks."""
+    with override_settings(DEBUG=True):
+        response = client.get("/__heartbeat__")
+
+    assert response.status_code == 200
+
+    payload = response.json()
+    assert payload["status"] == "ok"
+    assert payload["details"] == {}
+    assert payload["checks"]["check_database_connected"] == "ok"
+    assert payload["checks"]["check_migrations_applied"] == "ok"
+
+
+def test_dockerflow_heartbeat_is_a_readiness_signal(client):
+    """A check reporting an error takes the heartbeat down with a 500."""
+
+    def failing_check(**kwargs):
+        return [checks.Error("Could not connect to database", id="health.E001")]
+
+    with mock.patch.object(
+        django_check_registry, "get_checks", return_value=[failing_check]
+    ):
+        response = client.get("/__heartbeat__")
+
+    assert response.status_code == 500
+    assert response.json()["status"] == "error"
+
+
+def test_dockerflow_heartbeat_tolerates_warnings(client):
+    """A warning in the check should not affect the probes."""
+
+    def warning_check(**kwargs):
+        return [checks.Warning("Unapplied migration", id="health.W001")]
+
+    with mock.patch.object(
+        django_check_registry, "get_checks", return_value=[warning_check]
+    ):
+        response = client.get("/__heartbeat__")
+
+    assert response.status_code == 200
+    assert response.json()["status"] == "warning"

src/backend/core/tests/test_external_api_users.py

@@ -1,209 +0,0 @@
-"""
-Tests for external API /users endpoints (transit codes)
-"""
-
-# pylint: disable=W0621
-
-from datetime import datetime, timedelta, timezone
-from unittest import mock
-
-from django.conf import settings as django_settings
-
-import jwt
-import pytest
-from lasuite.oidc_resource_server.authentication import ResourceServerAuthentication
-from rest_framework.test import APIClient
-
-from core.factories import ApplicationFactory, UserFactory
-from core.models import ApplicationScope
-from core.services.transit_code import TransitCodeService
-
-pytestmark = pytest.mark.django_db
-
-
-def generate_addons_test_token(user, scopes):
-    """Generate a valid JWT token signed with the addons secret for testing."""
-    now = datetime.now(timezone.utc)
-
-    payload = {
-        "iss": django_settings.ADDONS_TOKEN_ISSUER,
-        "aud": django_settings.ADDONS_TOKEN_AUDIENCE,
-        "iat": now,
-        "exp": now + timedelta(seconds=django_settings.ADDONS_TOKEN_TTL),
-        "scope": " ".join(scopes),
-        "user_id": str(user.id),
-    }
-
-    return jwt.encode(
-        payload,
-        django_settings.ADDONS_TOKEN_SECRET_KEY,
-        algorithm=django_settings.ADDONS_TOKEN_ALG,
-    )
-
-
-def generate_test_token(user, scopes, application=None):
-    """Generate a valid application JWT token for testing."""
-    now = datetime.now(timezone.utc)
-    scope_string = " ".join(scopes)
-
-    if application is None:
-        application = ApplicationFactory(scopes=scopes)
-
-    payload = {
-        "iss": django_settings.APPLICATION_JWT_ISSUER,
-        "aud": django_settings.APPLICATION_JWT_AUDIENCE,
-        "iat": now,
-        "exp": now
-        + timedelta(seconds=django_settings.APPLICATION_JWT_EXPIRATION_SECONDS),
-        "client_id": str(application.client_id),
-        "scope": scope_string,
-        "user_id": str(user.id),
-        "delegated": True,
-    }
-
-    return jwt.encode(
-        payload,
-        django_settings.APPLICATION_JWT_SECRET_KEY,
-        algorithm=django_settings.APPLICATION_JWT_ALG,
-    )
-
-
-def test_api_users_transit_code_requires_authentication():
-    """Minting a transit code without authentication should return 401."""
-    client = APIClient()
-    response = client.post("/external-api/v1.0/users/transit-code/")
-
-    assert response.status_code == 401
-
-
-def test_api_users_transit_code_missing_scope():
-    """A token without the 'users:session' scope should be rejected."""
-    user = UserFactory()
-
-    token = generate_test_token(user, [ApplicationScope.ROOMS_RETRIEVE])
-
-    client = APIClient()
-    client.credentials(HTTP_AUTHORIZATION=f"Bearer {token}")
-    response = client.post("/external-api/v1.0/users/transit-code/")
-
-    assert response.status_code == 403
-    assert "users:session" in str(response.data)
-
-
-def test_api_users_transit_code_success(settings):
-    """A delegated user with the scope should be able to mint a transit code."""
-    user = UserFactory()
-
-    token = generate_test_token(user, [ApplicationScope.USERS_SESSION])
-
-    client = APIClient()
-    client.credentials(HTTP_AUTHORIZATION=f"Bearer {token}")
-    response = client.post("/external-api/v1.0/users/transit-code/")
-
-    assert response.status_code == 200
-    assert response.data["expires_in"] == settings.TRANSIT_CODE_TTL
-
-    code = response.data["transit_code"]
-    # Opaque, high-entropy random string
-    assert len(code) == (4 * settings.TRANSIT_CODE_NBYTES + 2) // 3
-
-    # The code is stored server-side and references the delegated user
-    code_data = TransitCodeService().consume_code(code)
-    assert code_data == {
-        "user_id": str(user.id),
-        "client_id": mock.ANY,
-    }
-
-
-def test_api_users_transit_code_scope_claim_exceeding_db_grant():
-    """A 'users:session' claim beyond the grant recorded in database is refused."""
-    user = UserFactory()
-    application = ApplicationFactory(scopes=[ApplicationScope.ROOMS_RETRIEVE])
-
-    token = generate_test_token(
-        user, [ApplicationScope.USERS_SESSION], application=application
-    )
-
-    client = APIClient()
-    client.credentials(HTTP_AUTHORIZATION=f"Bearer {token}")
-    response = client.post("/external-api/v1.0/users/transit-code/")
-
-    assert response.status_code == 403
-    assert "not granted" in str(response.data)
-
-
-def test_api_users_transit_code_get_forbidden():
-    """Minting a transit code with a GET should not be allowed."""
-    user = UserFactory()
-
-    token = generate_test_token(user, [ApplicationScope.USERS_SESSION])
-
-    client = APIClient()
-    client.credentials(HTTP_AUTHORIZATION=f"Bearer {token}")
-    response = client.get("/external-api/v1.0/users/transit-code/")
-
-    assert response.status_code == 405
-
-
-def test_api_users_transit_code_resource_server_not_supported():
-    """A resource server token must not be able to mint a transit code."""
-    user = UserFactory()
-
-    with mock.patch.object(
-        ResourceServerAuthentication,
-        "authenticate",
-        return_value=(user, {"scope": "users:session", "client_id": "rs-client"}),
-    ) as mock_rs_authenticate:
-        client = APIClient()
-        client.credentials(HTTP_AUTHORIZATION="Bearer some-opaque-rs-token")
-        response = client.post("/external-api/v1.0/users/transit-code/")
-
-    assert response.status_code == 401
-    mock_rs_authenticate.assert_not_called()
-
-
-def test_api_users_transit_code_feature_disabled(settings):
-    """Minting a transit code should return 404 when the feature is disabled."""
-    settings.USER_ACCESS_TOKEN_ENABLED = False
-
-    user = UserFactory()
-    token = generate_test_token(user, [ApplicationScope.USERS_SESSION])
-
-    client = APIClient()
-    client.credentials(HTTP_AUTHORIZATION=f"Bearer {token}")
-    response = client.post("/external-api/v1.0/users/transit-code/")
-
-    assert response.status_code == 404
-
-
-def test_api_users_transit_code_inactive_user():
-    """An inactive user should not be able to mint a transit code."""
-    user = UserFactory(is_active=False)
-
-    token = generate_test_token(user, [ApplicationScope.USERS_SESSION])
-
-    client = APIClient()
-    client.credentials(HTTP_AUTHORIZATION=f"Bearer {token}")
-    response = client.post("/external-api/v1.0/users/transit-code/")
-
-    assert response.status_code == 401
-
-
-def test_api_users_transit_code_rejects_addons_token():
-    """An addons token must not be able to mint a transit code.
-
-    The token carries the 'users:session' scope and is signed with the addons
-    secret, so only the missing backend stands between it and a transit code.
-    """
-    user = UserFactory()
-    token = generate_addons_test_token(user, [ApplicationScope.USERS_SESSION])
-
-    client = APIClient()
-    client.credentials(HTTP_AUTHORIZATION=f"Bearer {token}")
-
-    with mock.patch.object(
-        ResourceServerAuthentication, "authenticate", return_value=None
-    ):
-        response = client.post("/external-api/v1.0/users/transit-code/")
-
-    assert response.status_code == 401

