🔒️(backend) reject inactive users in resource server backend

The resource server backend returned any user matching the token's
`sub` claim without checking `User.is_active`. The upstream lasuite
backend only validates the token's introspection `active` claim, so a
deactivated Django account kept API access until its token expired.

Raise `SuspiciousOperation` in `get_or_create_user` when the user is
inactive, which the authentication class turns into a 401, consistent
with `BaseJWTAuthentication`. Add unit and end-to-end tests.

CHANGELOG.md

@@ -8,25 +8,15 @@ and this project adheres to
 
 ## [Unreleased]
 
-### Fixed
-
-- 🔒️(backend) enforce display name setting on rename API
-
-## [1.31.0] - 2026-09-08
-
 ### Added
 
 - ✨(frontend) add 1080p sending resolution option #1660
 - ✨(backend) add Traefik support via configurable media-auth url header #1649
 - ✨(backend) update a room's attributes from the external API
-- 🔊(backend) log request duration in Gunicorn workers
-- 📈(frontend) track missing lobby participant on accept/reject
-- ✨(backend) sort waiting participants by their arrival time
 
 ### Changed
 
 - ⬆️(dev) pin LiveKit server to v1.13.6
-- 🔒(frontend) upgrade base image to 1.30.4-alpine3.24
 
 ### Fixed
 
@@ -34,12 +24,7 @@ and this project adheres to
 - 🐛(frontend) keep the sending resolution picked while the camera is off #1667
 - 🐛(frontend) restore automatic lower-hand on speaking
 - 🐛(frontend) center Avatar initials with a font-aware cap-height ratio
-- 🐛(frontend) keep feedback buttons on one line for fr/es/en
+- 🔒️(backend) reject inactive users in resource server backend
-- ⚡️(frontend) increase lobby polling interval on both sides
-- ⚡️(frontend) add trailing slash on the /me endpoint call
-- ⚡️(backend) refactor lobby storage to bound key lookups per room
-- ⚡️(backend) refactor presence cache to bound key lookups per room
-- 💄(frontend) position the login hint dynamically next to the button
 
 ## [1.30.0] - 2026-09-01
 

docker/dinum-frontend/Dockerfile

@@ -54,11 +54,19 @@ RUN npx webpack --mode production
 
 
 # ---- Front-end image ----
-FROM nginxinc/nginx-unprivileged:1.30.4-alpine3.24 AS frontend-production
+FROM nginxinc/nginx-unprivileged:1.30.3-alpine3.23 AS frontend-production
 
 USER root
-RUN apk del curl
+
-USER nginx
+# Security patches for known CVEs
+RUN apk update && apk upgrade  \
+    libcrypto3>=3.5.7-r0 \
+    libssl3>=3.5.7-r0 \
+    musl \
+    musl-utils \
+    zlib>=1.3.2-r0 \
+    libexpat>=2.8.4-r0 \
+    && apk del curl
 
 USER nginx
 

docker/files/usr/local/etc/gunicorn/meet.py

@@ -14,4 +14,3 @@ accesslog = "-"
 # Using '-' for the error log file makes gunicorn log errors to stderr
 errorlog = "-"
 loglevel = "info"
-access_log_format = '%(h)s %(l)s %(u)s %(t)s "%(r)s" %(s)s %(b)s "%(f)s" "%(a)s" %(M)s'

src/agents/pyproject.toml

@@ -1,7 +1,7 @@
 
 [project]
 name = "agents"
-version = "1.31.0"
+version = "1.29.0"
 requires-python = ">=3.12"
 dependencies = [
     "livekit-agents==1.6.7",

src/agents/uv.lock

@@ -9,7 +9,7 @@ resolution-markers = [
 
 [[package]]
 name = "agents"
-version = "1.31.0"
+version = "1.29.0"
 source = { virtual = "." }
 dependencies = [
     { name = "httpx" },

src/backend/core/api/viewsets.py

@@ -909,15 +909,6 @@ class RoomViewSet(
         """Rename the current participant in the room."""
         room = self.get_object()
 
-        if (
-            not settings.AUTHENTICATED_PARTICIPANTS_CAN_EDIT_DISPLAY_NAME
-            and request.user.is_authenticated
-        ):
-            return drf_response.Response(
-                {"error": "Authenticated participants cannot edit their display name"},
-                status=drf_status.HTTP_403_FORBIDDEN,
-            )
-
         serializer = serializers.RenameParticipantSerializer(data=request.data)
         serializer.is_valid(raise_exception=True)
 

src/backend/core/external_api/authentication.py

@@ -286,6 +286,10 @@ class ResourceServerBackend(LaSuiteBackend):
         if user is None and settings.OIDC_CREATE_USER:
             user = self.create_user(sub)
 
+        if user is not None and not user.is_active:
+            logger.warning("Inactive user attempted authentication: %s", user.pk)
+            raise SuspiciousOperation("User account is disabled.")
+
         return user
 
     def create_user(self, sub):

src/backend/core/services/lobby.py

@@ -4,12 +4,11 @@ import logging
 import uuid
 from dataclasses import dataclass
 from enum import Enum
-from typing import Dict, FrozenSet, Optional, Sequence, Tuple
+from typing import Dict, List, Optional, Tuple
 from uuid import UUID
 
 from django.conf import settings
 from django.core.cache import cache
-from django.utils import timezone
 
 from core import models, utils
 
@@ -47,7 +46,6 @@ class LobbyParticipant:
     username: str
     color: str
     id: str
-    entered_at: str
 
     def to_dict(self) -> Dict[str, str]:
         """Serialize the participant object to a dict representation."""
@@ -56,7 +54,6 @@ class LobbyParticipant:
             "username": self.username,
             "id": self.id,
             "color": self.color,
-            "entered_at": self.entered_at,
         }
 
     @classmethod
@@ -71,7 +68,6 @@ class LobbyParticipant:
                 username=data["username"],
                 id=data["id"],
                 color=data["color"],
-                entered_at=data["entered_at"],
             )
         except (KeyError, ValueError) as e:
             logger.exception("Error creating Participant from dict:")
@@ -90,47 +86,6 @@ class LobbyService:
         """Generate cache key for participant(s) data."""
         return f"{settings.LOBBY_KEY_PREFIX}_{room_id!s}_{participant_id}"
 
-    @staticmethod
-    def _get_index_key(room_id: UUID) -> str:
-        """Raw Redis key of the per-room participant index (a native SET)."""
-        return cache.client.make_key(f"{settings.LOBBY_KEY_PREFIX}-index_{room_id!s}")
-
-    @staticmethod
-    def _redis(write: bool = True):
-        """Raw redis-py client.
-
-        SADD/SREM/SMEMBERS are not exposed by the Django cache API; this is
-        the documented django-redis escape hatch.
-        """
-        return cache.client.get_client(write=write)
-
-    def _index_add(self, room_id: UUID, participant_id: str) -> None:
-        """Record a participant id in the room index."""
-        index_key = self._get_index_key(room_id)
-        pipe = self._redis().pipeline(transaction=False)
-        pipe.sadd(index_key, participant_id)
-        pipe.expire(index_key, settings.LOBBY_ACCEPTED_TIMEOUT)
-        pipe.execute()
-
-    def _index_members(self, room_id: UUID) -> FrozenSet[str]:
-        """All participant ids currently indexed for the room."""
-        members = self._redis(write=False).smembers(self._get_index_key(room_id))
-        return frozenset(
-            member.decode() if isinstance(member, bytes) else member
-            for member in members
-        )
-
-    def _index_touch(self, room_id: UUID) -> None:
-        """Re-arm the room index backstop TTL."""
-        self._redis().expire(
-            self._get_index_key(room_id), settings.LOBBY_ACCEPTED_TIMEOUT
-        )
-
-    def _index_remove(self, room_id: UUID, *participant_ids: str) -> None:
-        """Drop participant ids from the room index."""
-        if participant_ids:
-            self._redis().srem(self._get_index_key(room_id), *participant_ids)
-
     @staticmethod
     def _get_or_create_participant_id(request) -> str:
         """Extract unique participant identifier from the request."""
@@ -207,7 +162,6 @@ class LobbyService:
                     username=username,
                     id=participant_id,
                     color=utils.generate_color(participant_id),
-                    entered_at=timezone.now().isoformat(),
                 )
             else:
                 participant.status = LobbyParticipantStatus.ACCEPTED
@@ -255,12 +209,15 @@ class LobbyService:
         cache.touch(
             self._get_cache_key(room_id, participant_id), settings.LOBBY_WAITING_TIMEOUT
         )
-        self._index_touch(room_id)
 
     def enter(
         self, room_id: UUID, participant_id: str, username: str
     ) -> LobbyParticipant:
-        """Add participant to waiting lobby."""
+        """Add participant to waiting lobby.
+
+        Create a new participant entry in waiting status and notify room
+        participants of the new entry request.
+        """
 
         color = utils.generate_color(participant_id)
 
