🔒️(agents) upgrade python to 3.14.10 to fix CVE-2026-109518

The python:3.14.8-slim base image ships apt 3.0.3, which is affected by
CVE-2026-109518.

.github/.trivyignore

@@ -21,3 +21,6 @@ CVE-2026-9538 exp:2026-12-05
 
 # libsqlite3-0 (fixed in sid 3.54.1-1; trixie marked no-dsa / minor)
 CVE-2026-119373 exp:2026-12-05
+
+# zlib (fixed in sid 1:1.3.dfsg+really1.3.2-4; trixie still vulnerable)
+CVE-2026-76844 exp:2026-12-05

CHANGELOG.md

@@ -22,11 +22,18 @@ and this project adheres to
 - ⬆️(backend) update python dependencies
 - ⬆️(agents) update python dependencies
 - ⬆️(summary) update python dependencies
+- 🔒️(backend) issue room access tokens via POST rooms/{id}/join/ only
+- 🔒️(frontend) send the display name in the join request body
+- 🔥(backend) drop is_administrable from unregistered room payloads
 
 ### Fixed
 
 - 🐛(frontend) show a page when the connection ends unexpectedly
 - 🐛(frontend) show the transcript mic hint when every mic is muted
+- 🐛(frontend) show join errors instead of silently waiting in the lobby
+- 🐛(frontend) send users who cannot enter directly back to the lobby
+- 🔒️(backend) refuse unregistered rooms whose slug is a UUID
+- 🔒️(agents) upgrade python to 3.14.10 to fix CVE-2026-109518
 
 ## [1.37.0] - 2026-11-01
 

UPGRADE.md

@@ -16,6 +16,35 @@ the following command inside your docker container:
 
 ## [Unreleased]
 
+
+### Room access tokens moved to POST /join/
+
+LiveKit access tokens are no longer returned when reading a room. They are henceforth issued by a dedicated `POST
+/api/v1.0/rooms/{id}/join/` endpoint, which receives the display name in its JSON body. Display names therefore no
+longer appear in URLs and token retrieval by logged-in users is now protected against CSRF.
+
+- `GET /api/v1.0/rooms/{id}/` no longer returns the `livekit` block, and neither do the list, create and update
+responses
+- The `username` field of `POST /api/v1.0/rooms/{id}/request-entry/` is now limited to 255 characters
+- When the caller may enter the room directly, the response contains the room data plus a `livekit` block
+- When the caller must go through the lobby, the response has no `livekit` block
+- Session-authenticated callers must send the CSRF token (`X-CSRFToken` header and `csrftoken` cookie)
+- Every join returning a `livekit` block mints a new token, valid for 6 hours, and anonymous callers get a new
+participant identity each time.
+- Joining again returns no `livekit` block to callers admitted through the lobby.
+- Unregistered rooms are always entered directly: joining one always returns a `livekit` block.
+- Unregistered rooms are no longer described with an `is_administrable` field,
+
+### Unregistered rooms can no longer be named after a UUID
+
+When `ALLOW_UNREGISTERED_ROOMS` is enabled, reading or joining a room whose identifier normalizes to an empty slug or to
+a UUID now returns a 404 instead of describing or letting callers join the unregistered room.
+
+This closes a lobby bypass since a registered LiveKit room is named after its room id. An identifier crafted to not
+parse as a UUID, yet to normalize to an existing room's id, matched no registered room and was treated as an
+unregistered one. The token minted for that unregistered room was valid for the registered room: anyone could join a
+trusted or restricted room without being admitted through the lobby.
+
 ## v1.37.0
 
 ### Crisp support chat replaced by the La Suite support form

src/agents/Dockerfile

@@ -1,4 +1,4 @@
-FROM python:3.14.8-slim AS base
+FROM python:3.14.10-slim AS base
 
 # Install system dependencies required by LiveKit, fetching packages over HTTPS only for Bureautix proxy
 RUN sed -i "s|^URIs: http://|URIs: https://|" /etc/apt/sources.list.d/debian.sources \

src/backend/core/api/serializers.py

@@ -27,9 +27,12 @@ from timezone_field.rest_framework import TimeZoneSerializerField
 
 from core import models, utils
 from core.api.exceptions import ensure_room_not_deleted
+from core.services.lobby import LobbyService
 
 logger = logging.getLogger(__name__)
 
+DISPLAY_NAME_MAX_LENGTH = 255
+
 
 class UserSerializer(serializers.ModelSerializer):
     """Serialize users."""
@@ -170,17 +173,18 @@ class RoomSerializer(serializers.ModelSerializer):
         return value
 
     def to_representation(self, instance):
-        """
-        Add users only for administrator users.
-        Add LiveKit credentials for public instance or related users/groups
-        """
+        """Add accesses only for administrator and owner users."""
         output = super().to_representation(instance)
         request = self.context.get("request")
 
         if not request:
             return output
 
-        role = instance.get_role(request.user)
+        if "role" in self.context:
+            role = self.context["role"]
+        else:
+            role = instance.get_role(request.user)
+
         is_admin_or_owner = models.RoleChoices.check_administrator_role(
             role
         ) or models.RoleChoices.check_owner_role(role)
@@ -193,26 +197,9 @@ class RoomSerializer(serializers.ModelSerializer):
             )
             output["accesses"] = access_serializer.data
 
-        should_access_room = (
-            (
-                instance.access_level == models.RoomAccessLevel.TRUSTED
-                and request.user.is_authenticated
-            )
-            or role is not None
-            or instance.is_public
-        )
-
-        if should_access_room:
-            room_id = f"{instance.id!s}"
-            username = request.query_params.get("username", None)
-            output["livekit"] = utils.generate_livekit_config(
-                room_id=room_id,
-                user=request.user,
-                username=username,
-                configuration=output["configuration"],
-                role=role,
-            )
-        else:
+        if not LobbyService.can_bypass_lobby(
+            room=instance, user=request.user, role=role
+        ):
             del output["pin_code"]
 
         return output
@@ -355,10 +342,23 @@ class StartRecordingSerializer(BaseValidationOnlySerializer):
         return value
 
 
+class JoinRoomSerializer(BaseValidationOnlySerializer):
+    """Validate the data sent to join a room."""
+
+    username = serializers.CharField(
+        required=False,
+        allow_blank=True,
+        allow_null=True,
+        max_length=DISPLAY_NAME_MAX_LENGTH,
+        help_text="Display name in the room. The default name is used when it "
+        "is missing, null or blank.",
+    )
+
+
 class RequestEntrySerializer(BaseValidationOnlySerializer):
     """Validate request entry data."""
 
-    username = serializers.CharField(required=True)
+    username = serializers.CharField(required=True, max_length=DISPLAY_NAME_MAX_LENGTH)
     participant_id = serializers.CharField(
         required=False, allow_null=True, max_length=128
     )
@@ -675,7 +675,9 @@ class RaiseHandSerializer(BaseValidationOnlySerializer):
 class RenameParticipantSerializer(BaseValidationOnlySerializer):
     """Serializer for renaming a participant in a room."""
 
-    name = serializers.CharField(min_length=1, max_length=255, allow_blank=False)
+    name = serializers.CharField(
+        min_length=1, max_length=DISPLAY_NAME_MAX_LENGTH, allow_blank=False
+    )
 
 
 class ExternalProcessEventSerializer(BaseValidationOnlySerializer):

src/backend/core/api/viewsets.py

@@ -309,35 +309,35 @@ class RoomViewSet(  # pylint: disable=too-many-public-methods
         ensure_room_not_deleted(obj)
         return obj
 
+    def _get_object_or_unregistered_slug(self):
+        """Return the requested room, or the slug of an unregistered room."""
+        try:
+            return self.get_object(), None
+        except Http404:
+            slug = slugify(self.kwargs["pk"])
+            if not settings.ALLOW_UNREGISTERED_ROOMS or not slug or utils.is_uuid(slug):
+                raise
+            return None, slug
+
+    @staticmethod
+    def _get_unregistered_room_data(slug):
+        """Describe an unregistered room, which only exists by its slug."""
+        return {
+            "id": None,
+            "slug": slug,
+            "access_level": RoomAccessLevel.PUBLIC,
+        }
+
     def retrieve(self, request, *args, **kwargs):
         """
         Allow unregistered rooms when activated.
-        For unregistered rooms we only return a null id and the livekit room and token.
+        LiveKit credentials are never returned: they are obtained by joining.
         """
-        try:
-            instance = self.get_object()
-        except Http404:
-            if not settings.ALLOW_UNREGISTERED_ROOMS:
-                raise
-            slug = slugify(self.kwargs["pk"])
-            username = request.query_params.get("username", None)
-            data = {
-                "id": None,
-                "slug": slug,
-                "is_administrable": False,
-                "access_level": RoomAccessLevel.PUBLIC,
-                "livekit": {
-                    "url": settings.LIVEKIT_CONFIGURATION["url"],
-                    "room": slug,
-                    "token": utils.generate_token(
-                        room=slug, user=request.user, username=username
-                    ),
-                },
-            }
-        else:
-            data = self.get_serializer(instance).data
+        room, slug = self._get_object_or_unregistered_slug()
+        if room is None:
+            return drf_response.Response(self._get_unregistered_room_data(slug))
 
-        return drf_response.Response(data)
+        return drf_response.Response(self.get_serializer(room).data)
 
     def list(self, request, *args, **kwargs):
         """Limit listed rooms to the ones related to the authenticated user."""
@@ -572,6 +572,55 @@ class RoomViewSet(  # pylint: disable=too-many-public-methods
             {"message": f"Recording stopped for room {room.slug}."}
         )
 