src/backend/core/tests/test_models_recording.py

@@ -157,6 +157,7 @@ def test_models_recording_is_savable_normal():
 @pytest.mark.parametrize(
     "status",
     [
+        RecordingStatusChoices.FAILED,
         RecordingStatusChoices.FAILED_TO_STOP,
         RecordingStatusChoices.FAILED_TO_START,
         RecordingStatusChoices.ABORTED,
@@ -279,6 +280,7 @@ def test_models_recording_is_saved_false_initiated():
 @pytest.mark.parametrize(
     "status",
     [
+        RecordingStatusChoices.FAILED,
         RecordingStatusChoices.FAILED_TO_STOP,
         RecordingStatusChoices.FAILED_TO_START,
         RecordingStatusChoices.ABORTED,

src/backend/core/urls.py

@@ -48,11 +48,6 @@ external_router.register(
     external_viewsets.RoomViewSet,
     basename="external_room",
 )
-external_router.register(
-    "users",
-    external_viewsets.UserViewSet,
-    basename="external_user",
-)
 
 urlpatterns = [
     path(

src/backend/meet/settings.py

@@ -287,6 +287,7 @@ class Base(Configuration):
 
     MIDDLEWARE = [
         "django.middleware.security.SecurityMiddleware",
+        "dockerflow.django.middleware.DockerflowMiddleware",
         "whitenoise.middleware.WhiteNoiseMiddleware",
         "django.contrib.sessions.middleware.SessionMiddleware",
         "django.middleware.locale.LocaleMiddleware",
@@ -296,7 +297,6 @@ class Base(Configuration):
         "django.middleware.csrf.CsrfViewMiddleware",
         "django.contrib.auth.middleware.AuthenticationMiddleware",
         "django.contrib.messages.middleware.MessageMiddleware",
-        "dockerflow.django.middleware.DockerflowMiddleware",
     ]
 
     AUTHENTICATION_BACKENDS = [
@@ -347,7 +347,6 @@ class Base(Configuration):
     REST_FRAMEWORK = {
         "DEFAULT_AUTHENTICATION_CLASSES": (
             "core.authentication.backends.SessionAuthenticationWith401",
-            "core.authentication.user_token.UserAccessJWTAuthentication",
         ),
         "DEFAULT_PARSER_CLASSES": [
             "rest_framework.parsers.JSONParser",
@@ -367,11 +366,6 @@ class Base(Configuration):
                 environ_name="REQUEST_ENTRY_THROTTLE_RATES",
                 environ_prefix=None,
             ),
-            "exchange_access_token": values.Value(
-                default="30/minute",
-                environ_name="EXCHANGE_ACCESS_TOKEN_THROTTLE_RATES",
-                environ_prefix=None,
-            ),
             "creation_callback": values.Value(
                 default="600/minute",
                 environ_name="CREATION_CALLBACK_THROTTLE_RATES",
@@ -904,6 +898,11 @@ class Base(Configuration):
         environ_name="LOBBY_NOTIFICATION_TYPE",
         environ_prefix=None,
     )
+    LOBBY_COOKIE_NAME = values.Value(
+        "lobbyParticipantId",
+        environ_name="LOBBY_COOKIE_NAME",
+        environ_prefix=None,
+    )
 
