wip sign participant lobby

Only run the transit_code exchange flow when the app is loaded in an
embedded context (i.e. inside an iframe).

Combined with the CSP rules that will restrict which origins are
allowed to embed the app, this gives us a client-side lever to
control which integrations can actually use this authentication
path.

.github/ISSUE_TEMPLATE/Bug_report.md

@@ -0,0 +1,28 @@
+---
+name: 🐛 Bug Report
+about: If something is not working as expected 🤔.
+
+---
+
+## Bug Report
+
+**Problematic behavior**
+A clear and concise description of the behavior.
+
+**Expected behavior/code**
+A clear and concise description of what you expected to happen (or code).
+
+**Steps to Reproduce**
+1. Do this...
+2. Then this...
+3. And then the bug happens!
+
+**Environment**
+- Meet version:
+- Platform:
+
+**Possible Solution**
+<!--- Only if you have suggestions on a fix for the bug -->
+
+**Additional context/Screenshots**
+Add any other context about the problem here. If applicable, add screenshots to help explain.

.github/ISSUE_TEMPLATE/Feature_request.md

@@ -0,0 +1,23 @@
+---
+name: ✨ Feature Request
+about: I have a suggestion (and may want to build it 💪)!
+
+---
+
+## Feature Request
+
+**Is your feature request related to a problem or unsupported use case? Please describe.**
+A clear and concise description of what the problem is. For example: I need to do some task and I have an issue...
+
+**Describe the solution you'd like**
+A clear and concise description of what you want to happen. Add any considered drawbacks.
+
+**Describe alternatives you've considered**
+A clear and concise description of any alternative solutions or features you've considered.
+
+**Discovery, Documentation, Adoption, Migration Strategy**
+If you can, explain how users will be able to use this and possibly write out a version the docs (if applicable).
+Maybe a screenshot or design?
+
+**Do you want to work on it through a Pull Request?**
+<!-- Make sure to coordinate with us before you spend too much time working on an implementation! -->

.github/ISSUE_TEMPLATE/Support_question.md

@@ -0,0 +1,22 @@
+---
+name: 🤗 Support Question
+about: If you have a question 💬, or something was not clear from the docs!
+
+---
+
+<!-- ^ Click "Preview" for a nicer view! ^
+We primarily use GitHub as an issue tracker. If however you're encountering an issue not covered in the docs, we may be able to help! -->
+
+---
+
+Please make sure you have read our [main Readme](https://github.com/numerique-gouv/meet).
+
+Also make sure it was not already answered in [an open or close issue](https://github.com/numerique-gouv/meet/issues).
+
+If your question was not covered, and you feel like it should be, fire away! We'd love to improve our docs! 👌
+
+**Topic**
+What's the general area of your question: for example, docker setup, database schema, search functionality,...
+
+**Question**
+Try to be as specific as possible so we can help you as best we can. Please be patient 🙏

.github/PULL_REQUEST_TEMPLATE.md

@@ -0,0 +1,11 @@
+## Purpose
+
+Description...
+
+
+## Proposal
+
+Description...
+
+- [] item 1...
+- [] item 2...

.github/workflows/ci.yml

@@ -226,9 +226,8 @@ jobs:
       REDIS_URL: redis://localhost:6379/1
       STORAGES_STATICFILES_BACKEND: django.contrib.staticfiles.storage.StaticFilesStorage
       AWS_S3_ENDPOINT_URL: http://localhost:9000
-      AWS_S3_ACCESS_KEY_ID: meet-access-key
-      AWS_S3_SECRET_ACCESS_KEY: meet-secret-access-key
-      AWS_S3_REGION_NAME: local
+      AWS_S3_ACCESS_KEY_ID: meet
+      AWS_S3_SECRET_ACCESS_KEY: password
       OIDC_RS_CLIENT_ID: meet
       OIDC_RS_CLIENT_SECRET: ThisIsAnExampleKeyForDevPurposeOnly
       OIDC_OP_INTROSPECTION_ENDPOINT: https://oidc.example.com/introspect
@@ -251,22 +250,34 @@ jobs:
           path: "src/backend/core/templates/mail"
           key: mail-templates-${{ hashFiles('src/mail/mjml') }}
 
-      # Creates the access key and the bucket on startup
-      - name: Start Garage
+      - name: Start MinIO
         run: |
-          docker run -d --name garage \
+          docker pull quay.io/minio/minio
+          docker run -d --name minio \
             -p 9000:9000 \
-            -v "${GITHUB_WORKSPACE}/docker/files/etc/garage/garage.toml:/etc/garage.toml:ro" \
-            -e "GARAGE_RPC_SECRET=$(openssl rand -hex 32)" \
-            -e "GARAGE_DEFAULT_ACCESS_KEY=meet-access-key" \
-            -e "GARAGE_DEFAULT_SECRET_KEY=meet-secret-access-key" \
-            -e "GARAGE_DEFAULT_BUCKET=meet-media-storage" \
-            dxflrs/garage:v2.4.1 \
-            /garage server --single-node --default-bucket
+            -e "MINIO_ACCESS_KEY=meet" \
+            -e "MINIO_SECRET_KEY=password" \
+            -v /data/media:/data \
+            quay.io/minio/minio server --console-address :9001 /data
 
-      - name: Wait for Garage to be ready
+      # Tool to wait for a service to be ready
+      - name: Install Dockerize
         run: |
-          timeout 30 sh -c 'until docker exec garage /garage health; do sleep 1; done'
+          curl --proto "=https" --proto-redir "=https" --tlsv1.2 -sSLf \
+            https://github.com/jwilder/dockerize/releases/download/v0.8.0/dockerize-linux-amd64-v0.8.0.tar.gz |
+            sudo tar -C /usr/local/bin -xzv
+
+      - name: Wait for MinIO to be ready
+        run: |
+          dockerize -wait tcp://localhost:9000 -timeout 10s
+
+      - name: Configure MinIO
+        run: |
+          MINIO=$(docker ps | grep minio/minio | sed -E 's/.*\s+([a-zA-Z0-9_-]+)$/\1/')
+          docker exec ${MINIO} sh -c \
+            "mc alias set meet http://localhost:9000 meet password && \
+            mc alias ls && \
+            mc mb meet/meet-media-storage"
 
       - name: Install Python
         uses: actions/setup-python@ece7cb06caefa5fff74198d8649806c4678c61a1 # v6.3.0
@@ -299,9 +310,9 @@ jobs:
     env:
       AUTHORIZED_TENANTS: '[{"id": "test-tenant", "api_key": "test-api-token", "webhook_url": "https://example.com/webhook", "webhook_api_key": "test-webhook-api-key"}]'
       AWS_STORAGE_BUCKET_NAME: "http://meet-media-storage"
-      AWS_S3_ENDPOINT_URL: "garage:9000"
-      AWS_S3_ACCESS_KEY_ID: "meet-access-key"
-      AWS_S3_SECRET_ACCESS_KEY: "meet-secret-access-key"
+      AWS_S3_ENDPOINT_URL: "minio:9000"
+      AWS_S3_ACCESS_KEY_ID: "meet"
+      AWS_S3_SECRET_ACCESS_KEY: "password"
       WHISPERX_BASE_URL: "https://configure-your-url.com"
       WHISPERX_ASR_MODEL: "large-v2"
       WHISPERX_API_KEY: "test-whisperx-secret"

CHANGELOG.md

@@ -8,39 +8,13 @@ and this project adheres to
 
 ## [Unreleased]
 
-### Changed
-
-- ⬆️(backend) update python dependencies
-- ⬆️(summary) update python dependencies
-- ⬆️(agents) update python dependencies
-
-### Fixed
-
-- ⚡️(frontend) disable posthog-js periodic feature flag reloads
-
-## [1.32.1] - 2026-09-25
-
-### Fixed
-
-- 🔒️(backend) fix CVE-2026-73228 and CVE-2026-73229 in drf
-- 🔒️(agent) fix CRITICAL CVE-2026-63072 / CVE-2026-63073 in libssl3t64
-
-## [1.32.0] - 2026-09-25
-
 ### Added
 
 - ✨(backend) make the LiveKit default video codec configurable
-- ✨(backend) purge rooms inactive for a configurable period
 - 🔧(dev) add support for Bureautix workstations
-- ✨(frontend) add screen share zoom controls #1498
-- 🔨(makefile) add targets to list and download files stored in Garage
 
 ### Changed
 
-- 🔥(backend) remove unused API viewset and permission helpers
-- 🔊(backend) pin the dockerflow logger level to WARNING
-- 🚑️(summary) serve health endpoints with the dockerflow router
-- ♻️(backend) serve the dockerflow views early in the middleware stack
 - 📈(frontend) include LiveKit SIDs in the connection analytics event
 - 🔇(backend) silence expected 401 warnings on /me
 - 🔇(backend) silence noisy request summary info logs
@@ -49,29 +23,15 @@ and this project adheres to
 - ⬆️(frontend) upgrade posthog-js from 1.414.0 to 1.418.10
 - ⬆️(addons) upgrade i18next from 26.3.6 to 26.4.0
 - ⬆️(frontend) upgrade humanize-duration from 3.33.2 to 3.34.1
-- ⬆️(addons) upgrade i18next from 26.4.0 to 26.4.2
-- 🔖(helm) release chart 0.0.28
-- ♻️(backend) decouple recording event handling from LiveKit egress statuses
-- ♻️(agents) replace the minio client by boto3
-- 🔧(compose) replace MinIO by Garage for local development
-- 🔧(helm) point media services to Garage by default
 
 ### Fixed
 
-- 🐛(helm) probe liveness on __lbheartbeat__ and readiness on __heartbeat__
-- 🐛(helm) render periodSeconds and failureThreshold on probes
 - 🐛(backend) report the app release to Sentry instead of "NA"
 - 🐛(frontend) play the waiting room notification sound on every arrival
-- 🐛(frontend) apply saved reception resolution when joining a meeting #1714
 - 🐛(backend) acknowledge unknown LiveKit webhook events instead of 422
 - 🔒️(backend) enforce display name setting on rename API
 - 🔒️(backend) reject inactive users in resource server backend
 - 🐛(frontend) fix file permissions in the Docker image
-- 🚸(frontend) inform user that recording waits until a track is published
-- 🔒(backend) upgrade base image to python:3.13.5-alpine3.24
-- 🐛(backend) handle failed and aborted egresses
-- 🩹(frontend) notify participants when a recording fails or is aborted
-- 🔒️(frontend) fix HIGH CVE-2026-93990 in libexpat
 
 ## [1.31.0] - 2026-09-08
 

Dockerfile

@@ -1,7 +1,7 @@
 # Django Meet
 
 # ---- base image to inherit from ----
-FROM python:3.13.15-alpine3.24 AS base
+FROM python:3.13.5-alpine3.21 AS base
 
 # Upgrade pip to its latest release to speed up dependencies installation
 RUN python -m pip install --upgrade pip

Makefile

@@ -69,22 +69,6 @@ LINT_SUMMARY        = echo 'lint:ruff-format started…' && $(LINT_RUFF_FORMAT)
 # -- Frontend
 PATH_FRONT          = ./src/frontend
 
-# -- Storage
-GARAGE_BUCKET       = meet-media-storage
-STORAGE_FOLDERS     = recordings transcripts summaries
-STORAGE_DIRS        = $(addprefix data/,$(STORAGE_FOLDERS))
-COMPOSE_RUN_AWS     = $(COMPOSE_RUN) --user $(DOCKER_USER)
-AWS_CLI             = garage-cors --endpoint-url=http://garage:9000
-# Extensions listed in each folder (skips the Egress manifests in recordings/)
-recordings_EXTENSIONS  = mp4 ogg
-transcripts_EXTENSIONS = json
-summaries_EXTENSIONS   = txt
-# $(1): folder. Lists its objects with a known extension, most recent first
-storage_list        = s3api list-objects-v2 --bucket $(GARAGE_BUCKET) \
-  --prefix $(1)/
-storage_query       = reverse(sort_by(Contents[?$(foreach ext,$($(1)_EXTENSIONS), \
-  ends_with(Key, `".$(ext)"`) ||) `false`] || `[]`, &LastModified))
-
 # ==============================================================================
 # RULES
 
@@ -93,9 +77,6 @@ default: help
 data/media:
 	@mkdir -p data/media
 
-$(STORAGE_DIRS):
-	@mkdir -p $@
-
 data/static:
 	@mkdir -p data/static
 
@@ -104,7 +85,6 @@ data/static:
 create-env-files: ## Copy the dist env files to env files
 create-env-files: \
 	env.d/development/common \
-	env.d/development/garage \
 	env.d/development/crowdin \
 	env.d/development/postgresql \
 	env.d/development/kc_postgresql \
@@ -337,38 +317,12 @@ env.d/development/summary:
 env.d/development/kube-secret:
 	cp -n env.d/development/kube-secret.dist env.d/development/kube-secret
 
-env.d/development/garage:
-	sed "s/^GARAGE_RPC_SECRET=.*/GARAGE_RPC_SECRET=$$(openssl rand -hex 32)/" \
-		env.d/development/garage.dist > env.d/development/garage
-
 env.d/development/multi_user_transcriber:
 	cp -n env.d/development/multi_user_transcriber.dist env.d/development/multi_user_transcriber
 
 env.d/development/metadata_collector:
 	cp -n env.d/development/metadata_collector.dist env.d/development/metadata_collector
 
-# -- Storage
-
-recordings-download-latest: ## download the latest recording from Garage into data/recordings
-transcripts-download-latest: ## download the latest transcript from Garage into data/transcripts
-summaries-download-latest: ## download the latest summary from Garage into data/summaries
-$(STORAGE_FOLDERS:%=%-download-latest): %-download-latest: data/%
-	@key=$$($(COMPOSE_RUN_AWS) -T $(AWS_CLI) $(call storage_list,$*) \
-		--query '$(call storage_query,$*)[0].Key' --output text) && \
-	if [ "$$key" = "None" ]; then echo "No $* found"; exit 1; fi && \
-	$(COMPOSE_RUN_AWS) --volume $(CURDIR)/data/$*:/aws/data/$* \
-		$(AWS_CLI) s3 cp "s3://$(GARAGE_BUCKET)/$$key" data/$*/
-.PHONY: $(STORAGE_FOLDERS:%=%-download-latest)
-
-recordings-list: ## list recordings stored in Garage, most recent first
-transcripts-list: ## list transcripts stored in Garage, most recent first
-summaries-list: ## list summaries stored in Garage, most recent first
-$(STORAGE_FOLDERS:%=%-list): %-list:
-	@$(COMPOSE_RUN_AWS) $(AWS_CLI) $(call storage_list,$*) \
-		--query '$(call storage_query,$*)[].{Date: LastModified, Key: Key, "Size (bytes)": Size}' \
-		--output table
-.PHONY: $(STORAGE_FOLDERS:%=%-list)
-
 # -- Internationalization
 
 env.d/development/crowdin:

UPGRADE.md

@@ -16,44 +16,6 @@ the following command inside your docker container:
 
 ## [Unreleased]
 
-### Purging inactive rooms
-
-Rooms now keep track of the last time they were started (`last_started_at`), fed by LiveKit's `room_started` webhook. A new `purge_inactive_rooms` management command permanently deletes the rooms that have not been started for `ROOM_INACTIVITY_DELETION_DAYS` days. See [the room purge documentation](docs/features/room-purge.md).
-
-- The feature is **disabled by default**: nothing is deleted unless you set `ROOM_INACTIVITY_DELETION_DAYS`.
-- The migration marks every existing room as started at the time of the upgrade, so no existing room can be purged before a full inactivity period has elapsed after upgrading.
-- Rooms holding a saved recording their users may still access are kept: any saved recording, or, when `RECORDING_EXPIRATION_DAYS` is set, a saved recording created within that window.
-- Inactivity is measured from LiveKit's `room_started` webhook: if it is not delivered to your backend, rooms in daily use look inactive and get purged.
-- When a room is purged, all it's configuration and access rights are also deleted. Its slug becomes available again and can be reused when a meeting is created from that same URL.
-
-* With `ALLOW_UNREGISTERED_ROOMS=false`, only an authenticated user can navigate to a previously existing link after the room has been purged. Doing so recreates the room in the database with a fresh configuration, with that user associated with it and granted admin rights.
-* With `ALLOW_UNREGISTERED_ROOMS=true`, any user can reopen the purged room by navigating to the same URL. In that case, the room is created dynamically and no corresponding room entry is persisted in the database.
-
-### Local development: MinIO replaced by Garage
-
-The development stacks now use [Garage](https://garagehq.deuxfleurs.fr/) instead of MinIO as S3 storage. Garage keeps its own format in `data/media/meta` and `data/media/data` and cannot read what MinIO left there, so local recordings and files will be lost.
-
-To migrate a local environment:
-
-1. Stop the stack and remove its containers, including the former `minio` one: `docker compose down --remove-orphans`
-2. Optionally reclaim the space used by MinIO: `rm -rf data/media && make data/media`
-3. In your `env.d/development/*` files, replace `minio:9000` by `garage:9000`, the `meet` / `password` credentials by `meet-access-key` / `meet-secret-access-key`, and add `AWS_S3_REGION_NAME=local` (or delete these files and run `make create-env-files`)
-4. Run `make create-env-files` to generate `env.d/development/garage`, which holds a random RPC secret for Garage.
-5. Rebuild the images, since the summary and agent images now install boto3 instead of minio
-
-### Summary service and metadata collector: boto3 replaces the minio client
-
-The summary service and the metadata collector agent now talk to S3 through boto3 instead of the minio client, with the same settings.
-Requests are now signed for `AWS_S3_REGION_NAME` as-is. When it is not set, the region is no longer looked up from the bucket: boto3 falls back to `AWS_DEFAULT_REGION`, then to `us-east-1`. If you left `AWS_S3_REGION_NAME` unset, set it to your provider's region before upgrading, or providers that check the signing region will reject the transcripts, summaries and meeting metadata uploads, as well as their signed URLs.
-
-Also:
-- Signed URLs to transcripts and summaries are now always path-style (`<endpoint>/<bucket>/<key>`), whereas the minio client used virtual-hosted-style URLs
-- The metadata collector now accepts `AWS_S3_ENDPOINT_URL` with or without a scheme, like the summary service: the scheme always follows `AWS_S3_SECURE_ACCESS`.
-
-### Helm chart: media services default to Garage
-
-The `meet` chart now defaults `serviceMedia.host` and `serviceMediaFiles.host` to `garage.meet.svc.cluster.local`, and the `upstream-vhost` annotation of `ingressMedia` and `ingressMediaFiles` to `garage.meet.svc.cluster.local:9000`. If you relied on the former `minio.meet.svc.cluster.local` defaults, set these values explicitly to your S3 service before upgrading, or recordings and files stop being served under `/media`.
-
 ## v1.30.0
 
 ### Removing S3 storage-event webhooks for recordings

bin/Tiltfile

@@ -104,8 +104,8 @@ k8s_yaml(secret_yaml_generic(
 
 k8s_yaml(local('cd ../src/helm && helmfile -n meet -e ${DEV_ENV:-dev-keycloak} template .'))
 
-k8s_resource('garage-cors', resource_deps=['garage'])
-k8s_resource('meet-backend', resource_deps=['postgresql', 'garage-cors', 'redis', 'livekit-livekit-server'])
+k8s_resource('minio-bucket', resource_deps=['minio'])
+k8s_resource('meet-backend', resource_deps=['postgresql', 'minio', 'redis', 'livekit-livekit-server'])
 k8s_resource('meet-celery-backend', resource_deps=['redis'])
 k8s_resource('meet-celery-summarize', resource_deps=['redis'])
 k8s_resource('meet-celery-summary-backend', resource_deps=['redis'])

compose.yml

@@ -15,44 +15,36 @@ services:
     ports:
       - "1081:1080"
 
-  garage:
+  minio:
     user: ${DOCKER_USER:-1000}
-    image: dxflrs/garage:v2.4.1
-    command: /garage server --single-node --default-bucket
-    env_file:
-      - env.d/development/garage
+    image: quay.io/minio/minio
     environment:
-      - GARAGE_DEFAULT_ACCESS_KEY=meet-access-key
-      - GARAGE_DEFAULT_SECRET_KEY=meet-secret-access-key
-      - GARAGE_DEFAULT_BUCKET=meet-media-storage
+      - MINIO_ROOT_USER=meet
+      - MINIO_ROOT_PASSWORD=password
     ports:
-      - '127.0.0.1:9000:9000'
+      - '9000:9000'
+      - '9001:9001'
     healthcheck:
-      test: [ "CMD", "/garage", "health" ]
+      test: [ "CMD", "mc", "ready", "local" ]
       interval: 1s
       timeout: 20s
       retries: 300
+    entrypoint: ""
+    command: minio server --console-address :9001 /data
     volumes:
-      - ./docker/files/etc/garage/garage.toml:/etc/garage.toml:ro
-      - ./data/media:/var/lib/garage
+      - ./data/media:/data
 
-  # Garage denies cross-origin requests by default: allow the frontend to upload files
-  garage-cors:
-    image: amazon/aws-cli:2.37.1
-    environment:
-      - AWS_ACCESS_KEY_ID=meet-access-key
-      - AWS_SECRET_ACCESS_KEY=meet-secret-access-key
-      - AWS_DEFAULT_REGION=local
+  createbuckets:
+    image: quay.io/minio/mc
     depends_on:
-      garage:
+      minio:
         condition: service_healthy
         restart: true
-    command:
-      - s3api
-      - put-bucket-cors
-      - --endpoint-url=http://garage:9000
-      - --bucket=meet-media-storage
-      - '--cors-configuration={"CORSRules": [{"AllowedOrigins": ["http://localhost:3000"], "AllowedMethods": ["GET", "HEAD", "PUT"], "AllowedHeaders": ["*"], "ExposeHeaders": ["ETag"]}]}'
+    entrypoint: >
+      sh -c "
+      /usr/bin/mc alias set meet http://minio:9000 meet password && \
+      /usr/bin/mc mb meet/meet-media-storage && \
+      exit 0;"
 
   app-dev:
     build:
@@ -78,7 +70,7 @@ services:
         - postgresql
         - mailcatcher
         - redis
-        - garage-cors
+        - createbuckets
     extra_hosts:
       - "127.0.0.1.nip.io:host-gateway"
     networks:
@@ -118,7 +110,7 @@ services:
       - postgresql
       - redis
       - livekit
-      - garage
+      - minio
 
   celery:
     user: ${DOCKER_USER:-1000}
@@ -252,7 +244,7 @@ services:
       - /app/.venv
     depends_on:
       - livekit
-      - garage
+      - minio
     develop:
       watch:
         - action: rebuild
@@ -305,7 +297,7 @@ services:
     depends_on:
       - redis-summary
       - app-summary-dev
-      - garage
+      - minio
     develop:
       watch:
         - action: rebuild
@@ -325,7 +317,7 @@ services:
     depends_on:
       - redis-summary
       - app-summary-dev
-      - garage
+      - minio
     develop:
       watch:
         - action: rebuild

devenv.nix

@@ -163,7 +163,7 @@ in
       REDIS_URL = "redis://127.0.0.1:6379/1";
       CELERY_BROKER_URL = "redis://127.0.0.1:6379/0";
 
-      # S3 / Garage
+      # S3 / MinIO
       AWS_S3_ENDPOINT_URL = "http://127.0.0.1:9000";
 
       # OIDC

docker/compose.d/compose.podman.yml

@@ -19,9 +19,7 @@ services:
     <<: *keep-id
   celery-dev:
     <<: *keep-id
-  garage:
-    <<: *keep-id
-  garage-cors:
+  minio:
     <<: *keep-id
   node:
     <<: *keep-id

docker/dinum-frontend/Dockerfile

@@ -57,8 +57,7 @@ RUN npx webpack --mode production
 FROM nginxinc/nginx-unprivileged:1.30.4-alpine3.24 AS frontend-production
 
 USER root
-RUN apk upgrade --no-cache libexpat && \
-    apk del curl
+RUN apk del curl
 USER nginx
 
 USER nginx

docker/files/etc/garage/garage.toml

@@ -1,15 +0,0 @@
-# Garage configuration for local development only: single node, no replication.
-# See https://garagehq.deuxfleurs.fr/documentation/reference-manual/configuration/
-metadata_dir = "/var/lib/garage/meta"
-data_dir = "/var/lib/garage/data"
-db_engine = "lmdb"
-
-replication_factor = 1
-
-rpc_bind_addr = "127.0.0.1:3901"
-rpc_public_addr = "127.0.0.1:3901"
-
-[s3_api]
-api_bind_addr = "[::]:9000"
-# Clients must sign their requests for this region (AWS_S3_REGION_NAME)
-s3_region = "local"

docker/files/etc/nginx/conf.d/default.conf

@@ -17,9 +17,9 @@ server {
         proxy_set_header X-Amz-Date $authDate;
         proxy_set_header X-Amz-Content-SHA256 $authContentSha256;
 
-        # Get resource from Garage
-        proxy_pass http://garage:9000/meet-media-storage/;
-        proxy_set_header Host garage:9000;
+        # Get resource from Minio
+        proxy_pass http://minio:9000/meet-media-storage/;
+        proxy_set_header Host minio:9000;
         # To use with ds_proxy
         # proxy_pass http://ds-proxy:4444/upstream/meet-media-storage/;
         # proxy_set_header Host ds-proxy:4444;

docs/developping_locally.md

@@ -13,7 +13,7 @@ These components rely on a few key services:
 
 - PostgreSQL for storing data (users, rooms, recordings)
 - Redis for caching and inter-service communication
-- Garage for storing files (room recordings)
+- MinIO for storing files (room recordings)
 - Celery workers for meeting transcript (optional, required for AI beta features)
 
 We provide two stack options for getting Visio up and running for development:

docs/features/room-purge.md

@@ -1,40 +0,0 @@
-# Room purge
-
-Rooms pile up over time and most of them are only used once. The `purge_inactive_rooms` management command permanently deletes the rooms that have not been started for a configurable number of days. It is disabled by default.
-
-## How it works
-
-Each time LiveKit tells the backend that a room has started (`room_started` webhook), the backend records the date on the room (`last_started_at`).
-A room is inactive when:
-
-- it was last started more than `ROOM_INACTIVITY_DELETION_DAYS` days ago, or
-- it was never started and was created more than `ROOM_INACTIVITY_DELETION_DAYS` days ago.
-
-Rooms that existed before this feature was deployed are considered started on the day of the release, so none of them can be purged before a full inactivity period has elapsed.
-
-The command is meant to run once a day. The Helm chart schedules it in `backend.cronjobs` (`purge-inactive-rooms`, 01:00); it does nothing until `ROOM_INACTIVITY_DELETION_DAYS` is set.
-
-```bash
-python manage.py purge_inactive_rooms            # delete the inactive rooms
-python manage.py purge_inactive_rooms --dry-run  # only list the rooms that would be deleted
-```
-
-## Rooms that are kept
-
-A recording can only be reached through its room. An inactive room is kept as long as it holds a saved recording its users may still access:
-
-- with `RECORDING_EXPIRATION_DAYS` set, a saved recording created less than that many days ago,
-- with `RECORDING_EXPIRATION_DAYS` unset, any saved recording.
-
-## What happens to a purged room
-
-The room is deleted from the database, along with its accesses, its telephony PIN code, and the recording entries it still holds — the expired ones and those that were never saved, since any other recording would have protected the room — together with their own accesses.
-
-The recording **files in the bucket are left untouched**: the backend never deletes anything from the storage, it only drops the database entries pointing at it. Removing the files is the job of the bucket lifecycle policy, which should match `RECORDING_EXPIRATION_DAYS` (see the [recording documentation](recording.md)). When the two do not match, the purge leaves objects behind: they become unreachable, since serving a recording requires its database entry, but they keep costing storage.
-
-⚠️ When a room is purged, all it's configuration and access rights are also deleted. Its slug becomes available again
-and can be reused when a meeting is created from that same URL.
-
-* With `ALLOW_UNREGISTERED_ROOMS=false`, only an authenticated user can navigate to a previously existing link after the room has been purged. Doing so recreates the room in the database with a fresh configuration, with that user associated with it and granted admin rights.
-
-* With `ALLOW_UNREGISTERED_ROOMS=true`, any user can reopen the purged room by navigating to the same URL. In that case, the room is created dynamically and no corresponding room entry is persisted in the database.

docs/features/transcription.md

@@ -42,7 +42,7 @@ sequenceDiagram
   participant Backend as Backend API
   participant Summary as Summary Service
   participant Celery as Celery Workers (transcribe-queue)
-  participant S3 as S3 (Object Storage)
+  participant MinIO as MinIO (Object Storage)
   participant STT as WhisperX API
   participant Docs as LaSuite Docs
 
@@ -50,7 +50,7 @@ sequenceDiagram
   Note right of Backend: Payload contains 7 params: owner_id, filename, email, sub, room, recording_date, recording_time
 
   Summary->>Celery: Register task (transcribe-queue)
-  Celery->>S3: Fetch audio file
+  Celery->>MinIO: Fetch audio file
   Celery->>STT: Transcribe audio (WhisperX)
   STT-->>Celery: Segmented transcript
 
@@ -72,12 +72,11 @@ sequenceDiagram
 | celery_result_backend    | String    | `"redis://redis/0"`                                                   | Celery result backend URL.                                                                                                                                              |
 | celery_max_retries       | Integer   | `1`                                                                   | Maximum number of retries for Celery tasks.                                                                                                                             |
 | transcribe_queue         | String    | `"transcribe-queue"`                                                  | Name of the Celery queue for transcription tasks.                                                                                                                       |
-| aws_storage_bucket_name  | String    | —                                                                     | Name of the S3 bucket used for storing recordings.                                                                                                                      |
-| aws_s3_endpoint_url      | String    | —                                                                     | Endpoint URL of the S3 storage.                                                                                                                                         |
-| aws_s3_access_key_id     | String    | —                                                                     | Access key for S3.                                                                                                                                                      |
-| aws_s3_secret_access_key | Secret    | —                                                                     | Secret key for S3.                                                                                                                                                      |
-| aws_s3_secure_access     | Boolean   | `True`                                                                | Use HTTPS for S3 requests.                                                                                                                                              |
-| aws_s3_region_name       | String    | —                                                                     | Region used to sign S3 requests, passed as-is to boto3.                                                                                                                 |
+| aws_storage_bucket_name  | String    | —                                                                     | Name of the S3/MinIO bucket used for storing recordings.                                                                                                                |
+| aws_s3_endpoint_url      | String    | —                                                                     | Endpoint URL of the S3/MinIO storage.                                                                                                                                   |
+| aws_s3_access_key_id     | String    | —                                                                     | Access key for S3/MinIO.                                                                                                                                                |
+| aws_s3_secret_access_key | Secret    | —                                                                     | Secret key for S3/MinIO.                                                                                                                                                |
+| aws_s3_secure_access     | Boolean   | `True`                                                                | Use HTTPS for S3/MinIO requests.                                                                                                                                        |
 | whisperx_api_key         | Secret    | —                                                                     | API key for accessing WhisperX.                                                                                                                                         |
 | whisperx_base_url        | String    | `"https://api.whisperx.com/v1"`                                       | Base URL for the WhisperX API.                                                                                                                                          |
 | whisperx_asr_model       | String    | `"whisper-1"`                                                         | ASR model used for transcription.                                                                                                                                       |

docs/installation/compose.md

@@ -14,7 +14,7 @@ All services are required to run the minimalist instance of LaSuite Meet. Click
 | **OIDC Provider** | User authentication | [Keycloak setup](../examples/compose/keycloak/README.md) |
 | **SMTP Service**  | Email notifications | -                                                        |
 
-> [!NOTE] Some advanced features, as Recording and transcription, require additional services (S3-compatible object storage, email). See `/features` folder for details.
+> [!NOTE] Some advanced features, as Recording and transcription, require additional services (MinIO, email). See `/features` folder for details.
 
