✨(backend) allow configuring trace sampling

Add a configuration knob for the trace sampling rate, so we can
enable tracing on middleware and cache spans when debugging slow
requests in production.

Sampling is set to 0 by default, so tracing stays fully off unless
explicitly enabled.

CHANGELOG.md

@@ -8,17 +8,9 @@ and this project adheres to
 
 ## [Unreleased]
 
-### Changed
-
-- 📈(frontend) include LiveKit SIDs in the connection analytics event
-- 🔇(backend) silence expected 401 warnings on /me
-- 🔇(backend) silence noisy request summary info logs
-
 ### Fixed
 
-- 🐛(backend) acknowledge unknown LiveKit webhook events instead of 422
 - 🔒️(backend) enforce display name setting on rename API
-- 🔒️(backend) reject inactive users in resource server backend
 
 ## [1.31.0] - 2026-09-08
 

src/backend/core/external_api/authentication.py

@@ -286,10 +286,6 @@ class ResourceServerBackend(LaSuiteBackend):
         if user is None and settings.OIDC_CREATE_USER:
             user = self.create_user(sub)
 
-        if user is not None and not user.is_active:
-            logger.warning("Inactive user attempted authentication: %s", user.pk)
-            raise SuspiciousOperation("User account is disabled.")
-
         return user
 
     def create_user(self, sub):

src/backend/core/logging_filters.py

@@ -1,25 +0,0 @@
-"""Logging filters for the core application."""
-
-import logging
-
-from django.conf import settings
-
-
-class SilenceExpected401(logging.Filter):
-    """Drop the expected 401 from anonymous hits on the /me endpoint.
-
-    The frontend probes `/users/me/` to check authentication; a 401 for
-    anonymous users is normal, not a warning worth logging.
-    """
-
-    def filter(self, record):
-        """Return False for a 401 on a silenced path, True otherwise."""
-        if getattr(record, "status_code", None) != 401:
-            return True
-
-        request = getattr(record, "request", None)
-        path = getattr(request, "path", None)
-        if not path:
-            return True
-
-        return path not in settings.LOGGING_SILENCED_401_PATHS

src/backend/core/services/livekit_events.py

@@ -52,6 +52,12 @@ class InvalidPayloadError(LiveKitWebhookError):
     status_code = 400
 
 
+class UnsupportedEventTypeError(LiveKitWebhookError):
+    """Unsupported event type."""
+
+    status_code = 422
+
+
 class ActionFailedError(LiveKitWebhookError):
     """Webhook action fails to process or complete."""
 
@@ -68,7 +74,6 @@ class LiveKitWebhookEventType(Enum):
     # Participant events
     PARTICIPANT_JOINED = "participant_joined"
     PARTICIPANT_LEFT = "participant_left"
-    PARTICIPANT_CONNECTION_ABORTED = "participant_connection_aborted"
 
     # Track events
     TRACK_PUBLISHED = "track_published"
@@ -148,13 +153,10 @@ class LiveKitEventsService:
 
         try:
             webhook_type = LiveKitWebhookEventType(data.event)
-        except ValueError:
-            logger.warning(
-                "Ignoring unknown LiveKit webhook event type '%s' for room '%s'",
-                data.event,
-                room_name,
-            )
-            return
+        except ValueError as e:
+            raise UnsupportedEventTypeError(
+                f"Unknown webhook type: {data.event}"
+            ) from e
 
         # Handle according to received webhook type
         handler = self._webhook_handlers.get(webhook_type.value)

src/backend/core/tests/rooms/test_api_rooms_webhook.py

@@ -94,7 +94,7 @@ def test_invalid_payload(client, auth_token, mock_livekit_config):
 
 
 def test_unknown_event_type(client, mock_livekit_config):
-    """Should acknowledge (200) an unknown event type rather than reject it."""
+    """Should return 422 for unknown event type."""
     event_data = json.dumps({"event": "unknown_event_type"})
 
     # Generate auth token for this specific payload
@@ -112,8 +112,10 @@ def test_unknown_event_type(client, mock_livekit_config):
         HTTP_AUTHORIZATION=auth_token,
     )
 
-    assert response.status_code == 200
-    assert response.json() == {"status": "success"}
+    assert response.status_code == 422
+    assert response.json() == {
+        "status": "error",
+    }
 
 
 @mock.patch.object(LiveKitEventsService, "_handle_room_finished")

src/backend/core/tests/services/test_livekit_events.py

@@ -16,6 +16,7 @@ from core.services.livekit_events import (
     AuthenticationError,
     InvalidPayloadError,
     LiveKitEventsService,
+    UnsupportedEventTypeError,
     api,
 )
 from core.services.lobby import LobbyService
@@ -664,27 +665,22 @@ def test_receive_missing_auth(service):
 