     # Calendar integrations
     ROOM_CREATION_CALLBACK_CACHE_TIMEOUT = values.PositiveIntegerValue(
@@ -1026,66 +1025,6 @@ class Base(Configuration):
         environ_name="APPLICATION_BASE_URL",
         environ_prefix=None,
     )
-
-    # User access tokens (embedded frontend / iframe support)
-    USER_ACCESS_TOKEN_ENABLED = values.BooleanValue(
-        False, environ_name="USER_ACCESS_TOKEN_ENABLED", environ_prefix=None
-    )
-    USER_ACCESS_TOKEN_SECRET_KEY = SecretFileValue(
-        None, environ_name="USER_ACCESS_TOKEN_SECRET_KEY", environ_prefix=None
-    )
-    USER_ACCESS_TOKEN_ALG = values.Value(
-        "HS256",
-        environ_name="USER_ACCESS_TOKEN_ALG",
-        environ_prefix=None,
-    )
-    USER_ACCESS_TOKEN_ISSUER = values.Value(
-        "lasuite-meet",
-        environ_name="USER_ACCESS_TOKEN_ISSUER",
-        environ_prefix=None,
-    )
-    USER_ACCESS_TOKEN_AUDIENCE = values.Value(
-        None,
-        environ_name="USER_ACCESS_TOKEN_AUDIENCE",
-        environ_prefix=None,
-    )
-    # Lifetime of the user access token obtained through the exchange
-    # endpoint. It never transits through a URL, so it can cover a full
-    # meeting (default: 2 hours).
-    USER_ACCESS_TOKEN_TTL = values.PositiveIntegerValue(
-        7200,
-        environ_name="USER_ACCESS_TOKEN_TTL",
-        environ_prefix=None,
-    )
-    # Lifetime of the single-use transit code handed to the frontend
-    # through a URL fragment. Kept very short by design: it must only
-    # survive the redirect and the exchange call.
-    TRANSIT_CODE_TTL = values.PositiveIntegerValue(
-        60,
-        environ_name="TRANSIT_CODE_TTL",
-        environ_prefix=None,
-    )
-    TRANSIT_CODE_CACHE_PREFIX = values.Value(
-        "transit-code",
-        environ_name="TRANSIT_CODE_CACHE_PREFIX",
-        environ_prefix=None,
-    )
-    # Number of random bytes per code (48 bytes -> 64 url-safe characters)
-    TRANSIT_CODE_NBYTES = values.PositiveIntegerValue(
-        48,
-        environ_name="TRANSIT_CODE_NBYTES",
-        environ_prefix=None,
-    )
-    USER_ACCESS_TOKEN_TYPE = values.Value(
-        "Bearer",
-        environ_name="USER_ACCESS_TOKEN_TYPE",
-        environ_prefix=None,
-    )
-    USER_ACCESS_TOKEN_TYPE_CLAIM = values.Value(
-        "user_token",
-        environ_name="USER_ACCESS_TOKEN_TYPE_CLAIM",
-        environ_prefix=None,
-    )
     # Warning: EXTERNAL_API_ALLOW_PUBLIC_ACCESS is ignored when
     # EXTERNAL_API_DEFAULT_ACCESS_LEVEL=public.
     EXTERNAL_API_ALLOW_PUBLIC_ACCESS = values.BooleanValue(
@@ -1234,6 +1173,13 @@ class Base(Configuration):
                     environ_prefix="",
                 )
             },
+            "dockerflow": {
+                "level": values.Value(
+                    "WARNING",
+                    environ_name="LOGGING_LEVEL_DOCKERFLOW",
+                    environ_prefix="",
+                )
+            },
             "core": {
                 "handlers": ["console"],
                 "level": values.Value(
@@ -1408,9 +1354,6 @@ class Test(Base):
     ADDONS_ENABLED = True
     ADDONS_CSRF_SECRET = "secret-key-padded-for-minimum-len!-addons"  # noqa:S105
     ADDONS_TOKEN_SECRET_KEY = "secret-key-padded-for-minimum-len!-addons"  # noqa:S105
-    USER_ACCESS_TOKEN_ENABLED = True
-    USER_ACCESS_TOKEN_SECRET_KEY = "secret-key-padded-for-minimum-len!-room"  # noqa:S105
-    USER_ACCESS_TOKEN_AUDIENCE = "Test inc."  # noqa:S105
 
     CONNECTION_TEST_ENABLED = True
 

src/backend/pyproject.toml

@@ -7,7 +7,7 @@ build-backend = "uv_build"
 
 [project]
 name = "meet"
-version = "1.31.0"
+version = "1.32.1"
 authors = [{ "name" = "DINUM", "email" = "dev@mail.numerique.gouv.fr" }]
 classifiers = [
     "Development Status :: 5 - Production/Stable",
@@ -41,7 +41,7 @@ dependencies = [
     "django-timezone-field>=5.1",
     "django-pydantic-field==0.5.4",
     "django==5.2.16",
-    "djangorestframework==3.17.1",
+    "djangorestframework==3.17.2",
     "drf_spectacular==0.30.0",
     "dockerflow==2026.3.4",
     "easy_thumbnails==2.10.1",

src/backend/uv.lock

@@ -754,14 +754,14 @@ wheels = [
 
 [[package]]
 name = "djangorestframework"
-version = "3.17.1"
+version = "3.17.2"
 source = { registry = "https://pypi.org/simple" }
 dependencies = [
     { name = "django" },
 ]
-sdist = { url = "https://files.pythonhosted.org/packages/ca/d7/c016e69fac19ff8afdc89db9d31d9ae43ae031e4d1993b20aca179b8301a/djangorestframework-3.17.1.tar.gz", hash = "sha256:a6def5f447fe78ff853bff1d47a3c59bf38f5434b031780b351b0c73a62db1a5", size = 905742, upload-time = "2026-03-24T16:58:33.705Z" }
+sdist = { url = "https://files.pythonhosted.org/packages/3b/35/c96055e700fdff25da3a7b7756cfd1d4dc54f38b9bc6d6c5e19e3a0fdc20/djangorestframework-3.17.2.tar.gz", hash = "sha256:89ed713b6dc83e1539f214b7d10808ae19bb8511004beba886225da6d5c9dafa", size = 906683, upload-time = "2026-08-05T07:47:22.5Z" }
 wheels = [
-    { url = "https://files.pythonhosted.org/packages/5a/e1/2c516bdc83652b1a60c6119366ac2c0607b479ed05cd6093f916ca8928f8/djangorestframework-3.17.1-py3-none-any.whl", hash = "sha256:c3c74dd3e83a5a3efc37b3c18d92bd6f86a6791c7b7d4dff62bb068500e76457", size = 898844, upload-time = "2026-03-24T16:58:31.845Z" },
+    { url = "https://files.pythonhosted.org/packages/a2/46/c14108e400b208c394325eb63fbae06c81341b6447fa1a6f9da718b17fe7/djangorestframework-3.17.2-py3-none-any.whl", hash = "sha256:cb0546a7415d5b46c04e0f4fe0a54b2109f4fdd5e83ca773c8c6183a6493d042", size = 899109, upload-time = "2026-08-05T07:47:20.853Z" },
 ]
 
 [[package]]
@@ -1187,7 +1187,7 @@ wheels = [
 
 [[package]]
 name = "meet"
-version = "1.31.0"
+version = "1.32.1"
 source = { editable = "." }
 dependencies = [
     { name = "aiohttp" },
@@ -1273,7 +1273,7 @@ requires-dist = [
     { name = "django-redis", specifier = "==7.0.0" },
     { name = "django-storages", extras = ["s3"], specifier = "==1.14.6" },
     { name = "django-timezone-field", specifier = ">=5.1" },
-    { name = "djangorestframework", specifier = "==3.17.1" },
+    { name = "djangorestframework", specifier = "==3.17.2" },
     { name = "dockerflow", specifier = "==2026.3.4" },
     { name = "drf-spectacular", specifier = "==0.30.0" },
     { name = "easy-thumbnails", specifier = "==2.10.1" },

src/frontend/Dockerfile

@@ -45,7 +45,8 @@ RUN npm run build
 FROM nginxinc/nginx-unprivileged:1.30.4-alpine3.24 AS frontend-production
 