 
 ## Software Requirements

docs/installation/kubernetes.md

@@ -403,7 +403,6 @@ These are the environmental options available on meet backend.
 | LIVEKIT_ENABLE_FIREFOX_PROXY_WORKAROUND         | Firefox-only connection warmup: pre-calls WebSocket endpoint (expecting 401) to initialize cache, resolving proxy/network connectivity issues.               | false                                                                                                                                                         |
 | RESOURCE_DEFAULT_ACCESS_LEVEL                   | Default resource access level for rooms                                                                                                                      | public                                                                                                                                                        |
 | ALLOW_UNREGISTERED_ROOMS                        | Allow usage of unregistered rooms                                                                                                                            | true                                                                                                                                                          |
-| ROOM_INACTIVITY_DELETION_DAYS                   | Days without being started after which a room is purged. Unset to never purge                                                                                |                                                                                                                                                               |
 | RECORDING_ENABLE                                | Record meeting option                                                                                                                                        | false                                                                                                                                                         |
 | RECORDING_OUTPUT_FOLDER                         | Folder to store meetings                                                                                                                                     | recordings                                                                                                                                                    |
 | RECORDING_WORKER_CLASSES                        | Worker classes for recording                                                                                                                                 | {"screen_recording": "core.recording.worker.services.VideoCompositeEgressService","transcript": "core.recording.worker.services.AudioCompositeEgressService"} |

env.d/development/common.dist

@@ -24,10 +24,9 @@ MEET_BASE_URL="http://localhost:8072"
 # Media
 STORAGES_STATICFILES_BACKEND=django.contrib.staticfiles.storage.StaticFilesStorage
 AWS_S3_DOMAIN_REPLACE=http://localhost:9000
-AWS_S3_ENDPOINT_URL=http://garage:9000
-AWS_S3_ACCESS_KEY_ID=meet-access-key
-AWS_S3_SECRET_ACCESS_KEY=meet-secret-access-key
-AWS_S3_REGION_NAME=local
+AWS_S3_ENDPOINT_URL=http://minio:9000
+AWS_S3_ACCESS_KEY_ID=meet
+AWS_S3_SECRET_ACCESS_KEY=password
 MEDIA_BASE_URL=http://localhost:3000
 FILE_UPLOAD_ENABLED=True
 
@@ -64,8 +63,7 @@ ALLOW_UNREGISTERED_ROOMS=False
 
 # Recording
 RECORDING_ENABLE=True
-SUMMARY_SERVICE_VERSION=2
-SUMMARY_SERVICE_ENDPOINT=http://app-summary-dev:8000/api/v2/async-jobs/transcribe
+SUMMARY_SERVICE_ENDPOINT=http://app-summary-dev:8000/api/v2/async-jobs/transcribe/
 SUMMARY_SERVICE_API_TOKEN=password
 SUMMARY_SERVICE_WEBHOOK_API_TOKEN=webhook-password
 RECORDING_DOWNLOAD_BASE_URL=http://localhost:3000/recording

env.d/development/garage.dist

@@ -1,2 +0,0 @@
-# Filled with a random value by `make create-env-files`
-GARAGE_RPC_SECRET=

env.d/development/metadata_collector.dist

@@ -2,9 +2,8 @@ LIVEKIT_URL=ws://livekit:7880
 LIVEKIT_API_KEY=devkey
 LIVEKIT_API_SECRET=secret
 
-AWS_S3_ENDPOINT_URL=garage:9000
-AWS_S3_ACCESS_KEY_ID=meet-access-key
-AWS_S3_SECRET_ACCESS_KEY=meet-secret-access-key
-AWS_S3_REGION_NAME=local
+AWS_S3_ENDPOINT_URL=minio:9000
+AWS_S3_ACCESS_KEY_ID=meet
+AWS_S3_SECRET_ACCESS_KEY=password
 AWS_STORAGE_BUCKET_NAME=meet-media-storage
 AWS_S3_SECURE_ACCESS=False

env.d/development/multi_user_transcriber.dist

@@ -1,7 +1,6 @@
-AWS_S3_ENDPOINT_URL=garage:9000
-AWS_S3_ACCESS_KEY_ID=meet-access-key
-AWS_S3_SECRET_ACCESS_KEY=meet-secret-access-key
-AWS_S3_REGION_NAME=local
+AWS_S3_ENDPOINT_URL=minio:9000
+AWS_S3_ACCESS_KEY_ID=meet
+AWS_S3_SECRET_ACCESS_KEY=password
 
 LIVEKIT_URL=ws://livekit:7880
 LIVEKIT_API_KEY=devkey

env.d/development/summary.dist

@@ -2,12 +2,11 @@ APP_NAME="meet-app-summary-dev"
 APP_API_TOKEN="password"
 
 AWS_STORAGE_BUCKET_NAME="meet-media-storage"
-AWS_S3_ENDPOINT_URL="garage:9000"
+AWS_S3_ENDPOINT_URL="minio:9000"
 AWS_S3_SECURE_ACCESS=false
 
-AWS_S3_ACCESS_KEY_ID="meet-access-key"
-AWS_S3_SECRET_ACCESS_KEY="meet-secret-access-key"
-AWS_S3_REGION_NAME="local"
+AWS_S3_ACCESS_KEY_ID="meet"
+AWS_S3_SECRET_ACCESS_KEY="password"
 
 WHISPERX_BASE_URL="https://configure-your-url.com"
 WHISPERX_ASR_MODEL="large-v2"

src/addons/outlook/package-lock.json

@@ -10,7 +10,7 @@
       "license": "MIT",
       "dependencies": {
         "core-js": "3.50.0",
-        "i18next": "26.4.2",
+        "i18next": "26.4.0",
         "i18next-browser-languagedetector": "8.2.1",
         "regenerator-runtime": "0.14.1"
       },
@@ -9367,9 +9367,9 @@
       }
     },
     "node_modules/i18next": {
-      "version": "26.4.2",
-      "resolved": "https://registry.npmjs.org/i18next/-/i18next-26.4.2.tgz",
-      "integrity": "sha512-RX+R0VLg13IbvRuJSxnqykUFS9vQZTl8wYpWPCIUDWVrSGjsQywB5Y+pjzrkboxGAuYfJZVH1InFTdgBdxq6ug==",
+      "version": "26.4.0",
+      "resolved": "https://registry.npmjs.org/i18next/-/i18next-26.4.0.tgz",
+      "integrity": "sha512-rsmK5bFqsD1AetSFSIa43wtNR4WpvvH4p0tLEsTxkC7QTrfdFm06nbQ95bh8Og4wwaCnUEcm9DVYL2cgxitiQg==",
       "funding": [
         {
           "type": "individual",

src/addons/outlook/package.json

@@ -27,7 +27,7 @@
   },
   "dependencies": {
     "core-js": "3.50.0",
-    "i18next": "26.4.2",
+    "i18next": "26.4.0",
     "i18next-browser-languagedetector": "8.2.1",
     "regenerator-runtime": "0.14.1"
   },

src/agents/Dockerfile

@@ -5,7 +5,6 @@ RUN sed -i "s|^URIs: http://|URIs: https://|" /etc/apt/sources.list.d/debian.sou
     && apt-get update && apt-get install -y --no-install-recommends  \
     libglib2.0-0 \
     libgobject-2.0-0 \
-    libssl3t64 \
     && rm -rf /var/lib/apt/lists/*
 
 

src/agents/metadata_collector.py

@@ -6,11 +6,9 @@ import logging
 import os
 from dataclasses import asdict, dataclass
 from datetime import datetime, timezone
+from io import BytesIO
 from typing import List, Optional
 
-import boto3
-from botocore.config import Config
-from botocore.exceptions import BotoCoreError, ClientError
 from dotenv import load_dotenv
 from livekit import api, rtc
 from livekit.agents import (
@@ -30,6 +28,8 @@ from livekit.agents import (
     room_io as lk_room_io,
 )
 from livekit.plugins import silero
+from minio import Minio
+from minio.error import S3Error
 
 from exceptions import MissingConfigError
 from observability import configure_sentry, set_job_context
@@ -59,30 +59,6 @@ server = AgentServer(
 server.setup_fnc = prewarm
 
 
-def create_s3_client():
-    """Create an S3 client for the configured endpoint and region.
-
-    The endpoint may be given with or without a scheme: the scheme always
-    follows AWS_S3_SECURE_ACCESS.
-    """
-    endpoint = (
-        os.getenv("AWS_S3_ENDPOINT_URL", "")
-        .removeprefix("https://")
-        .removeprefix("http://")
-        .rstrip("/")
-    )
-    secure = os.getenv("AWS_S3_SECURE_ACCESS", "False").lower() == "true"
-
-    return boto3.client(
-        "s3",
-        endpoint_url=f"{'https' if secure else 'http'}://{endpoint}",
-        aws_access_key_id=os.getenv("AWS_S3_ACCESS_KEY_ID"),
-        aws_secret_access_key=os.getenv("AWS_S3_SECRET_ACCESS_KEY"),
-        region_name=os.getenv("AWS_S3_REGION_NAME"),
-        config=Config(signature_version="s3v4", s3={"addressing_style": "path"}),
-    )
-
-
 @dataclass
 class MetadataEvent:
     """A single timestamped event recorded during a meeting."""
@@ -145,13 +121,18 @@ class MetadataCollector:
 
     def __init__(self, ctx: JobContext, recording_id: str):
         """Initialize metadata agent."""
+        self.minio_client = Minio(
+            endpoint=os.getenv("AWS_S3_ENDPOINT_URL"),
+            access_key=os.getenv("AWS_S3_ACCESS_KEY_ID"),
+            secret_key=os.getenv("AWS_S3_SECRET_ACCESS_KEY"),
+            secure=os.getenv("AWS_S3_SECURE_ACCESS", "False").lower() == "true",
+        )
+
         if (bucket_name := os.getenv("AWS_STORAGE_BUCKET_NAME")) is not None:
             self.bucket_name = bucket_name
         else:
             raise MissingConfigError
 
-        self.s3_client = create_s3_client()
-
         self.ctx = ctx
         self._sessions: dict[str, AgentSession] = {}
         self._tasks: set[asyncio.Task] = set()
@@ -220,18 +201,20 @@ class MetadataCollector:
         }
 
         data = json.dumps(payload, indent=2).encode("utf-8")
+        stream = BytesIO(data)
 
         try:
-            self.s3_client.put_object(
-                Bucket=self.bucket_name,
-                Key=self.output_filename,
-                Body=data,
-                ContentType="application/json",
+            self.minio_client.put_object(
+                self.bucket_name,
+                self.output_filename,
+                stream,
+                length=len(data),
+                content_type="application/json",
             )
             logger.info(
                 "Uploaded speaker meeting metadata",
             )
-        except (BotoCoreError, ClientError):
+        except S3Error:
             logger.exception(
                 "Failed to upload meeting metadata",
             )

src/agents/pyproject.toml

@@ -1,24 +1,24 @@
 
 [project]
 name = "agents"
-version = "1.32.1"
+version = "1.31.0"
 requires-python = ">=3.12"
 dependencies = [
-    "livekit-agents==1.7.0",
-    "livekit-plugins-deepgram==1.7.0",
-    "livekit-plugins-silero==1.7.0",
+    "livekit-agents==1.6.7",
+    "livekit-plugins-deepgram==1.6.7",
+    "livekit-plugins-silero==1.6.7",
     "livekit-plugins-kyutai-lasuite==0.0.6",
-    "boto3==1.43.56",
-    "python-dotenv==1.2.3",
-    "protobuf==7.36.0",
-    "sentry-sdk==2.68.1",
+    "python-dotenv==1.2.2",
+    "protobuf==6.33.6",
+    "minio==7.2.20",
+    "sentry-sdk==2.66.1",
     "websockets==17.1",
     "httpx==0.28.1",
 ]
 
 [project.optional-dependencies]
 dev = [
-    "ruff==0.16.4",
+    "ruff==0.16.0",
 ]
 
 [tool.uv]

src/backend/core/admin.py

@@ -279,16 +279,9 @@ class RoomAdmin(admin.ModelAdmin):
 
     inlines = (ResourceAccessInline,)
     search_fields = ["name", "slug", "=id"]
-    list_display = [
-        "name",
-        "slug",
-        "access_level",
-        "get_owner",
-        "created_at",
-        "last_started_at",
-    ]
-    list_filter = ["access_level", "created_at", "last_started_at"]
-    readonly_fields = ["id", "created_at", "updated_at", "last_started_at"]
+    list_display = ["name", "slug", "access_level", "get_owner", "created_at"]
+    list_filter = ["access_level", "created_at"]
+    readonly_fields = ["id", "created_at", "updated_at"]
 
     def get_queryset(self, request):
         """Optimize queries by prefetching related access and user data to avoid N+1 queries."""

src/backend/core/api/feature_flag.py

@@ -17,6 +17,7 @@ class FeatureFlag:
         "application": "APPLICATION_ENABLED",
         "roomkit": "ROOMKIT_ENABLED",
         "connection_test": "CONNECTION_TEST_ENABLED",
+        "user_access_token": "USER_ACCESS_TOKEN_ENABLED",
     }
 
     @classmethod

src/backend/core/api/permissions.py

@@ -12,6 +12,10 @@ from ..services.participants_management import (
     ParticipantsManagementException,
 )
 
+ACTION_FOR_METHOD_TO_PERMISSION = {
+    "versions_detail": {"DELETE": "versions_destroy", "GET": "versions_retrieve"}
+}
+
 
 class IsAuthenticated(permissions.BasePermission):
     """
@@ -23,6 +27,15 @@ class IsAuthenticated(permissions.BasePermission):
         return bool(request.auth) or request.user.is_authenticated
 
 
+class IsAuthenticatedOrSafe(IsAuthenticated):
+    """Allows access to authenticated users (or anonymous users but only on safe methods)."""
+
+    def has_permission(self, request, view):
+        if request.method in permissions.SAFE_METHODS:
+            return True
+        return super().has_permission(request, view)
+
+
 class IsSelf(IsAuthenticated):
     """
     Allows access only to authenticated users. Alternative method checking the presence

src/backend/core/api/serializers.py

@@ -7,6 +7,7 @@ from typing import Literal
 from urllib.parse import quote
 
 from django.conf import settings
+from django.core import signing
 from django.core.exceptions import SuspiciousOperation
 
 # pylint: disable=abstract-method,no-name-in-module
@@ -292,6 +293,26 @@ class RequestEntrySerializer(BaseValidationOnlySerializer):
     """Validate request entry data."""
 
     username = serializers.CharField(required=True)
+    participant_id = serializers.CharField(
+        required=False, allow_null=True, max_length=128
+    )
+
+    @staticmethod
+    def sign_participant_id(participant_id):
+        """Sign with Django's SECRET_KEY and a lobby-specific namespace."""
+        return signing.Signer(salt="core.lobby.participant").sign(participant_id)
+
+    def validate_participant_id(self, value):
+        """Require a valid server signature before looking up a participant."""
+        if value is None:
+            return None
+        try:
+            participant_id = signing.Signer(salt="core.lobby.participant").unsign(value)
+        except signing.BadSignature as exc:
+            raise serializers.ValidationError(
+                "Invalid participant credential."
+            ) from exc
+        return str(serializers.UUIDField().run_validation(participant_id))
 
 
 class ParticipantEntrySerializer(BaseValidationOnlySerializer):
@@ -599,3 +620,20 @@ class ExternalProcessEventSerializer(BaseValidationOnlySerializer):
     # useless bad requests
     type = serializers.CharField(required=False, allow_null=True, allow_blank=True)
     status = serializers.CharField(required=False, allow_null=True, allow_blank=True)
+
+
+class TransitCodeSerializer(BaseValidationOnlySerializer):
+    """Validate the single-use transit code sent to the exchange endpoint."""
+
+    code = serializers.CharField(trim_whitespace=True)
+
+    def validate_code(self, value):
+        """Reject codes whose length cannot match a generated one."""
+
+        # Calculates urlsafe_b64encode length without padding
+        expected_length = (4 * settings.TRANSIT_CODE_NBYTES + 2) // 3
+
+        if len(value) != expected_length:
+            raise serializers.ValidationError("Invalid transit code format.")
+
+        return value

src/backend/core/api/throttling.py

@@ -1,11 +1,11 @@
 """Throttling modules for the API."""
 
-from django.conf import settings
-
 from lasuite.drf.throttling import MonitoredThrottleMixin
 from rest_framework.throttling import AnonRateThrottle, UserRateThrottle
 from sentry_sdk import capture_message
 
+from . import serializers
+
 
 def sentry_monitoring_throttle_failure(message):
     """Log when a failure occurs to detect rate limiting issues."""
@@ -42,13 +42,14 @@ class RequestEntryAnonRateThrottle(MonitoredAnonRateThrottle):
     def get_cache_key(self, request, view):
         """Use the lobby participant cookie ID as the throttle cache key.
 
-        Only throttle if a cookie is already set. If no cookie exists yet,
-        return None to skip throttling — the cookie will be set on the first
-        response, and throttling will apply from the second request onward.
+        Only throttle requests carrying a participant identifier. The
+        identifier is returned by the first request-entry response and
+        echoed back by the client from the second request onward, which is
+        when throttling starts applying.
 
-        Keying on the cookie rather than the IP address prevents penalising
-        multiple users behind the same NAT/proxy, and is consistent with how
-        LobbyService identifies participants.
+        Keying on the identifier rather than the IP address prevents
+        penalising multiple users behind the same NAT/proxy, and is
+        consistent with how the lobby identifies participants.
 
         Note: as per DRF documentation, application-level throttling is not a
         security measure against brute-force or DoS attacks. This throttle exists
@@ -58,10 +59,14 @@ class RequestEntryAnonRateThrottle(MonitoredAnonRateThrottle):
         if request.user and request.user.is_authenticated:
             return None  # Only throttle unauthenticated requests.
 
-        participant_id = request.COOKIES.get(settings.LOBBY_COOKIE_NAME)
+        serializer = serializers.RequestEntrySerializer(data=request.data)
+        if not serializer.is_valid():
+            return None
 
-        if participant_id is None:
-            return None  # No throttling for cookieless requests
+        participant_id = serializer.validated_data.get("participant_id")
+
+        if not participant_id:
+            return None  # No throttling for unidentified requests
 
         return self.cache_format % {
             "scope": self.scope,
@@ -97,3 +102,14 @@ class ConnectionTestAnonRateThrottle(MonitoredAnonRateThrottle):
     """Throttle anonymous users requesting connection test tokens."""
 
     scope = "connection_test"
+
+
+class ExchangeAccessTokenAnonRateThrottle(MonitoredAnonRateThrottle):
+    """Throttle anonymous transit code exchange attempts.
+
+    Abuse mitigation only, not a security boundary: DRF throttling is
+    best-effort. The security of the exchange rests on the codes'
+    entropy and single use.
+    """
+
+    scope = "exchange_access_token"

src/backend/core/api/viewsets.py

@@ -43,6 +43,7 @@ from rest_framework.settings import api_settings
 from core import analytics, enums, models, utils
 from core.api import throttling
 from core.api.filters import ListFileFilter
+from core.authentication.user_token import USER_ACCESS_TOKEN_TYPE_CLAIM
 from core.enums import MEDIA_STORAGE_URL_PATTERN
 from core.recording.enums import FileExtension
 from core.recording.event.authentication import RecordingProcessWebhookAuthentication
@@ -61,6 +62,7 @@ from core.recording.worker.mediator import (
     WorkerServiceMediator,
 )
 from core.services.invitation import InvitationService
+from core.services.jwt_token import JwtTokenService
 from core.services.livekit_events import (
     LiveKitEventsService,
     LiveKitWebhookError,
@@ -81,6 +83,7 @@ from core.services.room_roles import (
     RoomRoleService,
 )
 from core.services.subtitle import SubtitleException, SubtitleService
+from core.services.transit_code import TransitCodeService
 from core.tasks.connection_test import delete_connection_test_room
 from core.tasks.file import process_file_deletion
 from core.utils import generate_token
@@ -95,6 +98,60 @@ from .feature_flag import FeatureFlag
 logger = getLogger(__name__)
 
 
+class NestedGenericViewSet(viewsets.GenericViewSet):
+    """
+    A generic Viewset aims to be used in a nested route context.
+    e.g: `/api/v1.0/resource_1/<resource_1_pk>/resource_2/<resource_2_pk>/`
+
+    It allows to define all url kwargs and lookup fields to perform the lookup.
+    """
+
+    lookup_fields: list[str] = ["pk"]
+    lookup_url_kwargs: list[str] = []
+
+    def __getattribute__(self, file):
+        """
+        This method is overridden to allow to get the last lookup field or lookup url kwarg
+        when accessing the `lookup_field` or `lookup_url_kwarg` attribute. This is useful
+        to keep compatibility with all methods used by the parent class `GenericViewSet`.
+        """
+        if file in ["lookup_field", "lookup_url_kwarg"]:
+            return getattr(self, file + "s", [None])[-1]
+
+        return super().__getattribute__(file)
+
+    def get_queryset(self):
+        """
+        Get the list of files for this view.
+
+        `lookup_fields` attribute is enumerated here to perform the nested lookup.
+        """
+        queryset = super().get_queryset()
+
+        # The last lookup field is removed to perform the nested lookup as it corresponds
+        # to the object pk, it is used within get_object method.
+        lookup_url_kwargs = (
+            self.lookup_url_kwargs[:-1]
+            if self.lookup_url_kwargs
+            else self.lookup_fields[:-1]
+        )
+
+        filter_kwargs = {}
+        for index, lookup_url_kwarg in enumerate(lookup_url_kwargs):
+            if lookup_url_kwarg not in self.kwargs:
+                raise KeyError(
+                    f"Expected view {self.__class__.__name__} to be called with a URL "
+                    f'keyword argument named "{lookup_url_kwarg}". Fix your URL conf, or '
+                    "set the `.lookup_fields` attribute on the view correctly."
+                )
+
+            filter_kwargs.update(
+                {self.lookup_fields[index]: self.kwargs[lookup_url_kwarg]}
+            )
+
+        return queryset.filter(**filter_kwargs)
+
+
 class SerializerPerActionMixin:
     """
     A mixin to allow to define serializer classes for each action.
@@ -165,6 +222,96 @@ class UserViewSet(
             self.serializer_class(request.user, context=context).data
         )
 
+    @decorators.action(
+        detail=False,
+        methods=["post"],
+        url_path="exchange-access-token",
+        permission_classes=[],
+        throttle_classes=[throttling.ExchangeAccessTokenAnonRateThrottle],
+    )
+    @FeatureFlag.require("user_access_token")
+    def exchange_access_token(self, request):
+        """Exchange a single-use transit code for a user access token.
+
+        The endpoint is unauthenticated: the transit code itself, an opaque
+        random string obtained through the external API and delivered to
+        the embedded frontend via a URL fragment, is the credential. Each
+        code can be exchanged exactly once (consuming it deletes it from
+        the cache); replaying a consumed code is denied and logged.
+
+        The issued JWT authenticates the user the code was minted for on
+        the whole core API, exactly like a session cookie would (similar
+        to lib-jitsi-meet's token authentication), and never appears in
+        any URL. Role-based permissions apply unchanged.
+        """
+        if request.user and request.user.is_authenticated:
+            logger.warning(
+                "Transit code exchange refused: request is already "
+                "session-authenticated (user_id=%s)",
+                request.user.id,
+            )
+            raise drf_exceptions.PermissionDenied("Already authenticated.")
+
+        serializer = serializers.TransitCodeSerializer(data=request.data)
+        serializer.is_valid(raise_exception=True)
+
+        code_data = TransitCodeService().consume_code(serializer.validated_data["code"])
+
+        if code_data is None:
+            logger.warning("Invalid, expired or already used transit code")
+            raise drf_exceptions.PermissionDenied(
+                "Invalid, expired or already used transit code."
+            )
+
+        # Re-check the user at exchange time so that a deactivation after
+        # the transit code was minted is taken into account.
+        try:
+            user = models.User.objects.get(id=code_data["user_id"], is_active=True)
+        except models.User.DoesNotExist as excpt:
+            raise drf_exceptions.PermissionDenied(
+                "This account can no longer access the application."
+            ) from excpt
+
+        if not models.Application.has_active_scope(
+            code_data.get("client_id"), models.ApplicationScope.USERS_SESSION
+        ):
+            logger.warning(
+                "Transit code exchange refused: application '%s' no longer "
+                "holds the '%s' grant",
+                code_data.get("client_id"),
+                models.ApplicationScope.USERS_SESSION,
+            )
+            raise drf_exceptions.PermissionDenied(
+                "This application can no longer create user sessions."
+            )
+
+        token_service = JwtTokenService(
+            secret_key=settings.USER_ACCESS_TOKEN_SECRET_KEY,
+            algorithm=settings.USER_ACCESS_TOKEN_ALG,
+            issuer=settings.USER_ACCESS_TOKEN_ISSUER,
+            audience=settings.USER_ACCESS_TOKEN_AUDIENCE,
+            expiration_seconds=settings.USER_ACCESS_TOKEN_TTL,
+            token_type=settings.USER_ACCESS_TOKEN_TYPE,
+        )
+
+        data = token_service.generate_jwt(
+            user,
+            "user:access",
+            {
+                "client_id": code_data.get("client_id", "unknown"),
+                "token_type": USER_ACCESS_TOKEN_TYPE_CLAIM,
+            },
+        )
+
+        # Log for auditing
+        logger.info(
+            "User access token issued from transit code: user_id=%s, client_id=%s",
+            user.id,
+            code_data.get("client_id", "unknown"),
+        )
+
+        return drf_response.Response(data)
+
 
 class RoomViewSet(
     mixins.CreateModelMixin,
@@ -432,13 +579,18 @@ class RoomViewSet(
 
         participant, livekit = lobby_service.request_entry(
             room=room,
-            request=request,
+            user=request.user,
             **serializer.validated_data,
         )
-        response = drf_response.Response({**participant.to_dict(), "livekit": livekit})
-        lobby_service.prepare_response(response, participant.id)
-
-        return response
+        return drf_response.Response(
+            {
+                **participant.to_dict(),
+                "id": serializers.RequestEntrySerializer.sign_participant_id(
+                    participant.id
+                ),
+                "livekit": livekit,
+            }
+        )
 
     @decorators.action(
         detail=True,

src/backend/core/authentication/livekit.py

@@ -9,6 +9,8 @@ from rest_framework import authentication, exceptions
 
 UserModel = get_user_model()
 
+LIVEKIT_AUTH_SCHEME = "X-LiveKit-Token"
+
 
 class LiveKitTokenAuthentication(authentication.BaseAuthentication):
     """Authenticate using LiveKit token and load the associated Django user."""
@@ -20,9 +22,14 @@ class LiveKitTokenAuthentication(authentication.BaseAuthentication):
             return None  # No authentication attempted
 
         parts = auth_header.split()
-        if len(parts) != 2 or parts[0].lower() != "bearer":
+        if not parts or parts[0].lower() != LIVEKIT_AUTH_SCHEME.lower():
+            # Not our scheme (e.g. "Bearer <user access token>"): defer, another
+            # backend may recognize it.
+            return None
+
+        if len(parts) != 2:
             raise exceptions.AuthenticationFailed(
-                "Authorization header must be: Bearer <token>"
+                f"Authorization header must be: {LIVEKIT_AUTH_SCHEME} <token>"
             )
 
         token = parts[1]

src/backend/core/authentication/user_token.py

@@ -0,0 +1,82 @@
+"""User access JWT authentication for the Meet core API.
+
+Allows an embedded frontend (e.g. rendered in an iframe, where third-party
+session cookies are blocked) to authenticate requests on the core API with
+a JWT, obtained by exchanging a single-use transit code (see
+core.services.transit_code and the users exchange-access-token endpoint)
+and passed as a Bearer header. The JWT itself never appears in any URL.
+
+Similar to lib-jitsi-meet's token authentication, the token is bound to a
+user, not to a resource: once authenticated, the request is treated
+exactly like a session-authenticated one, and the existing role-based
+permissions apply unchanged.
+"""
+
+import logging
+
+from django.conf import settings
+
+from rest_framework import exceptions
+
+from core.external_api.authentication import BaseJWTAuthentication
+from core.models import Application, ApplicationScope
+
+logger = logging.getLogger(__name__)
+
+USER_ACCESS_TOKEN_TYPE_CLAIM = "user_access"  # noqa: S105
+
+
+class UserAccessJWTAuthentication(BaseJWTAuthentication):
+    """JWT authentication for user access tokens.
+
+    Validates user access tokens issued by the users exchange-access-token
+    endpoint and authenticates the user they were issued for. A bearer
+    token that does not verify against the user access token secret is
+    deferred to the next authentication backend; a token that does verify
+    but carries wrong claims is rejected.
+
+    When the feature is disabled (USER_ACCESS_TOKEN_ENABLED=False), the
+    backend is entirely inert: `BaseJWTAuthentication.authenticate`
+    returns None before reading the Authorization header, deferring every
+    request to the next authentication backend.
+    """
+
+    def __init__(self):
+        """Initialize the backend with user access token settings."""
+        super().__init__(
+            secret_key=settings.USER_ACCESS_TOKEN_SECRET_KEY,
+            algorithm=settings.USER_ACCESS_TOKEN_ALG,
+            issuer=settings.USER_ACCESS_TOKEN_ISSUER,
+            audience=settings.USER_ACCESS_TOKEN_AUDIENCE,
+            expiration_seconds=settings.USER_ACCESS_TOKEN_TTL,
+            token_type=settings.USER_ACCESS_TOKEN_TYPE,
+            is_enabled=settings.USER_ACCESS_TOKEN_ENABLED,
+        )
+
+    def validate_payload(self, payload):
+        """Validate the token type and the issuance-audit claim.
+
+        Raises:
+            AuthenticationFailed: If the token verified against the user
+                access token secret but does not carry the expected
+                claims, or if the issuing application lost its grant.
+        """
+
+        if payload.get("token_type") != USER_ACCESS_TOKEN_TYPE_CLAIM:
+            logger.warning("Wrong 'token_type' in user access token payload")
+            raise exceptions.AuthenticationFailed("Invalid token type.")
+
+        if not payload.get("client_id"):
+            logger.warning("Missing 'client_id' in user access token payload")
+            raise exceptions.AuthenticationFailed("Invalid token claims.")
+
+        if not Application.has_active_scope(
+            payload["client_id"], ApplicationScope.USERS_SESSION
+        ):
+            logger.warning(
+                "User access token refused: application '%s' no longer "
+                "holds the '%s' grant",
+                payload["client_id"],
+                ApplicationScope.USERS_SESSION,
+            )
+            raise exceptions.AuthenticationFailed("Application access revoked.")

src/backend/core/external_api/permissions.py

@@ -20,8 +20,60 @@ class BaseScopePermission(permissions.BasePermission):
 
     scope_map: Dict[str, str] = {}
 
+    def get_required_scope(self, view):
+        """Return the scope required by the view's current action.
+
+        Returns:
+            The required scope, or None for an unsupported method so
+            DRF's router can answer 405.
+
+        Raises:
+            PermissionDenied: If the action is not in scope_map (deny by
+                default).
+        """
+        # Get the current action (e.g., 'list', 'create'), if None let DRF handle it
+        action = getattr(view, "action", None)
+        if not action:
+            # DRF routers return a 405 for unsupported methods
+            return None
+
+        required_scope = self.scope_map.get(action)
+        if not required_scope:
+            # Action not in scope_map, deny by default
+            raise exceptions.PermissionDenied(
+                f"Insufficient permissions. Required scope: {required_scope}"
+            )
+
+        return required_scope
+
+    def get_token_scopes(self, request):
+        """Extract and normalize the scopes claimed by the token."""
+        token_scopes = (request.auth or {}).get("scope")
+
+        if not token_scopes:
+            return []
+
+        # Ensure scopes is a list (handle both list and space-separated string)
+        if isinstance(token_scopes, str):
+            token_scopes = token_scopes.split()
+
+        # Ensure scopes is a deduplicated list (preserving order) and lowercase all scopes
+        token_scopes = list(dict.fromkeys(scope.lower() for scope in token_scopes))
+
+        return self.strip_scope_prefix(token_scopes)
+
+    @staticmethod
+    def strip_scope_prefix(token_scopes):
+        """Strip the OIDC resource server prefix, when configured."""
+        if settings.OIDC_RS_SCOPES_PREFIX:
+            return [
+                scope.removeprefix(f"{settings.OIDC_RS_SCOPES_PREFIX}:")
+                for scope in token_scopes
+            ]
+        return token_scopes
+
     def has_permission(self, request, view):
-        """Check if the JWT token contains the required scope for this action.
+        """Check if the token claims the scope required by this action.
 