+    @decorators.action(
+        detail=True,
+        methods=["post"],
+        url_path="join",
+        permission_classes=[],
+    )
+    def join(self, request, pk=None):  # pylint: disable=unused-argument
+        """
+        Join a room, getting LiveKit credentials when allowed to enter directly.
+
+        The response contains the room with a livekit object holding the url,
+        room and token to connect with when the requester may enter without
+        going through the lobby. Otherwise, it has no livekit object and the
+        client should request entry through the lobby.
+
+        Unregistered rooms, when allowed, are always joined directly.
+        """
+
+        serializer = serializers.JoinRoomSerializer(data=request.data)
+        serializer.is_valid(raise_exception=True)
+        username = serializer.validated_data.get("username") or None
+
+        room, slug = self._get_object_or_unregistered_slug()
+        if room is None:
+            return drf_response.Response(
+                {
+                    **self._get_unregistered_room_data(slug),
+                    "livekit": utils.generate_livekit_config(
+                        room_id=slug, user=request.user, username=username
+                    ),
+                }
+            )
+
+        role = room.get_role(request.user)
+        data = self.get_serializer(
+            room, context={**self.get_serializer_context(), "role": role}
+        ).data
+
+        if LobbyService.can_bypass_lobby(room=room, user=request.user, role=role):
+            data["livekit"] = utils.generate_livekit_config(
+                room_id=str(room.id),
+                user=request.user,
+                username=username,
+                configuration=data["configuration"],
+                role=role,
+            )
+
+        return drf_response.Response(data)
+
     @decorators.action(
         detail=True,
         methods=["post"],

src/backend/core/tests/rooms/test_api_rooms_create.py

@@ -66,6 +66,8 @@ def test_api_rooms_create_authenticated(reset_cache):
     assert room.name == "my room"
     assert room.slug == "my-room"
     assert room.accesses.filter(role="owner", user=user).exists() is True
+    assert "livekit" not in response.json()
+    assert response.json()["pin_code"] == room.pin_code
 
     rooms_data = cache.keys("room-creation-callback_*")
     assert not rooms_data
@@ -495,3 +497,4 @@ def test_api_rooms_create_authenticated_with_user_access_token():
     assert response.status_code == 201
     room = Room.objects.get()
     assert room.accesses.filter(role="owner", user=user).exists()
+    assert "livekit" not in response.json()