 USER root
-RUN apk del curl
+RUN apk upgrade --no-cache libexpat && \
+    apk del curl
 USER nginx
 
 # Un-privileged user running the application

src/frontend/package-lock.json

@@ -1,12 +1,12 @@
 {
   "name": "meet",
-  "version": "1.31.0",
+  "version": "1.32.1",
   "lockfileVersion": 3,
   "requires": true,
   "packages": {
     "": {
       "name": "meet",
-      "version": "1.31.0",
+      "version": "1.32.1",
       "dependencies": {
         "@fontsource-variable/atkinson-hyperlegible-next": "5.3.0",
         "@fontsource-variable/lexend": "5.3.0",

src/frontend/package.json

@@ -1,7 +1,7 @@
 {
   "name": "meet",
   "private": true,
-  "version": "1.31.0",
+  "version": "1.32.1",
   "type": "module",
   "scripts": {
     "dev": "panda codegen && vite",

src/frontend/panda.config.ts

@@ -121,7 +121,7 @@ const config: Config = {
     },
     tokens: defineTokens({
       /* we take a few things from the panda preset but for now we clear out some stuff.
-       * This way we'll only add the things we need step by step and prevent using lots of differents things.
+       * This way we'll only add the things we need step by step and prevent using lots of different things.
        */
       ...pandaPreset.theme.tokens,
       colors: defineTokens.colors({

src/frontend/src/App.tsx

@@ -12,7 +12,6 @@ import { routes } from './routes'
 import './i18n/init'
 import { queryClient } from '@/api/queryClient'
 import { AppInitialization } from '@/components/AppInitialization'
-import { TransitCodeGate } from '@/features/auth/components/TransitCodeGate'
 import { useIsSdkContext } from '@/features/sdk/hooks/useIsSdkContext'
 import { useApplyA11yFonts } from '@/hooks/useApplyA11yFonts'
 
@@ -25,29 +24,23 @@ function App() {
 
   return (
     <QueryClientProvider client={queryClient}>
-      <TransitCodeGate>
-        {!isSDKContext && <AppInitialization />}
-        <Suspense fallback={null}>
-          <I18nProvider locale={i18n.language}>
-            <Layout>
-              <Switch>
-                {Object.entries(routes).map(([, route], i) => (
-                  <Route
-                    key={i}
-                    path={route.path}
-                    component={route.Component}
-                  />
-                ))}
-                <Route component={NotFoundScreen} />
-              </Switch>
-            </Layout>
-            <ReactQueryDevtools
-              initialIsOpen={false}
-              buttonPosition="bottom-left"
-            />
-          </I18nProvider>
-        </Suspense>
-      </TransitCodeGate>
+      {!isSDKContext && <AppInitialization />}
+      <Suspense fallback={null}>
+        <I18nProvider locale={i18n.language}>
+          <Layout>
+            <Switch>
+              {Object.entries(routes).map(([, route], i) => (
+                <Route key={i} path={route.path} component={route.Component} />
+              ))}
+              <Route component={NotFoundScreen} />
+            </Switch>
+          </Layout>
+          <ReactQueryDevtools
+            initialIsOpen={false}
+            buttonPosition="bottom-left"
+          />
+        </I18nProvider>
+      </Suspense>
     </QueryClientProvider>
   )
 }

src/frontend/src/api/fetchApi.ts

@@ -1,23 +1,17 @@
 import { ApiError } from './ApiError'
 import { apiUrl } from './apiUrl'
-import { getAccessToken } from '@/stores/accessToken'
 
 export const fetchApi = async <T = Record<string, unknown>>(
   url: string,
   options?: RequestInit
 ): Promise<T> => {
   const csrfToken = getCsrfToken()
-  // Embedded (iframe) mode: the user access token obtained through the
-  // transit code exchange authenticates requests in place of the session
-  // cookie, which is blocked in third-party contexts.
-  const accessToken = getAccessToken()
   const response = await fetch(apiUrl(url), {
     credentials: 'include',
     ...options,
     headers: {
       'Content-Type': 'application/json',
       ...(!!csrfToken && { 'X-CSRFToken': csrfToken }),
-      ...(!!accessToken && { Authorization: `Bearer ${accessToken}` }),
       ...options?.headers,
     },
   })

src/frontend/src/features/auth/api/exchangeAccessToken.ts

@@ -1,72 +0,0 @@
-import { fetchApi } from '@/api/fetchApi'
-import { setAccessToken } from '@/stores/accessToken'
-import {
-  consumeTransitCodeFromFragment,
-  isEmbedded,
-} from '../utils/transitCode'
-
-type ApiAccessToken = {
-  access_token: string
-  token_type: string
-  expires_in: number
-  scope: string
-}
-
-/**
- * Exchange a single-use transit code for a user access token.
- *
- * The endpoint is unauthenticated: the code itself is the credential.
- */
-export const exchangeAccessToken = (code: string): Promise<ApiAccessToken> => {
-  return fetchApi<ApiAccessToken>('/users/exchange-access-token/', {
-    method: 'POST',
-    body: JSON.stringify({ code }),
-  })
-}
-
-const runInitialization = async (): Promise<void> => {
-  const code = consumeTransitCodeFromFragment()
-
-  if (!code) {
-    return
-  }
-
-  if (!isEmbedded()) {
-    console.warn('Transit code ignored outside an embedded context')
-    return
-  }
-
-  try {
-    const { access_token } = await exchangeAccessToken(code)
-    setAccessToken(access_token)
-  } catch (error) {
-    console.warn('Transit code exchange failed:', error)
-  }
-}
-
-let initialization: Promise<void> | null = null
-
-/**
- * Bootstrap the embedded (iframe) authentication, if applicable.
- *
- * When, and only when, a transit code is present in the URL fragment,
- * exchange it for a user access token and keep it in the in-memory
- * accessToken store: fetchApi then sends it as a Bearer header on every
- * api call, authenticating the user exactly like a session cookie would.
- *
- * Must complete before anything fires an authenticated query, which the
- * TransitCodeGate component guarantees by gating the app tree on it.
- *
- * Memoized: the fragment is consumed and the code exchanged exactly once,
- * however many times this is called (StrictMode double-invoked effects,
- * among others). Subsequent calls await the same promise.
- *
- * A failed exchange (expired or already used code) is not fatal: the app
- * starts unauthenticated, falling back to the regular session flow.
- */
-export const initializeAccessTokenFromFragment = (): Promise<void> => {
-  if (!initialization) {
-    initialization = runInitialization()
-  }
-  return initialization
-}

src/frontend/src/features/auth/api/fetchUser.ts

@@ -2,7 +2,6 @@ import { ApiError } from '@/api/ApiError'
 import { fetchApi } from '@/api/fetchApi'
 import { type ApiUser } from './ApiUser'
 import { attemptSilentLogin, canAttemptSilentLogin } from '../utils/silentLogin'
-import { getAccessToken } from '@/stores/accessToken'
 