@@ -269,7 +226,6 @@ class LobbyService:
             username=username,
             id=participant_id,
             color=color,
-            entered_at=timezone.now().isoformat(),
         )
 
         try:
@@ -289,7 +245,6 @@ class LobbyService:
             participant.to_dict(),
             timeout=settings.LOBBY_WAITING_TIMEOUT,
         )
-        self._index_add(room_id, participant_id)
 
         return participant
 
@@ -311,42 +266,28 @@ class LobbyService:
             cache.delete(cache_key)
             return None
 
-    def list_waiting_participants(self, room_id: UUID) -> Sequence[dict]:
+    def list_waiting_participants(self, room_id: UUID) -> List[dict]:
         """List all waiting participants for a room."""
 
-        member_ids = self._index_members(room_id)
+        pattern = self._get_cache_key(room_id, "*")
+        keys = list(cache.iter_keys(pattern, itersize=utils.CACHE_SCAN_ITERSIZE))
 
-        if not member_ids:
+        if not keys:
-            return ()
+            return []
 
-        keys_by_id = {
+        data = cache.get_many(keys)
-            participant_id: self._get_cache_key(room_id, participant_id)
-            for participant_id in member_ids
-        }
-        data = cache.get_many(list(keys_by_id.values()))
 
-        dead_ids = []
         waiting_participants = []
-
+        for cache_key, raw_participant in data.items():
-        for participant_id, cache_key in keys_by_id.items():
-            raw_participant = data.get(cache_key)
-            if raw_participant is None:
-                dead_ids.append(participant_id)
-                continue
             try:
                 participant = LobbyParticipant.from_dict(raw_participant)
             except LobbyParticipantParsingError:
                 cache.delete(cache_key)
-                dead_ids.append(participant_id)
                 continue
             if participant.status == LobbyParticipantStatus.WAITING:
                 waiting_participants.append(participant.to_dict())
 
-        self._index_remove(room_id, *dead_ids)
+        return waiting_participants
-
-        waiting_participants.sort(key=lambda p: p["entered_at"], reverse=True)
-
-        return tuple(waiting_participants)
 
     def handle_participant_entry(
         self,
@@ -400,24 +341,16 @@ class LobbyService:
 
         participant.status = status
         cache.set(cache_key, participant.to_dict(), timeout=timeout)
-        self._index_touch(room_id)
 
     def clear_room_cache(self, room_id: UUID) -> None:
         """Clear all participant entries from the cache for a specific room."""
 
-        member_ids = self._index_members(room_id)
+        cache.delete_pattern(
-        if member_ids:
+            self._get_cache_key(room_id, "*"), itersize=utils.CACHE_SCAN_ITERSIZE
-            cache.delete_many(
+        )
-                [
-                    self._get_cache_key(room_id, participant_id)
-                    for participant_id in member_ids
-                ]
-            )
-        self._redis().delete(self._get_index_key(room_id))
 
     def clear_participant_cache(self, room_id: UUID, participant_id: str) -> None:
         """Clear a given participant entry from the cache for a specific room."""
 
         cache_key = self._get_cache_key(room_id, participant_id)
         cache.delete(cache_key)
-        self._index_remove(room_id, participant_id)

src/backend/core/services/presence.py

@@ -1,11 +1,25 @@
-"""Presence cache."""
+"""Presence cache.
+
+Redis-backed memo of "this identity is currently connected to this room".
+
+This module is intentionally a *pure cache store* with no dependency on other
+services, so that `participants_management` (which talks to LiveKit) can
+import it without creating an import cycle. The composition of "check cache,
+fall back to LiveKit" lives in
+`ParticipantsManagement.check_if_in_meeting_cached`.
+
+Only positive answers are stored: a sticky negative would lock out someone
+who joins right after a miss for the whole TTL. The TTL is a safety net in
+case an invalidation webhook is lost.
+"""
 
-from typing import FrozenSet
 from uuid import UUID
 
 from django.conf import settings
 from django.core.cache import cache
 
+from core.utils import CACHE_SCAN_ITERSIZE
+
 
 class PresenceCache:
     """Store and invalidate (room, identity) presence entries."""
@@ -15,65 +29,24 @@ class PresenceCache:
         """Cache key for a (room, identity) presence entry."""
         return f"{settings.PRESENCE_KEY_PREFIX}_{room_id!s}_{identity}"
 
-    @staticmethod
-    def _get_index_key(room_id: UUID | str) -> str:
-        """Raw Redis key of the per-room identity index (a native SET).
-
-        Built through django-redis' make_key so it lives under the same
-        KEY_PREFIX/version namespace as the presence entries.
-        """
-        return cache.client.make_key(
-            f"{settings.PRESENCE_KEY_PREFIX}-index_{room_id!s}"
-        )
-
-    @staticmethod
-    def _redis(write: bool = True):
-        """Raw redis-py client.
-
-        SADD/SREM/SMEMBERS are not exposed by the Django cache API; this is
-        the documented django-redis escape hatch.
-        """
-        return cache.client.get_client(write=write)
-
-    def _index_members(self, room_id: UUID | str) -> FrozenSet[str]:
-        """All identities currently indexed for the room."""
-        members = self._redis(write=False).smembers(self._get_index_key(room_id))
-        return frozenset(
-            member.decode() if isinstance(member, bytes) else member
-            for member in members
-        )
-
     def is_marked_present(self, room_id: UUID | str, identity: str) -> bool:
         """Return True if a positive presence entry exists in cache."""
         return bool(cache.get(self._get_cache_key(room_id, identity)))
 
     def mark_present(self, room_id: UUID | str, identity: str) -> None:
-        """Record that `identity` is in `room_id` and index it for the room."""
+        """Record that `identity` is in `room_id`."""
         cache.set(
             self._get_cache_key(room_id, identity),
             True,
             timeout=settings.PRESENCE_CACHE_TIMEOUT,
         )
-        index_key = self._get_index_key(room_id)
-        pipe = self._redis().pipeline(transaction=False)
-        pipe.sadd(index_key, identity)
-        pipe.expire(index_key, settings.PRESENCE_CACHE_TIMEOUT)
-        pipe.execute()
 
     def clear(self, room_id: UUID | str, identity: str) -> None:
         """Forget presence for one participant (e.g. on participant_left)."""
         cache.delete(self._get_cache_key(room_id, identity))
-        self._redis().srem(self._get_index_key(room_id), identity)
 
     def clear_room(self, room_id: UUID | str) -> None:
-        """Forget presence for every participant of a room (on room_finished).
+        """Forget presence for every participant of a room (on room_finished)."""
-
+        cache.delete_pattern(
-        Deletes the indexed entries and the index itself with targeted
+            self._get_cache_key(room_id, "*"), itersize=CACHE_SCAN_ITERSIZE
-        commands instead of a full-keyspace pattern scan.
+        )
-        """
-        identities = self._index_members(room_id)
-        if identities:
-            cache.delete_many(
-                [self._get_cache_key(room_id, identity) for identity in identities]
-            )
-        self._redis().delete(self._get_index_key(room_id))

src/backend/core/tests/rooms/test_api_rooms_lobby.py

@@ -9,7 +9,6 @@ from unittest import mock
 from django.core.cache import cache
 
 import pytest
-from freezegun import freeze_time
 from rest_framework.test import APIClient
 
 from ... import utils
@@ -25,7 +24,6 @@ pytestmark = pytest.mark.django_db
 # Tests for request_entry endpoint
 