src/backend/core/tests/rooms/test_api_rooms_join.py

@@ -0,0 +1,580 @@
+"""
+Test rooms API endpoints in the Meet core app: join.
+"""
+
+# pylint: disable=redefined-outer-name
+
+from unittest import mock
+
+from django.conf import settings
+from django.contrib.auth.models import AnonymousUser
+from django.utils.crypto import get_random_string
+
+import jwt
+import pytest
+from faker import Faker
+from rest_framework.test import APIClient
+
+from ...factories import (
+    RoomFactory,
+    UserFactory,
+    UserResourceAccessFactory,
+)
+from ...models import RoleChoices, RoomAccessLevel
+from ..utils import generate_user_access_token
+
+fake = Faker()
+pytestmark = pytest.mark.django_db
+
+livekit_token = fake.sha256()
+
+ANONYMOUS = "anonymous"
+NO_ROLE = "no-role"
+
+# Who may join a room directly, without going through the lobby
+# room.get_role(user) returns None both for an anonymous user and for an
+# authenticated user without access, hence the NO_ROLE
+ACCESS_MATRIX = [
+    (RoomAccessLevel.PUBLIC, ANONYMOUS, True),
+    (RoomAccessLevel.TRUSTED, ANONYMOUS, False),
+    (RoomAccessLevel.RESTRICTED, ANONYMOUS, False),
+    (RoomAccessLevel.PUBLIC, NO_ROLE, True),
+    (RoomAccessLevel.TRUSTED, NO_ROLE, True),
+    (RoomAccessLevel.RESTRICTED, NO_ROLE, False),
+    *[
+        (access_level, role, True)
+        for access_level in RoomAccessLevel
+        for role in RoleChoices
+    ],
+]
+
+
+def decode_token(token):
+    """Decode a LiveKit access token for inspection."""
+    return jwt.decode(
+        token,
+        settings.LIVEKIT_CONFIGURATION["api_secret"],
+        algorithms=["HS256"],
+    )
+
+
+def join_url(room_id):
+    """Return the url to join a room."""
+    return f"/api/v1.0/rooms/{room_id!s}/join/"
+
+
+@pytest.mark.parametrize(
+    ("access_level", "requester", "can_join_directly"), ACCESS_MATRIX
+)
+@mock.patch("core.utils.generate_token", return_value=livekit_token)
+def test_api_rooms_join_access(mock_token, access_level, requester, can_join_directly):
+    """
+    Joining a room should return LiveKit credentials and the pin code only to
+    users who may enter without going through the lobby, and the accesses
+    only to the room's administrators and owners.
+    """
+    room = RoomFactory(
+        access_level=access_level,
+        configuration={"can_publish_sources": ["camera"]},
+    )
+    client = APIClient()
+    user = AnonymousUser()
+    username = fake.user_name()
+
+    role = None
+    if requester != ANONYMOUS:
+        user = UserFactory()
+        client.force_login(user)
+        if requester != NO_ROLE:
+            role = requester
+            UserResourceAccessFactory(resource=room, user=user, role=role)
+
+    response = client.post(join_url(room.id), {"username": username}, format="json")
+
+    assert response.status_code == 200
+    content = response.json()
+
+    accesses = content.pop("accesses", None)
+
+    if role in (RoleChoices.ADMIN, RoleChoices.OWNER):
+        assert {access["id"] for access in accesses} == {
+            str(access.id) for access in room.accesses.all()
+        }
+    else:
+        assert accesses is None
+
+    expected = {
+        "id": str(room.id),
+        "name": room.name,
+        "slug": room.slug,
+        "configuration": {"can_publish_sources": ["camera"]},
+        "access_level": str(access_level),
+    }
+    if can_join_directly:
+        expected["pin_code"] = room.pin_code
+        expected["livekit"] = {
+            "url": settings.LIVEKIT_CONFIGURATION["url"],
+            "room": str(room.id),
+            "token": livekit_token,
+        }
+    assert content == expected
+
+    if can_join_directly:
+        mock_token.assert_called_once_with(
+            room=str(room.id),
+            user=user,
+            username=username,
+            color=None,
+            sources=["camera"],
+            role=role,
+            participant_id=None,
+        )
+    else:
+        mock_token.assert_not_called()
+
+
+@mock.patch("core.utils.generate_token", return_value=livekit_token)
+def test_api_rooms_join_by_slug(mock_token):
+    """It should be possible to join a room by its slug, not normalized."""
+    room = RoomFactory(name="Réunion", access_level=RoomAccessLevel.PUBLIC)
+
+    response = APIClient().post(join_url("Réunion"), {}, format="json")
+
+    assert response.status_code == 200
+    assert response.json()["id"] == str(room.id)
+    assert response.json()["livekit"]["room"] == str(room.id)
+    mock_token.assert_called_once()
+
+
+@mock.patch("core.utils.generate_token", return_value=livekit_token)
+def test_api_rooms_join_members_num_queries(mock_token, django_assert_num_queries):
+    """The role of the requester should only be looked up once."""
+    user = UserFactory()
+    room = RoomFactory(access_level=RoomAccessLevel.RESTRICTED)
+    UserResourceAccessFactory(resource=room, user=user, role=RoleChoices.MEMBER)
+    client = APIClient()
+    client.force_login(user)
+
+    with django_assert_num_queries(3):
+        response = client.post(join_url(room.id), {}, format="json")
+
+    assert response.status_code == 200
+    assert "livekit" in response.json()
+    assert mock_token.call_args.kwargs["role"] == RoleChoices.MEMBER
+
+
+@pytest.mark.parametrize("role", [RoleChoices.ADMIN, RoleChoices.OWNER])
+@mock.patch("core.utils.generate_token", return_value=livekit_token)
+def test_api_rooms_join_administrators_num_queries(
+    mock_token, role, django_assert_num_queries
+):
+    """Only the accesses should be queried on top of the role for administrators."""
+    user = UserFactory()
+    room = RoomFactory(access_level=RoomAccessLevel.RESTRICTED)
+    UserResourceAccessFactory(resource=room, user=user, role=role)
+    client = APIClient()
+    client.force_login(user)
+
+    with django_assert_num_queries(4):
+        response = client.post(join_url(room.id), {}, format="json")
+
+    assert response.status_code == 200
+    assert "livekit" in response.json()
+    assert "accesses" in response.json()
+    assert mock_token.call_args.kwargs["role"] == role
+
+
+def test_api_rooms_join_get_not_allowed():
+    """Joining a room should only be possible with a POST request."""
+    room = RoomFactory(access_level=RoomAccessLevel.PUBLIC)
+
+    response = APIClient().get(join_url(room.id))
+
+    assert response.status_code == 405
+
+
+@pytest.mark.parametrize("authenticated", [False, True])
+@mock.patch("core.utils.generate_token", return_value=livekit_token)
+def test_api_rooms_join_unregistered_allowed(mock_token, authenticated, settings):
+    """
+    Joining an unregistered room should return LiveKit credentials for the
+    room named after the slug, when unregistered rooms are allowed.
+    """
+    settings.ALLOW_UNREGISTERED_ROOMS = True
+    client = APIClient()
+    user = AnonymousUser()
+    username = fake.user_name()
+    if authenticated:
+        user = UserFactory()
+        client.force_login(user)
+
+    response = client.post(
+        join_url("unregistered-room"), {"username": username}, format="json"
+    )
+
+    assert response.status_code == 200
+    assert response.json() == {
+        "id": None,
+        "slug": "unregistered-room",
+        "access_level": "public",
+        "livekit": {
+            "url": settings.LIVEKIT_CONFIGURATION["url"],
+            "room": "unregistered-room",
+            "token": livekit_token,
+        },
+    }
+    mock_token.assert_called_once_with(
+        room="unregistered-room",
+        user=user,
+        username=username,
+        color=None,
+        sources=None,
+        role=None,
+        participant_id=None,
+    )
+
+
+@mock.patch("core.utils.generate_token", return_value=livekit_token)
+def test_api_rooms_join_unregistered_allowed_not_normalized(mock_token, settings):
+    """
+    Joining an unregistered room by a slug that is not normalized should use
+    the LiveKit room named after the url-safe slug.
+    """
+    settings.ALLOW_UNREGISTERED_ROOMS = True
+
+    response = APIClient().post(join_url("Réunion"), {}, format="json")
+
+    assert response.status_code == 200
+    assert response.json() == {
+        "id": None,
+        "slug": "reunion",
+        "access_level": "public",
+        "livekit": {
+            "url": settings.LIVEKIT_CONFIGURATION["url"],
+            "room": "reunion",
+            "token": livekit_token,
+        },
+    }
+    mock_token.assert_called_once_with(
+        room="reunion",
+        user=AnonymousUser(),
+        username=None,
+        color=None,
+        sources=None,
+        role=None,
+        participant_id=None,
+    )
+
+
+def test_api_rooms_join_unregistered_token_claims(settings):
+    """The token of an unregistered room should be scoped to it and carry the name."""
+    settings.ALLOW_UNREGISTERED_ROOMS = True
+    username = fake.user_name()
+
+    response = APIClient().post(
+        join_url("unregistered-room"), {"username": username}, format="json"
+    )
+
+    assert response.status_code == 200
+    claims = decode_token(response.json()["livekit"]["token"])
+    assert claims["name"] == username
+    assert claims["video"]["room"] == "unregistered-room"
+
+
+@mock.patch("core.utils.generate_token", return_value=livekit_token)
+def test_api_rooms_join_unregistered_not_allowed(mock_token, settings):
+    """
+    Joining an unregistered room should return a 404 if unregistered rooms
+    are not allowed.
+    """
+    settings.ALLOW_UNREGISTERED_ROOMS = False
+
+    response = APIClient().post(join_url("unregistered-room"), {}, format="json")
+
+    assert response.status_code == 404
+    assert response.json() == {"detail": "No Room matches the given query."}
+    mock_token.assert_not_called()
+
+
+@pytest.mark.parametrize("lookup", ["---", "!!!", "_"])
+@mock.patch("core.utils.generate_token", return_value=livekit_token)
+def test_api_rooms_join_unregistered_empty_slug(mock_token, lookup, settings):
+    """
+    Joining an unregistered room whose slug is empty once normalized should
+    return a 404 rather than credentials for a room with no name.
+    """
+    settings.ALLOW_UNREGISTERED_ROOMS = True
+
+    response = APIClient().post(join_url(lookup), {}, format="json")
+
+    assert response.status_code == 404
+    assert response.json() == {"detail": "No Room matches the given query."}
+    mock_token.assert_not_called()
+
+
+@pytest.mark.parametrize("template", ["{}!", "_{}", "{}~", "{}!!"])
+@pytest.mark.parametrize(
+    "access_level", [RoomAccessLevel.TRUSTED, RoomAccessLevel.RESTRICTED]
+)
+@mock.patch("core.utils.generate_token", return_value=livekit_token)
+def test_api_rooms_join_unregistered_uuid_slug(
+    mock_token, access_level, template, settings
+):
+    """
+    Joining an unregistered room whose slug is a UUID once normalized should
+    return a 404 rather than credentials for the registered room with that id.
+    """
+    settings.ALLOW_UNREGISTERED_ROOMS = True
+    room = RoomFactory(access_level=access_level)
+
+    response = APIClient().post(
+        join_url(template.format(str(room.id).upper())), {}, format="json"
+    )
+
+    assert response.status_code == 404
+    assert response.json() == {"detail": "No Room matches the given query."}
+    mock_token.assert_not_called()
+
+
+@pytest.mark.parametrize("allow_unregistered_rooms", [True, False])
+@pytest.mark.parametrize("lookup", ["id", "slug"])
+@mock.patch("core.utils.generate_token", return_value=livekit_token)
+def test_api_rooms_join_soft_deleted(
+    mock_token, lookup, allow_unregistered_rooms, settings
+):
+    """
+    Joining a soft-deleted room should return a 410, and never fall back
+    to an unregistered room with the same slug.
+    """
+    settings.ALLOW_UNREGISTERED_ROOMS = allow_unregistered_rooms
+    room = RoomFactory(access_level=RoomAccessLevel.PUBLIC)
+    room.soft_delete()
+
+    response = APIClient().post(join_url(getattr(room, lookup)), {}, format="json")
+
+    assert response.status_code == 410
+    assert response.json() == {"detail": "This room has been deleted."}
+    mock_token.assert_not_called()
+
+
+@pytest.mark.parametrize(
+    ("payload", "expected_username"),
+    [
+        ({"username": "Jean Bon"}, "Jean Bon"),
+        ({"username": "  Jean Bon  "}, "Jean Bon"),
+        ({"username": "x" * 255}, "x" * 255),
+        ({}, None),
+        ({"username": None}, None),
+        ({"username": ""}, None),
+        ({"username": "   "}, None),
+    ],
+)
+@mock.patch("core.utils.generate_token", return_value=livekit_token)
+def test_api_rooms_join_username(mock_token, payload, expected_username):
+    """
+    The trimmed display name should be passed on to the token, a missing or
+    blank one leaving the default name to the token generation.
+    """
+    room = RoomFactory(access_level=RoomAccessLevel.PUBLIC)
+
+    response = APIClient().post(join_url(room.id), payload, format="json")
+
+    assert response.status_code == 200
+    assert response.json()["livekit"]["token"] == livekit_token
+    assert mock_token.call_args.kwargs["username"] == expected_username
+
+
+@mock.patch("core.utils.generate_token", return_value=livekit_token)
+def test_api_rooms_join_username_too_long(mock_token):
+    """A display name exceeding 255 characters should be rejected."""
+    room = RoomFactory(access_level=RoomAccessLevel.PUBLIC)
+
+    response = APIClient().post(
+        join_url(room.id), {"username": "a" * 256}, format="json"
+    )
+
+    assert response.status_code == 400
+    assert response.json() == {
+        "username": ["Ensure this field has no more than 255 characters."]
+    }
+    mock_token.assert_not_called()
+
+
+@mock.patch("core.utils.generate_token", return_value=livekit_token)
+def test_api_rooms_join_username_in_query_string_ignored(mock_token):
+    """The display name should only be read from the request body."""
+    room = RoomFactory(access_level=RoomAccessLevel.PUBLIC)
+    username = fake.user_name()
+
+    response = APIClient().post(
+        f"{join_url(room.id)}?username={username}", {}, format="json"
+    )
+
+    assert response.status_code == 200
+    assert mock_token.call_args.kwargs["username"] is None
+
+
+def test_api_rooms_join_token_claims_anonymous():
+    """The token should carry the submitted display name and be scoped to the room."""
+    room = RoomFactory(access_level=RoomAccessLevel.PUBLIC)
+    username = fake.user_name()
+
+    response = APIClient().post(
+        join_url(room.id), {"username": username}, format="json"
+    )
+
+    assert response.status_code == 200
+    claims = decode_token(response.json()["livekit"]["token"])
+    assert claims["name"] == username
+    assert claims["video"]["room"] == str(room.id)
+    assert claims["video"]["roomAdmin"] is False
+
+
+def test_api_rooms_join_token_claims_anonymous_default_name():
+    """An anonymous user joining without a display name should get the default one."""
+    room = RoomFactory(access_level=RoomAccessLevel.PUBLIC)
+
+    response = APIClient().post(join_url(room.id), {"username": ""}, format="json")
+
+    assert response.status_code == 200
+    claims = decode_token(response.json()["livekit"]["token"])
+    assert claims["name"] == "Anonymous"
+
+
+def test_api_rooms_join_token_claims_owner():
+    """The token of an owner should carry the submitted name and the room admin grant."""
+    username = fake.user_name()
+    user = UserFactory(full_name=fake.name())
+    room = RoomFactory(access_level=RoomAccessLevel.RESTRICTED, users=[(user, "owner")])
+    client = APIClient()
+    client.force_login(user)
+
+    response = client.post(join_url(room.id), {"username": username}, format="json")
+
+    assert response.status_code == 200
+    claims = decode_token(response.json()["livekit"]["token"])
+    assert claims["name"] == username
+    assert claims["sub"] == str(user.sub)
+    assert claims["video"]["roomAdmin"] is True
+
+
+def test_api_rooms_join_display_name_edit_disabled(settings):
+    """
+    An authenticated user should keep their account's name when display name
+    edition is disabled, whatever name they submit.
+    """
+    settings.AUTHENTICATED_PARTICIPANTS_CAN_EDIT_DISPLAY_NAME = False
+    full_name = f"{fake.first_name()} {fake.last_name()}"
+    user = UserFactory(full_name=full_name)
+    room = RoomFactory(access_level=RoomAccessLevel.PUBLIC)
+    client = APIClient()
+    client.force_login(user)
+
+    response = client.post(join_url(room.id), {"username": "Impostor"}, format="json")
+
+    assert response.status_code == 200
+    claims = decode_token(response.json()["livekit"]["token"])
+    assert claims["name"] == full_name
+
+
+def test_api_rooms_join_display_name_edit_disabled_anonymous(settings):
+    """Anonymous users should still choose their display name when edition is disabled."""
+    settings.AUTHENTICATED_PARTICIPANTS_CAN_EDIT_DISPLAY_NAME = False
+    username = fake.user_name()
+    room = RoomFactory(access_level=RoomAccessLevel.PUBLIC)
+
+    response = APIClient().post(
+        join_url(room.id), {"username": username}, format="json"
+    )
+
+    assert response.status_code == 200
+    claims = decode_token(response.json()["livekit"]["token"])
+    assert claims["name"] == username
+
+
+def test_api_rooms_join_session_without_csrf_token():
+    """A session-authenticated request without a CSRF token should be rejected."""
+    user = UserFactory()
+    room = RoomFactory(access_level=RoomAccessLevel.PUBLIC)
+    client = APIClient(enforce_csrf_checks=True)
+    client.force_login(user)
+
+    response = client.post(join_url(room.id), {"username": "Jane"}, format="json")
+
+    assert response.status_code == 403
+    assert response.json()["detail"].startswith("CSRF Failed")
+
+
+def test_api_rooms_join_session_with_csrf_token():
+    """A session-authenticated request with a valid CSRF token should be accepted."""
+    user = UserFactory()
+    room = RoomFactory(access_level=RoomAccessLevel.PUBLIC)
+    client = APIClient(enforce_csrf_checks=True)
+    client.force_login(user)
+    csrf_secret = get_random_string(32)
+    client.cookies[settings.CSRF_COOKIE_NAME] = csrf_secret
+
+    response = client.post(
+        join_url(room.id),
+        {"username": "Jane"},
+        format="json",
+        HTTP_X_CSRFTOKEN=csrf_secret,
+    )
+
+    assert response.status_code == 200
+    assert "livekit" in response.json()
+
+
+def test_api_rooms_join_session_with_csrf_token_foreign_origin():
+    """A session-authenticated request from a foreign origin should be rejected."""
+    user = UserFactory()
+    room = RoomFactory(access_level=RoomAccessLevel.PUBLIC)
+    client = APIClient(enforce_csrf_checks=True)
+    client.force_login(user)
+    csrf_secret = get_random_string(32)
+    client.cookies[settings.CSRF_COOKIE_NAME] = csrf_secret
+
+    response = client.post(
+        join_url(room.id),
+        {"username": "Jane"},
+        format="json",
+        HTTP_X_CSRFTOKEN=csrf_secret,
+        HTTP_ORIGIN="https://evil.example",
+    )
+
+    assert response.status_code == 403
+    assert response.json()["detail"].startswith("CSRF Failed: Origin checking failed")
+
+
+def test_api_rooms_join_anonymous_without_csrf_token():
+    """
+    An anonymous request carries no ambient credential, so it should not be
+    subject to CSRF checks.
+    """
+    room = RoomFactory(access_level=RoomAccessLevel.PUBLIC)
+    client = APIClient(enforce_csrf_checks=True)
+
+    response = client.post(join_url(room.id), {"username": "Anonymous"}, format="json")
+
+    assert response.status_code == 200
+    assert "livekit" in response.json()
+
+
+def test_api_rooms_join_user_access_token_without_csrf_token():
+    """
+    A request authenticated with a user access token carries no ambient
+    credential, so it should not be subject to CSRF checks.
+    """
+    username = fake.user_name()
+    user = UserFactory()
+    room = RoomFactory(access_level=RoomAccessLevel.RESTRICTED, users=[(user, "owner")])
+    client = APIClient(enforce_csrf_checks=True)
+    client.credentials(HTTP_AUTHORIZATION=f"Bearer {generate_user_access_token(user)}")
+
+    response = client.post(join_url(room.id), {"username": username}, format="json")
+
+    assert response.status_code == 200
+    assert response.json()["pin_code"] == room.pin_code
+    assert "accesses" in response.json()
+    claims = decode_token(response.json()["livekit"]["token"])
+    assert claims["sub"] == str(user.sub)

src/backend/core/tests/rooms/test_api_rooms_list.py

@@ -61,6 +61,7 @@ def test_api_rooms_list_authenticated():
     }
     results_id = {result["id"] for result in results}
     assert expected_ids == results_id
+    assert all("livekit" not in result for result in results)
 