         Args:
             request: DRF request object with authenticated user
@@ -33,38 +85,15 @@ class BaseScopePermission(permissions.BasePermission):
         Raises:
             PermissionDenied: If required scope is missing from token
         """
-        # Get the current action (e.g., 'list', 'create'), if None let DRF handle it
-        action = getattr(view, "action", None)
-        if not action:
-            # DRF routers return a 405 for unsupported methods
+        required_scope = self.get_required_scope(view)
+        if required_scope is None:
             return True
 
-        required_scope = self.scope_map.get(action)
-        if not required_scope:
-            # Action not in scope_map, deny by default
-            raise exceptions.PermissionDenied(
-                f"Insufficient permissions. Required scope: {required_scope}"
-            )
-
-        token_payload = request.auth
-        token_scopes = token_payload.get("scope")
+        token_scopes = self.get_token_scopes(request)
 
         if not token_scopes:
             raise exceptions.PermissionDenied("Insufficient permissions.")
 
-        # Ensure scopes is a list (handle both list and space-separated string)
-        if isinstance(token_scopes, str):
-            token_scopes = token_scopes.split()
-
-        # Ensure scopes is a deduplicated list (preserving order) and lowercase all scopes
-        token_scopes = list(dict.fromkeys(scope.lower() for scope in token_scopes))
-
-        if settings.OIDC_RS_SCOPES_PREFIX:
-            token_scopes = [
-                scope.removeprefix(f"{settings.OIDC_RS_SCOPES_PREFIX}:")
-                for scope in token_scopes
-            ]
-
         if required_scope not in token_scopes:
             raise exceptions.PermissionDenied(
                 f"Insufficient permissions. Required scope: {required_scope}"
@@ -73,6 +102,37 @@ class BaseScopePermission(permissions.BasePermission):
         return True
 
 
+class ApplicationScopePermission(BaseScopePermission):
+    """Scope-based permission for application-authenticated endpoints."""
+
+    @staticmethod
+    def strip_scope_prefix(token_scopes):
+        """Compare application scopes verbatim."""
+        return token_scopes
+
+    def has_permission(self, request, view):
+        """Check the scope claim, then the grant recorded in the database."""
+        granted = super().has_permission(request, view)
+
+        required_scope = self.get_required_scope(view)
+
+        if granted and required_scope:
+            client_id = (request.auth or {}).get("client_id")
+
+            if not models.Application.has_active_scope(client_id, required_scope):
+                logger.warning(
+                    "Application '%s' presented scope '%s' without a matching "
+                    "grant in database",
+                    client_id,
+                    required_scope,
+                )
+                raise exceptions.PermissionDenied(
+                    f"Application is not granted the required scope: {required_scope}"
+                )
+
+        return granted
+
+
 class HasRequiredRoomScope(BaseScopePermission):
     """Permission class for Room-related operations."""
 
@@ -86,6 +146,14 @@ class HasRequiredRoomScope(BaseScopePermission):
     }
 
 
+class HasRequiredUserScope(ApplicationScopePermission):
+    """Scope-based permissions for the external user endpoints."""
+
+    scope_map = {
+        "generate_transit_code": models.ApplicationScope.USERS_SESSION,
+    }
+
+
 class RoomPermissions(permissions.BasePermission):
     """Permissions applying to the room API endpoint."""
 

src/backend/core/external_api/viewsets.py

@@ -27,6 +27,7 @@ from core import analytics, api, models
 from core.api.feature_flag import FeatureFlag
 from core.services.jwt_token import JwtTokenService
 from core.services.room_management import RoomManagement
+from core.services.transit_code import TransitCodeService
 
 from ..services.provisional_user_service import (
     ProvisionalUserCreationDisabledError,
@@ -265,3 +266,59 @@ class RoomViewSet(
             updated_fields=updated_fields,
             previous_access_level=previous_values["access_level"],
         )
+
+
+class UserViewSet(viewsets.GenericViewSet):
+    """Application-delegated API for user operations.
+
+    Provides JWT-authenticated access to user operations for external
+    applications acting on behalf of users. All operations are
+    scope-based. Meant to grow with the other user actions exposed to
+    third parties.
+
+    Supported operations:
+    - transit-code: Mint a single-use transit code for the delegated user
+      (requires 'users:session' scope)
+    """
+
+    authentication_classes = [
+        authentication.ApplicationJWTAuthentication,
+    ]
+    permission_classes = [
+        api.permissions.IsAuthenticated & permissions.HasRequiredUserScope
+    ]
+
+    @decorators.action(
+        detail=False,
+        methods=["post"],
+        url_path="transit-code",
+        url_name="transit-code",
+    )
+    @FeatureFlag.require("user_access_token")
+    def generate_transit_code(self, request):
+        """Mint a transit code for the delegated user.
+
+        Returns a short-lived, single-use opaque code to pass to an embedded
+        frontend (e.g. via a URL fragment when cookies are unavailable). The
+        frontend exchanges it once on
+        POST /api/v1.0/users/exchange-access-token/ for a JWT access token,
+        equivalent to session-cookie authentication and never exposed in a URL.
+        """
+        client_id = (request.auth or {}).get("client_id", "unknown")
+
+        code = TransitCodeService().create_code(request.user, client_id=client_id)
+
+        # Log for auditing
+        logger.info(
+            "Transit code issued: user_id=%s, client_id=%s",
+            request.user.id,
+            client_id,
+        )
+
+        return drf_response.Response(
+            {
+                "transit_code": code,
+                "expires_in": settings.TRANSIT_CODE_TTL,
+            },
+            status=drf_status.HTTP_200_OK,
+        )

src/backend/core/management/commands/purge_inactive_rooms.py

@@ -1,94 +0,0 @@
-"""Purge inactive rooms."""
-
-from datetime import timedelta
-from itertools import batched
-from logging import getLogger
-
-from django.conf import settings
-from django.core.management.base import BaseCommand
-from django.db.models import Exists, OuterRef, Q
-from django.utils import timezone
-
-from core.models import Recording, RecordingStatusChoices, Room
-
-logger = getLogger(__name__)
-
-CHUNK_SIZE = 500
-
-
-class Command(BaseCommand):
-    """
-    Delete rooms that have not been started for ROOM_INACTIVITY_DELETION_DAYS days:
-    - rooms which were last started before that period
-    - rooms never started and created before that period
-
-    Rooms holding a saved recording that has not expired are kept.
-    """
-
-    help = "Purge inactive rooms"
-
-    def add_arguments(self, parser):
-        parser.add_argument(
-            "--dry-run",
-            action="store_true",
-            help="List the rooms that would be purged without deleting them",
-        )
-
-    def handle(self, *args, **options):
-        """Browse inactive rooms and delete them chunk by chunk."""
-
-        if not settings.ROOM_INACTIVITY_DELETION_DAYS:
-            self.stdout.write(
-                "Purging inactive rooms is disabled "
-                "(ROOM_INACTIVITY_DELETION_DAYS is not set)."
-            )
-            return
-
-        now = timezone.now()
-        inactive_rooms = self.get_inactive_rooms(now)
-
-        inactive_count = inactive_rooms.count()
-        if not inactive_count:
-            self.stdout.write("No inactive room to purge.")
-            return
-
-        if options["dry_run"]:
-            self.stdout.write(
-                f"[dry-run] {inactive_count} inactive room(s) would be purged:"
-            )
-            names = inactive_rooms.values_list("name", flat=True)
-            for name in names.iterator(chunk_size=CHUNK_SIZE):
-                self.stdout.write(f"- {name}")
-            return
-
-        purged_count = 0
-        rooms = inactive_rooms.values_list("pk", "slug").iterator(chunk_size=CHUNK_SIZE)
-        for chunk in batched(rooms, CHUNK_SIZE, strict=False):
-            for room_id, slug in chunk:
-                logger.info("Purging inactive room %s (%s)", room_id, slug)
-
-            _, deleted_by_model = inactive_rooms.filter(
-                pk__in=[room_id for room_id, _ in chunk]
-            ).delete()
-            purged_count += deleted_by_model.get("core.Room", 0)
-
-        self.stdout.write(f"Purged {purged_count} inactive room(s).")
-
-    @staticmethod
-    def get_inactive_rooms(now):
-        """Return the rooms inactive for too long that no recording protects."""
-
-        threshold = now - timedelta(days=settings.ROOM_INACTIVITY_DELETION_DAYS)
-        is_inactive = Q(last_started_at__lt=threshold) | Q(
-            last_started_at__isnull=True, created_at__lt=threshold
-        )
-
-        protected_recordings = Recording.objects.filter(
-            room=OuterRef("pk"), status__in=RecordingStatusChoices.saved_statuses()
-        )
-        if settings.RECORDING_EXPIRATION_DAYS:
-            protected_recordings = protected_recordings.filter(
-                created_at__gte=now - timedelta(days=settings.RECORDING_EXPIRATION_DAYS)
-            )
-
-        return Room.objects.filter(is_inactive, ~Exists(protected_recordings))

src/backend/core/migrations/0022_alter_application_scopes.py

@@ -0,0 +1,19 @@
+# Generated by Django 5.2.14 on 2026-07-31 18:27
+
+import django.contrib.postgres.fields
+from django.db import migrations, models
+
+
+class Migration(migrations.Migration):
+
+    dependencies = [
+        ('core', '0021_recording_external_process_id_alter_recording_status'),
+    ]
+
+    operations = [
+        migrations.AlterField(
+            model_name='application',
+            name='scopes',
+            field=django.contrib.postgres.fields.ArrayField(base_field=models.CharField(choices=[('rooms:create', 'Create rooms'), ('rooms:list', 'List rooms'), ('rooms:retrieve', 'Retrieve room details'), ('rooms:update', 'Update rooms'), ('rooms:delete', 'Delete rooms'), ('users:session', 'Create user session tokens')], max_length=50), blank=True, default=list, size=None),
+        ),
+    ]

src/backend/core/migrations/0023_alter_recording_status.py

@@ -1,18 +0,0 @@
-# Generated by Django 5.2.16 on 2026-09-23 16:49
-
-from django.db import migrations, models
-
-
-class Migration(migrations.Migration):
-
-    dependencies = [
-        ('core', '0022_user_default_room_access_level_and_more'),
-    ]
-
-    operations = [
-        migrations.AlterField(
-            model_name='recording',
-            name='status',
-            field=models.CharField(choices=[('initiated', 'Initiated'), ('active', 'Active'), ('stopped', 'Stopped'), ('saved', 'Saved'), ('aborted', 'Aborted'), ('failed', 'Failed'), ('failed_to_start', 'Failed to Start'), ('failed_to_stop', 'Failed to Stop'), ('notification_succeeded', 'Notification succeeded'), ('external_process_successful', 'External process successful'), ('external_process_failed', 'External process failed')], default='initiated', max_length=50),
-        ),
-    ]

src/backend/core/migrations/0023_user_default_room_access_level_and_more.py

@@ -6,7 +6,7 @@ from django.db import migrations, models
 class Migration(migrations.Migration):
 
     dependencies = [
-        ('core', '0021_recording_external_process_id_alter_recording_status'),
+        ('core', '0022_alter_application_scopes'),
     ]
 
     operations = [

src/backend/core/migrations/0024_room_last_started_at.py

@@ -1,18 +0,0 @@
-from django.db import migrations, models
-import django.utils.timezone
-
-
-class Migration(migrations.Migration):
-
-    dependencies = [
-        ('core', '0023_alter_recording_status'),
-    ]
-
-    operations = [
-        migrations.AddField(
-            model_name='room',
-            name='last_started_at',
-            field=models.DateTimeField(blank=True, default=django.utils.timezone.now, editable=False, help_text='date and time at which the room was last started', null=True, verbose_name='last started at'),
-            preserve_default=False,
-        ),
-    ]

src/backend/core/models.py

@@ -58,7 +58,6 @@ class RecordingStatusChoices(models.TextChoices):
     STOPPED = "stopped", _("Stopped")
     SAVED = "saved", _("Saved")
     ABORTED = "aborted", _("Aborted")
-    FAILED = "failed", _("Failed")
     FAILED_TO_START = "failed_to_start", _("Failed to Start")
     FAILED_TO_STOP = "failed_to_stop", _("Failed to Stop")
     NOTIFICATION_SUCCEEDED = "notification_succeeded", _("Notification succeeded")
@@ -80,7 +79,6 @@ class RecordingStatusChoices(models.TextChoices):
             cls.STOPPED,
             cls.SAVED,
             cls.ABORTED,
-            cls.FAILED,
             cls.EXTERNAL_PROCESS_SUCCESSFUL,
             cls.EXTERNAL_PROCESS_FAILED,
             cls.FAILED_TO_START,
@@ -88,15 +86,9 @@ class RecordingStatusChoices(models.TextChoices):
         }
 
     @classmethod
-    def saved_statuses(cls):
-        """Return the statuses of a recording whose file users can access."""
-
-        return {
-            cls.NOTIFICATION_SUCCEEDED,
-            cls.SAVED,
-            cls.EXTERNAL_PROCESS_SUCCESSFUL,
-            cls.EXTERNAL_PROCESS_FAILED,
-        }
+    def is_unsuccessful(cls, status):
+        """Determine if the recording status represents an unsuccessful state."""
+        return status in {cls.ABORTED, cls.FAILED_TO_START, cls.FAILED_TO_STOP}
 
 
 class RecordingModeChoices(models.TextChoices):
@@ -437,13 +429,6 @@ class Room(Resource):
         verbose_name=_("Room PIN code"),
         help_text=_("Unique n-digit code that identifies this room in telephony mode."),
     )
-    last_started_at = models.DateTimeField(
-        verbose_name=_("last started at"),
-        help_text=_("date and time at which the room was last started"),
-        blank=True,
-        null=True,
-        editable=False,
-    )
 
     class Meta:
         db_table = "meet_room"
@@ -597,7 +582,6 @@ class Recording(BaseModel):
     4. NOTIFICATION_SUCCEEDED: External service has been notified of this recording
 
     Error States:
-    - FAILED: Egress failed mid-recording
     - FAILED_TO_START: Worker failed to initialize recording
     - FAILED_TO_STOP: Worker failed during stop operation
     - ABORTED: Recording was terminated before completion
@@ -700,7 +684,12 @@ class Recording(BaseModel):
     @property
     def is_saved(self) -> bool:
         """Check if the recording is in a saved state."""
-        return self.status in RecordingStatusChoices.saved_statuses()
+        return self.status in {
+            RecordingStatusChoices.NOTIFICATION_SUCCEEDED,
+            RecordingStatusChoices.SAVED,
+            RecordingStatusChoices.EXTERNAL_PROCESS_SUCCESSFUL,
+            RecordingStatusChoices.EXTERNAL_PROCESS_FAILED,
+        }
 
     @property
     def extension(self):
@@ -799,6 +788,7 @@ class ApplicationScope(models.TextChoices):
     ROOMS_RETRIEVE = "rooms:retrieve", _("Retrieve room details")
     ROOMS_UPDATE = "rooms:update", _("Update rooms")
     ROOMS_DELETE = "rooms:delete", _("Delete rooms")
+    USERS_SESSION = "users:session", _("Create user session tokens")
 
 
 class Application(BaseModel):
@@ -848,6 +838,18 @@ class Application(BaseModel):
         domain = get_domain_from_email(email)
         return self.allowed_domains.filter(domain__iexact=domain).exists()
 
+    @classmethod
+    def has_active_scope(cls, client_id, scope) -> bool:
+        """Check that an active application holds a scope."""
+        if not client_id or not scope:
+            return False
+
+        return cls.objects.filter(
+            client_id=client_id,
+            is_active=True,
+            scopes__contains=[scope],
+        ).exists()
+
 
 class ApplicationDomain(BaseModel):
     """Domain authorized for application delegation."""

src/backend/core/recording/enums.py

@@ -8,50 +8,3 @@ class FileExtension(Enum):
 
     OGG = "ogg"
     MP4 = "mp4"
-
-
-class RecordingWorkerEvent(Enum):
-    """Lifecycle events a recording worker reports about a recording.
-
-    It is intended to be free of SFU-specific vocabulary.
-    """
-
-    # The worker accepted the request but is not recording yet.
-    STARTING = "starting"
-    # The worker is recording.
-    STARTED = "started"
-    # The worker stopped recording and is flushing the media file.
-    SAVING = "saving"
-
-    # The recording ended, its media file is available.
-    COMPLETED = "completed"
-    # The recording ended on its configured limit, its media file is available.
-    LIMIT_REACHED = "limit reached"
-    # The worker stopped before it ever started recording, there is no media file.
-    ABORTED = "aborted"
-    # The worker hit a runtime error once recording had started; its media file
-    # may be available.
-    FAILED = "failed"
-
-    @classmethod
-    def is_terminal(cls, event):
-        """Determine if the event ends the recording's lifecycle (successful or not)."""
-
-        return event in TERMINAL_EVENTS
-
-
-SUCCESSFUL_EVENTS = frozenset(
-    {
-        RecordingWorkerEvent.COMPLETED,
-        RecordingWorkerEvent.LIMIT_REACHED,
-    }
-)
-
-UNSUCCESSFUL_EVENTS = frozenset(
-    {
-        RecordingWorkerEvent.ABORTED,
-        RecordingWorkerEvent.FAILED,
-    }
-)
-
-TERMINAL_EVENTS = SUCCESSFUL_EVENTS | UNSUCCESSFUL_EVENTS

src/backend/core/recording/services/recording_events.py

@@ -1,13 +1,13 @@
-"""Recording-related Events Service"""
+"""Recording-related LiveKit Events Service"""
+
+# pylint: disable=no-member
 
 from logging import getLogger
 
+from livekit import api
+
 from core import models, utils
 from core.models import Recording
-from core.recording.enums import (
-    UNSUCCESSFUL_EVENTS,
-    RecordingWorkerEvent,
-)
 from core.recording.event.notification import notification_service
 from core.services.room_management import (
     RoomManagement,
@@ -26,110 +26,22 @@ class RecordingNotSavableError(Exception):
     """Recording cannot be saved because it is either in an error state or has already been saved"""
 
 
-# Notification sent to the room's participants, per event and recording mode.
-NOTIFICATION_PREFIXES = {
-    models.RecordingModeChoices.SCREEN_RECORDING: "screenRecording",
-    models.RecordingModeChoices.TRANSCRIPT: "transcription",
-}
-NOTIFICATION_SUFFIXES = {
-    RecordingWorkerEvent.LIMIT_REACHED: "LimitReached",
-    RecordingWorkerEvent.FAILED: "Failed",
-    RecordingWorkerEvent.ABORTED: "Aborted",
-}
-
-
-def get_notification_type(recording_mode, event):
-    """Generate corresponding notification type string."""
-    try:
-        return f"{NOTIFICATION_PREFIXES[recording_mode]}{NOTIFICATION_SUFFIXES[event]}"
-    except KeyError:
-        return None
-
-
-# Recording status in the room's metadata, per event.
-ROOM_METADATA_RECORDING_STATUSES = {
-    RecordingWorkerEvent.STARTED: "started",
-    RecordingWorkerEvent.SAVING: "saving",
-}
-
-
 class RecordingEventsService:
-    """Handles recording-related worker events.
-
-    Two entry points: `handle_update` for the events a running recording
-    reports, and `handle_terminal_event` for the one ending it.
-    """
+    """Handles recording-related LiveKit webhook events."""
 
     @staticmethod
-    def log_worker_error(recording, event, error=None, error_code=None):
-        """Log FAILED at error level and expected ABORTED outcomes at info level."""
-
-        if event == RecordingWorkerEvent.FAILED:
-            log = logger.error
-        elif event == RecordingWorkerEvent.ABORTED:
-            log = logger.info
-        else:
-            return
-
-        log(
-            "Recording worker reported %s for recording %s (room=%s, mode=%s): %s (error_code=%s)",
-            event.value,
-            recording.id,
-            recording.room.id,
-            recording.mode,
-            error or "no error reported",
-            error_code or "no error_code reported",
-        )
-
-    @staticmethod
-    def _notify_participants(recording: Recording, event: RecordingWorkerEvent):
-        """Notify the room's participants that a recording ended on the given event."""
-        recording_mode = recording.options.get("original_mode", None) or recording.mode
-
-        notification_type = get_notification_type(recording_mode, event)
-        if not notification_type:
-            logger.warning(
-                "Could not find notification type for: "
-                "room=%s, recording_id=%s, mode=%s, event=%s",
-                recording.room.id,
-                recording.id,
-                recording_mode,
-                event.value,
-            )
-            return
-
-        try:
-            utils.notify_participants(
-                room_name=str(recording.room.id),
-                notification_data={"type": notification_type},
-            )
-        except utils.NotificationError as e:
-            raise RecordingEventsError(
-                f"Failed to notify participants in room '{recording.room.id}' about "
-                f"recording {event.value} (recording_id={recording.id})"
-            ) from e
-
-    @staticmethod
-    def _log_notification_failure(recording, event: RecordingWorkerEvent):
-        """Log a participant notification error on an unsuccessful recording."""
-
-        logger.exception(
-            "Failed to notify participants that recording %s %s (room=%s)",
-            recording.id,
-            event.value,
-            recording.room.id,
-        )
-
-    @staticmethod
-    def handle_update(recording: Recording, event: RecordingWorkerEvent):
-        """Handle non-terminal worker events and sync recording state to room metadata.
-
-        Terminal events are dispatched through `handle_terminal_event` instead.
-        """
+    def handle_update(recording: Recording, egress_status):
+        """Handle egress status updates and sync recording state to room metadata."""
 
         room_name = str(recording.room.id)
 
-        recording_status = ROOM_METADATA_RECORDING_STATUSES.get(event)
+        status_mapping = {
+            api.EgressStatus.EGRESS_ACTIVE: "started",
+            api.EgressStatus.EGRESS_ENDING: "saving",
+            api.EgressStatus.EGRESS_ABORTED: "aborted",
+        }
+
+        recording_status = status_mapping.get(egress_status)
         if recording_status:
             try:
                 RoomManagement.update_metadata(
@@ -143,113 +55,42 @@ class RecordingEventsService:
             except RoomManagementException as e:
                 logger.exception("Failed to update room's metadata: %s", e)
 
-    def handle_terminal_event(self, recording: Recording, event: RecordingWorkerEvent):
-        """Run the appropriate handlers for a terminal event, given the recording's state."""
-
-        if not RecordingWorkerEvent.is_terminal(event):
-            logger.warning(
-                "Ignoring non-terminal event %s dispatched as a terminal event "
-                "for recording %s.",
-                event.value,
-                recording.id,
-            )
-            return
-
-        if event in UNSUCCESSFUL_EVENTS:
-            self._flag_unsuccessful_recording(recording, event)
-        else:
-            self._save_successful_recording(recording, event)
-
-    def _flag_unsuccessful_recording(
-        self, recording: Recording, event: RecordingWorkerEvent
-    ):
-        """Persist the outcome of a recording the worker announced as unsuccessful."""
-
-        # Aborted
-        if event == RecordingWorkerEvent.ABORTED:
-            if recording.status == models.RecordingStatusChoices.ACTIVE:
-                self._apply_outcome(recording, event, self._handle_aborted)
-            return
-
-        # Failed
-        if event == RecordingWorkerEvent.FAILED:
-            if recording.is_savable():
-                self._apply_outcome(recording, event, self._handle_failed)
-            return
-
-        logger.error(
-            "Unsuccessful event %s has no handler; recording %s keeps status '%s'.",
-            event.value,
-            recording.id,
-            recording.status,
-        )
-
-    def _save_successful_recording(
-        self, recording: Recording, event: RecordingWorkerEvent
-    ):
-        """Save a recording whose media file the worker made available."""
-
-        # Limit reached
-        if (
-            event == RecordingWorkerEvent.LIMIT_REACHED
-            and recording.status == models.RecordingStatusChoices.ACTIVE
-        ):
-            self._apply_outcome(recording, event, self._handle_limit_reached)
-
-        try:
-            self._handle_successful(recording)
-        except RecordingNotSavableError:
-            logger.warning(
-                "Recording %s is not savable on a completed recording "
-                "(already saved or in an error state); ignoring.",
-                recording.id,
-            )
-
-    def _apply_outcome(
-        self, recording: Recording, event: RecordingWorkerEvent, handler
-    ):
-        """Keep notification failure non-fatal."""
-
-        try:
-            handler(recording)
-        except RecordingEventsError:
-            self._log_notification_failure(recording, event)
-
-    @classmethod
-    def _handle_limit_reached(cls, recording: Recording):
+    @staticmethod
+    def handle_limit_reached(recording: Recording):
         """Stop recording and notify participants when limit is reached."""
 
         recording.status = models.RecordingStatusChoices.STOPPED
         recording.save()
 
-        cls._notify_participants(recording, RecordingWorkerEvent.LIMIT_REACHED)
+        notification_mapping = {
+            models.RecordingModeChoices.SCREEN_RECORDING: "screenRecordingLimitReached",
+            models.RecordingModeChoices.TRANSCRIPT: "transcriptionLimitReached",
+        }
 
-    @classmethod
-    def _handle_failed(cls, recording: Recording):
-        """Set recording status to failed, matching the worker event, and notify participants.
+        notification_type = notification_mapping.get(recording.mode)
+        if not notification_type:
+            return
 
-        FAILED: used when an actual runtime/pipeline error occurs after the
-        recording has started
-        """
-        recording.status = models.RecordingStatusChoices.FAILED
-        recording.save()
-
-        cls._notify_participants(recording, RecordingWorkerEvent.FAILED)
-
-    @classmethod
-    def _handle_aborted(cls, recording: Recording):
-        """Set recording status to aborted, matching the worker event, and notify participants.
-
-        ABORTED: used when the worker stops before it ever became
-        active/recording
-        """
-        recording.status = models.RecordingStatusChoices.ABORTED
-        recording.save()
-
-        cls._notify_participants(recording, RecordingWorkerEvent.ABORTED)
+        try:
+            utils.notify_participants(
+                room_name=str(recording.room.id),
+                notification_data={"type": notification_type},
+            )
+        except utils.NotificationError as e:
+            logger.exception(
+                "Failed to notify participants about recording limit reached: "
+                "room=%s, recording_id=%s, mode=%s",
+                recording.room.id,
+                recording.id,
+                recording.mode,
+            )
+            raise RecordingEventsError(
+                f"Failed to notify participants in room '{recording.room.id}' about "
+                f"recording limit reached (recording_id={recording.id})"
+            ) from e
 
     @staticmethod
-    def _handle_successful(recording: Recording):
+    def handle_complete(recording: Recording):
         """Notify external services and save recording."""
 
         if not recording.is_savable():

src/backend/core/recording/worker/services.py

@@ -2,8 +2,6 @@
 
 # pylint: disable=no-member
 
-import logging
-
 from asgiref.sync import async_to_sync
 from livekit import api as livekit_api
 
@@ -12,8 +10,6 @@ from ..enums import FileExtension
 from .exceptions import WorkerConnectionError, WorkerResponseError
 from .factories import WorkerServiceConfig
 
-logger = logging.getLogger(__name__)
-
 
 class BaseEgressService:
     """Base egress defining common methods to manage and interact with LiveKit egress processes."""
@@ -53,22 +49,6 @@ class BaseEgressService:
         finally:
             await lkapi.aclose()
 
-    @staticmethod
-    def _log_egress_error(response, event: str):
-        """Log the reason LiveKit reported an unsuccessful egress on stop.
-
-        Mirrors the logging done in the 'egress_ended' webhook. The
-        StopEgress response carries the same error fields.
-        """
-        logger.error(
-            "Egress %s on stop (egress_id=%s, status=%s): %s (error_code=%s)",
-            event,
-            response.egress_id,
-            livekit_api.EgressStatus.Name(response.status),
-            response.error or "no error reported",
-            response.error_code or "no error_code reported",
-        )
-
     def stop(self, worker_id: str) -> str:
         """Stop an ongoing egress worker.
         The StopEgressRequest is shared among all types of egress,
@@ -86,26 +66,14 @@ class BaseEgressService:
                 "LiveKit response is missing the recording status."
             )
 
+        # To avoid exposing EgressStatus values and coupling with LiveKit outside of this class,
+        # the response status is mapped to simpler "ABORTED", "STOPPED" or "FAILED_TO_STOP" strings.
+        if response.status == livekit_api.EgressStatus.EGRESS_ABORTED:
+            return "ABORTED"
+
         if response.status == livekit_api.EgressStatus.EGRESS_ENDING:
             return "STOPPED"
 
-        if response.status == livekit_api.EgressStatus.EGRESS_LIMIT_REACHED:
-            return "STOPPED"
-
-        # Cases below should be very infrequent as status changes should be
-        # received and processed by `handle_ended`, thus `stop` would not
-        # be called (unless failure and stop are very close in time).
-        # We therefore accept not to notify the user in this code branch.
-        # This could be fixed in a future refactoring.
-        if response.status == livekit_api.EgressStatus.EGRESS_ABORTED:
-            self._log_egress_error(response, "aborted")
-            return "ABORTED"
-
-        if response.status == livekit_api.EgressStatus.EGRESS_FAILED:
-            self._log_egress_error(response, "failed")
-            return "FAILED"
-
-        self._log_egress_error(response, "failed to stop")
         return "FAILED_TO_STOP"
 
     def start(self, room_name, recording_id):

src/backend/core/services/livekit_events.py

@@ -8,17 +8,19 @@ from enum import Enum
 from logging import getLogger
 
 from django.conf import settings
-from django.utils import timezone
 
 from livekit import api
 
 from core import models
-from core.recording.enums import RecordingWorkerEvent
 from core.recording.services.metadata_collector import (
     MetadataCollectorException,
     MetadataCollectorService,
 )
-from core.recording.services.recording_events import RecordingEventsService
+from core.recording.services.recording_events import (
+    RecordingEventsError,
+    RecordingEventsService,
+    RecordingNotSavableError,
+)
 
 from .lobby import LobbyService
 from .presence import PresenceCache
@@ -82,30 +84,6 @@ class LiveKitWebhookEventType(Enum):
     INGRESS_ENDED = "ingress_ended"
 
 
-# LiveKit egress statuses mapped to recording worker event statuses
-EGRESS_STATUS_TO_RECORDING_EVENT = {
-    api.EgressStatus.EGRESS_STARTING: RecordingWorkerEvent.STARTING,
-    api.EgressStatus.EGRESS_ACTIVE: RecordingWorkerEvent.STARTED,
-    api.EgressStatus.EGRESS_ENDING: RecordingWorkerEvent.SAVING,
-    api.EgressStatus.EGRESS_COMPLETE: RecordingWorkerEvent.COMPLETED,
-    api.EgressStatus.EGRESS_LIMIT_REACHED: RecordingWorkerEvent.LIMIT_REACHED,
-    api.EgressStatus.EGRESS_ABORTED: RecordingWorkerEvent.ABORTED,
-    api.EgressStatus.EGRESS_FAILED: RecordingWorkerEvent.FAILED,
-}
-
-
-def to_recording_event(egress_status):
-    """Translate a LiveKit egress status into a recording worker event."""
-
-    event = EGRESS_STATUS_TO_RECORDING_EVENT.get(egress_status)
-    if event is None:
-        logger.warning(
-            "Unmapped LiveKit egress status '%s', ignoring the event.",
-            egress_status,
-        )
-    return event
-
-
 class LiveKitEventsService:
     """Service for processing and handling LiveKit webhook events and notifications."""
 