 
 @mock.patch.object(api.WebhookReceiver, "receive")
-def test_receive_unknown_event_is_acknowledged(mock_receive, service, caplog):
-    """Unknown event types are logged and ignored, not rejected.
-
-    LiveKit adds event types over time and does not retry 4xx responses, so
-    raising here would silently drop the event.
-    """
+def test_receive_unsupported_event(mock_receive, service):
+    """Should raise LiveKitWebhookError for unsupported events."""
     mock_request = mock.MagicMock()
     mock_request.headers = {"Authorization": "test_token"}
     mock_request.body = b"{}"
 
+    # Mock returned data with unsupported event type
     mock_data = mock.MagicMock()
     mock_data.room.name = str(uuid.uuid4())
-    mock_data.event = "some_future_event"
+    mock_data.event = "unsupported_event"
     mock_receive.return_value = mock_data
 
-    with caplog.at_level("WARNING", logger="core.services.livekit_events"):
-        service.receive(mock_request)  # must not raise
-
-    assert "Ignoring unknown LiveKit webhook event type 'some_future_event'" in (
-        caplog.text
-    )
+    with pytest.raises(
+        UnsupportedEventTypeError, match="Unknown webhook type: unsupported_event"
+    ):
+        service.receive(mock_request)
 
 
 @mock.patch.object(api.WebhookReceiver, "receive")

src/backend/core/tests/test_external_api_authentication.py

@@ -1,96 +0,0 @@
-"""Tests for the external API ResourceServerBackend."""
-
-from django.core.exceptions import SuspiciousOperation
-
-import pytest
-import responses
-from rest_framework.test import APIClient
-
-from core.external_api.authentication import ResourceServerBackend
-from core.factories import UserFactory
-from core.models import User
-
-pytestmark = pytest.mark.django_db
-
-
-def _payload(sub):
-    return {"sub": sub, "active": True, "scope": "lasuite_meet", "client_id": "app"}
-
-
-def test_resource_server_backend_get_or_create_user_active():
-    """An existing active user matching the sub should be returned."""
-
-    user = UserFactory()
-
-    result = ResourceServerBackend().get_or_create_user(
-        access_token="token", id_token=None, payload=_payload(user.sub)
-    )
-
-    assert result == user
-
-
-def test_resource_server_backend_get_or_create_user_inactive():
-    """An inactive user should be rejected even with a valid token."""
-
-    user = UserFactory(is_active=False)
-
-    with pytest.raises(SuspiciousOperation, match="User account is disabled."):
-        ResourceServerBackend().get_or_create_user(
-            access_token="token", id_token=None, payload=_payload(user.sub)
-        )
-
-
-def test_resource_server_backend_get_or_create_user_creates(settings):
-    """An unknown sub should create an active user when OIDC_CREATE_USER is set."""
-
-    settings.OIDC_CREATE_USER = True
-
-    result = ResourceServerBackend().get_or_create_user(
-        access_token="token", id_token=None, payload=_payload("new-sub")
-    )
-
-    assert result.sub == "new-sub"
-    assert result.is_active is True
-    assert User.objects.filter(sub="new-sub").exists()
-
-
-def test_resource_server_backend_get_or_create_user_no_creation(settings):
-    """An unknown sub should return None when OIDC_CREATE_USER is unset."""
-
-    settings.OIDC_CREATE_USER = False
-
-    result = ResourceServerBackend().get_or_create_user(
-        access_token="token", id_token=None, payload=_payload("new-sub")
-    )
-
-    assert result is None
-    assert not User.objects.filter(sub="new-sub").exists()
-
-
-@responses.activate
-def test_api_rooms_list_resource_server_inactive_user(settings):
-    """End to end: a valid introspected token for an inactive user should get 401."""
-
-    settings.OIDC_OP_INTROSPECTION_ENDPOINT = "https://oidc.example.com/introspect"
-    settings.OIDC_OP_URL = "https://oidc.example.com"
-
-    user = UserFactory(is_active=False)
-
-    responses.add(
-        responses.POST,
-        "https://oidc.example.com/introspect",
-        json={
-            "iss": "https://oidc.example.com",
-            "active": True,
-            "sub": user.sub,
-            "scope": "openid lasuite_meet rooms:list",
-            "client_id": "app",
-        },
-    )
-
-    client = APIClient()
-    client.credentials(HTTP_AUTHORIZATION="Bearer rs-token")
-    response = client.get("/external-api/v1.0/rooms/")
-
-    assert response.status_code == 401
-    assert "login failed" in str(response.data).lower()

src/backend/meet/settings.py

@@ -1113,12 +1113,6 @@ class Base(Configuration):
         environ_prefix=None,
     )
 