 
-@freeze_time("2025-01-01 10:00:00")
 def test_request_entry_anonymous(settings):
     """Anonymous users should be allowed to request entry to a room."""
     room = RoomFactory(access_level=RoomAccessLevel.RESTRICTED)
@@ -61,7 +59,6 @@ def test_request_entry_anonymous(settings):
         "username": "test_user",
         "status": "waiting",
         "color": "mocked-color",
-        "entered_at": "2025-01-01T10:00:00+00:00",
         "livekit": None,
     }
 
@@ -74,7 +71,6 @@ def test_request_entry_anonymous(settings):
     assert participant_data.get("username") == "test_user"
 
 
-@freeze_time("2025-01-01 10:00:00")
 def test_request_entry_authenticated_user(settings):
     """Authenticated users should be allowed to request entry."""
     room = RoomFactory(access_level=RoomAccessLevel.RESTRICTED)
@@ -112,7 +108,6 @@ def test_request_entry_authenticated_user(settings):
         "username": "test_user",
         "status": "waiting",
         "color": "mocked-color",
-        "entered_at": "2025-01-01T10:00:00+00:00",
         "livekit": None,
     }
 
@@ -125,7 +120,6 @@ def test_request_entry_authenticated_user(settings):
     assert participant_data.get("username") == "test_user"
 
 
-@freeze_time("2025-01-01 10:00:00")
 def test_request_entry_with_existing_participants(settings):
     """Anonymous users should be allowed to request entry to a room with existing participants."""
     # Create a restricted access room
@@ -144,7 +138,6 @@ def test_request_entry_with_existing_participants(settings):
             "username": "user1",
             "status": "waiting",
             "color": "#123456",
-            "entered_at": "2025-01-01T10:00:00+00:00",
         },
     )
     cache.set(
@@ -154,7 +147,6 @@ def test_request_entry_with_existing_participants(settings):
             "username": "user2",
             "status": "accepted",
             "color": "#654321",
-            "entered_at": "2025-01-01T10:00:00+00:00",
         },
     )
 
@@ -186,7 +178,6 @@ def test_request_entry_with_existing_participants(settings):
     assert response.json() == {
         "id": participant_id,
         "username": "test_user",
-        "entered_at": "2025-01-01T10:00:00+00:00",
         "status": "waiting",
         "color": "mocked-color",
         "livekit": None,
@@ -201,7 +192,6 @@ def test_request_entry_with_existing_participants(settings):
     assert participant_data.get("username") == "test_user"
 
 
-@freeze_time("2025-01-01 10:00:00")
 def test_request_entry_public_room(settings):
     """Entry requests to public rooms should return ACCEPTED status with LiveKit config."""
     room = RoomFactory(access_level=RoomAccessLevel.PUBLIC)
@@ -240,7 +230,6 @@ def test_request_entry_public_room(settings):
     assert response.json() == {
         "id": "123",
         "username": "test_user",
-        "entered_at": "2025-01-01T10:00:00+00:00",
         "status": "accepted",
         "color": "mocked-color",
         "livekit": {"token": "test-token"},
@@ -251,7 +240,6 @@ def test_request_entry_public_room(settings):
     assert not lobby_keys
 
 
-@freeze_time("2025-01-01 10:00:00")
 def test_request_entry_authenticated_user_public_room(settings):
     """While authenticated, entry request to public rooms should get accepted."""
     room = RoomFactory(access_level=RoomAccessLevel.PUBLIC)
@@ -294,7 +282,6 @@ def test_request_entry_authenticated_user_public_room(settings):
     assert response.json() == {
         "id": "2f7f162f-e7d1-421b-90e7-02bfbfbf8def",
         "username": "test_user",
-        "entered_at": "2025-01-01T10:00:00+00:00",
         "status": "accepted",
         "color": "mocked-color",
         "livekit": {"token": "test-token"},
@@ -305,7 +292,6 @@ def test_request_entry_authenticated_user_public_room(settings):
     assert not lobby_keys
 
 
-@freeze_time("2025-01-01 10:00:00")
 def test_request_entry_waiting_participant_public_room(settings):
     """While waiting, entry request to public rooms should get accepted."""
     room = RoomFactory(access_level=RoomAccessLevel.PUBLIC)
@@ -322,7 +308,6 @@ def test_request_entry_waiting_participant_public_room(settings):
             "username": "user1",
             "status": "waiting",
             "color": "#123456",
-            "entered_at": "2025-01-01T10:00:00+00:00",
         },
     )
 
@@ -353,7 +338,6 @@ def test_request_entry_waiting_participant_public_room(settings):
         "username": "user1",
         "status": "accepted",
         "color": "#123456",
-        "entered_at": "2025-01-01T10:00:00+00:00",
         "livekit": {"token": "test-token"},
     }
 
@@ -459,7 +443,6 @@ def test_allow_participant_to_enter_success(settings, allow_entry, updated_statu
             "status": "waiting",
             "username": "foo",
             "color": "123",
-            "entered_at": "2025-01-01T10:00:00+00:00",
         },
     )
 
@@ -595,7 +578,6 @@ def test_list_waiting_participants_success(settings):
             "username": "user1",
             "status": "waiting",
             "color": "#123456",
-            "entered_at": "2025-01-01T10:00:00+00:00",
         },
     )
     cache.set(
@@ -605,35 +587,28 @@ def test_list_waiting_participants_success(settings):
             "username": "user2",
             "status": "waiting",
             "color": "#654321",
-            "entered_at": "2025-01-01T10:05:00+00:00",
         },
     )
-    lobby_service = LobbyService()
-    lobby_service._index_add(room.id, "2f7f162f-e7d1-421b-90e7-02bfbfbf8def")
-    lobby_service._index_add(room.id, "f4ca3ab8a6c04ad88097b8da33f60f10")
 
     response = client.get(f"/api/v1.0/rooms/{room.id}/waiting-participants/")
 
     assert response.status_code == 200
 
-    assert response.json() == {
+    participants = response.json().get("participants")
-        "participants": [
+    assert sorted(participants, key=lambda p: p["id"]) == [
-            {
+        {
-                "id": "f4ca3ab8a6c04ad88097b8da33f60f10",
+            "id": "2f7f162f-e7d1-421b-90e7-02bfbfbf8def",
-                "username": "user2",
+            "username": "user1",
-                "status": "waiting",
+            "status": "waiting",
-                "color": "#654321",
+            "color": "#123456",
-                "entered_at": "2025-01-01T10:05:00+00:00",
+        },
-            },
+        {
-            {
+            "id": "f4ca3ab8a6c04ad88097b8da33f60f10",
-                "id": "2f7f162f-e7d1-421b-90e7-02bfbfbf8def",
+            "username": "user2",
-                "username": "user1",
+            "status": "waiting",
-                "status": "waiting",
+            "color": "#654321",
-                "color": "#123456",
+        },
-                "entered_at": "2025-01-01T10:00:00+00:00",
+    ]
-            },
-        ]
-    }
 
 
 def test_list_waiting_participants_empty(settings):

src/backend/core/tests/rooms/test_api_rooms_rename_toggle.py

@@ -372,67 +372,6 @@ def test_rename_participant_unexpected_twirp_error(mock_livekit_client, room, to
     mock_livekit_client.aclose.assert_called_once()
 