@@ -195,20 +173,12 @@ class LiveKitEventsService:
                 f"Recording with worker ID {egress_id} does not exist"
             ) from err
 
-        event = to_recording_event(data.egress_info.status)
-        if event is None:
-            return
-
-        self.recording_events.handle_update(recording, event)
+        egress_status = data.egress_info.status
+        self.recording_events.handle_update(recording, egress_status)
 
     def _handle_egress_ended(self, data):
-        """Handle 'egress_ended' event.
+        """Handle 'egress_ended' event."""
 
-        Egress ended is sent with one of these statuses:
-        EGRESS_COMPLETE, EGRESS_FAILED, EGRESS_ABORTED, EGRESS_LIMIT_REACHED
-        """
-
-        # Fetch recording
         try:
             recording = models.Recording.objects.select_related("room").get(
                 worker_id=data.egress_info.egress_id
@@ -218,17 +188,6 @@ class LiveKitEventsService:
                 f"Recording with worker ID {data.egress_info.egress_id} does not exist"
             ) from err
 
-        event = to_recording_event(data.egress_info.status)
-
-        # Log if/why the recording failed
-        self.recording_events.log_worker_error(
-            recording,
-            event,
-            error=data.egress_info.error,
-            error_code=data.egress_info.error_code,
-        )
-
-        # Update room
         try:
             room_name = str(recording.room.id)
             RoomManagement.update_metadata(
@@ -242,17 +201,38 @@ class LiveKitEventsService:
         except RoomManagementException as e:
             logger.exception("Failed to update room's metadata: %s", e)
 
-        # Stop metadata collector
         if recording.options.get("metadata_collector_dispatch_id", None) is not None:
             try:
                 MetadataCollectorService().stop(recording)
             except MetadataCollectorException:
                 logger.warning("Failed to stop the MetadataCollectorService")
 
-        if event is None:
-            return
+        if (
+            data.egress_info.status == api.EgressStatus.EGRESS_LIMIT_REACHED
+            and recording.status == models.RecordingStatusChoices.ACTIVE
+        ):
+            try:
+                self.recording_events.handle_limit_reached(recording)
+            except RecordingEventsError as e:
+                raise ActionFailedError(
+                    f"Failed to process limit reached event for recording {recording}"
+                ) from e
 
-        self.recording_events.handle_terminal_event(recording, event)
+        # Finalize the recording, the egress has uploaded the file to the storage
+        if data.egress_info.status in [
+            api.EgressStatus.EGRESS_COMPLETE,
+            api.EgressStatus.EGRESS_LIMIT_REACHED,
+        ]:
+            try:
+                self.recording_events.handle_complete(recording)
+            except RecordingNotSavableError:
+                logger.warning(
+                    "Recording %s is not savable on egress complete "
+                    "(already saved or in an error state); ignoring.",
+                    recording.id,
+                )
+
+        # Silently ignoring EGRESS_ABORTED, EGRESS_FAILED
 
     @staticmethod
     def _is_connection_test_room(room_name: str) -> bool:
@@ -271,20 +251,12 @@ class LiveKitEventsService:
             )
             raise ActionFailedError("Failed to process room started event") from e
 
-        room_updated_count = models.Room.objects.filter(pk=room_id).update(
-            last_started_at=timezone.now()
-        )
-        if not room_updated_count:
-            raise ActionFailedError(f"Room with ID {room_id} does not exist")
+        try:
+            room = models.Room.objects.get(id=room_id)
+        except models.Room.DoesNotExist as err:
+            raise ActionFailedError(f"Room with ID {room_id} does not exist") from err
 
         if settings.ROOM_TELEPHONY_ENABLED or settings.ROOMKIT_ENABLED:
-            try:
-                room = models.Room.objects.get(pk=room_id)
-            except models.Room.DoesNotExist as err:
-                raise ActionFailedError(
-                    f"Room with ID {room_id} does not exist"
-                ) from err
-
             try:
                 self.sip_management.ensure_dispatch_rule(room)
             except SIPException as e:

src/backend/core/services/lobby.py

@@ -131,23 +131,6 @@ class LobbyService:
         if participant_ids:
             self._redis().srem(self._get_index_key(room_id), *participant_ids)
 
-    @staticmethod
-    def _get_or_create_participant_id(request) -> str:
-        """Extract unique participant identifier from the request."""
-        return request.COOKIES.get(settings.LOBBY_COOKIE_NAME, str(uuid.uuid4()))
-
-    @staticmethod
-    def prepare_response(response, participant_id):
-        """Set participant cookie if needed."""
-        if not response.cookies.get(settings.LOBBY_COOKIE_NAME):
-            response.set_cookie(
-                key=settings.LOBBY_COOKIE_NAME,
-                value=participant_id,
-                httponly=True,
-                secure=True,
-                samesite="Lax",
-            )
-
     @staticmethod
     def can_bypass_lobby(room, user, role) -> bool:
         """Determines if a user can bypass the waiting lobby and join a room directly.
@@ -178,8 +161,9 @@ class LobbyService:
     def request_entry(
         self,
         room: models.Room,
-        request,
+        user,
         username: str,
+        participant_id: Optional[uuid.UUID] = None,
     ) -> Tuple[LobbyParticipant, Optional[Dict]]:
         """Request entry to a room for a participant.
 
@@ -194,52 +178,51 @@ class LobbyService:
         5. If denied, do nothing.
         """
 
-        participant_id = self._get_or_create_participant_id(request)
-        participant = self._get_participant(room.id, participant_id)
+        participant = None
+        if participant_id:
+            participant = self._get_participant(room.id, participant_id)
+
+        is_new_participant = participant is None
+        if is_new_participant:
+            participant = self._create_participant(username)
 
         room_id = str(room.id)
-        user_role = room.get_role(request.user)
+        user_role = room.get_role(user)
 
-        if self.can_bypass_lobby(room=room, user=request.user, role=user_role):
-            if participant is None:
-                participant = LobbyParticipant(
-                    status=LobbyParticipantStatus.ACCEPTED,
-                    username=username,
-                    id=participant_id,
-                    color=utils.generate_color(participant_id),
-                    entered_at=timezone.now().isoformat(),
-                )
-            else:
-                participant.status = LobbyParticipantStatus.ACCEPTED
+        if self.can_bypass_lobby(room=room, user=user, role=user_role):
+            if not is_new_participant:
+                self.clear_participant_cache(room.id, participant.id)
+            participant.status = LobbyParticipantStatus.ACCEPTED
 
             livekit_config = utils.generate_livekit_config(
                 room_id=room_id,
-                user=request.user,
-                username=username,
+                user=user,
+                username=participant.username,
                 color=participant.color,
                 configuration=room.configuration,
-                participant_id=participant_id,
+                participant_id=participant.id,
                 role=user_role,
             )
             return participant, livekit_config
 
         livekit_config = None
 
-        if participant is None:
-            participant = self.enter(room.id, participant_id, username)
+        if is_new_participant:
+            self._save_participant(room.id, participant)
+            self._notify_entry_request(room_id)
 
         elif participant.status == LobbyParticipantStatus.WAITING:
-            self.refresh_waiting_status(room.id, participant_id)
+            self.refresh_waiting_status(room.id, participant.id)
 
         elif participant.status == LobbyParticipantStatus.ACCEPTED:
             # wrongly named, contains access token to join a room
             livekit_config = utils.generate_livekit_config(
                 room_id=room_id,
-                user=request.user,
-                username=username,
+                user=user,
+                username=participant.username,
                 color=participant.color,
                 configuration=room.configuration,
-                participant_id=participant_id,
+                participant_id=participant.id,
                 role=user_role,
             )
 
@@ -257,24 +240,35 @@ class LobbyService:
         )
         self._index_touch(room_id)
 
-    def enter(
-        self, room_id: UUID, participant_id: str, username: str
-    ) -> LobbyParticipant:
-        """Add participant to waiting lobby."""
-
-        color = utils.generate_color(participant_id)
+    def _create_participant(self, username: str) -> LobbyParticipant:
+        """Create a new waiting participant without persisting it.
 
+        Participant identifiers are minted here, server-side, exclusively.
+        """
+        participant_id = str(uuid.uuid4())
         participant = LobbyParticipant(
             status=LobbyParticipantStatus.WAITING,
             username=username,
             id=participant_id,
-            color=color,
             entered_at=timezone.now().isoformat(),
+            color=utils.generate_color(participant_id),
         )
+        return participant
 
+    def _save_participant(self, room_id: UUID, participant: LobbyParticipant):
+        """Persist a participant in the room's lobby."""
+        cache.set(
+            self._get_cache_key(room_id, participant.id),
+            participant.to_dict(),
+            timeout=settings.LOBBY_WAITING_TIMEOUT,
+        )
+        self._index_add(room_id, participant.id)
+
+    def _notify_entry_request(self, room_id: str):
+        """Notify room participants of a new entry request."""
         try:
             utils.notify_participants(
-                room_name=str(room_id),
+                room_name=room_id,
                 notification_data={
                     "type": settings.LOBBY_NOTIFICATION_TYPE,
                 },
@@ -283,16 +277,6 @@ class LobbyService:
             # If room not created yet, there is no participants to notify
             logger.exception("Failed to notify room participants")
 
-        cache_key = self._get_cache_key(room_id, participant_id)
-        cache.set(
-            cache_key,
-            participant.to_dict(),
-            timeout=settings.LOBBY_WAITING_TIMEOUT,
-        )
-        self._index_add(room_id, participant_id)
-
-        return participant
-
     def _get_participant(
         self, room_id: UUID, participant_id: str
     ) -> Optional[LobbyParticipant]:
@@ -353,7 +337,7 @@ class LobbyService:
         room_id: UUID,
         participant_id: str,
         allow_entry: bool,
-    ) -> None:
+    ) -> LobbyParticipant:
         """Handle decision on participant entry.
 
         Updates participant status based on allow_entry:
@@ -371,7 +355,7 @@ class LobbyService:
                 "timeout": settings.LOBBY_DENIED_TIMEOUT,
             }
 
-        self._update_participant_status(room_id, participant_id, **decision)
+        return self._update_participant_status(room_id, participant_id, **decision)
 
     def _update_participant_status(
         self,
@@ -379,7 +363,7 @@ class LobbyService:
         participant_id: str,
         status: LobbyParticipantStatus,
         timeout: int,
-    ) -> None:
+    ) -> LobbyParticipant:
         """Update participant status with appropriate timeout."""
 
         cache_key = self._get_cache_key(room_id, participant_id)
@@ -402,6 +386,8 @@ class LobbyService:
         cache.set(cache_key, participant.to_dict(), timeout=timeout)
         self._index_touch(room_id)
 
+        return participant
+
     def clear_room_cache(self, room_id: UUID) -> None:
         """Clear all participant entries from the cache for a specific room."""
 

src/backend/core/services/room_management.py

@@ -76,6 +76,10 @@ class RoomManagement:
 
         except TwirpError as e:
             if e.code == "not_found":
+                logger.warning(
+                    "Room %s not found in LiveKit, skipping metadata update",
+                    room_name,
+                )
                 raise RoomNotFoundException("Room does not exist") from e
 
             logger.exception(

src/backend/core/services/transit_code.py

@@ -0,0 +1,74 @@
+"""Service handling the lifecycle of transit codes.
+
+A transit code is an opaque, cryptographically random, single-use code
+handed to an embedded frontend (through a URL fragment) so it can obtain a
+user access token on the core API without a session cookie. The code
+carries no information by itself: everything it references (user, client)
+is stored server-side in the cache, and consumed atomically on exchange.
+"""
+
+import hashlib
+import secrets
+
+from django.conf import settings
+from django.core.cache import cache
+
+
+class TransitCodeService:
+    """Create and consume single-use transit codes."""
+
+    @staticmethod
+    def _cache_key(code):
+        """Build the cache key for a code.
+
+        The code is hashed so that a dump of the cache never reveals
+        directly usable codes.
+        """
+        digest = hashlib.sha256(code.encode("utf-8")).hexdigest()
+        return f"{settings.TRANSIT_CODE_CACHE_PREFIX}:{digest}"
+
+    def create_code(self, user, client_id="unknown"):
+        """Generate a transit code for a user, and store it.
+
+        The code expires after TRANSIT_CODE_TTL seconds.
+
+        Returns:
+            str: The opaque code to hand to the client.
+        """
+        # Default 48 random bytes -> 64 url-safe characters, 384 bits of
+        # entropy: unguessable and safe to transit through a URL fragment.
+        code = secrets.token_urlsafe(settings.TRANSIT_CODE_NBYTES)
+
+        cache.set(
+            self._cache_key(code),
+            {
+                "user_id": str(user.id),
+                "client_id": client_id,
+            },
+            timeout=settings.TRANSIT_CODE_TTL,
+        )
+
+        return code
+
+    def consume_code(self, code):
+        """Consume a transit code, enforcing single use.
+
+        The code is deleted from the cache upon consumption. `cache.delete`
+        returns whether a key was actually deleted, so if two requests race
+        on the same code, only one of them wins.
+
+        Returns:
+            dict | None: The data stored at creation time ('user_id',
+                'client_id'), or None if the code is unknown, expired or
+                already consumed.
+        """
+        if not code:
+            return None
+
+        key = self._cache_key(code)
+        data = cache.get(key)
+
+        if data is None or not cache.delete(key):
+            return None
+
+        return data

src/backend/core/tests/commands/test_purge_inactive_rooms.py

@@ -1,239 +0,0 @@
-"""Tests for the purge_inactive_rooms management command."""
-
-import logging
-from datetime import timedelta
-from io import StringIO
-from unittest import mock
-
-from django.core.management import call_command
-from django.utils import timezone
-
-import pytest
-
-from core import factories, models
-
-pytestmark = pytest.mark.django_db
-
-COMMAND_MODULE = "core.management.commands.purge_inactive_rooms"
-
-BEFORE_PERIOD = timedelta(days=366)
-WITHIN_PERIOD = timedelta(days=364)
-
-
-@pytest.fixture(name="purge_enabled", autouse=True)
-def fixture_purge_enabled(settings):
-    """Enable the purge of the rooms inactive for a year."""
-    settings.ROOM_INACTIVITY_DELETION_DAYS = 365
-    settings.RECORDING_EXPIRATION_DAYS = 30
-
-
-def create_at(date, factory, **kwargs):
-    """Build an object with the factory as if it was created at the given date."""
-    with mock.patch("django.utils.timezone.now", return_value=date):
-        return factory(**kwargs)
-
-
-def call_purge(*args):
-    """Run the purge command and return what it wrote on stdout."""
-    out = StringIO()
-    call_command("purge_inactive_rooms", *args, stdout=out)
-    return out.getvalue()
-
-
-def room_exists(room):
-    """Tell whether the room is still in database."""
-    return models.Room.objects.filter(pk=room.pk).exists()
-
-
-def test_purge_inactive_rooms_disabled(settings):
-    """Should delete nothing when no inactivity period is configured."""
-    settings.ROOM_INACTIVITY_DELETION_DAYS = None
-    room = create_at(timezone.now() - BEFORE_PERIOD, factories.RoomFactory)
-
-    assert "disabled" in call_purge()
-
-    assert room_exists(room)
-
-
-def test_purge_inactive_rooms_without_recording_expiration(settings):
-    """Should purge when recordings never expire, keeping rooms with a saved one."""
-    settings.RECORDING_EXPIRATION_DAYS = None
-    long_ago = timezone.now() - BEFORE_PERIOD
-    room = create_at(long_ago, factories.RoomFactory)
-    room_with_recording = create_at(long_ago, factories.RoomFactory)
-    create_at(
-        long_ago,
-        factories.RecordingFactory,
-        room=room_with_recording,
-        status=models.RecordingStatusChoices.SAVED,
-    )
-
-    assert call_purge() == "Purged 1 inactive room(s).\n"
-
-    assert not room_exists(room)
-    assert room_exists(room_with_recording)
-
-
-def test_purge_inactive_rooms_without_recording_expiration_not_saved(settings):
-    """Should delete a room whose recordings were never saved when none expire."""
-    settings.RECORDING_EXPIRATION_DAYS = None
-    room = create_at(timezone.now() - BEFORE_PERIOD, factories.RoomFactory)
-    factories.RecordingFactory(room=room, status=models.RecordingStatusChoices.FAILED)
-
-    call_purge()
-
-    assert not room_exists(room)
-
-
-def test_purge_inactive_rooms_started_before_period(caplog):
-    """Should delete a room that was last started before the inactivity period."""
-    now = timezone.now()
-    room = create_at(
-        now - timedelta(days=800),
-        factories.RoomFactory,
-        last_started_at=now - BEFORE_PERIOD,
-    )
-
-    with caplog.at_level(logging.INFO, logger=COMMAND_MODULE):
-        output = call_purge()
-
-    assert output == "Purged 1 inactive room(s).\n"
-    assert not room_exists(room)
-    assert f"Purging inactive room {room.pk} ({room.slug})" in caplog.text
-
-
-def test_purge_inactive_rooms_never_started_created_before_period():
-    """Should delete a room that was never started and created before the period."""
-    room = create_at(timezone.now() - BEFORE_PERIOD, factories.RoomFactory)
-
-    call_purge()
-
-    assert not room_exists(room)
-
-
-def test_purge_inactive_rooms_started_within_period():
-    """Should keep a room created long ago that was started within the period."""
-    now = timezone.now()
-    room = create_at(
-        now - timedelta(days=800),
-        factories.RoomFactory,
-        last_started_at=now - WITHIN_PERIOD,
-    )
-
-    assert call_purge() == "No inactive room to purge.\n"
-
-    assert room_exists(room)
-
-
-def test_purge_inactive_rooms_never_started_created_within_period():
-    """Should keep a room that was never started but created within the period."""
-    room = create_at(timezone.now() - WITHIN_PERIOD, factories.RoomFactory)
-
-    assert call_purge() == "No inactive room to purge.\n"
-
-    assert room_exists(room)
-
-
-@pytest.mark.parametrize(
-    "status", sorted(models.RecordingStatusChoices.saved_statuses())
-)
-def test_purge_inactive_rooms_recording_not_expired(settings, status):
-    """Should keep a room holding a saved recording that has not expired yet."""
-    settings.RECORDING_EXPIRATION_DAYS = 400
-    long_ago = timezone.now() - BEFORE_PERIOD
-    room = create_at(long_ago, factories.RoomFactory)
-    create_at(long_ago, factories.RecordingFactory, room=room, status=status)
-
-    call_purge()
-
-    assert room_exists(room)
-
-
-def test_purge_inactive_rooms_recording_expired(settings):
-    """Should delete a room along with its recordings when they all have expired."""
-    settings.RECORDING_EXPIRATION_DAYS = 30
-    long_ago = timezone.now() - BEFORE_PERIOD
-    room = create_at(long_ago, factories.RoomFactory)
-    recording = create_at(
-        long_ago,
-        factories.RecordingFactory,
-        room=room,
-        status=models.RecordingStatusChoices.SAVED,
-    )
-
-    call_purge()
-
-    assert not room_exists(room)
-    assert not models.Recording.objects.filter(pk=recording.pk).exists()
-
-
-@pytest.mark.parametrize(
-    "status",
-    [
-        status
-        for status in models.RecordingStatusChoices
-        if status not in models.RecordingStatusChoices.saved_statuses()
-    ],
-)
-def test_purge_inactive_rooms_recording_not_saved(status):
-    """Should delete a room whose recordings were never saved, even unexpired."""
-    room = create_at(timezone.now() - BEFORE_PERIOD, factories.RoomFactory)
-    factories.RecordingFactory(room=room, status=status)
-
-    call_purge()
-
-    assert not room_exists(room)
-
-
-def test_purge_inactive_rooms_recording_saved_among_others():
-    """Should keep a room holding a saved recording next to a failed one."""
-    room = create_at(timezone.now() - BEFORE_PERIOD, factories.RoomFactory)
-    factories.RecordingFactory(room=room, status=models.RecordingStatusChoices.FAILED)
-    factories.RecordingFactory(room=room, status=models.RecordingStatusChoices.SAVED)
-
-    call_purge()
-
-    assert room_exists(room)
-
-
-def test_purge_inactive_rooms_deletes_accesses_and_resource():
-    """Should delete the last owner access and the resource of a purged room."""
-    room = create_at(timezone.now() - BEFORE_PERIOD, factories.RoomFactory)
-    access = factories.UserResourceAccessFactory(
-        resource=room, role=models.RoleChoices.OWNER
-    )
-
-    call_purge()
-
-    assert not room_exists(room)
-    assert not models.Resource.objects.filter(pk=room.pk).exists()
-    assert not models.ResourceAccess.objects.filter(pk=access.pk).exists()
-    assert models.User.objects.filter(pk=access.user.pk).exists()
-
-
-def test_purge_inactive_rooms_dry_run():
-    """Should list the inactive rooms by name without deleting them on a dry run."""
-    long_ago = timezone.now() - BEFORE_PERIOD
-    rooms = [
-        create_at(long_ago, factories.RoomFactory, name=name)
-        for name in ("Alpha room", "Beta room")
-    ]
-    factories.RoomFactory(name="Recent room")
-
-    assert call_purge("--dry-run") == (
-        "[dry-run] 2 inactive room(s) would be purged:\n- Alpha room\n- Beta room\n"
-    )
-
-    assert all(room_exists(room) for room in rooms)
-
-
-def test_purge_inactive_rooms_several_chunks():
-    """Should delete every inactive room when they span several chunks."""
-    long_ago = timezone.now() - BEFORE_PERIOD
-    rooms = [create_at(long_ago, factories.RoomFactory) for _ in range(5)]
-
-    with mock.patch(f"{COMMAND_MODULE}.CHUNK_SIZE", 2):
-        output = call_purge()
-
-    assert output == "Purged 5 inactive room(s).\n"
-    assert not any(room_exists(room) for room in rooms)

src/backend/core/tests/files/test_api_files_create.py

@@ -117,14 +117,14 @@ def test_api_files_create_file_authenticated_success():
     policy_parsed = urlparse(policy)
 
     assert policy_parsed.scheme == "http"
-    assert policy_parsed.netloc in ["garage:9000", "localhost:9000"]
+    assert policy_parsed.netloc in ["minio:9000", "localhost:9000"]
     assert policy_parsed.path == f"/meet-media-storage/tmp/files/{file.id!s}.png"
 
     query_params = parse_qs(policy_parsed.query)
 
     assert query_params.pop("X-Amz-Algorithm") == ["AWS4-HMAC-SHA256"]
     assert query_params.pop("X-Amz-Credential") == [
-        f"meet-access-key/{now.strftime('%Y%m%d')}/local/s3/aws4_request"
+        f"meet/{now.strftime('%Y%m%d')}/us-east-1/s3/aws4_request"
     ]
     assert query_params.pop("X-Amz-Date") == [now.strftime("%Y%m%dT%H%M%SZ")]
     assert query_params.pop("X-Amz-Expires") == ["60"]

src/backend/core/tests/recording/service/test_recording_events.py

@@ -2,23 +2,18 @@
 Test RecordingEventsService service.
 """
 
-# pylint: disable=redefined-outer-name,protected-access
+# pylint: disable=redefined-outer-name
 
-import logging
 from unittest import mock
 
 import pytest
 
 from core.factories import RecordingFactory
-from core.recording.enums import RecordingWorkerEvent
 from core.recording.services.recording_events import (
     RecordingEventsError,
     RecordingEventsService,
     RecordingNotSavableError,
 )
-from core.services.room_management import (
-    RoomManagementException,
-)
 from core.utils import NotificationError
 
 pytestmark = pytest.mark.django_db
@@ -39,10 +34,10 @@ def service():
 )
 @mock.patch("core.utils.notify_participants")
 def test_handle_limit_reached_success(mock_notify, mode, notification_type, service):
-    """Test _handle_limit_reached stops recording and notifies participants."""
+    """Test handle_limit_reached stops recording and notifies participants."""
 
     recording = RecordingFactory(status="active", mode=mode)
-    service._handle_limit_reached(recording)
+    service.handle_limit_reached(recording)
 
     assert recording.status == "stopped"
     mock_notify.assert_called_once_with(
@@ -53,69 +48,13 @@ def test_handle_limit_reached_success(mock_notify, mode, notification_type, serv
 @pytest.mark.parametrize(
     ("mode", "notification_type"),
     (
-        ("screen_recording", "screenRecordingFailed"),
-        ("transcript", "transcriptionFailed"),
+        ("screen_recording", "screenRecordingLimitReached"),
+        ("transcript", "transcriptionLimitReached"),
     ),
 )
 @mock.patch("core.utils.notify_participants")
-def test_handle_failed_success(mock_notify, mode, notification_type, service):
-    """Test _handle_failed marks recording as failed and notifies participants."""
-
-    recording = RecordingFactory(status="active", mode=mode)
-    service._handle_failed(recording)
-
-    assert recording.status == "failed"
-    mock_notify.assert_called_once_with(
-        room_name=str(recording.room.id), notification_data={"type": notification_type}
-    )
-
-
-@pytest.mark.parametrize(
-    ("mode", "notification_type"),
-    (
-        ("screen_recording", "screenRecordingAborted"),
-        ("transcript", "transcriptionAborted"),
-    ),
-)
-@mock.patch("core.utils.notify_participants")
-def test_handle_aborted_success(mock_notify, mode, notification_type, service):
-    """Test _handle_aborted marks recording as aborted and notifies participants."""
-
-    recording = RecordingFactory(status="active", mode=mode)
-    service._handle_aborted(recording)
-
-    assert recording.status == "aborted"
-    mock_notify.assert_called_once_with(
-        room_name=str(recording.room.id), notification_data={"type": notification_type}
-    )
-
-
-@pytest.mark.parametrize(
-    ("mode", "notification_prefix"),
-    (("screen_recording", "screenRecording"), ("transcript", "transcription")),
-)
-@pytest.mark.parametrize(
-    ("handler", "expected_status", "event", "notification_suffix"),
-    (
-        ("_handle_limit_reached", "stopped", "limit reached", "LimitReached"),
-        ("_handle_failed", "failed", "failed", "Failed"),
-        ("_handle_aborted", "aborted", "aborted", "Aborted"),
-    ),
-)
-@mock.patch("core.utils.notify_participants")
-def test_handle_event_notification_error(  # noqa: PLR0913, PLR0917
-    mock_notify,
-    handler,
-    expected_status,
-    event,
-    notification_suffix,
-    mode,
-    notification_prefix,
-    service,
-):  # pylint: disable=too-many-arguments,too-many-positional-arguments
-    """Test handlers raise RecordingEventsError when notifying participants fails,
-    while still applying the recording status of their event.
-    """
+def test_handle_limit_reached_error(mock_notify, mode, notification_type, service):
+    """Test handle_limit_reached raises RecordingEventsError when notification fails."""
 
     mock_notify.side_effect = NotificationError("Error notifying")
 
@@ -123,15 +62,14 @@ def test_handle_event_notification_error(  # noqa: PLR0913, PLR0917
 
     with pytest.raises(
         RecordingEventsError,
-        match=rf"Failed to notify participants in room '.+' "
-        rf"about recording {event} \(recording_id=.+\)",
+        match=r"Failed to notify participants in room '.+' "
+        r"about recording limit reached \(recording_id=.+\)",
     ):
-        getattr(service, handler)(recording)
+        service.handle_limit_reached(recording)
 
-    assert recording.status == expected_status
+    assert recording.status == "stopped"
     mock_notify.assert_called_once_with(
-        room_name=str(recording.room.id),
-        notification_data={"type": f"{notification_prefix}{notification_suffix}"},
+        room_name=str(recording.room.id), notification_data={"type": notification_type}
     )
 
 
@@ -144,19 +82,19 @@ def test_handle_event_notification_error(  # noqa: PLR0913, PLR0917
     "core.recording.services.recording_events.notification_service."
     "notify_external_services"
 )
-def test_handle_successful_saves_recording(  # pylint: disable=too-many-arguments, too-many-positional-arguments
+def test_handle_complete_saves_recording(  # pylint: disable=too-many-arguments, too-many-positional-arguments
     mock_notify_external_services,
     notify_return_value,
     expected_status,
     status,
     service,
 ):
-    """Test _handle_successful notifies external services and saves a savable recording."""
+    """Test handle_complete notifies external services and saves a savable recording."""
 
     mock_notify_external_services.return_value = notify_return_value
 
     recording = RecordingFactory(status=status)
-    service._handle_successful(recording)
+    service.handle_complete(recording)
 
     mock_notify_external_services.assert_called_once_with(recording)
 
@@ -166,293 +104,23 @@ def test_handle_successful_saves_recording(  # pylint: disable=too-many-argument
 
 @pytest.mark.parametrize(
     "status",
-    [
-        "initiated",
-        "saved",
-        "notification_succeeded",
-        "aborted",
-        "failed",
-        "failed_to_start",
-    ],
+    ["initiated", "saved", "notification_succeeded", "aborted", "failed_to_start"],
 )
 @mock.patch(
     "core.recording.services.recording_events.notification_service."
     "notify_external_services"
 )
-def test_handle_successful_non_savable_recording(
+def test_handle_complete_non_savable_recording(
     mock_notify_external_services, status, service
 ):
-    """Test _handle_successful refuses recordings that are already saved or in error."""
+    """Test handle_complete refuses recordings that are already saved or in error."""
 