 /**
  * fetch the logged-in user from the api.
@@ -26,13 +25,7 @@ export const fetchUser = (
         if (error instanceof ApiError && error.statusCode === 401) {
           // make sure to not resolve the promise while trying to silent login
           // so that consumers of fetchUser don't think the work already ended
-          // Never attempt a silent login in embedded (token) mode: an OIDC
-          // redirect inside the iframe would break the embed.
-          if (
-            opts.attemptSilent &&
-            !getAccessToken() &&
-            canAttemptSilentLogin()
-          ) {
+          if (opts.attemptSilent && canAttemptSilentLogin()) {
             attemptSilentLogin(30)
           } else {
             resolve(false)

src/frontend/src/features/auth/components/TransitCodeGate.tsx

@@ -1,67 +0,0 @@
-import { useEffect, useState } from 'react'
-import { LoadingScreen } from '@/components/LoadingScreen'
-import { useHash } from '@/hooks/useHash'
-import { initializeAccessTokenFromFragment } from '../api/exchangeAccessToken'
-import { hasTransitCodeInFragment } from '../utils/transitCode'
-
-/**
- * Gates the app tree on the embedded (iframe) authentication bootstrap.
- *
- * Without a transit code in the URL fragment — the overwhelmingly common
- * case — the component early returns children synchronously: no state,
- * no effect, no extra render, no loading screen.
- *
- * When a transit code is present, children are not mounted until it has
- * been exchanged for a user access token, so that every authenticated
- * query already carries the Authorization header. A loading screen is
- * displayed in the meantime, as UserAware does.
- */
-export const TransitCodeGate = ({
-  children,
-}: {
-  children: React.ReactNode
-}) => {
-  const hash = useHash()
-
-  // Note: the exchange only happens in an embedding context. This check lives
-  // in initializeAccessTokenFromFragment, the single funnel for all bootstrap paths.
-  // The gate still mounts top-level to scrub the fragment, but bootstrap then resolves
-  // immediately without exchanging.
-  //
-  // Latch the decision on the initial hash: bootstrap scrubs it immediately, and the
-  // gate must not switch back to the fast path while the exchange is in flight.
-  const [needsExchange] = useState(() => hasTransitCodeInFragment(hash))
-
-  if (!needsExchange) {
-    return children
-  }
-
-  return <TransitCodeExchange>{children}</TransitCodeExchange>
-}
-
-/**
- * Only ever mounted when a transit code is present: runs the memoized
- * bootstrap (safe against StrictMode double-invoked effects) and holds
- * children back until it settles.
- */
-const TransitCodeExchange = ({ children }: { children: React.ReactNode }) => {
-  const [isReady, setIsReady] = useState(false)
-
-  useEffect(() => {
-    let isMounted = true
-    initializeAccessTokenFromFragment().finally(() => {
-      if (isMounted) {
-        setIsReady(true)
-      }
-    })
-    return () => {
-      isMounted = false
-    }
-  }, [])
-
-  return isReady ? (
-    children
-  ) : (
-    <LoadingScreen header={false} footer={false} delay={1000} />
-  )
-}

src/frontend/src/features/auth/utils/transitCode.ts

@@ -1,59 +0,0 @@
-const TRANSIT_CODE_FRAGMENT_PARAM = 'transit_code'
-
-/**
- * Whether the app is rendered inside an embedding context (iframe).
- *
- * Comparing window references never throws, even when the parent is
- * cross-origin. Defaults to false outside a browser environment.
- */
-export const isEmbedded = (): boolean => {
-  if (typeof window === 'undefined') {
-    return false
-  }
-  return window.self !== window.top
-}
-
-/**
- * Whether a URL fragment carries a transit code. Pure check, does not
- * consume anything.
- */
-export const hasTransitCodeInFragment = (hash: string): boolean => {
-  if (!hash) {
-    return false
-  }
-  return new URLSearchParams(hash.replace(/^#/, '')).has(
-    TRANSIT_CODE_FRAGMENT_PARAM
-  )
-}
-
-/**
- * Extract the transit code from the URL fragment, if any.
- *
- * The fragment is scrubbed from the address bar immediately, before any
- * network call, so the code never lingers in the browser history. Any
- * other fragment content is preserved.
- */
-export const consumeTransitCodeFromFragment = (): string | null => {
-  if (typeof window === 'undefined' || !window.location.hash) {
-    return null
-  }
-
-  const params = new URLSearchParams(window.location.hash.substring(1))
-  const code = params.get(TRANSIT_CODE_FRAGMENT_PARAM)
-
-  if (!code) {
-    return null
-  }
-
-  params.delete(TRANSIT_CODE_FRAGMENT_PARAM)
-  const remaining = params.toString()
-  window.history.replaceState(
-    null,
-    '',
-    window.location.pathname +
-      window.location.search +
-      (remaining ? `#${remaining}` : '')
-  )
-
-  return code
-}

src/frontend/src/features/files/hooks/useResolvedMediaUrls.ts

@@ -1,56 +0,0 @@
-import { useCallback, useEffect, useState } from 'react'
-import { useSnapshot } from 'valtio'
-import { accessTokenStore } from '@/stores/accessToken'
-import { resolveMediaUrl } from '../utils/resolveMediaUrl'
-
-/**
- * Reactive companion of resolveMediaUrl for browser-native consumers
- * (CSS url(), img src attributes): resolves a list of /media/ URLs and
- * returns a stable lookup, identity in regular mode.
- *
- * Object URLs come from the shared session-lifetime cache and are never
- * revoked here: they may be used concurrently by the background
- * processors.
- */
-export const useResolvedMediaUrls = (
-  urls: (string | null | undefined)[]
-): ((url: string) => string) => {
-  const [resolved, setResolved] = useState<Record<string, string>>({})
-  const { accessToken } = useSnapshot(accessTokenStore)
-
-  // Stable dependency for the effect, insensitive to array identity
-  const urlsKey = urls.filter(Boolean).sort().join('\n')
-
-  useEffect(() => {
-    if (!accessToken || !urlsKey) {
-      return
-    }
-
-    let isMounted = true
-
-    const resolveAll = async () => {
-      const entries = await Promise.all(
-        urlsKey.split('\n').map(async (url) => {
-          try {
-            return [url, await resolveMediaUrl(url)] as const
-          } catch (error) {
-            console.warn(error)
-            return [url, url] as const
-          }
-        })
-      )
-      if (isMounted) {
-        setResolved(Object.fromEntries(entries))
-      }
-    }
-    resolveAll()
-
-    return () => {
-      isMounted = false
-    }
-  }, [accessToken, urlsKey])
-
-  // Stable identity so that consumers can safely list the resolver in
-  // their memo dependencies: it only changes when resolutions land.
-  return useCallback((url: string) => resolved[url] ?? url, [resolved])
-}