 
-@pytest.mark.parametrize("name", ["John Doe", "Admin", "Room Owner"])
-def test_rename_participant_forbidden_when_display_name_edit_disabled(
-    mock_livekit_client, settings, room, token, name
-):
-    """
-    Test rename is rejected for authenticated users when the self-hoster
-    disables AUTHENTICATED_PARTICIPANTS_CAN_EDIT_DISPLAY_NAME.
-    """
-    settings.AUTHENTICATED_PARTICIPANTS_CAN_EDIT_DISPLAY_NAME = False
-
-    client = APIClient()
-    url = reverse("rooms-rename", kwargs={"pk": room.id})
-    response = client.post(
-        url, {"name": name}, format="json", HTTP_AUTHORIZATION=f"Bearer {token}"
-    )
-
-    assert response.status_code == status.HTTP_403_FORBIDDEN
-    assert response.data == {
-        "error": "Authenticated participants cannot edit their display name"
-    }
-    mock_livekit_client.room.update_participant.assert_not_called()
-
-
-def test_rename_participant_allowed_when_display_name_edit_enabled(
-    mock_livekit_client, settings, room, token
-):
-    """Test rename still works for authenticated users when the setting is enabled."""
-    settings.AUTHENTICATED_PARTICIPANTS_CAN_EDIT_DISPLAY_NAME = True
-
-    client = APIClient()
-    url = reverse("rooms-rename", kwargs={"pk": room.id})
-    response = client.post(
-        url, {"name": "John Doe"}, format="json", HTTP_AUTHORIZATION=f"Bearer {token}"
-    )
-
-    assert response.status_code == status.HTTP_200_OK
-    mock_livekit_client.room.update_participant.assert_called_once()
-
-
-def test_rename_participant_anonymous_allowed_when_display_name_edit_disabled(
-    mock_livekit_client, settings, room, anonymous_token
-):
-    """
-    Test the setting only restricts authenticated users: anonymous participants
-    have no account name to fall back on and can still rename themselves.
-    """
-    settings.AUTHENTICATED_PARTICIPANTS_CAN_EDIT_DISPLAY_NAME = False
-
-    client = APIClient()
-    url = reverse("rooms-rename", kwargs={"pk": room.id})
-    response = client.post(
-        url,
-        {"name": "Guest User"},
-        format="json",
-        HTTP_AUTHORIZATION=f"Bearer {anonymous_token}",
-    )
-
-    assert response.status_code == status.HTTP_200_OK
-    mock_livekit_client.room.update_participant.assert_called_once()
-
-
 def test_rename_participant_success_anonymous(
     mock_livekit_client, room, anonymous_token
 ):

src/backend/core/tests/services/test_lobby.py

@@ -2,7 +2,7 @@
 Test lobby service.
 """
 
-# pylint: disable=W0621,W0613, W0212, R0913, C0302
+# pylint: disable=W0621,W0613, W0212, R0913
 # ruff: noqa: PLR0913, PLR0917
 
 import uuid
@@ -14,7 +14,6 @@ from django.core.cache import cache
 from django.http import HttpResponse
 
 import pytest
-from freezegun import freeze_time
 
 from core.factories import RoomFactory, UserFactory, UserResourceAccessFactory
 from core.models import RoleChoices, RoomAccessLevel
@@ -25,6 +24,7 @@ from core.services.lobby import (
     LobbyParticipantStatus,
     LobbyService,
 )
+from core.services.presence import CACHE_SCAN_ITERSIZE
 from core.utils import NotificationError
 
 pytestmark = pytest.mark.django_db
@@ -56,7 +56,6 @@ def participant_dict():
         "username": "test-username",
         "id": "test-participant-id",
         "color": "#123456",
-        "entered_at": "2025-01-01T10:00:00+00:00",
     }
 
 
@@ -68,7 +67,6 @@ def participant_data():
         username="test-username",
         id="test-participant-id",
         color="#123456",
-        entered_at="2025-01-01T10:00:00+00:00",
     )
 
 
@@ -80,7 +78,6 @@ def test_lobby_participant_to_dict(participant_data):
     assert result["username"] == "test-username"
     assert result["id"] == "test-participant-id"
     assert result["color"] == "#123456"
-    assert result["entered_at"] == "2025-01-01T10:00:00+00:00"
 
 
 def test_lobby_participant_from_dict_success(participant_dict):
@@ -91,20 +88,6 @@ def test_lobby_participant_from_dict_success(participant_dict):
     assert participant.username == "test-username"
     assert participant.id == "test-participant-id"
     assert participant.color == "#123456"
-    assert participant.entered_at == "2025-01-01T10:00:00+00:00"
-
-
-def test_lobby_participant_from_dict_missing_entered_at():
-    """`entered_at` is mandatory; data without it is rejected."""
-    data = {
-        "status": "waiting",
-        "username": "test-username",
-        "id": "test-participant-id",
-        "color": "#123456",
-    }
-
-    with pytest.raises(LobbyParticipantParsingError, match="Invalid participant data"):
-        LobbyParticipant.from_dict(data)
 
 
 def test_lobby_participant_from_dict_default_status():
@@ -113,7 +96,6 @@ def test_lobby_participant_from_dict_default_status():
         "username": "test-username",
         "id": "test-participant-id",
         "color": "#123456",
-        "entered_at": "2025-01-01T10:00:00+00:00",
     }
 
     participant = LobbyParticipant.from_dict(data_without_status)
@@ -139,7 +121,6 @@ def test_lobby_participant_from_dict_invalid_status():
         "username": "test-username",
         "id": "test-participant-id",
         "color": "#123456",
-        "entered_at": "2025-01-01T10:00:00+00:00",
     }
 
     with pytest.raises(LobbyParticipantParsingError, match="Invalid participant data"):
@@ -284,7 +265,6 @@ def test_request_entry_public_room(
         username=username,
         id=participant_id,
         color="#123456",
-        entered_at="2025-01-01T10:00:00+00:00",
     )
 
     lobby_service._get_or_create_participant_id = mock.Mock(return_value=participant_id)
@@ -323,7 +303,6 @@ def test_request_entry_trusted_room(
         username=username,
         id=participant_id,
         color="#123456",
-        entered_at="2025-01-01T10:00:00+00:00",
     )
 
     lobby_service._get_or_create_participant_id = mock.Mock(return_value=participant_id)
@@ -366,7 +345,6 @@ def test_request_entry_new_participant(
         username=username,
         id=participant_id,
         color="#123456",
-        entered_at="2025-01-01T10:00:00+00:00",
     )
     mock_enter.return_value = participant_data
 
@@ -394,7 +372,6 @@ def test_request_entry_waiting_participant(
         username=username,
         id=participant_id,
         color="#123456",
-        entered_at="2025-01-01T10:00:00+00:00",
     )
     lobby_service._get_or_create_participant_id = mock.Mock(return_value=participant_id)
     lobby_service._get_participant = mock.Mock(return_value=mocked_participant)
@@ -423,7 +400,6 @@ def test_request_entry_accepted_participant(
         username=username,
         id=participant_id,
         color="#123456",
-        entered_at="2025-01-01T10:00:00+00:00",
     )
     lobby_service._get_or_create_participant_id = mock.Mock(return_value=participant_id)
     lobby_service._get_participant = mock.Mock(return_value=mocked_participant)
@@ -464,7 +440,6 @@ def test_request_entry_participant_with_role(
         username=username,
         id=participant_id,
         color="#123456",
-        entered_at="2025-01-01T10:00:00+00:00",
     )
     lobby_service._get_or_create_participant_id = mock.Mock(return_value=participant_id)
     lobby_service._get_participant = mock.Mock(return_value=mocked_participant)
@@ -491,23 +466,18 @@ def test_request_entry_participant_with_role(
 def test_refresh_waiting_status(mock_cache, lobby_service, participant_id):
     """Test refreshing waiting status for a participant."""
     lobby_service._get_cache_key = mock.Mock(return_value="mocked_cache_key")
-    lobby_service._index_touch = mock.Mock()
     room = RoomFactory(access_level=RoomAccessLevel.RESTRICTED)
     lobby_service.refresh_waiting_status(room.id, participant_id)
     mock_cache.touch.assert_called_once_with(
         "mocked_cache_key", settings.LOBBY_WAITING_TIMEOUT
     )
-    lobby_service._index_touch.assert_called_once_with(room.id)
 