 
 @mock.patch.object(PageNumberPagination, "get_page_size", return_value=2)
@@ -172,3 +173,4 @@ def test_api_rooms_list_authenticated_with_user_access_token():
     assert response.status_code == 200
     assert response.data["count"] == 1
     assert response.data["results"][0]["id"] == str(room.id)
+    assert "livekit" not in response.data["results"][0]

src/backend/core/tests/rooms/test_api_rooms_lobby.py

@@ -2,7 +2,7 @@
 Test rooms API endpoints in the Meet core app: lobby functionality.
 """
 
-# pylint: disable=W0621,W0613,W0212
+# pylint: disable=W0621,W0613,W0212,too-many-lines
 import uuid
 from unittest import mock
 
@@ -360,6 +360,40 @@ def test_request_entry_invalid_data():
     assert response.status_code == 400
 
 
+def test_request_entry_username_too_long():
+    """Should return 400 for a username exceeding 255 characters."""
+    room = RoomFactory(access_level=RoomAccessLevel.RESTRICTED)
+    client = APIClient()
+
+    with mock.patch.object(utils, "notify_participants") as mock_notify:
+        response = client.post(
+            f"/api/v1.0/rooms/{room.id}/request-entry/",
+            {"username": "a" * 256},
+        )
+
+    assert response.status_code == 400
+    assert response.json() == {
+        "username": ["Ensure this field has no more than 255 characters."]
+    }
+    mock_notify.assert_not_called()
+    assert not LobbyService()._index_members(room.id)
+
+
+def test_request_entry_username_at_max_length():
+    """Should accept a username of exactly 255 characters."""
+    room = RoomFactory(access_level=RoomAccessLevel.RESTRICTED)
+    client = APIClient()
+
+    with mock.patch.object(utils, "notify_participants", return_value=None):
+        response = client.post(
+            f"/api/v1.0/rooms/{room.id}/request-entry/",
+            {"username": "a" * 255},
+        )
+
+    assert response.status_code == 200
+    assert response.json()["username"] == "a" * 255
+
+
 def test_request_entry_room_not_found():
     """Should return 404 for non-existent room."""
     client = APIClient()

src/backend/core/tests/rooms/test_api_rooms_rename_toggle.py

@@ -366,6 +366,22 @@ def test_rename_participant_name_too_long(room, token):
     assert "name" in response.data
 
 
+def test_rename_participant_name_at_max_length(mock_livekit_client, room, token):
+    """Test rename accepts a name of exactly 255 characters."""
+    client = APIClient()
+    url = reverse("rooms-rename", kwargs={"pk": room.id})
+    response = client.post(
+        url,
+        {"name": "a" * 255},
+        format="json",
+        HTTP_AUTHORIZATION=f"X-LiveKit-Token {token}",
+    )
+
+    assert response.status_code == status.HTTP_200_OK
+    call_kwargs = mock_livekit_client.room.update_participant.call_args
+    assert call_kwargs[0][0].name == "a" * 255
+
+
 def test_rename_participant_forbidden_without_token(room):
     """Test rename returns 403 when no LiveKit token is provided."""
     client = APIClient()

src/backend/core/tests/rooms/test_api_rooms_retrieve.py

@@ -1,11 +1,8 @@
-"""
-Test rooms API endpoints in the Meet core app: retrieve.
-"""
+"""Test rooms API endpoints in the Meet core app: retrieve."""
 
 import random
 from unittest import mock
 
-from django.contrib.auth.models import AnonymousUser
 from django.test.utils import override_settings
 from django.utils import timezone as dj_timezone
 
@@ -112,18 +109,11 @@ def test_api_rooms_retrieve_anonymous_private_slug_not_normalized():
 
 
 @override_settings(ALLOW_UNREGISTERED_ROOMS=True)
-@override_settings(
-    LIVEKIT_CONFIGURATION={
-        "api_key": "key",
-        "api_secret": "secret",
-        "url": "test_url_value",
-    }
-)
 @mock.patch("core.utils.generate_token", return_value="foo")
 def test_api_rooms_retrieve_anonymous_unregistered_allowed(mock_token):
     """
-    Retrieving an unregistered room should return a Livekit token
-    if unregistered rooms are allowed.
+    Retrieving an unregistered room should describe it if unregistered rooms
+    are allowed, without any LiveKit token: those are obtained by joining.
     """
     client = APIClient()
     response = client.get("/api/v1.0/rooms/unregistered-room/")
@@ -133,32 +123,17 @@ def test_api_rooms_retrieve_anonymous_unregistered_allowed(mock_token):
         "id": None,
         "slug": "unregistered-room",
         "access_level": "public",
-        "is_administrable": False,
-        "livekit": {
-            "url": "test_url_value",
-            "room": "unregistered-room",
-            "token": "foo",
-        },
     }
 
-    mock_token.assert_called_once_with(
-        room="unregistered-room", user=AnonymousUser(), username=None
-    )
+    mock_token.assert_not_called()
 
 
 @override_settings(ALLOW_UNREGISTERED_ROOMS=True)
-@override_settings(
-    LIVEKIT_CONFIGURATION={
-        "api_key": "key",
-        "api_secret": "secret",
-        "url": "test_url_value",
-    }
-)
 @mock.patch("core.utils.generate_token", return_value="foo")
 def test_api_rooms_retrieve_anonymous_unregistered_allowed_not_normalized(mock_token):
     """
     Getting an unregistered room by a slug that is not normalized should work
-    and use the Livekit room on the url-safe name.
+    and return the url-safe slug.
     """
     client = APIClient()
     response = client.get("/api/v1.0/rooms/Réunion/")
@@ -168,17 +143,9 @@ def test_api_rooms_retrieve_anonymous_unregistered_allowed_not_normalized(mock_t
         "id": None,
         "slug": "reunion",
         "access_level": "public",
-        "is_administrable": False,
-        "livekit": {
-            "url": "test_url_value",
-            "room": "reunion",
-            "token": "foo",
-        },
     }
 
-    mock_token.assert_called_once_with(
-        room="reunion", user=AnonymousUser(), username=None
-    )
+    mock_token.assert_not_called()
 
 
 @override_settings(ALLOW_UNREGISTERED_ROOMS=False)
@@ -193,6 +160,36 @@ def test_api_rooms_retrieve_anonymous_unregistered_not_allowed():
     assert response.json() == {"detail": "No Room matches the given query."}
 
 
+@override_settings(ALLOW_UNREGISTERED_ROOMS=True)
+@pytest.mark.parametrize("lookup", ["---", "!!!", "_"])
+def test_api_rooms_retrieve_anonymous_unregistered_empty_slug(lookup):
+    """
+    Retrieving an unregistered room whose slug is empty once normalized should
+    return a 404.
+    """
+    client = APIClient()
+    response = client.get(f"/api/v1.0/rooms/{lookup}/")
+
+    assert response.status_code == 404
+    assert response.json() == {"detail": "No Room matches the given query."}
+
+
+@override_settings(ALLOW_UNREGISTERED_ROOMS=True)
+@pytest.mark.parametrize("template", ["{}!", "_{}", "{}~"])
+def test_api_rooms_retrieve_anonymous_unregistered_uuid_slug(template):
+    """
+    Retrieving an unregistered room whose slug is a UUID once normalized should
+    return a 404.
+    """
+    room = RoomFactory(access_level=RoomAccessLevel.RESTRICTED)
+
+    client = APIClient()
+    response = client.get(f"/api/v1.0/rooms/{template.format(room.id)}/")
+
+    assert response.status_code == 404
+    assert response.json() == {"detail": "No Room matches the given query."}
+
+
 @pytest.mark.parametrize("allow_unregistered_rooms", [True, False])
 @pytest.mark.parametrize("lookup", ["id", "slug"])
 @mock.patch("core.utils.generate_token", return_value="foo")
@@ -216,52 +213,33 @@ def test_api_rooms_retrieve_soft_deleted(
 
 
 @mock.patch("core.utils.generate_token", return_value="foo")
-@override_settings(
-    LIVEKIT_CONFIGURATION={
-        "api_key": "key",
-        "api_secret": "secret",
-        "url": "test_url_value",
-    }
-)
 def test_api_rooms_retrieve_anonymous_public(mock_token):
     """
-    Anonymous users should be able to retrieve a room with a token provided, if the room is public.
+    Anonymous users should be able to retrieve a public room with its pin code,
+    but should not be given any token: those are obtained by joining.
     """
     room = RoomFactory(access_level=RoomAccessLevel.PUBLIC)
     client = APIClient()
     response = client.get(f"/api/v1.0/rooms/{room.id!s}/")
 
     assert response.status_code == 200
-    expected_name = f"{room.id!s}"
     assert response.json() == {
         "configuration": {},
         "access_level": str(room.access_level),
         "id": str(room.id),
-        "livekit": {
-            "url": "test_url_value",
-            "room": expected_name,
-            "token": "foo",
-        },
         "name": room.name,
         "pin_code": room.pin_code,
         "slug": room.slug,
     }
 
-    mock_token.assert_called_once()
+    mock_token.assert_not_called()
 
 
 @mock.patch("core.utils.generate_token", return_value="foo")
-@override_settings(
-    LIVEKIT_CONFIGURATION={
-        "api_key": "key",
-        "api_secret": "secret",
-        "url": "test_url_value",
-    }
-)
 def test_api_rooms_retrieve_authenticated_public(mock_token):
     """
-    Authenticated users should be allowed to retrieve a room and get a token for a room to
-    which they are not related, provided the room is public.
+    Authenticated users should be allowed to retrieve a public room to which
+    they are not related, with its pin code but without any token.
     They should not see related users.
     """
     room = RoomFactory(
@@ -278,44 +256,23 @@ def test_api_rooms_retrieve_authenticated_public(mock_token):
     )
     assert response.status_code == 200
 