src/frontend/src/features/files/utils/resolveMediaUrl.ts

@@ -1,47 +0,0 @@
-import { getAccessToken } from '@/stores/accessToken'
-
-// Session-lifetime cache: object URLs are shared between every consumer
-// of a given media (background processors, thumbnails) and are therefore
-// never revoked - their number is bounded by the user's custom
-// backgrounds, and they die with the page like the access token does.
-const objectUrlCache = new Map<string, string>()
-
-/**
- * Resolve an authenticated /media/ URL for the embedded (token) mode.
- *
- * Media files are served behind an nginx auth_request subrequest that
- * authenticates the original request. In regular mode the session cookie
- * rides along browser-native loads (img.src, CSS url()) and the URL is
- * returned unchanged, without any fetch. In embedded mode the
- * third-party cookie is blocked and native loads cannot carry the
- * Authorization header, so the media is fetched here with the Bearer
- * header - which the media-auth endpoint accepts, as it sits behind the
- * default authentication stack - and exposed as a blob object URL.
- */
-export const resolveMediaUrl = async (url: string): Promise<string> => {
-  const accessToken = getAccessToken()
-
-  if (!accessToken) {
-    return url
-  }
-
-  const cached = objectUrlCache.get(url)
-  if (cached) {
-    return cached
-  }
-
-  const response = await fetch(url, {
-    headers: { Authorization: `Bearer ${accessToken}` },
-  })
-
-  if (!response.ok) {
-    throw new Error(
-      `Failed to resolve media url ${url}: HTTP ${response.status}`
-    )
-  }
-
-  const objectUrl = URL.createObjectURL(await response.blob())
-  objectUrlCache.set(url, objectUrl)
-
-  return objectUrl
-}

src/frontend/src/features/notifications/MainNotificationToast.tsx

@@ -96,6 +96,10 @@ export const MainNotificationToast = () => {
         case NotificationType.ScreenRecordingStopped:
         case NotificationType.TranscriptionLimitReached:
         case NotificationType.ScreenRecordingLimitReached:
+        case NotificationType.TranscriptionFailed:
+        case NotificationType.ScreenRecordingFailed:
+        case NotificationType.TranscriptionAborted:
+        case NotificationType.ScreenRecordingAborted:
           toastQueue.add(
             {
               participant,

src/frontend/src/features/notifications/NotificationProvider.tsx

@@ -1,5 +1,6 @@
 import { Div } from '@/primitives'
 import { ToastProvider } from './components/ToastProvider'
+import { RecordingWaitingForTracksNotification } from './components/RecordingWaitingForTracksNotification'
 import { WaitingParticipantNotification } from './components/WaitingParticipantNotification'
 
 export const NotificationProvider = ({
@@ -12,5 +13,6 @@ export const NotificationProvider = ({
   <Div position="absolute" bottom={bottom} right={right} zIndex={1000}>
     <ToastProvider />
     <WaitingParticipantNotification />
+    <RecordingWaitingForTracksNotification />
   </Div>
 )

src/frontend/src/features/notifications/NotificationType.ts

@@ -10,11 +10,15 @@ export enum NotificationType {
   TranscriptionStarted = 'transcriptionStarted',
   TranscriptionStopped = 'transcriptionStopped',
   TranscriptionLimitReached = 'transcriptionLimitReached',
+  TranscriptionFailed = 'transcriptionFailed',
+  TranscriptionAborted = 'transcriptionAborted',
   TranscriptionRequested = 'transcriptionRequested',
   ScreenRecordingStarted = 'screenRecordingStarted',
   ScreenRecordingStopped = 'screenRecordingStopped',
   ScreenRecordingRequested = 'screenRecordingRequested',
   ScreenRecordingLimitReached = 'screenRecordingLimitReached',
+  ScreenRecordingFailed = 'screenRecordingFailed',
+  ScreenRecordingAborted = 'screenRecordingAborted',
   RecordingSaving = 'recordingSaving',
   PermissionsRemoved = 'permissionsRemoved',
   RoleChanged = 'roleChanged',

src/frontend/src/features/notifications/components/RecordingWaitingForTracksNotification.tsx

@@ -0,0 +1,41 @@
+import { useTranslation } from 'react-i18next'
+import { Text } from '@/primitives'
+import { css } from '@/styled-system/css'
+import { HStack } from '@/styled-system/jsx'
+import { RecordingMode } from '@/features/recording'
+import { useRecordingWaitingForTracks } from '@/features/recording/hooks/useRecordingWaitingForTracks'
+import { StyledToastContainer } from './StyledToastContainer'
+
+export const RecordingWaitingForTracksNotification = () => {
+  const { t } = useTranslation('notifications')
+  const isTranscriptWaiting = useRecordingWaitingForTracks(
+    RecordingMode.Transcript
+  )
+  const isScreenRecordingWaiting = useRecordingWaitingForTracks(
+    RecordingMode.ScreenRecording
+  )
+
+  if (!isTranscriptWaiting && !isScreenRecordingWaiting) return null
+
+  return (
+    <StyledToastContainer role="status">
+      <HStack padding={14}>
+        <Text
+          margin={false}
+          className={css({
+            maxWidth: '22rem',
+            wordBreak: 'break-word',
+            overflowWrap: 'break-word',
+            whiteSpace: 'normal',
+          })}
+        >
+          {t(
+            isTranscriptWaiting
+              ? 'transcript.waitingForTracks'
+              : 'screenRecording.waitingForTracks'
+          )}
+        </Text>
+      </HStack>
+    </StyledToastContainer>
+  )
+}

src/frontend/src/features/notifications/components/ToastAnyRecording.tsx

@@ -22,12 +22,20 @@ export function ToastAnyRecording({ state, ...props }: Readonly<ToastProps>) {
         return 'transcript.stopped'
       case NotificationType.TranscriptionLimitReached:
         return 'transcript.limitReached'
+      case NotificationType.TranscriptionFailed:
+        return 'transcript.failed'
+      case NotificationType.TranscriptionAborted:
+        return 'transcript.aborted'
       case NotificationType.ScreenRecordingStarted:
         return 'screenRecording.started'
       case NotificationType.ScreenRecordingStopped:
         return 'screenRecording.stopped'
       case NotificationType.ScreenRecordingLimitReached:
         return 'screenRecording.limitReached'
+      case NotificationType.ScreenRecordingFailed:
+        return 'screenRecording.failed'
+      case NotificationType.ScreenRecordingAborted:
+        return 'screenRecording.aborted'
       default:
         return
     }