 
 # pylint: disable=R0917
 @mock.patch("core.services.lobby.cache")
 @mock.patch("core.utils.generate_color")
 @mock.patch("core.utils.notify_participants")
-@mock.patch("core.services.lobby.LobbyService._index_add")
-@freeze_time("2025-01-01 10:00:00")
 def test_enter_success(
-    mock_index_add,
     mock_notify,
     mock_generate_color,
     mock_cache,
@@ -527,7 +497,6 @@ def test_enter_success(
     assert participant.username == username
     assert participant.id == participant_id
     assert participant.color == "#123456"
-    assert participant.entered_at == "2025-01-01T10:00:00+00:00"
 
     lobby_service._get_cache_key.assert_called_once_with(room.id, participant_id)
 
@@ -539,16 +508,13 @@ def test_enter_success(
     mock_notify.assert_called_once_with(
         room_name=str(room.pk), notification_data={"type": "participantWaiting"}
     )
-    mock_index_add.assert_called_once_with(room.id, participant_id)
 
 
 # pylint: disable=R0917
 @mock.patch("core.services.lobby.cache")
 @mock.patch("core.utils.generate_color")
 @mock.patch("core.utils.notify_participants")
-@mock.patch("core.services.lobby.LobbyService._index_add")
 def test_enter_with_notification_error(
-    mock_index_add,
     mock_notify,
     mock_generate_color,
     mock_cache,
@@ -575,7 +541,6 @@ def test_enter_with_notification_error(
         participant.to_dict(),
         timeout=settings.LOBBY_WAITING_TIMEOUT,
     )
-    mock_index_add.assert_called_once_with(room.id, participant_id)
 
 
 @mock.patch("core.services.lobby.cache")
@@ -614,15 +579,14 @@ def test_get_participant_parsing_error(
 @mock.patch("core.services.lobby.cache")
 def test_list_waiting_participants_empty(mock_cache, lobby_service):
     """Test listing waiting participants when none exist."""
-    room = RoomFactory(access_level=RoomAccessLevel.RESTRICTED)
+    mock_cache.iter_keys.return_value = []
-    lobby_service._index_members = mock.Mock(return_value=[])
-    lobby_service._index_remove = mock.Mock()
 
+    room = RoomFactory(access_level=RoomAccessLevel.RESTRICTED)
     result = lobby_service.list_waiting_participants(room.id)
 
-    assert result == ()
+    assert result == []
-    lobby_service._index_members.assert_called_once_with(room.id)
+    pattern = f"{settings.LOBBY_KEY_PREFIX}_{room.id!s}_*"
-    lobby_service._index_remove.assert_not_called()
+    mock_cache.iter_keys.assert_called_once_with(pattern, itersize=CACHE_SCAN_ITERSIZE)
     mock_cache.get_many.assert_not_called()
 
 
@@ -631,8 +595,7 @@ def test_list_waiting_participants(mock_cache, lobby_service, participant_dict):
     """Test listing waiting participants with valid data."""
     room = RoomFactory(access_level=RoomAccessLevel.RESTRICTED)
     cache_key = f"{settings.LOBBY_KEY_PREFIX}_{room.id!s}_participant1"
-    lobby_service._index_members = mock.Mock(return_value=["participant1"])
+    mock_cache.iter_keys.return_value = [cache_key]
-    lobby_service._index_remove = mock.Mock()
     mock_cache.get_many.return_value = {cache_key: participant_dict}
 
     result = lobby_service.list_waiting_participants(room.id)
@@ -640,8 +603,8 @@ def test_list_waiting_participants(mock_cache, lobby_service, participant_dict):
     assert len(result) == 1
     assert result[0]["status"] == "waiting"
     assert result[0]["username"] == "test-username"
-    lobby_service._index_members.assert_called_once_with(room.id)
+    pattern = f"{settings.LOBBY_KEY_PREFIX}_{room.id!s}_*"
-    lobby_service._index_remove.assert_called_once_with(room.id)
+    mock_cache.iter_keys.assert_called_once_with(pattern, itersize=CACHE_SCAN_ITERSIZE)
     mock_cache.get_many.assert_called_once_with([cache_key])
 
 
@@ -657,7 +620,6 @@ def test_list_waiting_participants_multiple(mock_cache, lobby_service):
         "username": "user1",
         "id": "participant1",
         "color": "#123456",
-        "entered_at": "2025-01-01T10:00:00+00:00",
     }
 
     participant2 = {
@@ -665,13 +627,9 @@ def test_list_waiting_participants_multiple(mock_cache, lobby_service):
         "username": "user2",
         "id": "participant2",
         "color": "#654321",
-        "entered_at": "2025-01-01T10:05:00+00:00",
     }
 
-    lobby_service._index_members = mock.Mock(
+    mock_cache.iter_keys.return_value = [cache_key1, cache_key2]
-        return_value=["participant1", "participant2"]
-    )
-    lobby_service._index_remove = mock.Mock()
     mock_cache.get_many.return_value = {
         cache_key1: participant1,
         cache_key2: participant2,
@@ -681,15 +639,15 @@ def test_list_waiting_participants_multiple(mock_cache, lobby_service):
 
     assert len(result) == 2
 
-    # Most recent entry comes first
+    # Verify both participants are in the result
-    assert [p["id"] for p in result] == ["participant2", "participant1"]
+    assert any(p["id"] == "participant1" and p["username"] == "user1" for p in result)
-    assert result[0]["username"] == "user2"
+    assert any(p["id"] == "participant2" and p["username"] == "user2" for p in result)
-    assert result[1]["username"] == "user1"
 
     # Verify all participants have waiting status
     assert all(p["status"] == "waiting" for p in result)
 
-    lobby_service._index_members.assert_called_once_with(room.id)
+    pattern = f"{settings.LOBBY_KEY_PREFIX}_{room.id!s}_*"
+    mock_cache.iter_keys.assert_called_once_with(pattern, itersize=CACHE_SCAN_ITERSIZE)
     mock_cache.get_many.assert_called_once_with([cache_key1, cache_key2])
 
 
@@ -698,13 +656,12 @@ def test_list_waiting_participants_corrupted_data(mock_cache, lobby_service):
     """Test listing waiting participants with corrupted data."""
     room = RoomFactory(access_level=RoomAccessLevel.RESTRICTED)
     cache_key = f"{settings.LOBBY_KEY_PREFIX}_{room.id!s}_participant1"
-    lobby_service._index_members = mock.Mock(return_value=["participant1"])
+    mock_cache.iter_keys.return_value = [cache_key]
-    lobby_service._index_remove = mock.Mock()
     mock_cache.get_many.return_value = {cache_key: {"invalid": "data"}}
 
     result = lobby_service.list_waiting_participants(room.id)
 
-    assert result == ()
+    assert result == []
     mock_cache.delete.assert_called_once_with(cache_key)
 
 
@@ -720,15 +677,11 @@ def test_list_waiting_participants_partially_corrupted(mock_cache, lobby_service
         "username": "user2",
         "id": "participant2",
         "color": "#654321",
-        "entered_at": "2025-01-01T10:00:00+00:00",
     }
 
     corrupted_participant = {"invalid": "data"}
 
-    lobby_service._index_members = mock.Mock(
+    mock_cache.iter_keys.return_value = [cache_key1, cache_key2]
-        return_value=["participant1", "participant2"]
-    )
-    lobby_service._index_remove = mock.Mock()
     mock_cache.get_many.return_value = {
         cache_key1: corrupted_participant,
         cache_key2: valid_participant,
@@ -746,6 +699,8 @@ def test_list_waiting_participants_partially_corrupted(mock_cache, lobby_service
     mock_cache.delete.assert_called_once_with(cache_key1)
 
     # Verify both cache keys were queried
+    pattern = f"{settings.LOBBY_KEY_PREFIX}_{room.id!s}_*"
+    mock_cache.iter_keys.assert_called_once_with(pattern, itersize=CACHE_SCAN_ITERSIZE)
     mock_cache.get_many.assert_called_once_with([cache_key1, cache_key2])
 