-    expected_name = f"{room.id!s}"
     assert response.json() == {
         "configuration": {"can_publish_sources": ["camera"]},
         "access_level": str(room.access_level),
         "id": str(room.id),
-        "livekit": {
-            "url": "test_url_value",
-            "room": expected_name,
-            "token": "foo",
-        },
         "name": room.name,
         "pin_code": room.pin_code,
         "slug": room.slug,
     }
 
-    mock_token.assert_called_once_with(
-        room=expected_name,
-        user=user,
-        username=None,
-        color=None,
-        sources=["camera"],
-        role=None,
-        participant_id=None,
-    )
+    mock_token.assert_not_called()
 
 
 @mock.patch("core.utils.generate_token", return_value="foo")
-@override_settings(
-    LIVEKIT_CONFIGURATION={
-        "api_key": "key",
-        "api_secret": "secret",
-        "url": "test_url_value",
-    }
-)
 def test_api_rooms_retrieve_authenticated_trusted(mock_token):
     """
-    Authenticated users should be allowed to retrieve a room and get a token for a room to
-    which they are not related, provided the room has a trusted access_level.
+    Authenticated users should be allowed to retrieve a trusted room to which
+    they are not related, with its pin code but without any token.
     They should not see related users.
     """
     room = RoomFactory(access_level=RoomAccessLevel.TRUSTED)
@@ -329,30 +286,16 @@ def test_api_rooms_retrieve_authenticated_trusted(mock_token):
     )
     assert response.status_code == 200
 
-    expected_name = f"{room.id!s}"
     assert response.json() == {
         "configuration": {},
         "access_level": str(room.access_level),
         "id": str(room.id),
-        "livekit": {
-            "url": "test_url_value",
-            "room": expected_name,
-            "token": "foo",
-        },
         "name": room.name,
         "pin_code": room.pin_code,
         "slug": room.slug,
     }
 
-    mock_token.assert_called_once_with(
-        room=expected_name,
-        user=user,
-        username=None,
-        color=None,
-        sources=None,
-        role=None,
-        participant_id=None,
-    )
+    mock_token.assert_not_called()
 
 
 def test_api_rooms_retrieve_authenticated():
@@ -381,13 +324,6 @@ def test_api_rooms_retrieve_authenticated():
 
 
 @mock.patch("core.utils.generate_token", return_value="foo")
-@override_settings(
-    LIVEKIT_CONFIGURATION={
-        "api_key": "key",
-        "api_secret": "secret",
-        "url": "test_url_value",
-    }
-)
 def test_api_rooms_retrieve_members(mock_token, django_assert_num_queries, settings):
     """
     Users who are members of a room should not be allowed to see related users.
@@ -415,40 +351,19 @@ def test_api_rooms_retrieve_members(mock_token, django_assert_num_queries, setti
 
     assert "accesses" not in content_dict
 
-    expected_name = str(room.id)
     assert content_dict == {
         "configuration": {"can_publish_sources": ["camera"]},
         "access_level": str(room.access_level),
         "id": str(room.id),
-        "livekit": {
-            "url": "test_url_value",
-            "room": expected_name,
-            "token": "foo",
-        },
         "name": room.name,
         "pin_code": room.pin_code,
         "slug": room.slug,
     }
 
-    mock_token.assert_called_once_with(
-        room=expected_name,
-        user=user,
-        username=None,
-        color=None,
-        sources=["camera"],
-        role=str(RoleChoices.MEMBER),
-        participant_id=None,
-    )
+    mock_token.assert_not_called()
 
 
 @mock.patch("core.utils.generate_token", return_value="foo")
-@override_settings(
-    LIVEKIT_CONFIGURATION={
-        "api_key": "key",
-        "api_secret": "secret",
-        "url": "test_url_value",
-    }
-)
 def test_api_rooms_retrieve_administrators(
     mock_token, django_assert_num_queries, settings
 ):
@@ -511,30 +426,16 @@ def test_api_rooms_retrieve_administrators(
         ],
         key=lambda x: x["id"],
     )
-    expected_name = str(room.id)
     assert content_dict == {
         "access_level": str(room.access_level),
         "id": str(room.id),
         "configuration": {},
-        "livekit": {
-            "url": "test_url_value",
-            "room": expected_name,
-            "token": "foo",
-        },
         "name": room.name,
         "pin_code": room.pin_code,
         "slug": room.slug,
     }
 
-    mock_token.assert_called_once_with(
-        room=expected_name,
-        user=user,
-        username=None,
-        color=None,
-        sources=None,
-        role=str(user_access.role),
-        participant_id=None,
-    )
+    mock_token.assert_not_called()
 
 
 @pytest.mark.parametrize("access_level", RoomAccessLevel)
@@ -567,3 +468,77 @@ def test_api_rooms_retrieve_authenticated_with_user_access_token():
     assert response.data["id"] == str(room.id)
     assert response.data["pin_code"] == room.pin_code
     assert "accesses" in response.data
+    assert "livekit" not in response.data
+
+
+@pytest.mark.parametrize("access_level", RoomAccessLevel)
+@pytest.mark.parametrize("role", [None, *RoleChoices])
+@mock.patch("core.utils.generate_token", return_value="foo")
+def test_api_rooms_retrieve_never_returns_livekit_credentials(
+    mock_token, role, access_level
+):
+    """Retrieving a room should never mint a LiveKit token."""
+    room = RoomFactory(access_level=access_level)
+    user = UserFactory()
+    if role is not None:
+        UserResourceAccessFactory(resource=room, user=user, role=role)
+    client = APIClient()
+    client.force_login(user)
+
+    response = client.get(f"/api/v1.0/rooms/{room.id!s}/")
+
+    assert response.status_code == 200
+    assert "livekit" not in response.json()
+    mock_token.assert_not_called()
+
+
+@pytest.mark.parametrize("access_level", RoomAccessLevel)
+@mock.patch("core.utils.generate_token", return_value="foo")
+def test_api_rooms_retrieve_anonymous_never_returns_livekit_credentials(
+    mock_token, access_level
+):
+    """An anonymous user should never get a LiveKit token by retrieving a room."""
+    room = RoomFactory(access_level=access_level)
+
+    response = APIClient().get(f"/api/v1.0/rooms/{room.id!s}/")
+
+    assert response.status_code == 200
+    assert "livekit" not in response.json()
+    mock_token.assert_not_called()
+
+
+@pytest.mark.parametrize(
+    ("access_level", "authenticated", "role", "pin_code_exposed"),
+    [
+        (RoomAccessLevel.PUBLIC, False, None, True),
+        (RoomAccessLevel.TRUSTED, False, None, False),
+        (RoomAccessLevel.RESTRICTED, False, None, False),
+        (RoomAccessLevel.PUBLIC, True, None, True),
+        (RoomAccessLevel.TRUSTED, True, None, True),
+        (RoomAccessLevel.RESTRICTED, True, None, False),
+        (RoomAccessLevel.RESTRICTED, True, RoleChoices.MEMBER, True),
+        (RoomAccessLevel.RESTRICTED, True, RoleChoices.ADMIN, True),
+        (RoomAccessLevel.RESTRICTED, True, RoleChoices.OWNER, True),
+    ],
+)
+def test_api_rooms_retrieve_pin_code_exposure(
+    access_level, authenticated, role, pin_code_exposed
+):
+    """
+    The pin code should only be exposed to users who may join the room
+    without going through the lobby.
+    """
+    room = RoomFactory(access_level=access_level)
+    client = APIClient()
+    if authenticated:
+        user = UserFactory()
+        if role is not None:
+            UserResourceAccessFactory(resource=room, user=user, role=role)
+        client.force_login(user)
+
+    response = client.get(f"/api/v1.0/rooms/{room.id!s}/")
+
+    assert response.status_code == 200
+    assert ("pin_code" in response.json()) is pin_code_exposed
+    if pin_code_exposed:
+        assert response.json()["pin_code"] == room.pin_code

src/backend/core/tests/rooms/test_api_rooms_update.py

@@ -113,6 +113,7 @@ def test_api_rooms_update_administrators(mock_update_metadata):
         format="json",
     )
     assert response.status_code == 200
+    assert "livekit" not in response.json()
     room.refresh_from_db()
     assert room.name == "New name"
     assert room.slug == "new-name"
@@ -467,6 +468,7 @@ def test_api_rooms_update_authenticated_with_user_access_token(privileged_role):
     room.accesses.filter(user=user).update(role=privileged_role)
     response = client.patch(f"/api/v1.0/rooms/{room.id!s}/", {"name": "new name"})
     assert response.status_code == 200
+    assert "livekit" not in response.json()
     room.refresh_from_db()
     assert room.name == "new name"
 

src/backend/core/tests/test_utils_is_uuid.py

@@ -0,0 +1,38 @@
+"""
+Test utils.is_uuid
+"""
+
+import pytest
+from faker import Faker
+
+from core import utils
+
+fake = Faker()
+
+UUID = fake.uuid4()
+
+
+@pytest.mark.parametrize(
+    "value",
+    [
+        UUID,
+        UUID.upper(),
+        UUID.replace("-", ""),
+        f"{{{UUID}}}",
+        f"urn:uuid:{UUID}",
+    ],
+    ids=["canonical", "uppercase", "hex", "braces", "urn"],
+)
+def test_utils_is_uuid_true(value):
+    """Strings that parse as a UUID should be recognized."""
+    assert utils.is_uuid(value) is True
+
+
+@pytest.mark.parametrize(
+    "value",
+    ["", "my-room", "abc-defg-hij", f"{UUID}!", f"_{UUID}", UUID[:-1]],
+    ids=["empty", "slug", "room-slug", "suffix", "prefix", "truncated"],
+)
+def test_utils_is_uuid_false(value):
+    """Strings that do not parse as a UUID should not be recognized."""
+    assert utils.is_uuid(value) is False

src/backend/core/utils.py

@@ -16,7 +16,7 @@ import string
 from datetime import timedelta
 from functools import lru_cache
 from typing import List, Optional
-from uuid import uuid4
+from uuid import UUID, uuid4
 
 from django.conf import settings
 from django.core.files.storage import default_storage
@@ -336,6 +336,15 @@ def generate_room_slug():
     return "-".join(parts)
 
 
+def is_uuid(value: str) -> bool:
+    """Tell whether a value parses as a UUID."""
+    try:
+        UUID(value)
+    except ValueError:
+        return False
+    return True
+
+
 def detect_mimetype(file_buffer: bytes, filename: str | None = None) -> str:
     """
     Detect MIME type using multiple methods for better accuracy.