src/frontend/src/features/notifications/components/ToastRegion.tsx

@@ -58,6 +58,10 @@ const renderToast = (
     case NotificationType.ScreenRecordingStarted:
     case NotificationType.ScreenRecordingStopped:
     case NotificationType.ScreenRecordingLimitReached:
+    case NotificationType.TranscriptionFailed:
+    case NotificationType.ScreenRecordingFailed:
+    case NotificationType.TranscriptionAborted:
+    case NotificationType.ScreenRecordingAborted:
       return <ToastAnyRecording key={toast.key} toast={toast} state={state} />
 
     case NotificationType.TranscriptionRequested:

src/frontend/src/features/participantTile/components/ParticipantTile.tsx

@@ -20,6 +20,7 @@ import { Track } from 'livekit-client'
 import { ParticipantPlaceholder } from './ParticipantPlaceholder'
 import { ParticipantTileFocus } from './participantTileFocus/ParticipantTileFocus'
 import { FullScreenShareWarning } from './FullScreenShareWarning'
+import { ScreenShareZoomableVideo } from '@/features/rooms/livekit/components/ScreenShareZoomableVideo'
 import { useTranslation } from 'react-i18next'
 import { getShortcutDescriptorById } from '@/features/shortcuts/catalog'
 import { formatShortcutLabel } from '@/features/shortcuts/formatLabels'
@@ -89,6 +90,8 @@ export const ParticipantTile: (
   )
 
   const isScreenShare = trackReference.source != Track.Source.Camera
+  const isRemoteScreenShare =
+    isScreenShare && !trackReference.participant.isLocal
   const [hasKeyboardFocus, setHasKeyboardFocus] = React.useState(false)
 
   const participantColor = getParticipantColor(trackReference.participant)
@@ -98,11 +101,23 @@ export const ParticipantTile: (
   })
   const participantName = name || identity || 'Unknown'
 
+  // tileRef: fullscreen target, and the node the focus overlay listens on.
+  // setRefs merges it with the forwarded ref on the same node.
+  const tileRef = React.useRef<HTMLDivElement>(null)
+  const setRefs = React.useCallback(
+    (node: HTMLDivElement | null) => {
+      ;(tileRef as React.MutableRefObject<HTMLDivElement | null>).current = node
+      if (typeof ref === 'function') ref(node)
+      else if (ref)
+        (ref as React.MutableRefObject<HTMLDivElement | null>).current = node
+    },
+    [ref]
+  )
+
   const { t } = useTranslation('rooms', { keyPrefix: 'participantTileFocus' })
 
   const interactiveProps = {
     ...elementProps,
-    // Ensure the tile is focusable to expose contextual controls to keyboard users.
     tabIndex: 0,
     'aria-label': t('containerLabel', { name: participantName }),
     onFocus: (event: React.FocusEvent<HTMLDivElement>) => {
@@ -120,8 +135,41 @@ export const ParticipantTile: (
     },
   }
 
+  const isVideoTrack =
+    isTrackReference(trackReference) &&
+    trackReference.publication.kind === 'video'
+
+  let trackMedia: React.ReactNode = null
+  if (isVideoTrack) {
+    const videoTrack = (
+      <VideoTrack
+        trackRef={trackReference}
+        onSubscriptionStatusChanged={handleSubscribe}
+        manageSubscription={autoManageSubscription}
+      />
+    )
+    // Zoom toolbar stays out of picture-in-picture: that window has its own
+    // document and the fullscreen API is off. Follow-up PR can restore zoom
+    // there without the dead fullscreen button.
+    trackMedia =
+      isRemoteScreenShare && !disableTileControls ? (
+        <ScreenShareZoomableVideo tileRef={tileRef}>
+          {videoTrack}
+        </ScreenShareZoomableVideo>
+      ) : (
+        videoTrack
+      )
+  } else if (isTrackReference(trackReference)) {
+    trackMedia = (
+      <AudioTrack
+        trackRef={trackReference}
+        onSubscriptionStatusChanged={handleSubscribe}
+      />
+    )
+  }
+
   return (
-    <div ref={ref} style={{ position: 'relative' }} {...interactiveProps}>
+    <div ref={setRefs} style={{ position: 'relative' }} {...interactiveProps}>
       <TrackRefContextIfNeeded trackRef={trackReference}>
         <ParticipantContextIfNeeded participant={trackReference.participant}>
           {trackReference.participant.isLocal && (
@@ -129,23 +177,7 @@ export const ParticipantTile: (
           )}
           {children ?? (
             <>
-              {isTrackReference(trackReference) &&
-              (trackReference.publication?.kind === 'video' ||
-                trackReference.source === Track.Source.Camera ||
-                trackReference.source === Track.Source.ScreenShare) ? (
-                <VideoTrack
-                  trackRef={trackReference}
-                  onSubscriptionStatusChanged={handleSubscribe}
-                  manageSubscription={autoManageSubscription}
-                />
-              ) : (
-                isTrackReference(trackReference) && (
-                  <AudioTrack
-                    trackRef={trackReference}
-                    onSubscriptionStatusChanged={handleSubscribe}
-                  />
-                )
-              )}
+              {trackMedia}
               <div className="lk-participant-placeholder">
                 <ParticipantPlaceholder
                   color={participantColor}
@@ -164,6 +196,7 @@ export const ParticipantTile: (
           {!disableMetadata && !disableTileControls && (
             <ParticipantTileFocus
               trackRef={trackReference}
+              tileRef={tileRef}
               hasKeyboardFocus={hasKeyboardFocus}
             />
           )}

src/frontend/src/features/participantTile/components/participantTileFocus/ParticipantTileFocus.tsx

@@ -7,38 +7,64 @@ import { useCanMute } from '@/features/rooms/livekit/hooks/useCanMute'
 import { FocusButton } from './FocusButton'
 import { EffectsButton } from './EffectsButton'
 import { MuteButton } from './MuteButton'
-import { ZoomButton } from './ZoomButton'
 
 const MOUSE_IDLE_TIME = 3000
 
 type FadeOverlayProps = {
   children: ReactNode
   hasKeyboardFocus: boolean
+  tileRef: React.RefObject<HTMLDivElement | null>
 }
 