 
@@ -761,20 +716,15 @@ def test_list_waiting_participants_non_waiting(mock_cache, lobby_service):
         "username": "user1",
         "id": "participant1",
         "color": "#123456",
-        "entered_at": "2025-01-01T10:00:00+00:00",
     }
     participant2 = {
         "status": "accepted",
         "username": "user2",
         "id": "participant2",
         "color": "#654321",
-        "entered_at": "2025-01-01T10:00:00+00:00",
     }
 
-    lobby_service._index_members = mock.Mock(
+    mock_cache.iter_keys.return_value = [cache_key1, cache_key2]
-        return_value=["participant1", "participant2"]
-    )
-    lobby_service._index_remove = mock.Mock()
     mock_cache.get_many.return_value = {
         cache_key1: participant1,
         cache_key2: participant2,
@@ -866,12 +816,10 @@ def test_update_participant_status_success(mock_cache, lobby_service, participan
         "username": "test-username",
         "id": participant_id,
         "color": "#123456",
-        "entered_at": "2025-01-01T10:00:00+00:00",
     }
 
     mock_cache.get.return_value = participant_dict
     lobby_service._get_cache_key = mock.Mock(return_value="mocked_cache_key")
-    lobby_service._index_touch = mock.Mock()
 
     lobby_service._update_participant_status(
         room.id,
@@ -885,12 +833,10 @@ def test_update_participant_status_success(mock_cache, lobby_service, participan
         "username": "test-username",
         "id": participant_id,
         "color": "#123456",
-        "entered_at": "2025-01-01T10:00:00+00:00",
     }
     mock_cache.set.assert_called_once_with(
         "mocked_cache_key", expected_data, timeout=60
     )
-    lobby_service._index_touch.assert_called_once_with(room.id)
     lobby_service._get_cache_key.assert_called_once_with(room.id, participant_id)
 
 
@@ -911,7 +857,6 @@ def test_clear_room_cache(settings, lobby_service):
             username="participant1",
             id="participant1",
             color="#123456",
-            entered_at="2025-01-01T10:00:00+00:00",
         ),
         timeout=settings.LOBBY_WAITING_TIMEOUT,
     )
@@ -922,7 +867,6 @@ def test_clear_room_cache(settings, lobby_service):
             username="participant2",
             id="participant2",
             color="#123456",
-            entered_at="2025-01-01T10:00:00+00:00",
         ),
         timeout=settings.LOBBY_ACCEPTED_TIMEOUT,
     )
@@ -933,18 +877,13 @@ def test_clear_room_cache(settings, lobby_service):
             username="participant3",
             id="participant3",
             color="#123456",
-            entered_at="2025-01-01T10:00:00+00:00",
         ),
         timeout=settings.LOBBY_DENIED_TIMEOUT,
     )
 
-    for participant_id in ("participant1", "participant2", "participant3"):
-        lobby_service._index_add(room_id, participant_id)
-
     lobby_service.clear_room_cache(room_id)
 
     assert cache.keys(f"test-lobby_{room_id!s}_*") == []
-    assert lobby_service._index_members(room_id) == frozenset()
 
 
 def test_clear_room_empty(settings, lobby_service):
@@ -969,16 +908,12 @@ def test_clear_participant_cache(lobby_service):
         "username": "test-username",
         "id": participant_id,
         "color": "#123456",
-        "entered_at": "2025-01-01T10:00:00+00:00",
     }
     cache.set(cache_key, participant_data, timeout=settings.LOBBY_WAITING_TIMEOUT)
-    lobby_service._index_add(room_id, participant_id)
     assert cache.get(cache_key) is not None
-    assert participant_id in lobby_service._index_members(room_id)
 
     lobby_service.clear_participant_cache(room_id, participant_id)
     assert cache.get(cache_key) is None
-    assert participant_id not in lobby_service._index_members(room_id)
 
 
 def test_clear_participant_cache_nonexistent(lobby_service):
@@ -992,85 +927,3 @@ def test_clear_participant_cache_nonexistent(lobby_service):
     lobby_service.clear_participant_cache(room_id, participant_id)
 
     assert cache.get(cache_key) is None
-
-
-def test_index_add_members_remove_roundtrip(lobby_service):
-    """The room index records, lists and forgets participant ids."""
-    room_id = uuid.uuid4()
-
-    assert lobby_service._index_members(room_id) == frozenset()
-
-    lobby_service._index_add(room_id, "participant1")
-    lobby_service._index_add(room_id, "participant2")
-
-    assert sorted(lobby_service._index_members(room_id)) == [
-        "participant1",
-        "participant2",
-    ]
-
-    # The index carries a backstop TTL so abandoned rooms cannot leak it.
-    ttl = lobby_service._redis().ttl(lobby_service._get_index_key(room_id))
-    assert 0 < ttl <= settings.LOBBY_ACCEPTED_TIMEOUT
-
-    lobby_service._index_remove(room_id, "participant1")
-    assert lobby_service._index_members(room_id) == frozenset(["participant2"])
-
-
-@mock.patch("core.utils.notify_participants")
-def test_enter_registers_participant_in_room_index(
-    mock_notify, lobby_service, participant_id, username
-):
-    """Entering the lobby must index the participant id for the room."""
-    room_id = uuid.uuid4()
-
-    lobby_service.enter(room_id, participant_id, username)
-
-    assert lobby_service._index_members(room_id) == frozenset([participant_id])
-
-
-def test_list_waiting_participants_prunes_stale_index_ids(settings, lobby_service):
-    """Indexed ids whose cache entry expired are pruned and not listed."""
-    settings.LOBBY_KEY_PREFIX = "test-lobby-prune"
-    room_id = uuid.uuid4()
-
-    cache.set(
-        f"test-lobby-prune_{room_id!s}_participant1",
-        {
-            "id": "participant1",
-            "username": "user1",
-            "status": "waiting",
-            "color": "#123456",
-            "entered_at": "2025-01-01T10:00:00+00:00",
-        },
-        timeout=100,
-    )
-    lobby_service._index_add(room_id, "participant1")
-    # participant2 is indexed but its cache entry has expired.
-    lobby_service._index_add(room_id, "participant2")
-
-    result = lobby_service.list_waiting_participants(room_id)
-
-    assert [participant["id"] for participant in result] == ["participant1"]
-    assert lobby_service._index_members(room_id) == frozenset(["participant1"])
-
-
-def test_refresh_waiting_status_rearms_room_index_ttl(lobby_service, participant_id):
-    """A lone waiter's polling must keep the room index alive.
-
-    Regression test: the index backstop TTL is only armed at enter() time,
-    so a participant whose rolling WAITING refreshes outlast it would keep
-    their entry alive while silently vanishing from the moderator list.
-    Refreshing the waiting status must therefore re-arm the index TTL.
-    """
-    room_id = uuid.uuid4()
-    lobby_service._index_add(room_id, participant_id)
-
-    index_key = lobby_service._get_index_key(room_id)
-    redis_client = lobby_service._redis()
-    redis_client.expire(index_key, 10)
-    assert redis_client.ttl(index_key) <= 10
-
-    lobby_service.refresh_waiting_status(room_id, participant_id)
-
-    assert redis_client.ttl(index_key) > 10
-    assert lobby_service._index_members(room_id) == frozenset([participant_id])

src/backend/core/tests/services/test_presence.py

@@ -90,18 +90,19 @@ def test_presence_clear_and_clear_room():
     assert presence.is_marked_present(other_room, "a") is True
 
 
-def test_presence_clear_room_removes_many_entries_and_the_index():
+def test_presence_clear_room_scans_in_pages():
-    """clear_room removes every entry of the room through the index — never
+    """clear_room removes every match, even across several SCAN pages,
-    a keyspace scan — and leaves other rooms untouched."""
+    and only within the room."""
     room_id, other_room = str(uuid4()), str(uuid4())
     presence = PresenceCache()
     for i in range(7):
         presence.mark_present(room_id, f"user-{i}")
     presence.mark_present(other_room, "user-0")
 