     recording = RecordingFactory(status=status)
 
     with pytest.raises(RecordingNotSavableError):
-        service._handle_successful(recording)
+        service.handle_complete(recording)
 
     mock_notify_external_services.assert_not_called()
 
     recording.refresh_from_db()
     assert recording.status == status
-
-
-@pytest.mark.parametrize(
-    ("event", "recording_status"),
-    (
-        (RecordingWorkerEvent.STARTED, "started"),
-        (RecordingWorkerEvent.SAVING, "saving"),
-    ),
-)
-@mock.patch("core.services.room_management.RoomManagement.update_metadata")
-def test_handle_update_syncs_room_metadata(
-    mock_update_metadata, event, recording_status, service
-):
-    """Test handle_update updates the room's metadata."""
-
-    recording = RecordingFactory(status="active")
-    service.handle_update(recording, event)
-
-    mock_update_metadata.assert_called_once_with(
-        str(recording.room.id), {"recording_status": recording_status}
-    )
-
-
-@pytest.mark.parametrize(
-    "event",
-    (
-        RecordingWorkerEvent.STARTING,
-        RecordingWorkerEvent.COMPLETED,
-        RecordingWorkerEvent.LIMIT_REACHED,
-        RecordingWorkerEvent.ABORTED,
-        RecordingWorkerEvent.FAILED,
-    ),
-)
-@mock.patch("core.services.room_management.RoomManagement.update_metadata")
-def test_handle_update_ignores_events_without_a_metadata_status(
-    mock_update_metadata, event, service
-):
-    """Test handle_update doesn't update metadata for events it doesn't match."""
-
-    recording = RecordingFactory(status="active")
-    service.handle_update(recording, event)
-
-    mock_update_metadata.assert_not_called()
-
-
-@pytest.mark.parametrize(
-    ("event", "initial_status", "expected_status", "notification_type"),
-    (
-        (RecordingWorkerEvent.LIMIT_REACHED, "active", "saved", "LimitReached"),
-        (RecordingWorkerEvent.LIMIT_REACHED, "stopped", "saved", None),
-        (RecordingWorkerEvent.LIMIT_REACHED, "saved", "saved", None),
-        (RecordingWorkerEvent.ABORTED, "active", "aborted", "Aborted"),
-        (RecordingWorkerEvent.ABORTED, "failed_to_stop", "failed_to_stop", None),
-        (RecordingWorkerEvent.FAILED, "active", "failed", "Failed"),
-        (RecordingWorkerEvent.FAILED, "stopped", "failed", "Failed"),
-        (RecordingWorkerEvent.FAILED, "aborted", "aborted", None),
-        (RecordingWorkerEvent.COMPLETED, "active", "saved", None),
-        (RecordingWorkerEvent.COMPLETED, "saved", "saved", None),
-    ),
-)
-@mock.patch(
-    "core.recording.services.recording_events.notification_service."
-    "notify_external_services"
-)
-@mock.patch("core.utils.notify_participants")
-def test_handle_terminal_event_dispatches_on_event_and_status(  # noqa: PLR0913, PLR0917
-    mock_notify,
-    mock_notify_external_services,
-    event,
-    initial_status,
-    expected_status,
-    notification_type,
-    service,
-):  # pylint: disable=too-many-arguments,too-many-positional-arguments
-    """Test handle_terminal_event chooses the right handler from the event and status."""
-
-    mock_notify_external_services.return_value = False
-
-    recording = RecordingFactory(status=initial_status, mode="screen_recording")
-    service.handle_terminal_event(recording, event)
-
-    recording.refresh_from_db()
-    assert recording.status == expected_status
-
-    if notification_type is None:
-        mock_notify.assert_not_called()
-    else:
-        mock_notify.assert_called_once_with(
-            room_name=str(recording.room.id),
-            notification_data={"type": f"screenRecording{notification_type}"},
-        )
-
-
-@pytest.mark.parametrize(
-    "event",
-    (
-        RecordingWorkerEvent.STARTING,
-        RecordingWorkerEvent.STARTED,
-        RecordingWorkerEvent.SAVING,
-    ),
-)
-@mock.patch(
-    "core.recording.services.recording_events.notification_service."
-    "notify_external_services"
-)
-@mock.patch("core.utils.notify_participants")
-def test_handle_terminal_event_ignores_non_terminal_events(
-    mock_notify, mock_notify_external_services, event, service, caplog
-):
-    """Test handle_terminal_event refuses non-terminal events."""
-
-    recording = RecordingFactory(status="active")
-
-    with caplog.at_level(logging.WARNING):
-        service.handle_terminal_event(recording, event)
-
-    assert f"Ignoring non-terminal event {event.value}" in caplog.text
-    mock_notify.assert_not_called()
-    mock_notify_external_services.assert_not_called()
-
-    recording.refresh_from_db()
-    assert recording.status == "active"
-
-
-@pytest.mark.parametrize(
-    ("event", "expected_status"),
-    (
-        (RecordingWorkerEvent.LIMIT_REACHED, "saved"),
-        (RecordingWorkerEvent.ABORTED, "aborted"),
-        (RecordingWorkerEvent.FAILED, "failed"),
-    ),
-)
-@mock.patch(
-    "core.recording.services.recording_events.notification_service."
-    "notify_external_services"
-)
-@mock.patch("core.utils.notify_participants")
-def test_handle_terminal_event_survives_a_notification_failure(  # noqa: PLR0913, PLR0917
-    mock_notify,
-    mock_notify_external_services,
-    event,
-    expected_status,
-    service,
-    caplog,
-):  # pylint: disable=too-many-arguments,too-many-positional-arguments
-    """Test handle_terminal_event logs a notification failure instead of raising.
-
-    The recording status must still be persisted: participants missing their
-    notification should not disturb recording.
-    """
-
-    mock_notify_external_services.return_value = False
-    mock_notify.side_effect = NotificationError("Error notifying")
-
-    recording = RecordingFactory(status="active")
-
-    with caplog.at_level(logging.ERROR):
-        service.handle_terminal_event(recording, event)
-
-    assert f"Failed to notify participants that recording {recording.id}" in caplog.text
-
-    recording.refresh_from_db()
-    assert recording.status == expected_status
-
-
-@pytest.mark.parametrize(
-    "status",
-    ["failed_to_start", "aborted", "failed", "failed_to_stop", "saved", "initiated"],
-)
-@mock.patch(
-    "core.recording.services.recording_events.notification_service."
-    "notify_external_services"
-)
-def test_handle_terminal_event_ignores_a_non_savable_recording(
-    mock_notify_external_services, status, service, caplog
-):
-    """Test handle_terminal_event handles a redelivered event idempotently.
-
-    A terminal event may be redelivered for an already finalized recording;
-    this must not raise, otherwise the webhook would 500 and be retried.
-    """
-
-    recording = RecordingFactory(status=status)
-
-    with caplog.at_level(logging.WARNING):
-        service.handle_terminal_event(recording, RecordingWorkerEvent.COMPLETED)
-
-    assert f"Recording {recording.id} is not savable" in caplog.text
-    mock_notify_external_services.assert_not_called()
-
-    recording.refresh_from_db()
-    assert recording.status == status
-
-
-@mock.patch("core.services.room_management.RoomManagement.update_metadata")
-def test_handle_update_survives_a_metadata_failure(
-    mock_update_metadata, service, caplog
-):
-    """Test handle_update logs a metadata failure instead of raising."""
-
-    mock_update_metadata.side_effect = RoomManagementException("Error updating")
-
-    recording = RecordingFactory(status="active")
-
-    with caplog.at_level(logging.ERROR):
-        service.handle_update(recording, RecordingWorkerEvent.SAVING)
-
-    assert "Failed to update room's metadata" in caplog.text
-
-
-@pytest.mark.parametrize(
-    ("event", "expected_level"),
-    (
-        (RecordingWorkerEvent.ABORTED, logging.INFO),
-        (RecordingWorkerEvent.FAILED, logging.ERROR),
-    ),
-)
-def test_log_worker_error_reports_an_unsuccessful_event(
-    event, expected_level, service, caplog
-):
-    """Test log_worker_error records the reason the recording did not succeed."""
-
-    recording = RecordingFactory(status="active", mode="screen_recording")
-
-    with caplog.at_level(logging.INFO):
-        service.log_worker_error(
-            recording, event, error="could not connect to the room", error_code=500
-        )
-
-    assert (
-        f"Recording worker reported {event.value} for recording {recording.id}"
-        in caplog.text
-    )
-    assert "could not connect to the room" in caplog.text
-    assert "error_code=500" in caplog.text
-    worker_logs = [
-        record
-        for record in caplog.records
-        if record.name == "core.recording.services.recording_events"
-    ]
-    assert [record.levelno for record in worker_logs] == [expected_level]
-
-
-@pytest.mark.parametrize(
-    "event",
-    (
-        RecordingWorkerEvent.STARTING,
-        RecordingWorkerEvent.STARTED,
-        RecordingWorkerEvent.SAVING,
-        RecordingWorkerEvent.COMPLETED,
-        RecordingWorkerEvent.LIMIT_REACHED,
-        None,
-    ),
-)
-def test_log_worker_error_stays_quiet_on_anything_else(event, service, caplog):
-    """Test log_worker_error ignores events other than FAILED and ABORTED."""
-
-    recording = RecordingFactory(status="active")
-
-    with caplog.at_level(logging.INFO):
-        service.log_worker_error(recording, event, error="some error", error_code=500)
-
-    assert "Recording worker reported" not in caplog.text

src/backend/core/tests/recording/test_api_recordings_retrieve.py

@@ -224,7 +224,6 @@ def test_api_recording_retrieve_expired(settings):
         RecordingStatusChoices.INITIATED,
         RecordingStatusChoices.ACTIVE,
         RecordingStatusChoices.SAVED,
-        RecordingStatusChoices.FAILED,
         RecordingStatusChoices.FAILED_TO_START,
         RecordingStatusChoices.FAILED_TO_STOP,
         RecordingStatusChoices.ABORTED,

src/backend/core/tests/recording/worker/test_services.py

@@ -4,7 +4,6 @@ Test worker service classes.
 
 # pylint: disable=protected-access,redefined-outer-name,unused-argument,no-member
 
-import logging
 from unittest.mock import AsyncMock, Mock, patch
 
 import pytest
@@ -155,9 +154,9 @@ def test_base_egress_filepath_construction(service, filename, extension, expecte
     "response_status,expected_result",
     [
         (livekit_api.EgressStatus.EGRESS_ABORTED, "ABORTED"),
-        (livekit_api.EgressStatus.EGRESS_FAILED, "FAILED"),
         (livekit_api.EgressStatus.EGRESS_COMPLETE, "FAILED_TO_STOP"),
         (livekit_api.EgressStatus.EGRESS_ENDING, "STOPPED"),
+        (livekit_api.EgressStatus.EGRESS_FAILED, "FAILED_TO_STOP"),
     ],
 )
 def test_base_egress_stop_with_status(service, response_status, expected_result):
@@ -176,32 +175,6 @@ def test_base_egress_stop_with_status(service, response_status, expected_result)
     assert result == expected_result
 
 
-@pytest.mark.parametrize(
-    "response_status,event",
-    [
-        (livekit_api.EgressStatus.EGRESS_ABORTED, "aborted"),
-        (livekit_api.EgressStatus.EGRESS_FAILED, "failed"),
-        (livekit_api.EgressStatus.EGRESS_COMPLETE, "failed to stop"),
-    ],
-)
-def test_base_egress_stop_logs_livekit_error(service, response_status, event, caplog):
-    """Should log the reason LiveKit reported for an unsuccessful stop."""
-    mock_response = Mock(
-        status=response_status,
-        egress_id="test_worker_id",
-        error="could not connect to the room",
-        error_code=500,
-    )
-    service._handle_request = Mock(return_value=mock_response)
-
-    with caplog.at_level(logging.ERROR):
-        service.stop("test_worker_id")
-
-    assert f"Egress {event} on stop (egress_id=test_worker_id" in caplog.text
-    assert "could not connect to the room" in caplog.text
-    assert "error_code=500" in caplog.text
-
-
 def test_base_egress_stop_missing_status(service):
     """Test stop method when response is missing status"""
     # Mock _handle_request with missing status

src/backend/core/tests/rooms/test_api_rooms_create.py

@@ -2,15 +2,18 @@
 Test rooms API endpoints in the Meet core app: create.
 """
 
+from datetime import datetime, timedelta, timezone
+
 # pylint: disable=redefined-outer-name,unused-argument
 from django.conf import settings
 from django.core.cache import cache
 
+import jwt
 import pytest
 from rest_framework.test import APIClient
 
-from ...factories import RoomFactory, UserFactory
-from ...models import Room, RoomAccessLevel
+from ...factories import ApplicationFactory, RoomFactory, UserFactory
+from ...models import ApplicationScope, Room, RoomAccessLevel
 
 pytestmark = pytest.mark.django_db
 
@@ -312,3 +315,39 @@ def test_api_rooms_create_authenticated_blank_user_default_access_level():
     assert response.status_code == 201
     room = Room.objects.get()
     assert room.access_level == settings.RESOURCE_DEFAULT_ACCESS_LEVEL
+
+
+def generate_user_access_token(user):
+    """Generate a valid user access JWT signed with the token secret."""
+    now = datetime.now(timezone.utc)
+    application = ApplicationFactory(scopes=[ApplicationScope.USERS_SESSION])
+
+    payload = {
+        "iss": settings.USER_ACCESS_TOKEN_ISSUER,
+        "aud": settings.USER_ACCESS_TOKEN_AUDIENCE,
+        "iat": now,
+        "exp": now + timedelta(seconds=settings.USER_ACCESS_TOKEN_TTL),
+        "user_id": str(user.id),
+        "token_type": "user_access",
+        "client_id": application.client_id,
+        "scope": "user:access",
+    }
+
+    return jwt.encode(
+        payload,
+        settings.USER_ACCESS_TOKEN_SECRET_KEY,
+        algorithm=settings.USER_ACCESS_TOKEN_ALG,
+    )
+
+
+def test_api_rooms_create_authenticated_with_user_access_token():
+    """A user access token should create a room exactly like a session would."""
+    user = UserFactory()
+
+    client = APIClient()
+    client.credentials(HTTP_AUTHORIZATION=f"Bearer {generate_user_access_token(user)}")
+    response = client.post("/api/v1.0/rooms/", {"name": "my room"})
+
+    assert response.status_code == 201
+    room = Room.objects.get()
+    assert room.accesses.filter(role="owner", user=user).exists()

src/backend/core/tests/rooms/test_api_rooms_list.py

@@ -2,14 +2,18 @@
 Test rooms API endpoints in the Meet core app: list.
 """
 
+from datetime import datetime, timedelta, timezone
 from unittest import mock
 
+from django.conf import settings as django_settings
+
+import jwt
 import pytest
 from rest_framework.pagination import PageNumberPagination
 from rest_framework.test import APIClient
 
-from ...factories import RoomFactory, UserFactory
-from ...models import RoomAccessLevel
+from ...factories import ApplicationFactory, RoomFactory, UserFactory
+from ...models import ApplicationScope, RoomAccessLevel
 
 pytestmark = pytest.mark.django_db
 
@@ -156,3 +160,41 @@ def test_api_rooms_list_pagination_page_size():
     assert len(content["results"]) == 3
     assert content["next"] == "http://testserver/api/v1.0/rooms/?page=2&page_size=3"
     assert content["previous"] is None
+
+
+def generate_user_access_token(user):
+    """Generate a valid user access JWT signed with the token secret."""
+    now = datetime.now(timezone.utc)
+    application = ApplicationFactory(scopes=[ApplicationScope.USERS_SESSION])
+
+    payload = {
+        "iss": django_settings.USER_ACCESS_TOKEN_ISSUER,
+        "aud": django_settings.USER_ACCESS_TOKEN_AUDIENCE,
+        "iat": now,
+        "exp": now + timedelta(seconds=django_settings.USER_ACCESS_TOKEN_TTL),
+        "user_id": str(user.id),
+        "token_type": "user_access",
+        "client_id": application.client_id,
+        "scope": "user:access",
+    }
+
+    return jwt.encode(
+        payload,
+        django_settings.USER_ACCESS_TOKEN_SECRET_KEY,
+        algorithm=django_settings.USER_ACCESS_TOKEN_ALG,
+    )
+
+
+def test_api_rooms_list_authenticated_with_user_access_token():
+    """A user access token should list rooms exactly like a session would."""
+    user = UserFactory()
+    room = RoomFactory(users=[(user, "owner")])
+    RoomFactory()  # another user's room, not listed
+
+    client = APIClient()
+    client.credentials(HTTP_AUTHORIZATION=f"Bearer {generate_user_access_token(user)}")
+    response = client.get("/api/v1.0/rooms/")
+
+    assert response.status_code == 200
+    assert response.data["count"] == 1
+    assert response.data["results"][0]["id"] == str(room.id)

src/backend/core/tests/rooms/test_api_rooms_lobby.py

@@ -6,6 +6,7 @@ Test rooms API endpoints in the Meet core app: lobby functionality.
 import uuid
 from unittest import mock
 
+from django.core import signing
 from django.core.cache import cache
 
 import pytest
@@ -15,13 +16,16 @@ from rest_framework.test import APIClient
 from ... import utils
 from ...factories import RoomFactory, UserFactory
 from ...models import RoomAccessLevel
-from ...services.lobby import (
-    LobbyService,
-)
+from ...services.lobby import LobbyService
 
 pytestmark = pytest.mark.django_db
 
 
+def _lobby_signer():
+    """Use the polling credential's dedicated signing namespace."""
+    return signing.Signer(salt="core.lobby.participant")
+
+
 # Tests for request_entry endpoint
 
 
@@ -31,7 +35,6 @@ def test_request_entry_anonymous(settings):
     room = RoomFactory(access_level=RoomAccessLevel.RESTRICTED)
     client = APIClient()
 
-    settings.LOBBY_COOKIE_NAME = "mocked-cookie"
     settings.LOBBY_KEY_PREFIX = "mocked-cache-prefix"
 
     # Lobby cache should be empty before the request
@@ -49,11 +52,10 @@ def test_request_entry_anonymous(settings):
 
     assert response.status_code == 200
 
-    # Verify the lobby cookie was properly set
-    cookie = response.cookies.get("mocked-cookie")
-    assert cookie is not None
-
-    participant_id = cookie.value
+    # The participant identifier is returned in the response body; no
+    # cookie is involved anymore
+    assert not response.cookies
+    participant_id = response.json()["id"]
 
     # Verify response content matches expected structure and values
     assert response.json() == {
@@ -70,7 +72,8 @@ def test_request_entry_anonymous(settings):
     assert len(lobby_keys) == 1
 
     # Verify participant data was correctly stored in cache
-    participant_data = cache.get(f"mocked-cache-prefix_{room.id!s}_{participant_id}")
+    raw_id = _lobby_signer().unsign(participant_id)
+    participant_data = cache.get(f"mocked-cache-prefix_{room.id!s}_{raw_id}")
     assert participant_data.get("username") == "test_user"
 
 
@@ -82,7 +85,6 @@ def test_request_entry_authenticated_user(settings):
     client = APIClient()
     client.force_login(user)
 
-    settings.LOBBY_COOKIE_NAME = "mocked-cookie"
     settings.LOBBY_KEY_PREFIX = "mocked-cache-prefix"
 
     # Lobby cache should be empty before the request
@@ -100,11 +102,10 @@ def test_request_entry_authenticated_user(settings):
 
     assert response.status_code == 200
 
-    # Verify the lobby cookie was properly set
-    cookie = response.cookies.get("mocked-cookie")
-    assert cookie is not None
-
-    participant_id = cookie.value
+    # The participant identifier is returned in the response body; no
+    # cookie is involved anymore
+    assert not response.cookies
+    participant_id = response.json()["id"]
 
     # Verify response content matches expected structure and values
     assert response.json() == {
@@ -121,7 +122,8 @@ def test_request_entry_authenticated_user(settings):
     assert len(lobby_keys) == 1
 
     # Verify participant data was correctly stored in cache
-    participant_data = cache.get(f"mocked-cache-prefix_{room.id!s}_{participant_id}")
+    raw_id = _lobby_signer().unsign(participant_id)
+    participant_data = cache.get(f"mocked-cache-prefix_{room.id!s}_{raw_id}")
     assert participant_data.get("username") == "test_user"
 
 
@@ -133,7 +135,6 @@ def test_request_entry_with_existing_participants(settings):
     client = APIClient()
 
     # Configure test settings for cookies and cache
-    settings.LOBBY_COOKIE_NAME = "mocked-cookie"
     settings.LOBBY_KEY_PREFIX = "mocked-cache-prefix"
 
     # Add two participants already waiting in the lobby
@@ -176,11 +177,10 @@ def test_request_entry_with_existing_participants(settings):
     # Verify successful response
     assert response.status_code == 200
 
-    # Verify the lobby cookie was properly set for the new participant
-    cookie = response.cookies.get("mocked-cookie")
-    assert cookie is not None
-
-    participant_id = cookie.value
+    # The participant identifier is returned in the response body; no
+    # cookie is involved anymore
+    assert not response.cookies
+    participant_id = response.json()["id"]
 
     # Verify response content matches expected structure and values
     assert response.json() == {
@@ -197,7 +197,8 @@ def test_request_entry_with_existing_participants(settings):
     assert len(lobby_keys) == 3
 
     # Verify the new participant data was correctly stored in cache
-    participant_data = cache.get(f"mocked-cache-prefix_{room.id!s}_{participant_id}")
+    raw_id = _lobby_signer().unsign(participant_id)
+    participant_data = cache.get(f"mocked-cache-prefix_{room.id!s}_{raw_id}")
     assert participant_data.get("username") == "test_user"
 
 
@@ -207,7 +208,6 @@ def test_request_entry_public_room(settings):
     room = RoomFactory(access_level=RoomAccessLevel.PUBLIC)
     client = APIClient()
 
-    settings.LOBBY_COOKIE_NAME = "mocked-cookie"
     settings.LOBBY_KEY_PREFIX = "mocked-cache-prefix"
 
     # Lobby cache should be empty before the request
@@ -216,61 +216,8 @@ def test_request_entry_public_room(settings):
 
     with (
         mock.patch.object(utils, "notify_participants", return_value=None),
-        mock.patch.object(
-            LobbyService, "_get_or_create_participant_id", return_value="123"
-        ),
-        mock.patch.object(
-            utils, "generate_livekit_config", return_value={"token": "test-token"}
-        ),
-        mock.patch.object(utils, "generate_color", return_value="mocked-color"),
-    ):
-        response = client.post(
-            f"/api/v1.0/rooms/{room.id}/request-entry/",
-            {"username": "test_user"},
-        )
-
-    assert response.status_code == 200
-
-    # Verify the lobby cookie was set
-    cookie = response.cookies.get("mocked-cookie")
-    assert cookie is not None
-    assert cookie.value == "123"
-
-    # Verify response content matches expected structure and values
-    assert response.json() == {
-        "id": "123",
-        "username": "test_user",
-        "entered_at": "2025-01-01T10:00:00+00:00",
-        "status": "accepted",
-        "color": "mocked-color",
-        "livekit": {"token": "test-token"},
-    }
-
-    # Verify lobby cache is still empty after the request
-    lobby_keys = cache.keys(f"mocked-cache-prefix_{room.id}_*")
-    assert not lobby_keys
-
-
-@freeze_time("2025-01-01 10:00:00")
-def test_request_entry_authenticated_user_public_room(settings):
-    """While authenticated, entry request to public rooms should get accepted."""
-    room = RoomFactory(access_level=RoomAccessLevel.PUBLIC)
-    user = UserFactory()
-    client = APIClient()
-    client.force_login(user)
-
-    settings.LOBBY_COOKIE_NAME = "mocked-cookie"
-    settings.LOBBY_KEY_PREFIX = "mocked-cache-prefix"
-
-    # Lobby cache should be empty before the request
-    lobby_keys = cache.keys(f"mocked-cache-prefix_{room.id}_*")
-    assert not lobby_keys
-
-    with (
-        mock.patch.object(utils, "notify_participants", return_value=None),
-        mock.patch.object(
-            LobbyService,
-            "_get_or_create_participant_id",
+        mock.patch(
+            "core.services.lobby.uuid.uuid4",
             return_value="2f7f162f-e7d1-421b-90e7-02bfbfbf8def",
         ),
         mock.patch.object(
@@ -285,14 +232,9 @@ def test_request_entry_authenticated_user_public_room(settings):
 
     assert response.status_code == 200
 
-    # Verify the lobby cookie was set
-    cookie = response.cookies.get("mocked-cookie")
-    assert cookie is not None
-    assert cookie.value == "2f7f162f-e7d1-421b-90e7-02bfbfbf8def"
-
     # Verify response content matches expected structure and values
     assert response.json() == {
-        "id": "2f7f162f-e7d1-421b-90e7-02bfbfbf8def",
+        "id": _lobby_signer().sign("2f7f162f-e7d1-421b-90e7-02bfbfbf8def"),
         "username": "test_user",
         "entered_at": "2025-01-01T10:00:00+00:00",
         "status": "accepted",
@@ -300,10 +242,55 @@ def test_request_entry_authenticated_user_public_room(settings):
         "livekit": {"token": "test-token"},
     }
 
-    # Verify lobby cache is still empty after the request
+    assert not cache.keys(f"mocked-cache-prefix_{room.id}_*")
+    assert not LobbyService()._index_members(room.id)
+
+
+@freeze_time("2025-01-01 10:00:00")
+def test_request_entry_authenticated_user_public_room(settings):
+    """While authenticated, entry request to public rooms should get accepted."""
+    room = RoomFactory(access_level=RoomAccessLevel.PUBLIC)
+    user = UserFactory()
+    client = APIClient()
+    client.force_login(user)
+
+    settings.LOBBY_KEY_PREFIX = "mocked-cache-prefix"
+
+    # Lobby cache should be empty before the request
     lobby_keys = cache.keys(f"mocked-cache-prefix_{room.id}_*")
     assert not lobby_keys
 
+    with (
+        mock.patch.object(utils, "notify_participants", return_value=None),
+        mock.patch(
+            "core.services.lobby.uuid.uuid4",
+            return_value="2f7f162f-e7d1-421b-90e7-02bfbfbf8def",
+        ),
+        mock.patch.object(
+            utils, "generate_livekit_config", return_value={"token": "test-token"}
+        ),
+        mock.patch.object(utils, "generate_color", return_value="mocked-color"),
+    ):
+        response = client.post(
+            f"/api/v1.0/rooms/{room.id}/request-entry/",
+            {"username": "test_user"},
+        )
+
+    assert response.status_code == 200
+
+    # Verify response content matches expected structure and values
+    assert response.json() == {
+        "id": _lobby_signer().sign("2f7f162f-e7d1-421b-90e7-02bfbfbf8def"),
+        "username": "test_user",
+        "entered_at": "2025-01-01T10:00:00+00:00",
+        "status": "accepted",
+        "color": "mocked-color",
+        "livekit": {"token": "test-token"},
+    }
+
+    assert not cache.keys(f"mocked-cache-prefix_{room.id}_*")
+    assert not LobbyService()._index_members(room.id)
+
 
 @freeze_time("2025-01-01 10:00:00")
 def test_request_entry_waiting_participant_public_room(settings):
@@ -311,7 +298,6 @@ def test_request_entry_waiting_participant_public_room(settings):
     room = RoomFactory(access_level=RoomAccessLevel.PUBLIC)
     client = APIClient()
 
-    settings.LOBBY_COOKIE_NAME = "mocked-cookie"
     settings.LOBBY_KEY_PREFIX = "mocked-cache-prefix"
 
     # Add a waiting participant to the room's lobby cache
@@ -326,9 +312,9 @@ def test_request_entry_waiting_participant_public_room(settings):
         },
     )
 
-    # Simulate a browser with existing participant cookie
-    client.cookies.load({"mocked-cookie": "2f7f162f-e7d1-421b-90e7-02bfbfbf8def"})
+    LobbyService()._index_add(room.id, "2f7f162f-e7d1-421b-90e7-02bfbfbf8def")
 
+    # Simulate a returning participant echoing its identifier
     with (
         mock.patch.object(utils, "notify_participants", return_value=None),
         mock.patch.object(
@@ -337,19 +323,19 @@ def test_request_entry_waiting_participant_public_room(settings):
     ):
         response = client.post(
             f"/api/v1.0/rooms/{room.id}/request-entry/",
-            {"username": "user1"},
+            {
+                "username": "user1",
+                "participant_id": _lobby_signer().sign(
+                    "2f7f162f-e7d1-421b-90e7-02bfbfbf8def"
+                ),
+            },
         )
 
     assert response.status_code == 200
 
-    # Verify the lobby cookie was set
-    cookie = response.cookies.get("mocked-cookie")
-    assert cookie is not None
-    assert cookie.value == "2f7f162f-e7d1-421b-90e7-02bfbfbf8def"
-
     # Verify response content matches expected structure and values
     assert response.json() == {
-        "id": "2f7f162f-e7d1-421b-90e7-02bfbfbf8def",
+        "id": _lobby_signer().sign("2f7f162f-e7d1-421b-90e7-02bfbfbf8def"),
         "username": "user1",
         "status": "accepted",
         "color": "#123456",
@@ -357,9 +343,8 @@ def test_request_entry_waiting_participant_public_room(settings):
         "livekit": {"token": "test-token"},
     }
 
-    # Verify participant remains in the lobby cache after acceptance
-    lobby_keys = cache.keys(f"mocked-cache-prefix_{room.id}_*")
-    assert len(lobby_keys) == 1
+    assert not cache.keys(f"mocked-cache-prefix_{room.id}_*")
+    assert not LobbyService()._index_members(room.id)
 
 
 def test_request_entry_invalid_data():
@@ -662,15 +647,14 @@ def test_list_waiting_participants_empty(settings):
 @mock.patch.object(
     utils, "generate_livekit_config", return_value={"token": "test-token"}
 )
-def test_request_entry_throttling_anonymous_without_cookie(
+def test_request_entry_throttling_anonymous_unidentified(
     mock_notify_participants, mock_generate_livekit_config, settings
 ):
-    """Anonymous users without a cookie should not be throttled."""
+    """Requests without a participant identifier should not be throttled."""
 
     room = RoomFactory(access_level=RoomAccessLevel.RESTRICTED)
     client = APIClient()
 
-    settings.LOBBY_COOKIE_NAME = "mocked-cookie"
     settings.REST_FRAMEWORK["DEFAULT_THROTTLE_RATES"]["request_entry"] = "1/minute"
 
     response = client.post(
@@ -679,9 +663,6 @@ def test_request_entry_throttling_anonymous_without_cookie(
     )
 
     assert response.status_code == 200
-    assert response.cookies.get("mocked-cookie") is not None
-
-    client.cookies.clear()  # Simulate a new cookieless request
 
     response = client.post(
         f"/api/v1.0/rooms/{room.id}/request-entry/",
@@ -695,34 +676,32 @@ def test_request_entry_throttling_anonymous_without_cookie(
 @mock.patch.object(
     utils, "generate_livekit_config", return_value={"token": "test-token"}
 )
-def test_request_entry_throttling_anonymous_with_cookie(
+def test_request_entry_throttling_anonymous_identified(
     mock_notify_participants, mock_generate_livekit_config, settings
 ):
-    """Anonymous users with a cookie should be throttled after exceeding the rate limit."""
+    """Identified requests should be throttled after exceeding the rate limit."""
     room = RoomFactory(access_level=RoomAccessLevel.RESTRICTED)
     client = APIClient()
 