-const FadeOverlay = ({ children, hasKeyboardFocus }: FadeOverlayProps) => {
+// Pointer-events none so this overlay doesn't block the zoom surface below.
+// The tile node still gets the mouse events, so we listen on it directly
+// rather than lifting the state up: this keeps mouse moves from re-rendering
+// the tile and the video it contains.
+const FadeOverlay = ({
+  children,
+  hasKeyboardFocus,
+  tileRef,
+}: FadeOverlayProps) => {
   const [active, setActive] = useState(false)
   const idleTimerRef = useRef<number | null>(null)
 
-  const clearIdleTimer = () => {
-    if (idleTimerRef.current) window.clearTimeout(idleTimerRef.current)
-  }
+  useEffect(() => {
+    const tile = tileRef.current
+    if (!tile) return
 
-  const armIdleTimer = () => {
-    clearIdleTimer()
-    idleTimerRef.current = window.setTimeout(() => {
+    const clearIdleTimer = () => {
+      if (idleTimerRef.current) window.clearTimeout(idleTimerRef.current)
+      idleTimerRef.current = null
+    }
+
+    const handleActivity = () => {
+      setActive(true)
+      clearIdleTimer()
+      idleTimerRef.current = window.setTimeout(
+        () => setActive(false),
+        MOUSE_IDLE_TIME
+      )
+    }
+
+    const handleLeave = () => {
+      clearIdleTimer()
       setActive(false)
-    }, MOUSE_IDLE_TIME)
-  }
+    }
 
-  const handleActivity = () => {
-    setActive(true)
-    armIdleTimer()
-  }
+    tile.addEventListener('mouseenter', handleActivity)
+    tile.addEventListener('mousemove', handleActivity)
+    tile.addEventListener('mouseleave', handleLeave)
 
-  useEffect(() => clearIdleTimer, [])
+    return () => {
+      clearIdleTimer()
+      tile.removeEventListener('mouseenter', handleActivity)
+      tile.removeEventListener('mousemove', handleActivity)
+      tile.removeEventListener('mouseleave', handleLeave)
+    }
+  }, [tileRef])
 
   const isVisible = hasKeyboardFocus || active
+
   return (
     <div
       className={css({
@@ -50,15 +76,10 @@ const FadeOverlay = ({ children, hasKeyboardFocus }: FadeOverlayProps) => {
         alignItems: 'center',
         width: '100%',
         height: '100%',
+        pointerEvents: 'none',
       })}
       data-visible={isVisible || undefined}
       aria-hidden={!isVisible}
-      onMouseEnter={handleActivity}
-      onMouseMove={handleActivity}
-      onMouseLeave={() => {
-        clearIdleTimer()
-        setActive(false)
-      }}
     >
       {isVisible && children}
     </div>
@@ -67,9 +88,11 @@ const FadeOverlay = ({ children, hasKeyboardFocus }: FadeOverlayProps) => {
 
 export const ParticipantTileFocus = ({
   trackRef,
+  tileRef,
   hasKeyboardFocus,
 }: {
   trackRef: TrackReferenceOrPlaceholder
+  tileRef: React.RefObject<HTMLDivElement | null>
   hasKeyboardFocus: boolean
 }) => {
   const participant = trackRef.participant
@@ -78,7 +101,7 @@ export const ParticipantTileFocus = ({
   const canMute = useCanMute(participant)
 
   return (
-    <FadeOverlay hasKeyboardFocus={hasKeyboardFocus}>
+    <FadeOverlay hasKeyboardFocus={hasKeyboardFocus} tileRef={tileRef}>
       <div
         className={css({
           backgroundColor: 'primaryDark.50',
@@ -87,6 +110,7 @@ export const ParticipantTileFocus = ({
           display: 'flex',
           opacity: 0.6,
           animation: 'overlayIn 200ms linear 300ms backwards',
+          pointerEvents: 'auto',
           _hover: {
             opacity: 0.95,
           },
@@ -94,7 +118,7 @@ export const ParticipantTileFocus = ({
       >
         <HStack gap={0.5} padding={0.5}>
           <FocusButton trackRef={trackRef} />
-          {!isScreenShare ? (
+          {!isScreenShare && (
             <>
               {isLocal ? (
                 <EffectsButton />
@@ -102,8 +126,6 @@ export const ParticipantTileFocus = ({
                 canMute && <MuteButton participant={participant} />
               )}
             </>
-          ) : (
-            !isLocal && <ZoomButton trackRef={trackRef} />
           )}
         </HStack>
       </div>

src/frontend/src/features/participantTile/components/participantTileFocus/ZoomButton.tsx

@@ -1,32 +0,0 @@
-import { TrackReferenceOrPlaceholder } from '@livekit/components-core'
-import { useTranslation } from 'react-i18next'
-import { useFullScreen } from '@/features/rooms/livekit/hooks/useFullScreen'
-import { Button } from '@/primitives'
-import { RiFullscreenLine } from '@remixicon/react'
-
-export const ZoomButton = ({
-  trackRef,
-}: {
-  trackRef: TrackReferenceOrPlaceholder
-}) => {
-  const { t } = useTranslation('rooms', { keyPrefix: 'participantTileFocus' })
-  const { toggleFullScreen, isFullscreenAvailable } = useFullScreen({
-    trackRef,
-  })
-
-  if (!isFullscreenAvailable) {
-    return
-  }
-
-  return (
-    <Button
-      size="sm"
-      variant="primaryTextDark"
-      square
-      tooltip={t('fullScreen')}
-      onPress={() => toggleFullScreen()}
-    >
-      <RiFullscreenLine />
-    </Button>
-  )
-}

src/frontend/src/features/recording/hooks/useRecordingWaitingForTracks.ts

@@ -0,0 +1,29 @@
+import { useEffect, useState } from 'react'
+import { useTracks } from '@livekit/components-react'
+import { Track } from 'livekit-client'
+import { RecordingMode } from '@/features/recording'
+import { useRecordingStatuses } from './useRecordingStatuses'
+
+const STARTING_NOTIFICATION_DELAY = 15_000
+
+export const useRecordingWaitingForTracks = (mode: RecordingMode) => {
+  const { isStarting } = useRecordingStatuses(mode)
+  const tracks = useTracks(
+    mode === RecordingMode.Transcript ? [Track.Source.Microphone] : undefined,
+    { onlySubscribed: false }
+  )
+  const [delayElapsed, setDelayElapsed] = useState(false)
+
+  useEffect(() => {
+    setDelayElapsed(false)
+    if (!isStarting) return
+
+    const timeout = window.setTimeout(
+      () => setDelayElapsed(true),
+      STARTING_NOTIFICATION_DELAY
+    )
+    return () => window.clearTimeout(timeout)
+  }, [isStarting, mode])
+
+  return isStarting && delayElapsed && tracks.length === 0
+}