-    presence.clear_room(room_id)
+    # An itersize smaller than the match count forces delete_pattern to
+    # page through several SCAN cursors rather than finish in one pass.
+    with mock.patch("core.utils.CACHE_SCAN_ITERSIZE", 3):
+        presence.clear_room(room_id)
 
     assert all(not presence.is_marked_present(room_id, f"user-{i}") for i in range(7))
     assert presence.is_marked_present(other_room, "user-0") is True
-    assert presence._index_members(room_id) == frozenset([])
-    assert presence._index_members(other_room) == frozenset(["user-0"])

src/backend/core/tests/test_external_api_authentication.py

@@ -0,0 +1,96 @@
+"""Tests for the external API ResourceServerBackend."""
+
+from django.core.exceptions import SuspiciousOperation
+
+import pytest
+import responses
+from rest_framework.test import APIClient
+
+from core.external_api.authentication import ResourceServerBackend
+from core.factories import UserFactory
+from core.models import User
+
+pytestmark = pytest.mark.django_db
+
+
+def _payload(sub):
+    return {"sub": sub, "active": True, "scope": "lasuite_meet", "client_id": "app"}
+
+
+def test_resource_server_backend_get_or_create_user_active():
+    """An existing active user matching the sub should be returned."""
+
+    user = UserFactory()
+
+    result = ResourceServerBackend().get_or_create_user(
+        access_token="token", id_token=None, payload=_payload(user.sub)
+    )
+
+    assert result == user
+
+
+def test_resource_server_backend_get_or_create_user_inactive():
+    """An inactive user should be rejected even with a valid token."""
+
+    user = UserFactory(is_active=False)
+
+    with pytest.raises(SuspiciousOperation, match="User account is disabled."):
+        ResourceServerBackend().get_or_create_user(
+            access_token="token", id_token=None, payload=_payload(user.sub)
+        )
+
+
+def test_resource_server_backend_get_or_create_user_creates(settings):
+    """An unknown sub should create an active user when OIDC_CREATE_USER is set."""
+
+    settings.OIDC_CREATE_USER = True
+
+    result = ResourceServerBackend().get_or_create_user(
+        access_token="token", id_token=None, payload=_payload("new-sub")
+    )
+
+    assert result.sub == "new-sub"
+    assert result.is_active is True
+    assert User.objects.filter(sub="new-sub").exists()
+
+
+def test_resource_server_backend_get_or_create_user_no_creation(settings):
+    """An unknown sub should return None when OIDC_CREATE_USER is unset."""
+
+    settings.OIDC_CREATE_USER = False
+
+    result = ResourceServerBackend().get_or_create_user(
+        access_token="token", id_token=None, payload=_payload("new-sub")
+    )
+
+    assert result is None
+    assert not User.objects.filter(sub="new-sub").exists()
+
+
+@responses.activate
+def test_api_rooms_list_resource_server_inactive_user(settings):
+    """End to end: a valid introspected token for an inactive user should get 401."""
+
+    settings.OIDC_OP_INTROSPECTION_ENDPOINT = "https://oidc.example.com/introspect"
+    settings.OIDC_OP_URL = "https://oidc.example.com"
+
+    user = UserFactory(is_active=False)
+
+    responses.add(
+        responses.POST,
+        "https://oidc.example.com/introspect",
+        json={
+            "iss": "https://oidc.example.com",
+            "active": True,
+            "sub": user.sub,
+            "scope": "lasuite_meet",
+            "client_id": "app",
+        },
+    )
+
+    client = APIClient()
+    client.credentials(HTTP_AUTHORIZATION="Bearer rs-token")
+    response = client.get("/external-api/v1.0/rooms/")
+
+    assert response.status_code == 401
+    assert "login failed" in str(response.data).lower()

src/backend/core/utils.py

@@ -499,3 +499,6 @@ def build_telephony_config():
         "default_country": country,
         "international_phone_number": international,
     }
+
+
+CACHE_SCAN_ITERSIZE = 500

src/backend/meet/settings.py

@@ -865,7 +865,7 @@ class Base(Configuration):
         "room_lobby", environ_name="LOBBY_KEY_PREFIX", environ_prefix=None
     )
     LOBBY_WAITING_TIMEOUT = values.PositiveIntegerValue(
-        6, environ_name="LOBBY_WAITING_TIMEOUT", environ_prefix=None
+        3, environ_name="LOBBY_WAITING_TIMEOUT", environ_prefix=None
     )
     LOBBY_DENIED_TIMEOUT = values.PositiveIntegerValue(
         5, environ_name="LOBBY_DENIED_TIMEOUT", environ_prefix=None

src/backend/pyproject.toml

@@ -7,7 +7,7 @@ build-backend = "uv_build"
 
 [project]
 name = "meet"
-version = "1.31.0"
+version = "1.30.0"
 authors = [{ "name" = "DINUM", "email" = "dev@mail.numerique.gouv.fr" }]
 classifiers = [
     "Development Status :: 5 - Production/Stable",

src/backend/uv.lock

@@ -1187,7 +1187,7 @@ wheels = [
 
 [[package]]
 name = "meet"
-version = "1.31.0"
+version = "1.30.0"
 source = { editable = "." }
 dependencies = [
     { name = "aiohttp" },

src/frontend/Dockerfile

@@ -42,10 +42,20 @@ ENV VITE_APP_TITLE=${VITE_APP_TITLE}
 RUN npm run build
 
 # ---- Front-end image ----
-FROM nginxinc/nginx-unprivileged:1.30.4-alpine3.24 AS frontend-production
+FROM nginxinc/nginx-unprivileged:1.30.3-alpine3.23 AS frontend-production
 
 USER root
-RUN apk del curl
+
+# Security patches for known CVEs
+RUN apk update && apk upgrade  \
+    libcrypto3>=3.5.7-r0 \
+    libssl3>=3.5.7-r0 \
+    musl \
+    musl-utils \
+    zlib>=1.3.2-r0 \
+    libexpat>=2.8.4-r0 \
+    && apk del curl
+
 USER nginx
 
 # Un-privileged user running the application

src/frontend/package-lock.json

@@ -1,12 +1,12 @@
 {
   "name": "meet",
-  "version": "1.31.0",
+  "version": "1.30.0",
   "lockfileVersion": 3,
   "requires": true,
   "packages": {
     "": {
       "name": "meet",
-      "version": "1.31.0",
+      "version": "1.30.0",
       "dependencies": {
         "@fontsource-variable/atkinson-hyperlegible-next": "5.3.0",
         "@fontsource-variable/lexend": "5.3.0",

src/frontend/package.json

@@ -1,7 +1,7 @@
 {
   "name": "meet",
   "private": true,
-  "version": "1.31.0",
+  "version": "1.30.0",
   "type": "module",
   "scripts": {
     "dev": "panda codegen && vite",

src/frontend/src/features/auth/api/fetchUser.ts

@@ -18,7 +18,7 @@ export const fetchUser = (
   }
 ): Promise<ApiUser | false> => {
   return new Promise((resolve, reject) => {
-    fetchApi<ApiUser>('/users/me/')
+    fetchApi<ApiUser>('/users/me')
       .then(resolve)
       .catch((error) => {
         // we assume that a 401 means the user is not logged in

src/frontend/src/features/participants/api/enterRoom.ts

@@ -1,6 +1,5 @@
 import { ApiError } from '@/api/ApiError'
 import { fetchApi } from '@/api/fetchApi'
-import { captureEvent } from '@/features/analytics/telemetry'
 import { useMutation, type UseMutationOptions } from '@tanstack/react-query'
 
 export interface EnterRoomParams {
@@ -18,23 +17,13 @@ export const enterRoom = async ({
   allowEntry,
   participantId,
 }: EnterRoomParams): Promise<EnterRoomResponse> => {
-  try {
+  return await fetchApi<EnterRoomResponse>(`/rooms/${roomId}/enter/`, {
-    return await fetchApi<EnterRoomResponse>(`/rooms/${roomId}/enter/`, {
+    method: 'POST',
-      method: 'POST',
+    body: JSON.stringify({
-      body: JSON.stringify({
+      participant_id: participantId,
-        participant_id: participantId,
+      allow_entry: allowEntry,
-        allow_entry: allowEntry,
+    }),
-      }),
+  })
-    })
-  } catch (error) {
-    if (error instanceof ApiError && error.statusCode === 404) {
-      captureEvent('lobby_entry_participant_gone', {
-        room_id: roomId,
-        allow_entry: allowEntry,
-      })
-    }
-    throw error
-  }
 }
 
 export function useEnterRoom(

src/frontend/src/features/participants/api/listWaitingParticipants.ts

@@ -8,7 +8,6 @@ export type WaitingParticipant = {
   status: string
   username: string
   color: string
-  entered_at: string
 }
 
 export type WaitingParticipantsResponse = {

src/frontend/src/features/participants/hooks/useWaitingParticipants.ts

@@ -9,14 +9,6 @@ import {
 } from '../../participants/api/listWaitingParticipants'
 import { reportError } from '@/features/analytics/telemetry'
 