-    settings.LOBBY_COOKIE_NAME = "mocked-cookie"
     settings.REST_FRAMEWORK["DEFAULT_THROTTLE_RATES"]["request_entry"] = "2/minute"
 
-    participant_id = str(uuid.uuid4())
-    client.cookies.load({"mocked-cookie": participant_id})
+    participant_id = _lobby_signer().sign(str(uuid.uuid4()))
 
     response = client.post(
         f"/api/v1.0/rooms/{room.id}/request-entry/",
-        {"username": "test_user"},
+        {"username": "test_user", "participant_id": participant_id},
     )
     assert response.status_code == 200
 
     response = client.post(
         f"/api/v1.0/rooms/{room.id}/request-entry/",
-        {"username": "test_user"},
+        {"username": "test_user", "participant_id": participant_id},
     )
     assert response.status_code == 200
 
     response = client.post(
         f"/api/v1.0/rooms/{room.id}/request-entry/",
-        {"username": "test_user"},
+        {"username": "test_user", "participant_id": participant_id},
     )
 
     assert response.status_code == 429
@@ -741,7 +720,6 @@ def test_request_entry_throttling_authenticated_user(
     client = APIClient()
     client.force_login(user)
 
-    settings.LOBBY_COOKIE_NAME = "mocked-cookie"
     settings.REST_FRAMEWORK["DEFAULT_THROTTLE_RATES"]["request_entry"] = "2/minute"
 
     response = client.post(
@@ -762,3 +740,237 @@ def test_request_entry_throttling_authenticated_user(
     )
 
     assert response.status_code == 429
+
+
+def test_request_entry_with_participant_id(settings):
+    """Echoing the previously issued identifier preserves the lobby identity across requests."""
+    room = RoomFactory(access_level=RoomAccessLevel.RESTRICTED)
+    client = APIClient()
+
+    settings.LOBBY_KEY_PREFIX = "mocked-cache-prefix"
+
+    with (
+        mock.patch.object(utils, "notify_participants", return_value=None),
+        mock.patch.object(utils, "generate_color", return_value="mocked-color"),
+    ):
+        response = client.post(
+            f"/api/v1.0/rooms/{room.id}/request-entry/",
+            {"username": "test_user"},
+        )
+
+        assert response.status_code == 200
+        participant_id = response.json()["id"]
+
+        # Echoing the identifier must be recognized as the same
+        # participant: no duplicate in the lobby
+        response = client.post(
+            f"/api/v1.0/rooms/{room.id}/request-entry/",
+            {"username": "test_user", "participant_id": participant_id},
+        )
+
+    assert response.status_code == 200
+    assert response.json()["id"] == participant_id
+    assert response.json()["status"] == "waiting"
+
+    lobby_keys = cache.keys(f"mocked-cache-prefix_{room.id}_*")
+    assert len(lobby_keys) == 1
+
+
+def test_request_entry_unknown_participant_id_not_seeded(settings):
+    """A valid signed credential with no cached record creates a new participant."""
+    room = RoomFactory(access_level=RoomAccessLevel.RESTRICTED)
+    client = APIClient()
+
+    settings.LOBBY_KEY_PREFIX = "mocked-cache-prefix"
+
+    forged_id = str(uuid.uuid4())
+
+    with (
+        mock.patch.object(utils, "notify_participants", return_value=None),
+        mock.patch.object(utils, "generate_color", return_value="mocked-color"),
+    ):
+        response = client.post(
+            f"/api/v1.0/rooms/{room.id}/request-entry/",
+            {
+                "username": "test_user",
+                "participant_id": _lobby_signer().sign(forged_id),
+            },
+        )
+
+    assert response.status_code == 200
+    assert _lobby_signer().unsign(response.json()["id"]) != forged_id
+
+    # Nothing was stored under the forged identifier
+    assert cache.get(f"mocked-cache-prefix_{room.id}_{forged_id}") is None
+
+
+def test_request_entry_participant_id_bound_to_room(settings):
+    """An identifier minted for one room must not be honored in another."""
+    room = RoomFactory(access_level=RoomAccessLevel.RESTRICTED)
+    other_room = RoomFactory(access_level=RoomAccessLevel.RESTRICTED)
+    client = APIClient()
+
+    with (
+        mock.patch.object(utils, "notify_participants", return_value=None),
+        mock.patch.object(utils, "generate_color", return_value="mocked-color"),
+    ):
+        response = client.post(
+            f"/api/v1.0/rooms/{room.id}/request-entry/",
+            {"username": "test_user"},
+        )
+        participant_id = response.json()["id"]
+
+        response = client.post(
+            f"/api/v1.0/rooms/{other_room.id}/request-entry/",
+            {"username": "test_user", "participant_id": participant_id},
+        )
+
+    assert response.status_code == 200
+    assert response.json()["id"] != participant_id
+
+
+def test_request_entry_legacy_cookie_ignored():
+    """The retired cookie channel must not be honored anymore."""
+    room = RoomFactory(access_level=RoomAccessLevel.RESTRICTED)
+    client = APIClient()
+
+    legacy_participant_id = str(uuid.uuid4())
+    client.cookies["lobbyParticipantId"] = legacy_participant_id
+
+    with (
+        mock.patch.object(utils, "notify_participants", return_value=None),
+        mock.patch.object(utils, "generate_color", return_value="mocked-color"),
+    ):
+        response = client.post(
+            f"/api/v1.0/rooms/{room.id}/request-entry/",
+            {"username": "test_user"},
+        )
+
+    assert response.status_code == 200
+    returned_id = response.json()["id"]
+    assert returned_id != legacy_participant_id
+    uuid.UUID(_lobby_signer().unsign(returned_id))
+
+
+def test_request_entry_malformed_participant_id(settings):
+    """A malformed polling credential is rejected with a 400."""
+    room = RoomFactory(access_level=RoomAccessLevel.RESTRICTED)
+    client = APIClient()
+
+    response = client.post(
+        f"/api/v1.0/rooms/{room.id}/request-entry/",
+        {"username": "test_user", "participant_id": "../../../evil-key"},
+    )
+
+    assert response.status_code == 400
+    assert "participant_id" in response.json()
+
+
+@mock.patch.object(utils, "notify_participants", return_value=None)
+@mock.patch.object(utils, "generate_livekit_config")
+def test_request_entry_rejects_unsigned_id(generate_config, _notify):
+    """Knowing the public UUID must not grant admission."""
+    room = RoomFactory(access_level=RoomAccessLevel.RESTRICTED)
+    client = APIClient()
+
+    response = client.post(
+        f"/api/v1.0/rooms/{room.id}/request-entry/", {"username": "Guest"}
+    )
+    assert response.status_code == 200
+    public_id = _lobby_signer().unsign(response.json()["id"])
+    LobbyService().handle_participant_entry(room.id, public_id, True)
+
+    response = APIClient().post(
+        f"/api/v1.0/rooms/{room.id}/request-entry/",
+        {"username": "Impersonator", "participant_id": public_id},
+    )
+
+    assert response.status_code == 400
+    assert "participant_id" in response.json()
+    generate_config.assert_not_called()
+
+
+@mock.patch.object(utils, "notify_participants", return_value=None)
+@mock.patch.object(utils, "generate_livekit_config")
+def test_request_entry_rejects_tampered_credential(generate_config, _notify):
+    """Modifying a signed credential must invalidate it."""
+    room = RoomFactory(access_level=RoomAccessLevel.RESTRICTED)
+    client = APIClient()
+
+    response = client.post(
+        f"/api/v1.0/rooms/{room.id}/request-entry/", {"username": "Guest"}
+    )
+    assert response.status_code == 200
+    credential = response.json()["id"]
+    public_id = _lobby_signer().unsign(credential)
+    LobbyService().handle_participant_entry(room.id, public_id, True)
+
+    response = APIClient().post(
+        f"/api/v1.0/rooms/{room.id}/request-entry/",
+        {"username": "Impersonator", "participant_id": credential + "x"},
+    )
+
+    assert response.status_code == 400
+    assert "participant_id" in response.json()
+    generate_config.assert_not_called()
+
+
+@mock.patch.object(utils, "notify_participants", return_value=None)
+@mock.patch.object(utils, "generate_livekit_config")
+def test_request_entry_rejects_wrong_signing_secret(generate_config, _notify):
+    """A credential signed with another secret must not grant admission."""
+    room = RoomFactory(access_level=RoomAccessLevel.RESTRICTED)
+    client = APIClient()
+
+    response = client.post(
+        f"/api/v1.0/rooms/{room.id}/request-entry/", {"username": "Guest"}
+    )
+    assert response.status_code == 200
+    public_id = _lobby_signer().unsign(response.json()["id"])
+    LobbyService().handle_participant_entry(room.id, public_id, True)
+
+    forged = signing.Signer(
+        key="incorrect-test-signing-secret",
+        salt="core.lobby.participant",
+        fallback_keys=[],
+    ).sign(public_id)
+
+    response = APIClient().post(
+        f"/api/v1.0/rooms/{room.id}/request-entry/",
+        {"username": "Impersonator", "participant_id": forged},
+    )
+
+    assert response.status_code == 400
+    assert "participant_id" in response.json()
+    generate_config.assert_not_called()
+
+
+@mock.patch.object(utils, "notify_participants", return_value=None)
+@mock.patch.object(
+    utils, "generate_livekit_config", return_value={"token": "test-token"}
+)
+def test_request_entry_accepts_signed_credential(generate_config, _notify):
+    """The signed credential grants admission using the public LiveKit UUID."""
+    room = RoomFactory(access_level=RoomAccessLevel.RESTRICTED)
+    client = APIClient()
+
+    response = client.post(
+        f"/api/v1.0/rooms/{room.id}/request-entry/", {"username": "Guest"}
+    )
+    assert response.status_code == 200
+    credential = response.json()["id"]
+    public_id = _lobby_signer().unsign(credential)
+    assert credential != public_id
+    LobbyService().handle_participant_entry(room.id, public_id, True)
+
+    response = client.post(
+        f"/api/v1.0/rooms/{room.id}/request-entry/",
+        {"username": "Guest", "participant_id": credential},
+    )
+
+    assert response.status_code == 200
+    assert response.json()["status"] == "accepted"
+    assert response.json()["id"] == credential
+    assert response.json()["livekit"] == {"token": "test-token"}
+    generate_config.assert_called_once()
+    assert generate_config.call_args.kwargs["participant_id"] == public_id

src/backend/core/tests/rooms/test_api_rooms_participants_management.py

@@ -5,13 +5,16 @@ Test rooms API endpoints in the Meet core app: participants management.
 # pylint: disable=redefined-outer-name,unused-argument,protected-access,no-name-in-module,too-many-lines
 
 import random
+from datetime import datetime, timedelta, timezone
 from unittest import mock
 from uuid import uuid4
 
+from django.conf import settings as django_settings
 from django.contrib.auth.models import AnonymousUser
 from django.core.exceptions import SuspiciousOperation
 from django.urls import reverse
 
+import jwt
 import pytest
 from livekit.api import TwirpError, UpdateParticipantRequest
 from livekit.protocol.models import ParticipantInfo
@@ -19,8 +22,18 @@ from rest_framework import status
 from rest_framework.test import APIClient
 
 from core import utils
-from core.factories import RoomFactory, UserFactory, UserResourceAccessFactory
-from core.services.lobby import LobbyService
+from core.factories import (
+    ApplicationFactory,
+    RoomFactory,
+    UserFactory,
+    UserResourceAccessFactory,
+)
+from core.models import ApplicationScope
+from core.services.lobby import (
+    LobbyParticipant,
+    LobbyParticipantStatus,
+    LobbyService,
+)
 
 pytestmark = pytest.mark.django_db
 
@@ -87,7 +100,7 @@ def test_mute_participant_with_livekit_token_for_this_room(mock_livekit_client):
         url,
         {"participant_identity": str(uuid4()), "track_sid": "test-track-sid"},
         format="json",
-        HTTP_AUTHORIZATION=f"Bearer {token}",
+        HTTP_AUTHORIZATION=f"X-LiveKit-Token {token}",
     )
 
     assert response.status_code == status.HTTP_200_OK
@@ -113,7 +126,7 @@ def test_mute_participant_with_livekit_token_for_another_room_forbidden(
         url,
         {"participant_identity": str(uuid4()), "track_sid": "test-track-sid"},
         format="json",
-        HTTP_AUTHORIZATION=f"Bearer {token}",
+        HTTP_AUTHORIZATION=f"X-LiveKit-Token {token}",
     )
 
     assert response.status_code == status.HTTP_403_FORBIDDEN
@@ -153,7 +166,7 @@ def test_mute_participant_everyone_can_mute_disabled_blocks_non_admin(
         url,
         {"participant_identity": str(uuid4()), "track_sid": "test-track-sid"},
         format="json",
-        HTTP_AUTHORIZATION=f"Bearer {token}",
+        HTTP_AUTHORIZATION=f"X-LiveKit-Token {token}",
     )
 
     assert response.status_code == status.HTTP_403_FORBIDDEN
@@ -300,7 +313,7 @@ def test_mute_participant_admin_with_token_for_this_room(mock_livekit_client):
         url,
         {"participant_identity": str(uuid4()), "track_sid": "test-track-sid"},
         format="json",
-        HTTP_AUTHORIZATION=f"Bearer {token}",
+        HTTP_AUTHORIZATION=f"X-LiveKit-Token {token}",
     )
 
     assert response.status_code == status.HTTP_200_OK
@@ -330,7 +343,7 @@ def test_mute_participant_admin_with_token_for_another_room(mock_livekit_client)
         url,
         {"participant_identity": str(uuid4()), "track_sid": "test-track-sid"},
         format="json",
-        HTTP_AUTHORIZATION=f"Bearer {token}",
+        HTTP_AUTHORIZATION=f"X-LiveKit-Token {token}",
     )
 
     assert response.status_code == status.HTTP_403_FORBIDDEN
@@ -361,7 +374,7 @@ def test_mute_participant_admin_token_replayed_does_not_grant_admin(
         url,
         {"participant_identity": str(uuid4()), "track_sid": "test-track-sid"},
         format="json",
-        HTTP_AUTHORIZATION=f"Bearer {token}",
+        HTTP_AUTHORIZATION=f"X-LiveKit-Token {token}",
     )
 
     assert response.status_code == status.HTTP_403_FORBIDDEN
@@ -381,7 +394,7 @@ def test_mute_participant_livekit_token_triggers_presence_check(mock_livekit_cli
         url,
         {"participant_identity": str(uuid4()), "track_sid": "test-track-sid"},
         format="json",
-        HTTP_AUTHORIZATION=f"Bearer {token}",
+        HTTP_AUTHORIZATION=f"X-LiveKit-Token {token}",
     )
 
     assert response.status_code == status.HTTP_200_OK
@@ -412,7 +425,7 @@ def test_mute_participant_livekit_token_presence_check_returns_participant(
         url,
         {"participant_identity": str(uuid4()), "track_sid": "test-track-sid"},
         format="json",
-        HTTP_AUTHORIZATION=f"Bearer {token}",
+        HTTP_AUTHORIZATION=f"X-LiveKit-Token {token}",
     )
 
     assert response.status_code == status.HTTP_200_OK
@@ -440,7 +453,7 @@ def test_mute_participant_livekit_token_presence_check_participant_not_found(
         url,
         {"participant_identity": str(uuid4()), "track_sid": "test-track-sid"},
         format="json",
-        HTTP_AUTHORIZATION=f"Bearer {token}",
+        HTTP_AUTHORIZATION=f"X-LiveKit-Token {token}",
     )
 
     assert response.status_code == status.HTTP_403_FORBIDDEN
@@ -469,7 +482,7 @@ def test_mute_participant_livekit_token_presence_check_twirp_error_forbidden(
         url,
         {"participant_identity": str(uuid4()), "track_sid": "test-track-sid"},
         format="json",
-        HTTP_AUTHORIZATION=f"Bearer {token}",
+        HTTP_AUTHORIZATION=f"X-LiveKit-Token {token}",
     )
 
     assert response.status_code == status.HTTP_403_FORBIDDEN
@@ -849,7 +862,16 @@ def test_remove_participant_success_lobby_cache(mock_livekit_client):
     participant_identity = str(uuid4())
 
     # Create participant in lobby cache first
-    LobbyService().enter(room.id, participant_identity, "John doe")
+    LobbyService()._save_participant(
+        room.id,
+        LobbyParticipant(
+            id=participant_identity,
+            username="John doe",
+            status=LobbyParticipantStatus.WAITING,
+            color="#123456",
+            entered_at="2025-01-01T10:00:00+00:00",
+        ),
+    )
 
     # Accept participant
     LobbyService().handle_participant_entry(room.id, participant_identity, True)
@@ -1020,3 +1042,142 @@ def test_remove_participant_not_found(mock_livekit_client):
     assert response.data == {"error": "Participant not found"}
 
     mock_livekit_client.aclose.assert_called_once()
+
+
+def generate_user_access_token(user):
+    """Generate a valid user access JWT signed with the token secret."""
+    now = datetime.now(timezone.utc)
+    application = ApplicationFactory(scopes=[ApplicationScope.USERS_SESSION])
+
+    payload = {
+        "iss": django_settings.USER_ACCESS_TOKEN_ISSUER,
+        "aud": django_settings.USER_ACCESS_TOKEN_AUDIENCE,
+        "iat": now,
+        "exp": now + timedelta(seconds=django_settings.USER_ACCESS_TOKEN_TTL),
+        "user_id": str(user.id),
+        "token_type": "user_access",
+        "client_id": application.client_id,
+        "scope": "user:access",
+    }
+
+    return jwt.encode(
+        payload,
+        django_settings.USER_ACCESS_TOKEN_SECRET_KEY,
+        algorithm=django_settings.USER_ACCESS_TOKEN_ALG,
+    )
+
+
+def test_mute_participant_bearer_scheme_defers_to_next_authentication(
+    mock_livekit_client,
+):
+    """Should defer a "Bearer" header to the next authentication backend.
+
+    The LiveKit backend only claims the "X-LiveKit-Token" scheme. Any other
+    scheme must be left untouched so the backends declared after it get a
+    chance to authenticate the request.
+    """
+    client = APIClient()
+    room = RoomFactory()
+    user = UserFactory()
+    UserResourceAccessFactory(
+        resource=room, user=user, role=random.choice(["administrator", "owner"])
+    )
+    client.credentials(HTTP_AUTHORIZATION=f"Bearer {generate_user_access_token(user)}")
+
+    url = reverse("rooms-mute-participant", kwargs={"pk": room.id})
+    response = client.post(
+        url,
+        {"participant_identity": str(uuid4()), "track_sid": "test-track-sid"},
+        format="json",
+    )
+
+    assert response.status_code == status.HTTP_200_OK
+    assert response.data == {"status": "success"}
+
+    mock_livekit_client.room.get_participant.assert_not_called()
+    mock_livekit_client.room.mute_published_track.assert_called_once()
+
+
+def test_mute_participant_bearer_scheme_defers_role_permissions_still_apply(
+    mock_livekit_client,
+):
+    """Should still enforce room privileges once another backend authenticated."""
+    client = APIClient()
+    room = RoomFactory(configuration={"everyone_can_mute": False})
+    user = UserFactory()  # no UserResourceAccess for this room
+    client.credentials(HTTP_AUTHORIZATION=f"Bearer {generate_user_access_token(user)}")
+
+    url = reverse("rooms-mute-participant", kwargs={"pk": room.id})
+    response = client.post(
+        url,
+        {"participant_identity": str(uuid4()), "track_sid": "test-track-sid"},
+        format="json",
+    )
+
+    assert response.status_code == status.HTTP_403_FORBIDDEN
+    mock_livekit_client.room.mute_published_track.assert_not_called()
+
+
+def test_mute_participant_unknown_scheme_defers_and_stays_anonymous(
+    mock_livekit_client,
+):
+    """Should leave the request unauthenticated when no backend claims the scheme."""
+    client = APIClient()
+    room = RoomFactory()
+
+    url = reverse("rooms-mute-participant", kwargs={"pk": room.id})
+    response = client.post(
+        url,
+        {"participant_identity": str(uuid4()), "track_sid": "test-track-sid"},
+        format="json",
+        HTTP_AUTHORIZATION="Basic dXNlcjpwYXNzd29yZA==",
+    )
+
+    assert response.status_code == status.HTTP_403_FORBIDDEN
+    mock_livekit_client.room.mute_published_track.assert_not_called()
+
+
+def test_mute_participant_livekit_scheme_is_case_insensitive(mock_livekit_client):
+    """Should claim the LiveKit scheme whatever its casing, and not defer it."""
+    client = APIClient()
+    room = RoomFactory()
+
+    token = utils.generate_token(str(room.id), AnonymousUser())
+
+    url = reverse("rooms-mute-participant", kwargs={"pk": room.id})
+    response = client.post(
+        url,
+        {"participant_identity": str(uuid4()), "track_sid": "test-track-sid"},
+        format="json",
+        HTTP_AUTHORIZATION=f"x-livekit-token {token}",
+    )
+
+    assert response.status_code == status.HTTP_200_OK
+    assert response.data == {"status": "success"}
+
+    mock_livekit_client.room.get_participant.assert_called_once()
+    mock_livekit_client.room.mute_published_track.assert_called_once()
+
+
+def test_mute_participant_livekit_scheme_malformed_header_is_rejected(
+    mock_livekit_client,
+):
+    """Should reject a malformed header once the LiveKit scheme is claimed."""
+    client = APIClient()
+    room = RoomFactory()
+
+    token = utils.generate_token(str(room.id), AnonymousUser())
+
+    url = reverse("rooms-mute-participant", kwargs={"pk": room.id})
+    response = client.post(
+        url,
+        {"participant_identity": str(uuid4()), "track_sid": "test-track-sid"},
+        format="json",
+        HTTP_AUTHORIZATION=f"X-LiveKit-Token {token} extra-part",
+    )
+
+    assert response.status_code == status.HTTP_403_FORBIDDEN
+    assert response.data == {
+        "detail": "Authorization header must be: X-LiveKit-Token <token>"
+    }
+    mock_livekit_client.room.mute_published_track.assert_not_called()

src/backend/core/tests/rooms/test_api_rooms_rename_toggle.py

@@ -4,12 +4,15 @@ Test rooms API endpoints: toggle hand and rename participant.
 
 # pylint: disable=redefined-outer-name,unused-argument,protected-access
 
+from datetime import datetime, timedelta, timezone
 from unittest import mock
 from uuid import uuid4
 
+from django.conf import settings as django_settings
 from django.contrib.auth.models import AnonymousUser
 from django.urls import reverse
 
+import jwt
 import pytest
 from freezegun import freeze_time
 from livekit.api import TwirpError
@@ -17,7 +20,13 @@ from rest_framework import status
 from rest_framework.test import APIClient
 
 from core import utils
-from core.factories import RoomFactory, UserFactory
+from core.factories import (
+    ApplicationFactory,
+    RoomFactory,
+    UserFactory,
+    UserResourceAccessFactory,
+)
+from core.models import ApplicationScope
 
 pytestmark = pytest.mark.django_db
 
@@ -69,7 +78,10 @@ def test_toggle_hand_raise_success(mock_livekit_client, room, token):
     client = APIClient()
     url = reverse("rooms-toggle-hand", kwargs={"pk": room.id})
     response = client.post(
-        url, {"raised": True}, format="json", HTTP_AUTHORIZATION=f"Bearer {token}"
+        url,
+        {"raised": True},
+        format="json",
+        HTTP_AUTHORIZATION=f"X-LiveKit-token {token}",
     )
 
     assert response.status_code == status.HTTP_200_OK
@@ -84,7 +96,10 @@ def test_toggle_hand_lower_success(mock_livekit_client, room, token):
     client = APIClient()
     url = reverse("rooms-toggle-hand", kwargs={"pk": room.id})
     response = client.post(
-        url, {"raised": False}, format="json", HTTP_AUTHORIZATION=f"Bearer {token}"
+        url,
+        {"raised": False},
+        format="json",
+        HTTP_AUTHORIZATION=f"X-LiveKit-Token {token}",
     )
 
     assert response.status_code == status.HTTP_200_OK
@@ -101,7 +116,10 @@ def test_toggle_hand_raise_sets_timestamp(mock_livekit_client, room, token):
     client = APIClient()
     url = reverse("rooms-toggle-hand", kwargs={"pk": room.id})
     response = client.post(
-        url, {"raised": True}, format="json", HTTP_AUTHORIZATION=f"Bearer {token}"
+        url,
+        {"raised": True},
+        format="json",
+        HTTP_AUTHORIZATION=f"X-LiveKit-Token {token}",
     )
 
     assert response.status_code == status.HTTP_200_OK
@@ -117,7 +135,10 @@ def test_toggle_hand_identity_derived_from_token(
     client = APIClient()
     url = reverse("rooms-toggle-hand", kwargs={"pk": room.id})
     client.post(
-        url, {"raised": True}, format="json", HTTP_AUTHORIZATION=f"Bearer {token}"
+        url,
+        {"raised": True},
+        format="json",
+        HTTP_AUTHORIZATION=f"X-LiveKit-Token {token}",
     )
 
     call_kwargs = mock_livekit_client.room.update_participant.call_args
@@ -128,7 +149,9 @@ def test_toggle_hand_missing_raised_field(room, token):
     """Test toggle hand with missing raised field returns 400."""
     client = APIClient()
     url = reverse("rooms-toggle-hand", kwargs={"pk": room.id})
-    response = client.post(url, {}, format="json", HTTP_AUTHORIZATION=f"Bearer {token}")
+    response = client.post(
+        url, {}, format="json", HTTP_AUTHORIZATION=f"X-LiveKit-Token {token}"
+    )
 
     assert response.status_code == status.HTTP_400_BAD_REQUEST
     assert "raised" in response.data
@@ -142,7 +165,7 @@ def test_toggle_hand_invalid_raised_field(room, token):
         url,
         {"raised": "not-a-boolean"},
         format="json",
-        HTTP_AUTHORIZATION=f"Bearer {token}",
+        HTTP_AUTHORIZATION=f"X-LiveKit-Token {token}",
     )
 
     assert response.status_code == status.HTTP_400_BAD_REQUEST
@@ -166,7 +189,10 @@ def test_toggle_hand_forbidden_token_for_wrong_room(user):
     client = APIClient()
     url = reverse("rooms-toggle-hand", kwargs={"pk": target_room.id})
     response = client.post(
-        url, {"raised": True}, format="json", HTTP_AUTHORIZATION=f"Bearer {wrong_token}"
+        url,
+        {"raised": True},
+        format="json",
+        HTTP_AUTHORIZATION=f"X-LiveKit-Token {wrong_token}",
     )
 
     assert response.status_code == status.HTTP_403_FORBIDDEN
@@ -181,7 +207,10 @@ def test_toggle_hand_unexpected_twirp_error(mock_livekit_client, room, token):
     client = APIClient()
     url = reverse("rooms-toggle-hand", kwargs={"pk": room.id})
     response = client.post(
-        url, {"raised": True}, format="json", HTTP_AUTHORIZATION=f"Bearer {token}"
+        url,
+        {"raised": True},
+        format="json",
+        HTTP_AUTHORIZATION=f"X-LiveKit-Token {token}",
     )
 
     assert response.status_code == status.HTTP_500_INTERNAL_SERVER_ERROR
@@ -200,7 +229,7 @@ def test_toggle_hand_raise_success_anonymous(
         url,
         {"raised": True},
         format="json",
-        HTTP_AUTHORIZATION=f"Bearer {anonymous_token}",
+        HTTP_AUTHORIZATION=f"X-LiveKit-Token {anonymous_token}",
     )
 
     assert response.status_code == status.HTTP_200_OK
@@ -220,7 +249,7 @@ def test_toggle_hand_lower_success_anonymous(
         url,
         {"raised": False},
         format="json",
-        HTTP_AUTHORIZATION=f"Bearer {anonymous_token}",
+        HTTP_AUTHORIZATION=f"X-LiveKit-Token {anonymous_token}",
     )
 
     assert response.status_code == status.HTTP_200_OK
@@ -240,7 +269,7 @@ def test_toggle_hand_identity_derived_from_token_anonymous(
         url,
         {"raised": True},
         format="json",
-        HTTP_AUTHORIZATION=f"Bearer {anonymous_token}",
+        HTTP_AUTHORIZATION=f"X-LiveKit-Token {anonymous_token}",
     )
 
     call_kwargs = mock_livekit_client.room.update_participant.call_args
@@ -257,7 +286,10 @@ def test_rename_participant_success(mock_livekit_client, room, token):
     client = APIClient()
     url = reverse("rooms-rename", kwargs={"pk": room.id})
     response = client.post(
-        url, {"name": "John Doe"}, format="json", HTTP_AUTHORIZATION=f"Bearer {token}"
+        url,
+        {"name": "John Doe"},
+        format="json",
+        HTTP_AUTHORIZATION=f"X-LiveKit-Token {token}",
     )
 
     assert response.status_code == status.HTTP_200_OK
@@ -272,7 +304,10 @@ def test_rename_participant_sets_correct_name(mock_livekit_client, room, token):
     client = APIClient()
     url = reverse("rooms-rename", kwargs={"pk": room.id})
     client.post(
-        url, {"name": "Jane Doe"}, format="json", HTTP_AUTHORIZATION=f"Bearer {token}"
+        url,
+        {"name": "Jane Doe"},
+        format="json",
+        HTTP_AUTHORIZATION=f"X-LiveKit-Token {token}",
     )
 
     call_kwargs = mock_livekit_client.room.update_participant.call_args
@@ -286,7 +321,10 @@ def test_rename_participant_uses_identity_from_token(
     client = APIClient()
     url = reverse("rooms-rename", kwargs={"pk": room.id})
     client.post(
-        url, {"name": "John Doe"}, format="json", HTTP_AUTHORIZATION=f"Bearer {token}"
+        url,
+        {"name": "John Doe"},
+        format="json",
+        HTTP_AUTHORIZATION=f"X-LiveKit-Token {token}",
     )
 
     call_kwargs = mock_livekit_client.room.update_participant.call_args
@@ -298,7 +336,7 @@ def test_rename_participant_empty_name(room, token):
     client = APIClient()
     url = reverse("rooms-rename", kwargs={"pk": room.id})
     response = client.post(
-        url, {"name": ""}, format="json", HTTP_AUTHORIZATION=f"Bearer {token}"
+        url, {"name": ""}, format="json", HTTP_AUTHORIZATION=f"X-LiveKit-Token {token}"
     )
 
     assert response.status_code == status.HTTP_400_BAD_REQUEST
@@ -309,7 +347,9 @@ def test_rename_participant_missing_name(room, token):
     """Test rename with missing name field returns 400."""
     client = APIClient()
     url = reverse("rooms-rename", kwargs={"pk": room.id})
-    response = client.post(url, {}, format="json", HTTP_AUTHORIZATION=f"Bearer {token}")
+    response = client.post(
+        url, {}, format="json", HTTP_AUTHORIZATION=f"X-LiveKit-Token {token}"
+    )
 