-    LOGGING_SILENCED_401_PATHS = values.ListValue(
-        default=["/api/v1.0/users/me/"],
-        environ_name="LOGGING_SILENCED_401_PATHS",
-        environ_prefix=None,
-    )
-
     # Logging
     # We want to make it easy to log to console but by default we log production
     # to Sentry and don't want to log to console.
@@ -1131,16 +1125,10 @@ class Base(Configuration):
                 "style": "{",
             },
         },
-        "filters": {
-            "silence_expected_401": {
-                "()": "core.logging_filters.SilenceExpected401",
-            },
-        },
         "handlers": {
             "console": {
                 "class": "logging.StreamHandler",
                 "formatter": "simple",
-                "filters": ["silence_expected_401"],
             },
         },
         # Override root logger to send it to console
@@ -1151,13 +1139,6 @@ class Base(Configuration):
             ),
         },
         "loggers": {
-            "request.summary": {
-                "level": values.Value(
-                    "WARNING",
-                    environ_name="LOGGING_LEVEL_REQUEST_SUMMARY",
-                    environ_prefix="",
-                )
-            },
             "core": {
                 "handlers": ["console"],
                 "level": values.Value(

src/frontend/src/features/rooms/livekit/components/ConnectionObserver.tsx

@@ -71,30 +71,20 @@ export const ConnectionObserver = () => {
   useEffect(() => {
     if (!isAnalyticsEnabled) return
 
-    const handleConnection = async () => {
+    const handleConnection = () => {
       // Preserve original connection timestamp across reconnections to measure
       // total session duration from first connect to final disconnect.
       if (connectionStartTimeRef.current != null) return
       connectionStartTimeRef.current = Date.now()
-      const participantSid = room.localParticipant.sid
-      const roomSid = await room.getSid().catch(() => undefined)
-      void captureMediaEvent('connection-event', {
-        livekit_room_sid: roomSid,
-        livekit_participant_sid: participantSid,
-      })
+      void captureMediaEvent('connection-event', {})
     }
 
     const handleReconnect = () => {
       captureEvent('reconnect-event')
     }
 
-    const handleReconnected = async () => {
-      const participantSid = room.localParticipant.sid
-      const roomSid = await room.getSid().catch(() => undefined)
-      captureEvent('reconnected-event', {
-        livekit_room_sid: roomSid,
-        livekit_participant_sid: participantSid,
-      })
+    const handleReconnected = () => {
+      captureEvent('reconnected-event')
     }
 
     const handleSignalingConnect = () => {

src/frontend/src/locales/de/rooms.json

@@ -480,7 +480,7 @@
       "destination": "Ein neues Dokument wird erstellt auf",
       "destinationUnknown": "Ein neues Dokument wird erstellt",
       "language": "Meeting-Sprache:",
-      "recording": "Auch eine Videoaufzeichnung starten"
+      "recording": "Auch eine Aufzeichnung starten"
     },
     "button": {
       "start": "Meeting-Transkription starten",

src/frontend/src/locales/en/rooms.json

@@ -480,7 +480,7 @@
       "destination": "A new document will be created on",
       "destinationUnknown": "A new document will be created",
       "language": "Meeting language:",
-      "recording": "Also start a video recording"
+      "recording": "Also start a recording"
     },
     "button": {
       "start": "Start transcribing the meeting",

src/frontend/src/locales/es/rooms.json

@@ -479,7 +479,7 @@
       "destination": "Se creará un nuevo documento en",
       "destinationUnknown": "Se creará un nuevo documento",
       "language": "Idioma de la reunión:",
-      "recording": "Iniciar también una grabación de vídeo"
+      "recording": "Iniciar también una grabación"
     },
     "button": {
       "start": "Empezar a transcribir la reunión",

src/frontend/src/locales/fr/rooms.json

@@ -480,7 +480,7 @@
       "destination": "Un nouveau document sera créé sur",
       "destinationUnknown": "Un nouveau document sera créé",
       "language": "Langue de la réunion :",
-      "recording": "Démarrer aussi un enregistrement vidéo"
+      "recording": "Démarrer aussi un enregistrement"
     },
     "button": {
       "start": "Commencer à transcrire la réunion",

src/frontend/src/locales/nl/rooms.json

@@ -480,7 +480,7 @@
       "destination": "Er wordt een nieuw document aangemaakt op",
       "destinationUnknown": "Een nieuw document wordt aangemaakt",
       "language": "Vergadertalen:",
-      "recording": "Start ook een video-opname"
+      "recording": "Start ook een opname"
     },
     "button": {
       "start": "Begin met het transcriberen van de vergadering",