-const toTimestamp = (participant: WaitingParticipant): number =>
-  Date.parse(participant.entered_at)
-
-export const sortWaitingParticipants = (
-  participants: WaitingParticipant[]
-): WaitingParticipant[] =>
-  [...participants].sort((a, b) => toTimestamp(a) - toTimestamp(b))
-
 export const useWaitingParticipants = () => {
   const roomData = useRoomData()
   const roomId = roomData?.id || '' // FIXME - bad practice
@@ -30,10 +22,7 @@ export const useWaitingParticipants = () => {
     })
 
   const waitingParticipants = useMemo(
-    () =>
+    () => (canManageLobby ? waitingData?.participants || [] : []),
-      canManageLobby
-        ? sortWaitingParticipants(waitingData?.participants || [])
-        : [],
     [waitingData, canManageLobby]
   )
 

src/frontend/src/features/rooms/components/LobbyProvider.tsx

@@ -12,8 +12,8 @@ import { keys } from '@/api/queryKeys'
 import { queryClient } from '@/api/queryClient'
 import { ApiError } from '@/api/ApiError'
 
-export const POLL_INTERVAL_MS = 4_000
+export const POLL_INTERVAL_MS = 1000
-export const LAZY_POLL_INTERVAL_MS = 15_000
+export const LAZY_POLL_INTERVAL_MS = 10_000
 
 export const LobbyProvider = () => {
   const room = useRoomContext()
@@ -79,7 +79,7 @@ export const LobbyProvider = () => {
   // 3. Rights regained.
   const prevCanManageLobby = usePrevious(canManageLobby)
   useEffect(() => {
-    if (prevCanManageLobby != canManageLobby && isConnected) {
+    if (!prevCanManageLobby && canManageLobby && isConnected) {
       fetchIfManager()
     }
   }, [

src/frontend/src/features/rooms/components/Rating.tsx

@@ -16,7 +16,7 @@ const Card = styled('div', {
     borderRadius: '0.25rem',
     boxShadow: '',
     width: '100%',
-    maxWidth: '410px',
+    maxWidth: '380px',
     minHeight: '196px',
   },
 })
@@ -229,7 +229,7 @@ const ConfirmationMessage = ({ onNext }: { onNext: () => void }) => {
   return (
     <Card
       style={{
-        maxWidth: '410px',
+        maxWidth: '380px',
         display: 'flex',
         flexDirection: 'column',
         justifyContent: 'center',

src/frontend/src/features/rooms/hooks/useLobby.ts

@@ -8,7 +8,7 @@ import {
 } from '../api/requestEntry'
 
 export const WAIT_TIMEOUT_MS = 600000 // 10 minutes
-export const POLL_INTERVAL_MS = 3_000
+export const POLL_INTERVAL_MS = 1000
 
 export const useLobby = ({
   roomId,

src/frontend/src/features/rooms/routes/Feedback.tsx

@@ -24,8 +24,7 @@ const Heading = styled('h1', {
 })
 
 const buttonClass = css({
-  width: '100%',
+  width: { base: '100%', xsm: 'auto' },
-  flex: 1,
 })
 
 enum DisconnectReasonKey {
@@ -65,8 +64,8 @@ const FeedbackRoute = () => {
           <Heading>{t(`feedback.heading.${reasonKey || 'normal'}`)}</Heading>
           <Stack
             direction={{ base: 'column', xsm: 'row' }}
-            width="100%"
+            width={{ base: '100%', xsm: 'auto' }}
-            maxWidth="410px"
+            maxWidth="380px"
           >
             {showBackButton && (
               <Button

src/frontend/src/layout/Header.tsx

@@ -35,21 +35,30 @@ const LoginHint = () => {
     <div
       className={css({
         position: 'absolute',
-        top: 'calc(100% + 12px)',
+        top: '103px',
-        right: 0,
+        right: '110px',
         zIndex: '100',
         outline: 'none',
         padding: '1.25rem',
-        width: 'max-content',
+        maxWidth: '350px',
-        maxWidth: 'min(350px, calc(100vw - 2rem))',
         boxShadow: '0 2px 5px rgba(0 0 0 / 0.1)',
         borderRadius: '1rem',
         backgroundColor: 'primary.200',
+        display: 'none',
+        xsm: {
+          display: 'block',
+        },
+        sm: {
+          top: '131px',
+          right: '100px',
+          zIndex: '100',
+        },
         _after: {
           content: '""',
           position: 'absolute',
           top: '-10px',
-          right: '1.5rem',
+          right: '20%',
+          marginLeft: '-10px',
           borderWidth: '0 10px 10px 10px',
           borderStyle: 'solid',
           borderColor: 'transparent transparent #E3E3FB transparent',
@@ -162,13 +171,12 @@ export const Header = () => {
                   <>
                     <div
                       className={css({
-                        position: 'relative',
                         display: { base: 'none', xsm: 'block' },
                       })}
                     >
                       <LoginButton proConnectHint={false} />
-                      <LoginHint />
                     </div>
+                    <LoginHint />
                   </>
                 )}
               {!!user && (

src/mail/package-lock.json

@@ -1,12 +1,12 @@
 {
   "name": "mail_mjml",
-  "version": "1.31.0",
+  "version": "1.30.0",
   "lockfileVersion": 3,
   "requires": true,
   "packages": {
     "": {
       "name": "mail_mjml",
-      "version": "1.31.0",
+      "version": "1.30.0",
       "license": "MIT",
       "dependencies": {
         "@html-to/text-cli": "0.6.1",

src/mail/package.json

@@ -1,6 +1,6 @@
 {
   "name": "mail_mjml",
-  "version": "1.31.0",
+  "version": "1.30.0",
   "description": "An util to generate html and text django's templates from mjml templates",
   "type": "module",
   "dependencies": {

src/sdk/package-lock.json

@@ -1,12 +1,12 @@
 {
   "name": "sdk",
-  "version": "1.31.0",
+  "version": "1.30.0",
   "lockfileVersion": 3,
   "requires": true,
   "packages": {
     "": {
       "name": "sdk",
-      "version": "1.31.0",
+      "version": "1.30.0",
       "license": "ISC",
       "workspaces": [
         "./library",

src/sdk/package.json

@@ -1,6 +1,6 @@
 {
   "name": "sdk",
-  "version": "1.31.0",
+  "version": "1.30.0",
   "author": "",
   "license": "ISC",
   "description": "",

src/summary/pyproject.toml

@@ -1,7 +1,7 @@
 
 [project]
 name = "summary"
-version = "1.31.0"
+version = "1.30.0"
 requires-python = ">=3.13"
 dependencies = [
     "fastapi[standard]>=0.105.0",

src/summary/uv.lock

@@ -1507,7 +1507,7 @@ wheels = [
 
 [[package]]
 name = "summary"
-version = "1.31.0"
+version = "1.30.0"
 source = { editable = "." }
 dependencies = [
     { name = "celery" },