     assert response.status_code == status.HTTP_400_BAD_REQUEST
     assert "name" in response.data
@@ -320,7 +360,10 @@ def test_rename_participant_name_too_long(room, token):
     client = APIClient()
     url = reverse("rooms-rename", kwargs={"pk": room.id})
     response = client.post(
-        url, {"name": "a" * 256}, format="json", HTTP_AUTHORIZATION=f"Bearer {token}"
+        url,
+        {"name": "a" * 256},
+        format="json",
+        HTTP_AUTHORIZATION=f"X-LiveKit-Token {token}",
     )
 
     assert response.status_code == status.HTTP_400_BAD_REQUEST
@@ -348,7 +391,7 @@ def test_rename_participant_forbidden_token_for_wrong_room(user):
         url,
         {"name": "John Doe"},
         format="json",
-        HTTP_AUTHORIZATION=f"Bearer {wrong_token}",
+        HTTP_AUTHORIZATION=f"X-LiveKit-Token {wrong_token}",
     )
 
     assert response.status_code == status.HTTP_403_FORBIDDEN
@@ -363,7 +406,10 @@ def test_rename_participant_unexpected_twirp_error(mock_livekit_client, room, to
     client = APIClient()
     url = reverse("rooms-rename", kwargs={"pk": room.id})
     response = client.post(
-        url, {"name": "John Doe"}, format="json", HTTP_AUTHORIZATION=f"Bearer {token}"
+        url,
+        {"name": "John Doe"},
+        format="json",
+        HTTP_AUTHORIZATION=f"X-LiveKit-Token {token}",
     )
 
     assert response.status_code == status.HTTP_500_INTERNAL_SERVER_ERROR
@@ -385,7 +431,10 @@ def test_rename_participant_forbidden_when_display_name_edit_disabled(
     client = APIClient()
     url = reverse("rooms-rename", kwargs={"pk": room.id})
     response = client.post(
-        url, {"name": name}, format="json", HTTP_AUTHORIZATION=f"Bearer {token}"
+        url,
+        {"name": name},
+        format="json",
+        HTTP_AUTHORIZATION=f"X-LiveKit-Token {token}",
     )
 
     assert response.status_code == status.HTTP_403_FORBIDDEN
@@ -404,7 +453,10 @@ def test_rename_participant_allowed_when_display_name_edit_enabled(
     client = APIClient()
     url = reverse("rooms-rename", kwargs={"pk": room.id})
     response = client.post(
-        url, {"name": "John Doe"}, format="json", HTTP_AUTHORIZATION=f"Bearer {token}"
+        url,
+        {"name": "John Doe"},
+        format="json",
+        HTTP_AUTHORIZATION=f"X-LiveKit-Token {token}",
     )
 
     assert response.status_code == status.HTTP_200_OK
@@ -426,7 +478,7 @@ def test_rename_participant_anonymous_allowed_when_display_name_edit_disabled(
         url,
         {"name": "Guest User"},
         format="json",
-        HTTP_AUTHORIZATION=f"Bearer {anonymous_token}",
+        HTTP_AUTHORIZATION=f"X-LiveKit-Token {anonymous_token}",
     )
 
     assert response.status_code == status.HTTP_200_OK
@@ -443,7 +495,7 @@ def test_rename_participant_success_anonymous(
         url,
         {"name": "Guest User"},
         format="json",
-        HTTP_AUTHORIZATION=f"Bearer {anonymous_token}",
+        HTTP_AUTHORIZATION=f"X-LiveKit-Token {anonymous_token}",
     )
 
     assert response.status_code == status.HTTP_200_OK
@@ -463,7 +515,7 @@ def test_rename_participant_uses_identity_from_token_anonymous(
         url,
         {"name": "Guest User"},
         format="json",
-        HTTP_AUTHORIZATION=f"Bearer {anonymous_token}",
+        HTTP_AUTHORIZATION=f"X-LiveKit-Token {anonymous_token}",
     )
 
     call_kwargs = mock_livekit_client.room.update_participant.call_args
@@ -480,7 +532,7 @@ def test_rename_participant_sets_correct_name_anonymous(
         url,
         {"name": "Guest User"},
         format="json",
-        HTTP_AUTHORIZATION=f"Bearer {anonymous_token}",
+        HTTP_AUTHORIZATION=f"X-LiveKit-Token {anonymous_token}",
     )
 
     call_kwargs = mock_livekit_client.room.update_participant.call_args
@@ -497,7 +549,7 @@ def test_rename_participant_forbidden_anonymous_token_for_wrong_room(anonymous_t
         url,
         {"name": "Guest User"},
         format="json",
-        HTTP_AUTHORIZATION=f"Bearer {anonymous_token}",
+        HTTP_AUTHORIZATION=f"X-LiveKit-Token {anonymous_token}",
     )
 
     assert response.status_code == status.HTTP_403_FORBIDDEN
@@ -523,7 +575,7 @@ def test_toggle_hand_expired_token(room, expired_token):
         url,
         {"raised": True},
         format="json",
-        HTTP_AUTHORIZATION=f"Bearer {expired_token}",
+        HTTP_AUTHORIZATION=f"X-LiveKit-Token {expired_token}",
     )
 
     assert response.status_code == status.HTTP_403_FORBIDDEN
@@ -537,7 +589,7 @@ def test_rename_participant_expired_token(room, expired_token):
         url,
         {"name": "John Doe"},
         format="json",
-        HTTP_AUTHORIZATION=f"Bearer {expired_token}",
+        HTTP_AUTHORIZATION=f"X-LiveKit-Token {expired_token}",
     )
 
     assert response.status_code == status.HTTP_403_FORBIDDEN
@@ -551,7 +603,7 @@ def test_toggle_hand_malformed_token(room):
         url,
         {"raised": True},
         format="json",
-        HTTP_AUTHORIZATION="Bearer this-is-not-a-valid-jwt",
+        HTTP_AUTHORIZATION="X-LiveKit-Token this-is-not-a-valid-jwt",
     )
 
     assert response.status_code == status.HTTP_403_FORBIDDEN
@@ -565,7 +617,10 @@ def test_toggle_hand_room_not_found(user):
     client = APIClient()
     url = reverse("rooms-toggle-hand", kwargs={"pk": non_existent_room_id})
     response = client.post(
-        url, {"raised": True}, format="json", HTTP_AUTHORIZATION=f"Bearer {token}"
+        url,
+        {"raised": True},
+        format="json",
+        HTTP_AUTHORIZATION=f"X-LiveKit-Token {token}",
     )
 
     assert response.status_code == status.HTTP_404_NOT_FOUND
@@ -580,7 +635,10 @@ def test_toggle_hand_participant_not_found(mock_livekit_client, room, token):
     client = APIClient()
     url = reverse("rooms-toggle-hand", kwargs={"pk": room.id})
     response = client.post(
-        url, {"raised": True}, format="json", HTTP_AUTHORIZATION=f"Bearer {token}"
+        url,
+        {"raised": True},
+        format="json",
+        HTTP_AUTHORIZATION=f"X-LiveKit-Token {token}",
     )
 
     assert response.status_code == status.HTTP_404_NOT_FOUND
@@ -597,7 +655,7 @@ def test_rename_participant_malformed_token(room):
         url,
         {"name": "John Doe"},
         format="json",
-        HTTP_AUTHORIZATION="Bearer this-is-not-a-valid-jwt",
+        HTTP_AUTHORIZATION="X-LiveKit-Token this-is-not-a-valid-jwt",
     )
 
     assert response.status_code == status.HTTP_403_FORBIDDEN
@@ -611,7 +669,10 @@ def test_rename_participant_room_not_found(user):
     client = APIClient()
     url = reverse("rooms-rename", kwargs={"pk": non_existent_room_id})
     response = client.post(
-        url, {"name": "John Doe"}, format="json", HTTP_AUTHORIZATION=f"Bearer {token}"
+        url,
+        {"name": "John Doe"},
+        format="json",
+        HTTP_AUTHORIZATION=f"X-LiveKit-Token {token}",
     )
 
     assert response.status_code == status.HTTP_404_NOT_FOUND
@@ -626,10 +687,206 @@ def test_rename_participant_not_found(mock_livekit_client, room, token):
     client = APIClient()
     url = reverse("rooms-rename", kwargs={"pk": room.id})
     response = client.post(
-        url, {"name": "John Doe"}, format="json", HTTP_AUTHORIZATION=f"Bearer {token}"
+        url,
+        {"name": "John Doe"},
+        format="json",
+        HTTP_AUTHORIZATION=f"X-LiveKit-Token {token}",
     )
 
     assert response.status_code == status.HTTP_404_NOT_FOUND
     assert response.data == {"error": "Participant not found"}
 
     mock_livekit_client.aclose.assert_called_once()
+
+
+@pytest.fixture
+def user_access_token(user):
+    """Generate a valid user access JWT, sent with the "X-LiveKit-Token" scheme."""
+    now = datetime.now(timezone.utc)
+    application = ApplicationFactory(scopes=[ApplicationScope.USERS_SESSION])
+
+    payload = {
+        "iss": django_settings.USER_ACCESS_TOKEN_ISSUER,
+        "aud": django_settings.USER_ACCESS_TOKEN_AUDIENCE,
+        "iat": now,
+        "exp": now + timedelta(seconds=django_settings.USER_ACCESS_TOKEN_TTL),
+        "user_id": str(user.id),
+        "token_type": "user_access",
+        "client_id": application.client_id,
+        "scope": "user:access",
+    }
+
+    return jwt.encode(
+        payload,
+        django_settings.USER_ACCESS_TOKEN_SECRET_KEY,
+        algorithm=django_settings.USER_ACCESS_TOKEN_ALG,
+    )
+
+
+def test_toggle_hand_bearer_scheme_defers_to_next_authentication(
+    mock_livekit_client, room, user, user_access_token
+):
+    """Test toggle hand defers a "Bearer" header instead of failing on it."""
+    UserResourceAccessFactory(resource=room, user=user, role="owner")
+
+    client = APIClient()
+    url = reverse("rooms-toggle-hand", kwargs={"pk": room.id})
+    response = client.post(
+        url,
+        {"raised": True},
+        format="json",
+        HTTP_AUTHORIZATION=f"Bearer {user_access_token}",
+    )
+
+    assert response.status_code == status.HTTP_403_FORBIDDEN
+    assert response.data == {"detail": "Authentication credentials were not provided."}
+
+    mock_livekit_client.room.update_participant.assert_not_called()
+
+
+def test_rename_participant_bearer_scheme_defers_to_next_authentication(
+    mock_livekit_client, room, user, user_access_token
+):
+    """Test rename defers a "Bearer" header instead of failing on it."""
+    UserResourceAccessFactory(resource=room, user=user, role="owner")
+
+    client = APIClient()
+    url = reverse("rooms-rename", kwargs={"pk": room.id})
+    response = client.post(
+        url,
+        {"name": "John Doe"},
+        format="json",
+        HTTP_AUTHORIZATION=f"Bearer {user_access_token}",
+    )
+
+    assert response.status_code == status.HTTP_403_FORBIDDEN
+    assert response.data == {"detail": "Authentication credentials were not provided."}
+
+    mock_livekit_client.room.update_participant.assert_not_called()
+
+
+def test_toggle_hand_unknown_scheme_defers(mock_livekit_client, room):
+    """Test toggle hand defers a scheme no backend recognizes."""
+    client = APIClient()
+    url = reverse("rooms-toggle-hand", kwargs={"pk": room.id})
+    response = client.post(
+        url,
+        {"raised": True},
+        format="json",
+        HTTP_AUTHORIZATION="Basic dXNlcjpwYXNzd29yZA==",
+    )
+
+    assert response.status_code == status.HTTP_403_FORBIDDEN
+    assert response.data == {"detail": "Authentication credentials were not provided."}
+
+    mock_livekit_client.room.update_participant.assert_not_called()
+
+
+def test_rename_participant_unknown_scheme_defers(mock_livekit_client, room):
+    """Test rename defers a scheme no backend recognizes."""
+    client = APIClient()
+    url = reverse("rooms-rename", kwargs={"pk": room.id})
+    response = client.post(
+        url,
+        {"name": "John Doe"},
+        format="json",
+        HTTP_AUTHORIZATION="Basic dXNlcjpwYXNzd29yZA==",
+    )
+
+    assert response.status_code == status.HTTP_403_FORBIDDEN
+    assert response.data == {"detail": "Authentication credentials were not provided."}
+
+    mock_livekit_client.room.update_participant.assert_not_called()
+
+
+def test_toggle_hand_session_authentication_is_not_accepted(
+    mock_livekit_client, room, user
+):
+    """Test toggle hand is not granted by a session, whatever the user's room role."""
+    UserResourceAccessFactory(resource=room, user=user, role="owner")
+
+    client = APIClient()
+    client.force_authenticate(user=user)
+
+    url = reverse("rooms-toggle-hand", kwargs={"pk": room.id})
+    response = client.post(url, {"raised": True}, format="json")
+
+    assert response.status_code == status.HTTP_403_FORBIDDEN
+    mock_livekit_client.room.update_participant.assert_not_called()
+
+
+def test_rename_participant_session_authentication_is_not_accepted(
+    mock_livekit_client, room, user
+):
+    """Test rename is not granted by a session, whatever the user's room role."""
+    UserResourceAccessFactory(resource=room, user=user, role="owner")
+
+    client = APIClient()
+    client.force_authenticate(user=user)
+
+    url = reverse("rooms-rename", kwargs={"pk": room.id})
+    response = client.post(url, {"name": "John Doe"}, format="json")
+
+    assert response.status_code == status.HTTP_403_FORBIDDEN
+    mock_livekit_client.room.update_participant.assert_not_called()
+
+
+def test_rename_participant_livekit_scheme_is_case_insensitive(
+    mock_livekit_client, room, token
+):
+    """Test rename claims the LiveKit scheme whatever its casing."""
+    client = APIClient()
+    url = reverse("rooms-rename", kwargs={"pk": room.id})
+    response = client.post(
+        url,
+        {"name": "John Doe"},
+        format="json",
+        HTTP_AUTHORIZATION=f"x-livekit-token {token}",
+    )
+
+    assert response.status_code == status.HTTP_200_OK
+    assert response.data == {"status": "success"}
+
+    mock_livekit_client.room.update_participant.assert_called_once()
+
+
+def test_toggle_hand_livekit_scheme_malformed_header_is_rejected(
+    mock_livekit_client, room, token
+):
+    """Test toggle hand rejects a malformed header once the LiveKit scheme is claimed."""
+    client = APIClient()
+    url = reverse("rooms-toggle-hand", kwargs={"pk": room.id})
+    response = client.post(
+        url,
+        {"raised": True},
+        format="json",
+        HTTP_AUTHORIZATION=f"X-LiveKit-Token {token} extra-part",
+    )
+
+    assert response.status_code == status.HTTP_403_FORBIDDEN
+    assert response.data == {
+        "detail": "Authorization header must be: X-LiveKit-Token <token>"
+    }
+
+    mock_livekit_client.room.update_participant.assert_not_called()
+
+
+def test_rename_participant_livekit_scheme_malformed_header_is_rejected(
+    mock_livekit_client, room, token
+):
+    """Test rename rejects a malformed header once the LiveKit scheme is claimed."""
+    client = APIClient()
+    url = reverse("rooms-rename", kwargs={"pk": room.id})
+    response = client.post(
+        url,
+        {"name": "John Doe"},
+        format="json",
+        HTTP_AUTHORIZATION=f"X-LiveKit-Token {token} extra-part",
+    )
+
+    assert response.status_code == status.HTTP_403_FORBIDDEN
+    assert response.data == {
+        "detail": "Authorization header must be: X-LiveKit-Token <token>"
+    }
+
+    mock_livekit_client.room.update_participant.assert_not_called()

src/backend/core/tests/rooms/test_api_rooms_retrieve.py

@@ -3,17 +3,24 @@ Test rooms API endpoints in the Meet core app: retrieve.
 """
 
 import random
+from datetime import datetime, timedelta, timezone
 from unittest import mock
 
+from django.conf import settings as django_settings
 from django.contrib.auth.models import AnonymousUser
 from django.test.utils import override_settings
-from django.utils import timezone
 
+import jwt
 import pytest
 from rest_framework.test import APIClient
 
-from ...factories import RoomFactory, UserFactory, UserResourceAccessFactory
-from ...models import RoleChoices, RoomAccessLevel
+from ...factories import (
+    ApplicationFactory,
+    RoomFactory,
+    UserFactory,
+    UserResourceAccessFactory,
+)
+from ...models import ApplicationScope, RoleChoices, RoomAccessLevel
 
 pytestmark = pytest.mark.django_db
 
@@ -510,18 +517,39 @@ def test_api_rooms_retrieve_administrators(
     )
 
 
-@pytest.mark.parametrize("access_level", RoomAccessLevel)
-@pytest.mark.parametrize("role", [None, *RoleChoices])
-def test_api_rooms_retrieve_last_started_at_not_exposed(role, access_level):
-    """Should not expose when the room was last started, whoever the requester is."""
-    room = RoomFactory(access_level=access_level, last_started_at=timezone.now())
-    client = APIClient()
-    user = UserFactory()
-    if role is not None:
-        UserResourceAccessFactory(resource=room, user=user, role=role)
-    client.force_login(user)
+def generate_user_access_token(user):
+    """Generate a valid user access JWT signed with the token secret."""
+    now = datetime.now(timezone.utc)
+    application = ApplicationFactory(scopes=[ApplicationScope.USERS_SESSION])
 
+    payload = {
+        "iss": django_settings.USER_ACCESS_TOKEN_ISSUER,
+        "aud": django_settings.USER_ACCESS_TOKEN_AUDIENCE,
+        "iat": now,
+        "exp": now + timedelta(seconds=django_settings.USER_ACCESS_TOKEN_TTL),
+        "user_id": str(user.id),
+        "token_type": "user_access",
+        "client_id": application.client_id,
+        "scope": "user:access",
+    }
+
+    return jwt.encode(
+        payload,
+        django_settings.USER_ACCESS_TOKEN_SECRET_KEY,
+        algorithm=django_settings.USER_ACCESS_TOKEN_ALG,
+    )
+
+
+def test_api_rooms_retrieve_authenticated_with_user_access_token():
+    """A user access token should retrieve a room exactly like a session would."""
+    user = UserFactory()
+    room = RoomFactory(users=[(user, "owner")])
+
+    client = APIClient()
+    client.credentials(HTTP_AUTHORIZATION=f"Bearer {generate_user_access_token(user)}")
     response = client.get(f"/api/v1.0/rooms/{room.id!s}/")
 
     assert response.status_code == 200
-    assert "last_started_at" not in response.json()
+    assert response.data["id"] == str(room.id)
+    assert response.data["pin_code"] == room.pin_code
+    assert "accesses" in response.data

src/backend/core/tests/rooms/test_api_rooms_subtitle.py

@@ -4,15 +4,18 @@ Test rooms API endpoints in the Meet core app: start subtitle.
 # pylint: disable=W0621
 
 import uuid
+from datetime import datetime, timedelta, timezone
 from unittest import mock
 
 from django.conf import settings
 
+import jwt
 import pytest
 from livekit.api import AccessToken, TwirpError, VideoGrants
 from rest_framework.test import APIClient
 
-from ...factories import RoomFactory, UserFactory
+from ...factories import ApplicationFactory, RoomFactory, UserFactory
+from ...models import ApplicationScope
 
 pytestmark = pytest.mark.django_db
 
@@ -110,7 +113,7 @@ def test_start_subtitle_invalid_token():
     response = client.post(
         f"/api/v1.0/rooms/{room.id}/start-subtitle/",
         {},
-        HTTP_AUTHORIZATION="Bearer invalid-token",
+        HTTP_AUTHORIZATION="X-LiveKit-Token invalid-token",
     )
 
     assert response.status_code == 403
@@ -130,7 +133,7 @@ def test_start_subtitle_disabled_by_default(mock_livekit_token, settings):
     response = client.post(
         f"/api/v1.0/rooms/{room.id}/start-subtitle/",
         {},
-        HTTP_AUTHORIZATION=f"Bearer {mock_livekit_token}",
+        HTTP_AUTHORIZATION=f"X-LiveKit-Token {mock_livekit_token}",
     )
 
     assert response.status_code == 404
@@ -150,7 +153,7 @@ def test_start_subtitle_valid_token(
     response = client.post(
         f"/api/v1.0/rooms/{room.id}/start-subtitle/",
         {},
-        HTTP_AUTHORIZATION=f"Bearer {mock_livekit_token}",
+        HTTP_AUTHORIZATION=f"X-LiveKit-Token {mock_livekit_token}",
     )
 
     assert response.status_code == 200
@@ -180,7 +183,7 @@ def test_start_subtitle_twirp_error(
     response = client.post(
         f"/api/v1.0/rooms/{room.id}/start-subtitle/",
         {},
-        HTTP_AUTHORIZATION=f"Bearer {mock_livekit_token}",
+        HTTP_AUTHORIZATION=f"X-LiveKit-Token {mock_livekit_token}",
     )
 
     assert response.status_code == 500
@@ -200,7 +203,7 @@ def test_start_subtitle_wrong_room(settings, mock_livekit_token):
     response = client.post(
         f"/api/v1.0/rooms/{room.id}/start-subtitle/",
         {},
-        HTTP_AUTHORIZATION=f"Bearer {mock_livekit_token}",
+        HTTP_AUTHORIZATION=f"X-LiveKit-Token {mock_livekit_token}",
     )
 
     assert response.status_code == 403
@@ -221,10 +224,133 @@ def test_start_subtitle_wrong_signature(settings, mock_livekit_token):
     response = client.post(
         f"/api/v1.0/rooms/{room.id}/start-subtitle/",
         {},
-        HTTP_AUTHORIZATION=f"Bearer {mock_livekit_token}",
+        HTTP_AUTHORIZATION=f"X-LiveKit-Token {mock_livekit_token}",
     )
 
     assert response.status_code == 403
     assert response.json() == {
         "detail": "Invalid LiveKit token: Signature verification failed"
     }
+
+
+@pytest.fixture
+def user_access_token():
+    """Generate a valid user access JWT, sent with the "Bearer" scheme."""
+    user = UserFactory()
+    now = datetime.now(timezone.utc)
+    application = ApplicationFactory(scopes=[ApplicationScope.USERS_SESSION])
+
+    payload = {
+        "iss": settings.USER_ACCESS_TOKEN_ISSUER,
+        "aud": settings.USER_ACCESS_TOKEN_AUDIENCE,
+        "iat": now,
+        "exp": now + timedelta(seconds=settings.USER_ACCESS_TOKEN_TTL),
+        "user_id": str(user.id),
+        "token_type": "user_access",
+        "client_id": application.client_id,
+        "scope": "user:access",
+    }
+
+    return jwt.encode(
+        payload,
+        settings.USER_ACCESS_TOKEN_SECRET_KEY,
+        algorithm=settings.USER_ACCESS_TOKEN_ALG,
+    )
+
+
+def test_start_subtitle_bearer_scheme_defers_to_next_authentication(
+    settings, mock_livekit_client, user_access_token
+):
+    """Test that a "Bearer" header is deferred instead of failing on the LiveKit backend.
+
+    The action declares LiveKitTokenAuthentication as its only backend, so a
+    scheme it does not own must be left to the next one. None follows, so the
+    request ends up unauthenticated: the body reports missing credentials
+    rather than an invalid LiveKit token.
+    """
+
+    settings.ROOM_SUBTITLE_ENABLED = True
+
+    room = RoomFactory()
+    client = APIClient()
+
+    response = client.post(
+        f"/api/v1.0/rooms/{room.id}/start-subtitle/",
+        {},
+        HTTP_AUTHORIZATION=f"Bearer {user_access_token}",
+    )
+
+    assert response.status_code == 403
+    assert response.json() == {
+        "detail": "Authentication credentials were not provided."
+    }
+
+    mock_livekit_client.agent_dispatch.create_dispatch.assert_not_called()
+
+
+def test_start_subtitle_unknown_scheme_defers(settings, mock_livekit_client):
+    """Test that a scheme no backend recognizes is deferred, not rejected."""
+
+    settings.ROOM_SUBTITLE_ENABLED = True
+
+    room = RoomFactory()
+    client = APIClient()
+
+    response = client.post(
+        f"/api/v1.0/rooms/{room.id}/start-subtitle/",
+        {},
+        HTTP_AUTHORIZATION="Basic dXNlcjpwYXNzd29yZA==",
+    )
+
+    assert response.status_code == 403
+    assert response.json() == {
+        "detail": "Authentication credentials were not provided."
+    }
+
+    mock_livekit_client.agent_dispatch.create_dispatch.assert_not_called()
+
+
+def test_start_subtitle_scheme_is_case_insensitive(
+    settings, mock_livekit_client, mock_livekit_token, mock_room_id
+):
+    """Test that the LiveKit scheme is claimed whatever its casing."""
+
+    settings.ROOM_SUBTITLE_ENABLED = True
+
+    room = RoomFactory(id=mock_room_id)
+    client = APIClient()
+
+    response = client.post(
+        f"/api/v1.0/rooms/{room.id}/start-subtitle/",
+        {},
+        HTTP_AUTHORIZATION=f"x-livekit-token {mock_livekit_token}",
+    )
+
+    assert response.status_code == 200
+    assert response.json() == {"status": "success"}
+
+    mock_livekit_client.agent_dispatch.create_dispatch.assert_called_once()
+
+
+def test_start_subtitle_malformed_header_is_rejected(
+    settings, mock_livekit_client, mock_livekit_token
+):
+    """Test that a malformed header is rejected once the LiveKit scheme is claimed."""
+
+    settings.ROOM_SUBTITLE_ENABLED = True
+
+    room = RoomFactory()
+    client = APIClient()
+
+    response = client.post(
+        f"/api/v1.0/rooms/{room.id}/start-subtitle/",
+        {},
+        HTTP_AUTHORIZATION=f"X-LiveKit-Token {mock_livekit_token} extra-part",
+    )
+
+    assert response.status_code == 403
+    assert response.json() == {
+        "detail": "Authorization header must be: X-LiveKit-Token <token>"
+    }
+
+    mock_livekit_client.agent_dispatch.create_dispatch.assert_not_called()

src/backend/core/tests/rooms/test_api_rooms_update.py

@@ -3,16 +3,17 @@ Test rooms API endpoints in the Meet core app: update.
 """
 
 import random
-from datetime import timedelta
+from datetime import datetime, timedelta, timezone
 from unittest.mock import patch
 
-from django.utils import timezone
+from django.conf import settings as django_settings
 
+import jwt
 import pytest
 from rest_framework.test import APIClient
 
-from ...factories import RoomFactory, UserFactory
-from ...models import RoomAccessLevel
+from ...factories import ApplicationFactory, RoomFactory, UserFactory
+from ...models import ApplicationScope, RoomAccessLevel
 from ...services.room_management import (
     RoomManagement,
     RoomManagementException,
@@ -228,39 +229,6 @@ def test_api_rooms_update_administrators_name_only(mock_update_metadata):
     mock_update_metadata.assert_not_called()
 
 
-@pytest.mark.parametrize("method", ["put", "patch"])
-def test_api_rooms_update_last_started_at_ignored(method):
-    """Should ignore a "last_started_at" value sent by a client.
-
-    The field is only ever written by the LiveKit "room_started" webhook: it is not
-    declared on the serializer and is "editable=False" on the model. A client must
-    not be able to keep a room alive by postponing its last start date.
-    """
-    user = UserFactory()
-    last_started_at = timezone.now() - timedelta(days=30)
-    room = RoomFactory(
-        name="Old name",
-        last_started_at=last_started_at,
-        users=[(user, random.choice(["administrator", "owner"]))],
-    )
-    client = APIClient()
-    client.force_login(user)
-
-    response = getattr(client, method)(
-        f"/api/v1.0/rooms/{room.id!s}/",
-        {"name": "New name", "last_started_at": timezone.now().isoformat()},
-        format="json",
-    )
-
-    assert response.status_code == 200
-    assert "last_started_at" not in response.json()
-
-    room.refresh_from_db()
-    # The rest of the payload was applied, so the request was not simply rejected
-    assert room.name == "New name"
-    assert room.last_started_at == last_started_at
-
-
 @pytest.mark.parametrize(
     "configuration",
     [
@@ -446,3 +414,46 @@ def test_api_rooms_update_livekit_sync_failure(mock_update_metadata, exception):
             "configuration": {"can_publish_sources": ["camera"]},
         },
     )
+
+
+def generate_user_access_token(user):
+    """Generate a valid user access JWT signed with the token secret."""
+    now = datetime.now(timezone.utc)
+    application = ApplicationFactory(scopes=[ApplicationScope.USERS_SESSION])
+
+    payload = {
+        "iss": django_settings.USER_ACCESS_TOKEN_ISSUER,
+        "aud": django_settings.USER_ACCESS_TOKEN_AUDIENCE,
+        "iat": now,
+        "exp": now + timedelta(seconds=django_settings.USER_ACCESS_TOKEN_TTL),
+        "user_id": str(user.id),
+        "token_type": "user_access",
+        "client_id": application.client_id,
+        "scope": "user:access",
+    }
+
+    return jwt.encode(
+        payload,
+        django_settings.USER_ACCESS_TOKEN_SECRET_KEY,
+        algorithm=django_settings.USER_ACCESS_TOKEN_ALG,
+    )
+
+
+def test_api_rooms_update_authenticated_with_user_access_token():
+    """Role-based permissions apply unchanged with a user access token."""
+    user = UserFactory()
+    room = RoomFactory(users=[(user, "member")])
+
+    client = APIClient()
+    client.credentials(HTTP_AUTHORIZATION=f"Bearer {generate_user_access_token(user)}")
+
+    # A simple member cannot update the room
+    response = client.patch(f"/api/v1.0/rooms/{room.id!s}/", {"name": "new name"})
+    assert response.status_code == 403
+
+    # An administrator can
+    room.accesses.filter(user=user).update(role="administrator")
+    response = client.patch(f"/api/v1.0/rooms/{room.id!s}/", {"name": "new name"})
+    assert response.status_code == 200
+    room.refresh_from_db()
+    assert room.name == "new name"

src/backend/core/tests/services/test_livekit_events.py

@@ -3,28 +3,20 @@ Test LiveKitEvents service.
 """
 # pylint: disable=W0621,W0613, W0212, E0611
 
-import logging
 import uuid
-from datetime import timedelta
 from unittest import mock
 
-from django.utils import timezone
-
 import pytest
 from livekit.api import EgressStatus
 
 from core.factories import RecordingFactory, RoomFactory
-from core.models import Room
-from core.recording.enums import RecordingWorkerEvent
 from core.recording.services.recording_events import RecordingEventsService
 from core.services.livekit_events import (
-    EGRESS_STATUS_TO_RECORDING_EVENT,
     ActionFailedError,
     AuthenticationError,
     InvalidPayloadError,
     LiveKitEventsService,
     api,
-    to_recording_event,
 )
 from core.services.lobby import LobbyService
 from core.services.room_management import RoomManagementException
@@ -85,7 +77,7 @@ def test_initialization(
 def test_handle_egress_ended_success(  # pylint: disable=too-many-arguments, too-many-positional-arguments
     mock_update_metadata, mock_notify, mode, notification_type, service
 ):
-    """Should successfully stop recording and notify all participant."""
+    """Should successfully stop recording and notifies all participant."""
 