src/frontend/src/features/home/components/CreateMeetingMenu.tsx

@@ -9,12 +9,8 @@ import { useState } from 'react'
 
 import { menuRecipe } from '@/primitives/menuRecipe'
 import { ApiRoom } from '@/features/rooms/api/ApiRoom'
-import { useSnapshot } from 'valtio'
-import { userStore } from '@/stores/user'
 
 export const CreateMeetingMenu = () => {
-  const { username } = useSnapshot(userStore)
-
   const { t } = useTranslation('home')
   const { mutateAsync: createRoom } = useCreateRoom()
   const [laterRoom, setLaterRoom] = useState<null | ApiRoom>(null)
@@ -30,9 +26,9 @@ export const CreateMeetingMenu = () => {
             className={menuRecipe({ icon: true, variant: 'light' }).item}
             onAction={() => {
               const slug = generateRoomId()
-              createRoom({ slug, username }).then((data) =>
+              createRoom({ slug }).then((data) =>
                 navigateTo('room', data.slug, {
-                  state: { create: true, initialRoomData: data },
+                  state: { create: true },
                 })
               )
             }}
@@ -45,7 +41,7 @@ export const CreateMeetingMenu = () => {
             className={menuRecipe({ icon: true, variant: 'light' }).item}
             onAction={() => {
               const slug = generateRoomId()
-              createRoom({ slug, username }).then(setLaterRoom)
+              createRoom({ slug }).then(setLaterRoom)
             }}
             data-attr="create-option-later"
           >

src/frontend/src/features/rooms/api/ApiRoom.ts

@@ -31,7 +31,6 @@ export type ApiRoom = {
   name: string
   slug: string
   pin_code?: string
-  is_administrable: boolean
   access_level: ApiAccessLevel
   livekit?: ApiLiveKit
   configuration?: RoomConfiguration

src/frontend/src/features/rooms/api/createRoom.ts

@@ -6,15 +6,13 @@ import type { ApiRoom } from './ApiRoom'
 export interface CreateRoomParams {
   slug: string
   callbackId?: string
-  username?: string
 }
 
 const createRoom = ({
   slug,
   callbackId,
-  username = '',
 }: CreateRoomParams): Promise<ApiRoom> => {
-  return fetchApi(`rooms/?username=${encodeURIComponent(username)}`, {
+  return fetchApi('rooms/', {
     method: 'POST',
     body: JSON.stringify({
       name: slug,

src/frontend/src/features/rooms/api/fetchRoom.ts

@@ -1,14 +1,6 @@
 import { type ApiRoom } from './ApiRoom'
 import { fetchApi } from '@/api/fetchApi'
 
-export const fetchRoom = ({
-  roomId,
-  username,
-}: {
-  roomId: string
-  username?: string
-}) => {
-  const query = username ? `?username=${encodeURIComponent(username)}` : ''
-
-  return fetchApi<ApiRoom>(`/rooms/${roomId}/${query}`)
+export const fetchRoom = ({ roomId }: { roomId: string }) => {
+  return fetchApi<ApiRoom>(`/rooms/${roomId}/`)
 }

src/frontend/src/features/rooms/api/joinRoom.ts

@@ -0,0 +1,14 @@
+import { type ApiRoom } from './ApiRoom'
+import { fetchApi } from '@/api/fetchApi'
+
+export type JoinRoomParams = {
+  roomId: string
+  username?: string
+}
+
+export const joinRoom = ({ roomId, username }: JoinRoomParams) => {
+  return fetchApi<ApiRoom>(`/rooms/${roomId}/join/`, {
+    method: 'POST',
+    body: JSON.stringify({ username }),
+  })
+}

src/frontend/src/features/rooms/components/Conference.tsx

@@ -1,4 +1,4 @@
-import { useEffect, useMemo, useRef, useState } from 'react'
+import { useCallback, useEffect, useMemo, useRef, useState } from 'react'
 import { useQuery } from '@tanstack/react-query'
 import { useTranslation } from 'react-i18next'
 import {
@@ -10,17 +10,16 @@ import {
   ConnectionErrorReason,
   DisconnectReason,
   MediaDeviceFailure,
+  type Room,
   type RoomOptions,
   VideoPresets,
 } from 'livekit-client'
 import { getMediaDeviceFailure } from '@/features/rooms/livekit/utils/mediaPermissions'
 import { keys } from '@/api/queryKeys'
-import { queryClient } from '@/api/queryClient'
 import { Screen } from '@/layout/Screen'
 import { QueryAware } from '@/components/QueryAware'
 import { ErrorScreen } from '@/components/ErrorScreen'
-import { fetchRoom } from '../api/fetchRoom'
-import type { ApiRoom } from '../api/ApiRoom'
+import { joinRoom } from '../api/joinRoom'
 import { useCreateRoom } from '../api/createRoom'
 import { InviteDialog } from './InviteDialog'
 import { VideoConference } from '../livekit/prefabs/VideoConference'
@@ -32,7 +31,7 @@ import {
   captureMediaEvent,
   reportError,
 } from '@/features/analytics/telemetry'
-import { useConfig } from '@/api/useConfig'
+import { type ApiConfig, useConfig } from '@/api/useConfig'
 import { isFireFox } from '@/utils/livekit'
 import { useIsMobile } from '@/utils/useIsMobile'
 import { navigateTo } from '@/navigation/navigateTo'
@@ -48,6 +47,13 @@ import { resolveAudioOutputDeviceId } from '@/features/rooms/utils/resolveAudioO
 import { ConnectionEndReason } from '@/features/rooms/utils/connectionEndReason'
 import { createLiveKitRoom } from '@/features/rooms/livekit/utils/reconnectPolicy'
 
+// Some clients (like DINUM) operate in bandwidth-constrained environments
+// These settings help ensure successful connections in poor network conditions
+const connectOptions = {
+  maxRetries: 5, // Default: 1. Only for unreachable server scenarios
+  peerConnectionTimeout: 60000, // Default: 15s. Extended for slow TURN/TLS negotiation
+}
+
 const handleError = (e: Error) => {
   const failure = getMediaDeviceFailure(e)
   if (failure && failure !== MediaDeviceFailure.Other) return
@@ -66,65 +72,111 @@ const handleError = (e: Error) => {
   })
 }
 
+/**
+ * Warm up connection to LiveKit server before joining room
+ * This prefetch helps reduce initial connection latency by establishing
+ * an early HTTP connection to the WebRTC signaling server
+ *
+ * It should cache DNS and TLS keys.
+ */
+const warmUpConnection = async (room: Room, livekit: ApiConfig['livekit']) => {
+  await room.prepareConnection(livekit.url)
+
+  if (isFireFox() && livekit.enable_firefox_proxy_workaround) {
+    try {
+      const wssUrl =
+        livekit.url.replace('https://', 'wss://').replace(/\/$/, '') + '/rtc'
+
+      /**
+       * FIREFOX + PROXY WORKAROUND:
+       *
+       * Issue: On Firefox behind proxy configurations, WebSocket signaling fails to establish.
+       * Symptom: Client receives HTTP 200 instead of expected 101 (Switching Protocols).
+       * Root Cause: Certificate/security issue where the initial request is considered insecure.
+       *
+       * Solution: Pre-establish a WebSocket connection to the signaling server, which fails.
+       * This "primes" the connection, allowing subsequent WebSocket establishments to work correctly.
+       *
+       * Note: This issue is reproducible on LiveKit's demo app.
+       * Reference: livekit-examples/meet/issues/466
+       */
+      const ws = new WebSocket(wssUrl)
+      // 401 unauthorized response is expected
+      ws.onerror = () => ws.readyState <= 1 && ws.close()
+    } catch (e) {
+      console.debug('Firefox WebSocket workaround failed.', e)
+    }
+  }
+}
+
+const getConnectionEndReason = (
+  reason: DisconnectReason | undefined,
+  hasConnected: boolean
+) => {
+  switch (reason) {
+    case DisconnectReason.CLIENT_INITIATED:
+      return undefined
+    case DisconnectReason.DUPLICATE_IDENTITY:
+    case DisconnectReason.PARTICIPANT_REMOVED:
+    case DisconnectReason.ROOM_DELETED:
+      return reason
+    default:
+      // Reconnecting gave up, or the join itself failed
+      return hasConnected
+        ? ConnectionEndReason.Lost
+        : ConnectionEndReason.Failed
+  }
+}
+
 export const Conference = ({
   roomId,
-  initialRoomData,
   mode = 'join',
+  onLobbyRequired,
 }: {
   roomId: string
   mode?: 'join' | 'create'
-  initialRoomData?: ApiRoom
+  onLobbyRequired: () => void
 }) => {
+  const { t } = useTranslation('rooms')
   const { data: apiConfig } = useConfig()
-
   const { userChoices: userConfig } = usePersistentUserChoices() as {
     userChoices: LocalUserChoices
   }
-
   const { username } = useSnapshot(userStore)
-
-  useEffect(() => {
-    void captureMediaEvent('visit-room', { slug: roomId })
-  }, [roomId])
-  const fetchKey = [keys.room, roomId]
-
-  const [isConnectionWarmedUp, setIsConnectionWarmedUp] = useState(false)
-
   const userPreferencesSnap = useSnapshot(userPreferencesStore)
+  const isMobile = useIsMobile()
 
-  const {
-    mutateAsync: createRoom,
-    status: createStatus,
-    isError: isCreateError,
-  } = useCreateRoom({
-    onSuccess: (data) => {
-      queryClient.setQueryData(fetchKey, data)
-    },
-  })
+  const [hasJoined, setHasJoined] = useState(false)
+  const [isConnectionWarmedUp, setIsConnectionWarmedUp] = useState(false)
+  const hasAutoMutedRef = useRef(false)
+  const hasConnectedRef = useRef(false)
 
+  const { mutateAsync: createRoom, isError: isCreateError } = useCreateRoom()
   const {
     status: fetchStatus,
-    isError: isFetchError,
     error: fetchError,
-    data,
+    data: createRoomData,
   } = useQuery({
-    queryKey: fetchKey,
+    queryKey: [keys.room, roomId],
     staleTime: 6 * 60 * 60 * 1000, // By default, LiveKit access tokens expire 6 hours after generation
-    initialData: initialRoomData,
     queryFn: () =>
-      fetchRoom({
-        roomId: roomId as string,
-        username: username,
-      }).catch((error) => {
-        if (error.statusCode == '404') {
-          createRoom({ slug: roomId, username })
-        }
-        // A deleted room can't be recreated, surface the error instead
-        if (error.statusCode == '410') throw error
+      joinRoom({ roomId, username }).catch(async (error) => {
+        if (error.statusCode != 404) throw error
+        await createRoom({ slug: roomId })
+        return joinRoom({ roomId, username })
       }),
     retry: false,
   })
 
+  const isLobbyRequired =
+    !!createRoomData && !createRoomData.livekit && !hasJoined
+  const status =
+    createRoomData?.livekit || hasJoined
+      ? 'success'
+      : isLobbyRequired
+        ? 'pending'
+        : fetchStatus
+
   const roomOptions = useMemo((): RoomOptions => {
     return {
       adaptiveStream: true,
@@ -155,62 +207,11 @@ export const Conference = ({
     apiConfig?.livekit.default_video_codec,
   ])
 
-  const reconnect = apiConfig?.livekit.reconnect
   const room = useMemo(
-    () => createLiveKitRoom(roomOptions, reconnect),
-    [roomOptions, reconnect]
+    () => createLiveKitRoom(roomOptions, apiConfig?.livekit.reconnect),
+    [roomOptions, apiConfig?.livekit.reconnect]
   )
 
-  useEffect(() => {
-    /**
-     * Warm up connection to LiveKit server before joining room
-     * This prefetch helps reduce initial connection latency by establishing
-     * an early HTTP connection to the WebRTC signaling server
-     *
-     * It should cache DNS and TLS keys.
-     */
-    const prepareConnection = async () => {
-      if (!apiConfig || isConnectionWarmedUp) return
-      await room.prepareConnection(apiConfig.livekit.url)
-
-      if (isFireFox() && apiConfig.livekit.enable_firefox_proxy_workaround) {
-        try {
-          const wssUrl =
-            apiConfig.livekit.url
-              .replace('https://', 'wss://')
-              .replace(/\/$/, '') + '/rtc'
-
-          /**
-           * FIREFOX + PROXY WORKAROUND:
-           *
-           * Issue: On Firefox behind proxy configurations, WebSocket signaling fails to establish.
-           * Symptom: Client receives HTTP 200 instead of expected 101 (Switching Protocols).
-           * Root Cause: Certificate/security issue where the initial request is considered insecure.
-           *
-           * Solution: Pre-establish a WebSocket connection to the signaling server, which fails.
-           * This "primes" the connection, allowing subsequent WebSocket establishments to work correctly.
-           *
-           * Note: This issue is reproducible on LiveKit's demo app.
-           * Reference: livekit-examples/meet/issues/466
-           */
-          const ws = new WebSocket(wssUrl)
-          // 401 unauthorized response is expected
-          ws.onerror = () => ws.readyState <= 1 && ws.close()
-        } catch (e) {
-          console.debug('Firefox WebSocket workaround failed.', e)
-        }
-      }
-
-      setIsConnectionWarmedUp(true)
-    }
-    prepareConnection()
-  }, [room, apiConfig, isConnectionWarmedUp])
-
-  const isMobile = useIsMobile()
-
-  const hasAutoMutedRef = useRef(false)
-  const hasConnectedRef = useRef(false)
-
   /*
    * Ensure stable WebSocket connection URL. This is critical for legacy browser compatibility
    * (Firefox <124, Chrome <125, Edge <125) where HTTPS URLs in WebSocket() constructor
@@ -225,7 +226,61 @@ export const Conference = ({
     return livekit_url
   }, [apiConfig?.livekit])
 
-  const { t } = useTranslation('rooms')
+  const handleConnected = useCallback(async () => {
+    hasConnectedRef.current = true
+    if (!apiConfig) return
+    if (
+      userPreferencesSnap.is_auto_mute_large_room_enabled &&
+      !hasAutoMutedRef.current &&
+      userConfig.audioEnabled &&
+      room.numParticipants > apiConfig.auto_mute_on_join_threshold
+    ) {
+      hasAutoMutedRef.current = true
+      await room.localParticipant.setMicrophoneEnabled(false)
+      notifyAutoMutedOnJoin()
+    }
+  }, [
+    apiConfig,
+    room,
+    userConfig.audioEnabled,
+    userPreferencesSnap.is_auto_mute_large_room_enabled,
+  ])
+
+  const handleDisconnected = useCallback(
+    (reason?: DisconnectReason) => {
+      navigateTo(
+        'feedback',
+        {},
+        {
+          state: {
+            reason: getConnectionEndReason(reason, hasConnectedRef.current),
+            room_id: roomId,
+          },
+        }
+      )
+    },
+    [roomId]
+  )
+
+  useEffect(() => {
+    void captureMediaEvent('visit-room', { slug: roomId })
+  }, [roomId])
+
+  useEffect(() => {
+    if (createRoomData?.livekit) setHasJoined(true)
+  }, [createRoomData?.livekit])
+
+  useEffect(() => {
+    if (isLobbyRequired) onLobbyRequired()
+  }, [isLobbyRequired, onLobbyRequired])
+
+  useEffect(() => {
+    if (!apiConfig || isConnectionWarmedUp) return
+    warmUpConnection(room, apiConfig.livekit).then(() =>
+      setIsConnectionWarmedUp(true)
+    )
+  }, [room, apiConfig, isConnectionWarmedUp])
+
   if (fetchError?.statusCode == 410) {
     return (
       <ErrorScreen
@@ -245,20 +300,13 @@ export const Conference = ({
     )
   }
 
-  // Some clients (like DINUM) operate in bandwidth-constrained environments
-  // These settings help ensure successful connections in poor network conditions
-  const connectOptions = {
-    maxRetries: 5, // Default: 1. Only for unreachable server scenarios
-    peerConnectionTimeout: 60000, // Default: 15s. Extended for slow TURN/TLS negotiation
-  }
-
   return (
-    <QueryAware status={isFetchError ? createStatus : fetchStatus}>
+    <QueryAware status={status}>
       <Screen header={false} footer={false}>
         <LiveKitRoom
           room={room}
           serverUrl={serverUrl}
-          token={data?.livekit?.token}
+          token={createRoomData?.livekit?.token}
           connect={isConnectionWarmedUp}
           audio={userConfig.audioEnabled}
           video={
@@ -273,65 +321,8 @@ export const Conference = ({
             backgroundColor: 'primaryDark.50 !important',
           })}
           onError={handleError}
-          onConnected={async () => {
-            hasConnectedRef.current = true
-            if (!apiConfig) return
-            if (
-              userPreferencesSnap.is_auto_mute_large_room_enabled &&
-              !hasAutoMutedRef.current &&
-              userConfig.audioEnabled &&
-              room.numParticipants > apiConfig.auto_mute_on_join_threshold
-            ) {
-              hasAutoMutedRef.current = true
-              await room.localParticipant.setMicrophoneEnabled(false)
-              notifyAutoMutedOnJoin()
-            }
-          }}
-          onDisconnected={(e) => {
-            const metadata = {
-              room_id: roomId,
-            }
-
-            switch (e) {
-              case DisconnectReason.CLIENT_INITIATED:
-                navigateTo(
-                  'feedback',
-                  {},
-                  {
-                    state: { ...metadata },
-                  }
-                )
-                return
-              case DisconnectReason.DUPLICATE_IDENTITY:
-              case DisconnectReason.PARTICIPANT_REMOVED:
-              case DisconnectReason.ROOM_DELETED:
-                navigateTo(
-                  'feedback',
-                  {},
-                  {
-                    state: {
-                      reason: e,
-                      ...metadata,
-                    },
-                  }
-                )
-                return
-              default:
-                // Reconnecting gave up, or the join itself failed
-                navigateTo(
-                  'feedback',
-                  {},
-                  {
-                    state: {
-                      reason: hasConnectedRef.current
-                        ? ConnectionEndReason.Lost
-                        : ConnectionEndReason.Failed,
-                      ...metadata,
-                    },
-                  }
-                )
-            }
-          }}
+          onConnected={handleConnected}
+          onDisconnected={handleDisconnected}
         >
           <WatchMediaDeviceErrors />
           <VideoConference />

src/frontend/src/features/rooms/components/Lobby.tsx

@@ -1,6 +1,6 @@
-import { useEffect } from 'react'
+import { type ReactNode } from 'react'
 import { useTranslation } from 'react-i18next'
-import { useQuery } from '@tanstack/react-query'
+import { useMutation } from '@tanstack/react-query'
 import { useSnapshot } from 'valtio'
 import { css } from '@/styled-system/css'
 import { VStack } from '@/styled-system/jsx'
@@ -10,15 +10,40 @@ import { Form, Text } from '@/primitives'
 import { Spinner } from '@/primitives/Spinner'
 import { keys } from '@/api/queryKeys'
 import { queryClient } from '@/api/queryClient'
+import type { ApiError } from '@/api/ApiError'
 import { useLoginHint } from '@/hooks/useLoginHint'
 import { useUser } from '@/features/auth/api/useUser'
 import { useConfig } from '@/api/useConfig'
 import { saveUsername, userStore } from '@/stores/user'
-import { fetchRoom } from '../api/fetchRoom'
-import { ApiAccessLevel } from '../api/ApiRoom'
-import { ApiLobbyStatus, type ApiRequestEntry } from '../api/requestEntry'
+import { joinRoom, type JoinRoomParams } from '../api/joinRoom'
+import { ApiAccessLevel, type ApiRoom } from '../api/ApiRoom'
+import { ApiLobbyStatus } from '../api/requestEntry'
 import { useLobby } from '../hooks/useLobby'
 
+const LobbyMessage = ({
+  title,
+  body,
+  children,
+}: {
+  title: string
+  body: string
+  children?: ReactNode
+}) => (
+  <VStack alignItems="center" textAlign="center">
+    <H lvl={1} margin={false} centered>
+      {title}
+    </H>
+    <Text
+      as="p"
+      variant="note"
+      className={children ? css({ marginBottom: '1.5rem' }) : undefined}
+    >
+      {body}
+    </Text>
+    {children}
+  </VStack>
+)
+
 export const Lobby = ({
   roomId,
   enterRoom,
@@ -27,124 +52,92 @@ export const Lobby = ({
   enterRoom: () => void
 }) => {
   const { t } = useTranslation('rooms', { keyPrefix: 'join' })
-
   const { data: configData } = useConfig()
   const { isLoggedIn, user } = useUser()
   const { username } = useSnapshot(userStore)
+  const { openLoginHint } = useLoginHint()
 
-  // Room data strategy:
-  // 1. Initial fetch is performed to check access and get LiveKit configuration
-  // 2. Data remains valid for 6 hours to avoid unnecessary refetches
-  // 3. State is manually updated via queryClient when a waiting participant is accepted
-  // 4. No automatic refetching or revalidation occurs during this period
+  const displayName = username || user?.full_name
+
+  // Join strategy:
+  // 1. Submitting the form asks to join the room, which checks access
+  // 2. The response is written to the [keys.room] cache entry, which
+  //    Conference reuses without refetching. It holds the LiveKit credentials
+  //    when the user may bypass the lobby
+  // 3. Otherwise the user waits in the lobby, and the credentials returned
+  //    once accepted are added to it
   const {
+    mutate: join,
     data: roomData,
     error,
     isError,
-    refetch: refetchRoom,
-  } = useQuery({
-    queryKey: [keys.room, roomId],
-    queryFn: () => fetchRoom({ roomId, username: username || user?.full_name }),
-    staleTime: 6 * 60 * 60 * 1000, // By default, LiveKit access tokens expire 6 hours after generation
-    retry: false,
-    enabled: false,
-  })
-
-  useEffect(() => {
-    if (isError && error?.statusCode == 404) {
+  } = useMutation<ApiRoom, ApiError, JoinRoomParams>({
+    mutationFn: joinRoom,
+    onSuccess: (room) => {
+      queryClient.setQueryData([keys.room, roomId], room)
+    },
+    onError: ({ statusCode }) => {
       // The room component will handle the room creation if the user is authenticated
-      enterRoom()
-    }
-  }, [isError, error, enterRoom])
-
-  const handleAccepted = (response: ApiRequestEntry) => {
-    queryClient.setQueryData([keys.room, roomId], {
-      ...roomData,
-      livekit: response.livekit,
-    })
-    enterRoom()
-  }
+      if (statusCode == 404) enterRoom()
+    },
+  })
 
   const { status, startWaiting } = useLobby({
     roomId,
-    username: username || user?.full_name || 'anonymous',
-    onAccepted: handleAccepted,
+    username: displayName || 'anonymous',
+    onAccepted: (response) => {
+      queryClient.setQueryData([keys.room, roomId], {
+        ...roomData,
+        livekit: response.livekit,
+      })
+      enterRoom()
+    },
   })
 
-  const { openLoginHint } = useLoginHint()
-
-  const handleSubmit = async () => {
-    const { data, error } = await refetchRoom()
-
-    if (error?.statusCode == 410) return
-
-    if (!data?.livekit) {
-      // Display a message to inform the user that by logging in, they won't have to wait for room entry approval.
-      if (data?.access_level == ApiAccessLevel.TRUSTED) {
-        openLoginHint()
-      }
-      startWaiting()
-      return
-    }
-
-    enterRoom()
-  }
-
   const isRoomDeleted = isError && error?.statusCode == 410
   const lobbyStatus = isRoomDeleted ? ApiLobbyStatus.DELETED : status
+  const hasJoinFailed = isError && !isRoomDeleted && error?.statusCode != 404
+
+  const handleSubmit = () => {
+    join(
+      { roomId, username: displayName || undefined },
+      {
+        onSuccess: (data) => {
+          if (data.livekit) {
+            enterRoom()
+            return
+          }
+          if (data.access_level == ApiAccessLevel.TRUSTED) {
+            openLoginHint()
+          }
+          startWaiting()
+        },
+      }
+    )
+  }
 
   switch (lobbyStatus) {
     case ApiLobbyStatus.DELETED:
       return (
-        <VStack alignItems="center" textAlign="center">
-          <H lvl={1} margin={false} centered>
-            {t('deleted.title')}
-          </H>
-          <Text as="p" variant="note">
-            {t('deleted.body')}
-          </Text>
-        </VStack>
+        <LobbyMessage title={t('deleted.title')} body={t('deleted.body')} />
       )
 
     case ApiLobbyStatus.TIMEOUT:
       return (
-        <VStack alignItems="center" textAlign="center">
-          <H lvl={1} margin={false} centered>
-            {t('timeoutInvite.title')}
-          </H>
-          <Text as="p" variant="note">
-            {t('timeoutInvite.body')}
-          </Text>
-        </VStack>
+        <LobbyMessage
+          title={t('timeoutInvite.title')}
+          body={t('timeoutInvite.body')}
+        />
       )
 
     case ApiLobbyStatus.DENIED:
-      return (
-        <VStack alignItems="center" textAlign="center">
-          <H lvl={1} margin={false} centered>
-            {t('denied.title')}
-          </H>
-          <Text as="p" variant="note">
-            {t('denied.body')}
-          </Text>
-        </VStack>
-      )
+      return <LobbyMessage title={t('denied.title')} body={t('denied.body')} />
 
     case ApiLobbyStatus.WAITING:
       return (
-        <VStack alignItems="center" textAlign="center">
-          <H lvl={1} margin={false} centered>
-            {t('waiting.title')}
-          </H>
-          <Text
-            as="p"
-            variant="note"
-            className={css({ marginBottom: '1.5rem' })}
-          >
-            {t('waiting.body')}
-          </Text>
+        <LobbyMessage title={t('waiting.title')} body={t('waiting.body')}>
           <Spinner />
-        </VStack>
+        </LobbyMessage>
       )
 
     default:
@@ -168,7 +161,7 @@ export const Lobby = ({
                 label={t('usernameLabel')}
                 aria-label={t('usernameLabel')}
                 id="input-name"
-                defaultValue={username || user?.full_name}
+                defaultValue={displayName}
                 validate={(value) => !value && t('errors.usernameEmpty')}
                 wrapperProps={{
                   noMargin: true,
@@ -178,6 +171,11 @@ export const Lobby = ({
                 maxLength={50}
               />
             )}
+            {hasJoinFailed && (
+              <Text variant="warning" role="alert" margin={false} centered>
+                {t('errors.joinFailed')}
+              </Text>
+            )}
           </VStack>
         </Form>
       )

src/frontend/src/features/rooms/livekit/components/Admin.tsx

@@ -3,13 +3,11 @@ import { css } from '@/styled-system/css'
 import { Separator as RACSeparator } from 'react-aria-components'
 import { useTranslation } from 'react-i18next'
 import { usePatchRoom } from '@/features/rooms/api/patchRoom'
-import { fetchRoom } from '@/features/rooms/api/fetchRoom'
 import { ApiAccessLevel } from '@/features/rooms/api/ApiRoom'
-import { keys } from '@/api/queryKeys'
-import { useQuery } from '@tanstack/react-query'
 import { useParams } from 'wouter'
 import { usePublishSourcesManager } from '../hooks/usePublishSourcesManager'
 import { usePermissionsManager } from '../hooks/usePermissionsManager'
+import { useRoomData } from '../hooks/useRoomData'
 import { useEffect } from 'react'
 import { closeSidePanel } from '@/stores/layout'
 import { useIsAdminOrOwner } from '../hooks/useIsAdminOrOwner'
@@ -34,12 +32,10 @@ export const Admin = () => {
     }
   }, [isAdminOrOwner])
 
-  const { data: readOnlyData } = useQuery({
-    queryKey: [keys.room, roomId],
-    queryFn: () => fetchRoom({ roomId }),
-    retry: false,
-    enabled: false,
-  })
+  // Read the cached room only: an observer with its own queryFn could serve
+  // the refetch that follows a setting change with a GET, which returns no
+  // LiveKit credentials
+  const readOnlyData = useRoomData()
 
   const {
     toggleMicrophone,

src/frontend/src/features/rooms/routes/Room.tsx

@@ -32,10 +32,12 @@ const BaseRoom = ({ children }: { children: ReactNode }) => {
 const Room = () => {
   const { isLoggedIn } = useUser()
   const [hasSubmittedEntry, setHasSubmittedEntry] = useState(false)
+  // Set by the conference when the user turns out to have to go through the
+  // lobby, even when the join screen was skipped
+  const [isLobbyRequired, setIsLobbyRequired] = useState(false)
 
   const { roomId } = useParams()
   const [location, setLocation] = useLocation()
-  const initialRoomData = history.state?.initialRoomData
   const mode = isLoggedIn && history.state?.create ? 'create' : 'join'
   const skipJoinScreen = isLoggedIn && mode === 'create'
 
@@ -75,10 +77,16 @@ const Room = () => {
     return <ErrorScreen />
   }
 
-  if (!hasSubmittedEntry && !skipJoinScreen) {
+  if (isLobbyRequired || (!hasSubmittedEntry && !skipJoinScreen)) {
     return (
       <BaseRoom>
-        <Join enterRoom={() => setHasSubmittedEntry(true)} roomId={roomId} />
+        <Join
+          enterRoom={() => {
+            setIsLobbyRequired(false)
+            setHasSubmittedEntry(true)
+          }}
+          roomId={roomId}
+        />
       </BaseRoom>
     )
   }
@@ -86,9 +94,10 @@ const Room = () => {
   return (
     <BaseRoom>
       <Conference
-        initialRoomData={initialRoomData}
+        key={roomId}
         roomId={roomId}
         mode={mode}
+        onLobbyRequired={() => setIsLobbyRequired(true)}
       />
     </BaseRoom>
   )

src/frontend/src/locales/de/rooms.json

@@ -70,6 +70,7 @@
     "usernameHint": "Wird anderen Teilnehmenden angezeigt",
     "usernameLabel": "Dein Name",
     "errors": {
+      "joinFailed": "Beitritt zum Meeting nicht möglich. Bitte versuche es erneut.",
       "usernameEmpty": "Dein Name darf nicht leer sein"
     },
     "cameraDisabled": "Kamera ist deaktiviert.",

src/frontend/src/locales/en/rooms.json

@@ -70,6 +70,7 @@
     "usernameHint": "Shown to other participants",
     "usernameLabel": "Your name",
     "errors": {
+      "joinFailed": "Unable to join the meeting. Please try again.",
       "usernameEmpty": "Your name cannot be empty"
     },
     "cameraDisabled": "Camera is disabled.",

src/frontend/src/locales/es/rooms.json

@@ -70,6 +70,7 @@
     "usernameHint": "Se muestra a los demás participantes",
     "usernameLabel": "Tu nombre",
     "errors": {
+      "joinFailed": "No se ha podido acceder a la reunión. Inténtalo de nuevo.",
       "usernameEmpty": "Tu nombre no puede estar vacío"
     },
     "cameraDisabled": "La cámara está desactivada.",

src/frontend/src/locales/fr/rooms.json

@@ -70,6 +70,7 @@
     "usernameHint": "Affiché aux autres participants",
     "usernameLabel": "Votre nom",
     "errors": {
+      "joinFailed": "Impossible de rejoindre la réunion. Veuillez réessayer.",
       "usernameEmpty": "Votre nom ne peut pas être vide"
     },
     "cameraDisabled": "La caméra est désactivée.",

src/frontend/src/locales/nl/rooms.json

@@ -70,6 +70,7 @@
     "usernameHint": "Getoond aan andere deelnemers",
     "usernameLabel": "Uw naam",
     "errors": {
+      "joinFailed": "Deelnemen aan de vergadering is niet gelukt. Probeer het opnieuw.",
       "usernameEmpty": "Uw naam kan niet leeg zijn"
     },
     "cameraDisabled": "Camera is uitgeschakeld.",