     recording = RecordingFactory(worker_id="worker-1", mode=mode, status="active")
     mock_data = mock.MagicMock()
@@ -112,6 +104,7 @@ def test_handle_egress_ended_success(  # pylint: disable=too-many-arguments, too
     (
         (EgressStatus.EGRESS_ACTIVE, "started"),
         (EgressStatus.EGRESS_ENDING, "saving"),
+        (EgressStatus.EGRESS_ABORTED, "aborted"),
     ),
 )
 @mock.patch("core.services.room_management.RoomManagement.update_metadata")
@@ -132,6 +125,29 @@ def test_handle_egress_updated_success(
     )
 
 
+@pytest.mark.parametrize(
+    "egress_status",
+    (
+        EgressStatus.EGRESS_FAILED,
+        EgressStatus.EGRESS_LIMIT_REACHED,
+    ),
+)
+@mock.patch("core.services.room_management.RoomManagement.update_metadata")
+def test_handle_egress_updated_non_handled(
+    mock_update_metadata, egress_status, service
+):
+    """Should ignore certain egress status and don't trigger metadata updates."""
+
+    recording = RecordingFactory(worker_id="worker-1", status="initiated")
+    mock_data = mock.MagicMock()
+    mock_data.egress_info.egress_id = recording.worker_id
+    mock_data.egress_info.status = egress_status
+
+    service._handle_egress_updated(mock_data)
+
+    mock_update_metadata.assert_not_called()
+
+
 @pytest.mark.parametrize(
     ("mode", "notification_type"),
     (
@@ -164,38 +180,33 @@ def test_handle_egress_ended_metadata_update_fails(  # pylint: disable=too-many-
     assert recording.status == "saved"
 
 
-@mock.patch(
-    "core.recording.services.recording_events.notification_service."
-    "notify_external_services"
-)
 @mock.patch("core.utils.notify_participants")
 @mock.patch("core.services.room_management.RoomManagement.update_metadata")
 def test_handle_egress_ended_notification_fails(
-    mock_update_metadata, mock_notify, mock_notify_external_services, service
+    mock_update_metadata, mock_notify, service
 ):
-    """Should still stop and save the recording when notifying participants fails."""
-
-    mock_notify_external_services.return_value = False
-    mock_notify.side_effect = NotificationError("Error notifying")
+    """Should raise ActionFailedError when notification fails but still stop recording."""
 
     recording = RecordingFactory(worker_id="worker-1", status="active")
     mock_data = mock.MagicMock()
     mock_data.egress_info.egress_id = recording.worker_id
     mock_data.egress_info.status = EgressStatus.EGRESS_LIMIT_REACHED
 
-    service._handle_egress_ended(mock_data)
+    mock_notify.side_effect = NotificationError("Error notifying")
+
+    with pytest.raises(
+        ActionFailedError,
+        match=r"Failed to process limit reached event for recording .+",
+    ):
+        service._handle_egress_ended(mock_data)
+
+    recording.refresh_from_db()
+    assert recording.status == "stopped"
 
-    mock_notify.assert_called_once_with(
-        room_name=str(recording.room.id),
-        notification_data={"type": "screenRecordingLimitReached"},
-    )
     mock_update_metadata.assert_called_once_with(
         str(recording.room.id), remove_keys=["recording_mode", "recording_status"]
     )
 
-    recording.refresh_from_db()
-    assert recording.status == "saved"
-
 
 @mock.patch("core.utils.notify_participants")
 @mock.patch("core.services.room_management.RoomManagement.update_metadata")
@@ -221,25 +232,17 @@ def test_handle_egress_ended_recording_not_found(
     assert recording.status == "active"
 
 
-@pytest.mark.parametrize(
-    "egress_status",
-    (
-        EgressStatus.EGRESS_FAILED,
-        EgressStatus.EGRESS_ABORTED,
-        EgressStatus.EGRESS_LIMIT_REACHED,
-    ),
-)
 @mock.patch("core.utils.notify_participants")
 @mock.patch("core.services.room_management.RoomManagement.update_metadata")
-def test_handle_egress_ended_recording_should_not_be_saved(
-    mock_update_metadata, mock_notify, egress_status, service
+def test_handle_egress_ended_recording_not_active(
+    mock_update_metadata, mock_notify, service
 ):
-    """Don't update status for recordings that must not be saved."""
+    """Should ignore non-active recordings."""
 
     recording = RecordingFactory(worker_id="worker-1", status="failed_to_stop")
     mock_data = mock.MagicMock()
     mock_data.egress_info.egress_id = "worker-1"
-    mock_data.egress_info.status = egress_status
+    mock_data.egress_info.status = EgressStatus.EGRESS_LIMIT_REACHED
 
     service._handle_egress_ended(mock_data)
 
@@ -252,24 +255,12 @@ def test_handle_egress_ended_recording_should_not_be_saved(
     assert recording.status == "failed_to_stop"
 
 
-@mock.patch(
-    "core.recording.services.recording_events.notification_service."
-    "notify_external_services"
-)
 @mock.patch("core.utils.notify_participants")
 @mock.patch("core.services.room_management.RoomManagement.update_metadata")
-def test_handle_egress_ended_complete_does_not_notify_participants(
-    mock_update_metadata, mock_notify, mock_notify_external_services, service
+def test_handle_egress_ended_recording_not_limit_reached(
+    mock_update_metadata, mock_notify, service
 ):
-    """Shouldn't notify participants on a successful egress.
-
-    EGRESS_COMPLETE is the only ended status that notifies no one: limit
-    reached, aborted and failed egresses each send their own notification.
-    A stopped recording is simply finalized, which is the nominal flow once
-    the egress uploaded the file of a user-initiated stop.
-    """
-
-    mock_notify_external_services.return_value = False
+    """Should ignore egress non-limit-reached statuses."""
 
     recording = RecordingFactory(worker_id="worker-1", status="stopped")
     mock_data = mock.MagicMock()
@@ -282,10 +273,7 @@ def test_handle_egress_ended_complete_does_not_notify_participants(
     mock_update_metadata.assert_called_once_with(
         str(recording.room.id), remove_keys=["recording_mode", "recording_status"]
     )
-    mock_notify_external_services.assert_called_once_with(recording)
-
-    recording.refresh_from_db()
-    assert recording.status == "saved"
+    assert recording.status == "stopped"
 
 
 @mock.patch("core.services.livekit_events.MetadataCollectorService")
@@ -345,163 +333,96 @@ def test_handle_egress_ended_does_not_call_metadata_collector_stop_when_conditio
     mock_collector.stop.assert_not_called()
 
 
-@pytest.mark.parametrize(
-    ("egress_status", "recording_status", "event", "expected_level"),
-    (
-        (EgressStatus.EGRESS_ABORTED, "active", "aborted", logging.INFO),
-        (EgressStatus.EGRESS_FAILED, "active", "failed", logging.ERROR),
-        # The synchronous stop may already have persisted the terminal status,
-        # and the error details exist only in the webhook payload.
-        (EgressStatus.EGRESS_ABORTED, "aborted", "aborted", logging.INFO),
-        (EgressStatus.EGRESS_FAILED, "failed", "failed", logging.ERROR),
-    ),
-)
-@mock.patch("core.utils.notify_participants")
-@mock.patch("core.services.room_management.RoomManagement.update_metadata")
-def test_handle_egress_ended_logs_livekit_error(  # noqa: PLR0913, PLR0917
-    mock_update_metadata,
-    mock_notify,
-    egress_status,
-    recording_status,
-    event,
-    expected_level,
-    service,
-    caplog,
-):  # pylint: disable=too-many-arguments,too-many-positional-arguments
-    """Should log the reason LiveKit reported an unsuccessful egress."""
-
-    recording = RecordingFactory(worker_id="worker-1", status=recording_status)
-    mock_data = mock.MagicMock()
-    mock_data.egress_info.egress_id = recording.worker_id
-    mock_data.egress_info.status = egress_status
-    mock_data.egress_info.error = "could not connect to the room"
-    mock_data.egress_info.error_code = 500
-
-    with caplog.at_level(logging.INFO):
-        service._handle_egress_ended(mock_data)
-
-    assert (
-        f"Recording worker reported {event} for recording {recording.id}" in caplog.text
-    )
-    assert "could not connect to the room" in caplog.text
-    assert "error_code=500" in caplog.text
-
-    worker_logs = [
-        record
-        for record in caplog.records
-        if record.name == "core.recording.services.recording_events"
-    ]
-    assert [record.levelno for record in worker_logs] == [expected_level]
-
-
-@pytest.mark.parametrize(
-    "egress_status",
-    (EgressStatus.EGRESS_COMPLETE, EgressStatus.EGRESS_LIMIT_REACHED),
-)
 @mock.patch(
     "core.recording.services.recording_events.notification_service."
     "notify_external_services"
 )
 @mock.patch("core.utils.notify_participants")
 @mock.patch("core.services.room_management.RoomManagement.update_metadata")
-def test_handle_egress_ended_does_not_log_error_on_successful_egress(  # noqa: PLR0913, PLR0917
+@pytest.mark.parametrize(
+    "egress_status",
+    [EgressStatus.EGRESS_COMPLETE, EgressStatus.EGRESS_LIMIT_REACHED],
+)
+@pytest.mark.parametrize(
+    "notify_return_value, recording_status",
+    [(True, "notification_succeeded"), (False, "saved")],
+)
+def test_handle_egress_ended_finalizes_recording(  # noqa: PLR0913, PLR0917
     mock_update_metadata,
     mock_notify,
     mock_notify_external_services,
+    notify_return_value,
+    recording_status,
     egress_status,
     service,
-    caplog,
 ):  # pylint: disable=too-many-arguments,too-many-positional-arguments
-    """Shouldn't log an egress error when LiveKit reports a successful egress."""
+    """Should notify external services and save the recording on egress completion
+    (EGRESS_COMPLETE or EGRESS_LIMIT_REACHED).
+    """
+    mock_notify_external_services.return_value = notify_return_value
 
     recording = RecordingFactory(worker_id="worker-1", status="active")
     mock_data = mock.MagicMock()
     mock_data.egress_info.egress_id = recording.worker_id
     mock_data.egress_info.status = egress_status
 
-    with caplog.at_level(logging.ERROR):
-        service._handle_egress_ended(mock_data)
+    service._handle_egress_ended(mock_data)
 
-    assert "Recording worker reported" not in caplog.text
+    mock_notify_external_services.assert_called_once_with(recording)
+
+    recording.refresh_from_db()
+    assert recording.status == recording_status
 
 
-@mock.patch("core.utils.notify_participants")
+@pytest.mark.parametrize(
+    "egress_status",
+    [
+        EgressStatus.EGRESS_STARTING,
+        EgressStatus.EGRESS_ACTIVE,
+        EgressStatus.EGRESS_ENDING,
+        EgressStatus.EGRESS_FAILED,
+        EgressStatus.EGRESS_ABORTED,
+    ],
+)
 @mock.patch("core.services.room_management.RoomManagement.update_metadata")
-def test_handle_egress_ended_logs_livekit_error_before_cleaning_up(
-    mock_update_metadata, mock_notify, service, caplog
+def test_handle_egress_ended_does_not_save_on_wrong_status(
+    mock_update_metadata, egress_status, service
 ):
-    """Should log the failure reason even when the cleanup fails afterwards."""
-
-    mock_update_metadata.side_effect = RuntimeError("LiveKit is unreachable")
+    """Shouldn't save on invalid status."""
 
     recording = RecordingFactory(worker_id="worker-1", status="active")
     mock_data = mock.MagicMock()
     mock_data.egress_info.egress_id = recording.worker_id
-    mock_data.egress_info.status = EgressStatus.EGRESS_FAILED
-    mock_data.egress_info.error = "could not connect to the room"
-    mock_data.egress_info.error_code = 500
+    mock_data.egress_info.status = egress_status
 
-    with caplog.at_level(logging.ERROR), pytest.raises(RuntimeError):
-        service._handle_egress_ended(mock_data)
+    service._handle_egress_ended(mock_data)
 
-    assert (
-        f"Recording worker reported failed for recording {recording.id}" in caplog.text
-    )
-    assert "could not connect to the room" in caplog.text
-
-
-def test_egress_status_mapping_covers_every_livekit_status():
-    """Every egress status LiveKit can report must translate to a recording event."""
-
-    unmapped = [
-        name
-        for name in EgressStatus.keys()
-        if getattr(EgressStatus, name) not in EGRESS_STATUS_TO_RECORDING_EVENT
-    ]
-
-    assert not unmapped
+    recording.refresh_from_db()
+    assert recording.status == "active"
 
 
 @pytest.mark.parametrize(
-    ("egress_status", "expected_event"),
-    (
-        (EgressStatus.EGRESS_STARTING, RecordingWorkerEvent.STARTING),
-        (EgressStatus.EGRESS_ACTIVE, RecordingWorkerEvent.STARTED),
-        (EgressStatus.EGRESS_ENDING, RecordingWorkerEvent.SAVING),
-        (EgressStatus.EGRESS_COMPLETE, RecordingWorkerEvent.COMPLETED),
-        (EgressStatus.EGRESS_LIMIT_REACHED, RecordingWorkerEvent.LIMIT_REACHED),
-        (EgressStatus.EGRESS_ABORTED, RecordingWorkerEvent.ABORTED),
-        (EgressStatus.EGRESS_FAILED, RecordingWorkerEvent.FAILED),
-    ),
+    "status", ["failed_to_start", "aborted", "failed_to_stop", "saved", "initiated"]
 )
-def test_to_recording_event_translates_egress_status(egress_status, expected_event):
-    """Should translate a LiveKit egress status into a recording worker event."""
-
-    assert to_recording_event(egress_status) == expected_event
-
-
-def test_to_recording_event_returns_none_on_unmapped_status(caplog):
-    """Should warn and return None when LiveKit reports an unknown status."""
-
-    with caplog.at_level(logging.WARNING):
-        event = to_recording_event(999)
-
-    assert event is None
-    assert "Unmapped LiveKit egress status" in caplog.text
-
-
 @mock.patch("core.services.room_management.RoomManagement.update_metadata")
-def test_handle_egress_updated_ignores_unmapped_status(mock_update_metadata, service):
-    """Shouldn't touch the room's metadata when the egress status is unknown."""
+def test_handle_egress_ended_ignores_non_savable_recording(
+    mock_update_metadata, status, service
+):
+    """Should handle non-savable recordings idempotently without raising.
 
-    RecordingFactory(worker_id="worker-1", status="active")
+    'egress_ended' may be redelivered (e.g. for an already-saved recording);
+    this must not raise, otherwise the webhook would 500 and LiveKit would retry.
+    """
+
+    recording = RecordingFactory(worker_id="worker-1", status=status)
     mock_data = mock.MagicMock()
-    mock_data.egress_info.egress_id = "worker-1"
-    mock_data.egress_info.status = 999
+    mock_data.egress_info.egress_id = recording.worker_id
+    mock_data.egress_info.status = EgressStatus.EGRESS_COMPLETE
 
-    service._handle_egress_updated(mock_data)
+    service._handle_egress_ended(mock_data)
 
-    mock_update_metadata.assert_not_called()
+    recording.refresh_from_db()
+    assert recording.status == status
 
 
 @mock.patch.object(LobbyService, "clear_room_cache")
@@ -700,82 +621,6 @@ def test_handle_room_started_skips_dispatch_rule_when_telephony_disabled(
     mock_ensure_dispatch_rule.assert_not_called()
 
 
-def test_handle_room_started_records_access(service, settings):
-    """Should record the access on a room that is started for the first time."""
-    settings.ROOM_TELEPHONY_ENABLED = False
-    settings.ROOMKIT_ENABLED = False
-    room = RoomFactory()
-    other_room = RoomFactory()
-    mock_data = mock.MagicMock()
-    mock_data.room.name = str(room.id)
-
-    now = timezone.now()
-    with mock.patch("django.utils.timezone.now", return_value=now):
-        service._handle_room_started(mock_data)
-
-    room.refresh_from_db()
-    assert room.last_started_at == now
-
-    other_room.refresh_from_db()
-    assert other_room.last_started_at is None
-
-
-def test_handle_room_started_overwrites_previous_access(service, settings):
-    """Should overwrite the previous access each time the room is started again."""
-    settings.ROOM_TELEPHONY_ENABLED = False
-    settings.ROOMKIT_ENABLED = False
-    now = timezone.now()
-    room = RoomFactory(last_started_at=now - timedelta(days=30))
-    mock_data = mock.MagicMock()
-    mock_data.room.name = str(room.id)
-
-    with mock.patch("django.utils.timezone.now", return_value=now):
-        service._handle_room_started(mock_data)
-
-    room.refresh_from_db()
-    assert room.last_started_at == now
-
-
-def test_handle_room_started_only_updates_access(service, settings):
-    """Should leave the slug and the update date untouched when recording the access."""
-    settings.ROOM_TELEPHONY_ENABLED = False
-    settings.ROOMKIT_ENABLED = False
-    room = RoomFactory()
-    Room.objects.filter(pk=room.pk).update(slug="𓆑")
-    room.refresh_from_db()
-    updated_at = room.updated_at
-    mock_data = mock.MagicMock()
-    mock_data.room.name = str(room.id)
-
-    service._handle_room_started(mock_data)
-
-    room.refresh_from_db()
-    assert room.last_started_at is not None
-    assert room.slug == "𓆑"
-    assert room.updated_at == updated_at
-
-
-@mock.patch.object(
-    SIPManagement,
-    "ensure_dispatch_rule",
-    side_effect=SIPException("Test error"),
-)
-def test_handle_room_started_records_access_when_dispatch_rule_creation_fails(
-    mock_ensure_dispatch_rule, service, settings
-):
-    """Should still record the access when ensuring the dispatch rule fails."""
-    settings.ROOM_TELEPHONY_ENABLED = True
-    room = RoomFactory()
-    mock_data = mock.MagicMock()
-    mock_data.room.name = str(room.id)
-
-    with pytest.raises(ActionFailedError):
-        service._handle_room_started(mock_data)
-
-    room.refresh_from_db()
-    assert room.last_started_at is not None
-
-
 def test_handle_room_started_raises_error_for_invalid_room_name(service):
     """Should raise ActionFailedError when room name format is invalid  when room starts."""
     mock_data = mock.MagicMock()

src/backend/core/tests/services/test_lobby.py

@@ -2,20 +2,20 @@
 Test lobby service.
 """
 
-# pylint: disable=W0621,W0613, W0212, R0913, C0302
+# pylint: disable=W0621,W0613, W0212, R0913, C0302, R0917
 # ruff: noqa: PLR0913, PLR0917
 
 import uuid
 from unittest import mock
 
-from django.conf import settings
+from django.conf import settings as django_settings
 from django.contrib.auth.models import AnonymousUser
 from django.core.cache import cache
-from django.http import HttpResponse
 
 import pytest
 from freezegun import freeze_time
 
+from core import utils
 from core.factories import RoomFactory, UserFactory, UserResourceAccessFactory
 from core.models import RoleChoices, RoomAccessLevel
 from core.services.lobby import (
@@ -151,63 +151,10 @@ def test_get_cache_key(lobby_service, participant_id):
     room = RoomFactory(access_level=RoomAccessLevel.RESTRICTED)
     cache_key = lobby_service._get_cache_key(room.id, participant_id)
 
-    expected_key = f"{settings.LOBBY_KEY_PREFIX}_{room.id!s}_{participant_id}"
+    expected_key = f"{django_settings.LOBBY_KEY_PREFIX}_{room.id!s}_{participant_id}"
     assert cache_key == expected_key
 
 
-def test_get_or_create_participant_id_from_cookie(lobby_service):
-    """Test extracting participant ID from cookie."""
-    request = mock.Mock()
-    request.COOKIES = {settings.LOBBY_COOKIE_NAME: "existing-id"}
-
-    participant_id = lobby_service._get_or_create_participant_id(request)
-
-    assert participant_id == "existing-id"
-
-
-@mock.patch.object(uuid, "uuid4", return_value="generated-id")
-def test_get_or_create_participant_id_new(mock_uuid4, lobby_service):
-    """Test creating new participant ID when cookie is missing."""
-    request = mock.Mock()
-    request.COOKIES = {}
-
-    participant_id = lobby_service._get_or_create_participant_id(request)
-
-    assert participant_id == "generated-id"
-    mock_uuid4.assert_called_once()
-
-
-def test_prepare_response_existing_cookie(lobby_service, participant_id):
-    """Test response preparation with existing cookie."""
-    response = HttpResponse()
-    response.cookies[settings.LOBBY_COOKIE_NAME] = "existing-cookie"
-
-    lobby_service.prepare_response(response, participant_id)
-
-    # Verify cookie wasn't set again
-    cookie = response.cookies.get(settings.LOBBY_COOKIE_NAME)
-    assert cookie.value == "existing-cookie"
-    assert cookie.value != participant_id
-
-
-def test_prepare_response_new_cookie(lobby_service, participant_id):
-    """Test response preparation with new cookie."""
-    response = HttpResponse()
-
-    lobby_service.prepare_response(response, participant_id)
-
-    # Verify cookie was set
-    cookie = response.cookies.get(settings.LOBBY_COOKIE_NAME)
-    assert cookie is not None
-    assert cookie.value == participant_id
-    assert cookie["httponly"] is True
-    assert cookie["secure"] is True
-    assert cookie["samesite"] == "Lax"
-
-    # It's a session cookies (no max_age specified):
-    assert not cookie["max-age"]
-
-
 def test_can_bypass_lobby_public_room(lobby_service):
     """Should return True for public rooms regardless of user auth and role."""
     room = RoomFactory(access_level=RoomAccessLevel.PUBLIC)
@@ -271,94 +218,99 @@ def test_can_bypass_lobby_private_room_with_any_role(role, lobby_service):
 
 @mock.patch("core.utils.generate_livekit_config")
 def test_request_entry_public_room(
-    mock_generate_config, lobby_service, participant_id, username
+    mock_generate_config, lobby_service, participant_id, username, settings
 ):
     """Test requesting entry to a public room."""
-    request = mock.Mock()
-    request.user = AnonymousUser()
+    settings.LOBBY_KEY_PREFIX = "mocked-cache-prefix"
+
+    user = AnonymousUser()
 
     room = RoomFactory(access_level=RoomAccessLevel.PUBLIC)
 
-    mocked_participant = LobbyParticipant(
-        status=LobbyParticipantStatus.UNKNOWN,
-        username=username,
-        id=participant_id,
-        color="#123456",
-        entered_at="2025-01-01T10:00:00+00:00",
+    cache.set(
+        f"mocked-cache-prefix_{room.id}_{participant_id}",
+        {
+            "id": participant_id,
+            "username": username,
+            "status": "waiting",
+            "color": "#123456",
+            "entered_at": "2025-01-01T10:00:00+00:00",
+        },
     )
 
-    lobby_service._get_or_create_participant_id = mock.Mock(return_value=participant_id)
-    lobby_service._get_participant = mock.Mock(return_value=mocked_participant)
     mock_generate_config.return_value = {"token": "test-token"}
 
-    participant, livekit_config = lobby_service.request_entry(room, request, username)
+    participant, livekit_config = lobby_service.request_entry(
+        room, user, username, participant_id=participant_id
+    )
 
     assert participant.status == LobbyParticipantStatus.ACCEPTED
     assert livekit_config == {"token": "test-token"}
     mock_generate_config.assert_called_once_with(
         room_id=str(room.id),
-        user=request.user,
+        user=user,
         username=username,
         color=participant.color,
         configuration=room.configuration,
-        participant_id="test-participant-id",
+        participant_id=participant_id,
         role=None,
     )
 
-    lobby_service._get_participant.assert_called_once_with(room.id, participant_id)
-
 
 @mock.patch("core.utils.generate_livekit_config")
 def test_request_entry_trusted_room(
-    mock_generate_config, lobby_service, participant_id, username
+    mock_generate_config, lobby_service, participant_id, username, settings
 ):
     """Test requesting entry to a trusted room when the user is authenticated."""
-    request = mock.Mock()
-    request.user = UserFactory()
+    settings.LOBBY_KEY_PREFIX = "mocked-cache-prefix"
+
+    user = UserFactory()
 
     room = RoomFactory(access_level=RoomAccessLevel.TRUSTED)
 
-    mocked_participant = LobbyParticipant(
-        status=LobbyParticipantStatus.UNKNOWN,
-        username=username,
-        id=participant_id,
-        color="#123456",
-        entered_at="2025-01-01T10:00:00+00:00",
+    cache.set(
+        f"mocked-cache-prefix_{room.id}_{participant_id}",
+        {
+            "id": participant_id,
+            "username": username,
+            "status": "waiting",
+            "color": "#123456",
+            "entered_at": "2025-01-01T10:00:00+00:00",
+        },
     )
 
-    lobby_service._get_or_create_participant_id = mock.Mock(return_value=participant_id)
-    lobby_service._get_participant = mock.Mock(return_value=mocked_participant)
     mock_generate_config.return_value = {"token": "test-token"}
 
-    participant, livekit_config = lobby_service.request_entry(room, request, username)
+    participant, livekit_config = lobby_service.request_entry(
+        room, user, username, participant_id=participant_id
+    )
 
     assert participant.status == LobbyParticipantStatus.ACCEPTED
     assert livekit_config == {"token": "test-token"}
     mock_generate_config.assert_called_once_with(
         room_id=str(room.id),
-        user=request.user,
+        user=user,
         username=username,
         color=participant.color,
         configuration=room.configuration,
-        participant_id="test-participant-id",
+        participant_id=participant_id,
         role=None,
     )
 
-    lobby_service._get_participant.assert_called_once_with(room.id, participant_id)
 
-
-@mock.patch("core.services.lobby.LobbyService.enter")
+@mock.patch("core.services.lobby.LobbyService._notify_entry_request")
+@mock.patch("core.services.lobby.LobbyService._create_participant")
 def test_request_entry_new_participant(
-    mock_enter, lobby_service, participant_id, username
+    mock_create, mock_notify, lobby_service, participant_id, username
 ):
-    """Test requesting entry for a new participant."""
-    request = mock.Mock()
-    request.COOKIES = {settings.LOBBY_COOKIE_NAME: participant_id}
-    request.user = AnonymousUser()
+    """A new participant gets a server-minted identifier - any provided
+    one is unknown to the lobby and therefore discarded - and the room is
+    notified of the entry request."""
+
+    user = AnonymousUser()
 
     room = RoomFactory(access_level=RoomAccessLevel.RESTRICTED)
 
-    lobby_service._get_or_create_participant_id = mock.Mock(return_value=participant_id)
     lobby_service._get_participant = mock.Mock(return_value=None)
 
     participant_data = LobbyParticipant(
@@ -368,14 +320,20 @@ def test_request_entry_new_participant(
         color="#123456",
         entered_at="2025-01-01T10:00:00+00:00",
     )
-    mock_enter.return_value = participant_data
+    mock_create.return_value = participant_data
 
-    participant, livekit_config = lobby_service.request_entry(room, request, username)
+    forged_id = str(uuid.uuid4())
+    participant, livekit_config = lobby_service.request_entry(
+        room, user, username, participant_id=forged_id
+    )
 
     assert participant == participant_data
     assert livekit_config is None
-    mock_enter.assert_called_once_with(room.id, participant_id, username)
-    lobby_service._get_participant.assert_called_once_with(room.id, participant_id)
+    # The provided identifier was looked up, found unknown, and replaced
+    # by a freshly minted participant
+    lobby_service._get_participant.assert_called_once_with(room.id, forged_id)
+    mock_create.assert_called_once_with(username)
+    mock_notify.assert_called_once_with(str(room.id))
 
 
 @mock.patch("core.services.lobby.LobbyService.refresh_waiting_status")
@@ -383,9 +341,7 @@ def test_request_entry_waiting_participant(
     mock_refresh, lobby_service, participant_id, username
 ):
     """Test requesting entry for a waiting participant."""
-    request = mock.Mock()
-    request.COOKIES = {settings.LOBBY_COOKIE_NAME: participant_id}
-    request.user = AnonymousUser()
+    user = AnonymousUser()
 
     room = RoomFactory(access_level=RoomAccessLevel.RESTRICTED)
 
@@ -396,10 +352,11 @@ def test_request_entry_waiting_participant(
         color="#123456",
         entered_at="2025-01-01T10:00:00+00:00",
     )
-    lobby_service._get_or_create_participant_id = mock.Mock(return_value=participant_id)
     lobby_service._get_participant = mock.Mock(return_value=mocked_participant)
 
-    participant, livekit_config = lobby_service.request_entry(room, request, username)
+    participant, livekit_config = lobby_service.request_entry(
+        room, user, username, participant_id=participant_id
+    )
 
     assert participant.status == LobbyParticipantStatus.WAITING
     assert livekit_config is None
@@ -409,82 +366,122 @@ def test_request_entry_waiting_participant(
 
 @mock.patch("core.utils.generate_livekit_config")
 def test_request_entry_accepted_participant(
-    mock_generate_config, lobby_service, participant_id, username
+    mock_generate_config, lobby_service, participant_id, username, settings
 ):
     """Test requesting entry for an accepted participant."""
-    request = mock.Mock()
-    request.user = AnonymousUser()
-    request.COOKIES = {settings.LOBBY_COOKIE_NAME: participant_id}
+    settings.LOBBY_KEY_PREFIX = "mocked-cache-prefix"
+    user = AnonymousUser()
 
     room = RoomFactory(access_level=RoomAccessLevel.RESTRICTED)
 
-    mocked_participant = LobbyParticipant(
-        status=LobbyParticipantStatus.ACCEPTED,
-        username=username,
-        id=participant_id,
-        color="#123456",
-        entered_at="2025-01-01T10:00:00+00:00",
+    cache.set(
+        f"mocked-cache-prefix_{room.id}_{participant_id}",
+        {
+            "id": participant_id,
+            "username": username,
+            "status": "accepted",
+            "color": "#123456",
+            "entered_at": "2025-01-01T10:00:00+00:00",
+        },
     )
-    lobby_service._get_or_create_participant_id = mock.Mock(return_value=participant_id)
-    lobby_service._get_participant = mock.Mock(return_value=mocked_participant)
 
     mock_generate_config.return_value = {"token": "test-token"}
 
-    participant, livekit_config = lobby_service.request_entry(room, request, username)
+    participant, livekit_config = lobby_service.request_entry(
+        room, user, username, participant_id=participant_id
+    )
 
     assert participant.status == LobbyParticipantStatus.ACCEPTED
     assert livekit_config == {"token": "test-token"}
     mock_generate_config.assert_called_once_with(
         room_id=str(room.id),
-        user=request.user,
+        user=user,
         username=username,
         color="#123456",
         configuration=room.configuration,
         participant_id="test-participant-id",
         role=None,
     )
-    lobby_service._get_participant.assert_called_once_with(room.id, participant_id)
+
+
+@mock.patch("core.utils.generate_livekit_config")
+def test_request_entry_accepted_participant_username_is_bound(
+    mock_generate_config, lobby_service, participant_id, settings
+):
+    """An accepted identifier must join under the username the host accepted.
+
+    The participant identifier is a bearer value: a stolen or replayed
+    identifier must not be able to enter the room under a different
+    display name than the one the acceptance decision was made on.
+    """
+    settings.LOBBY_KEY_PREFIX = "mocked-cache-prefix"
+    user = AnonymousUser()
+
+    room = RoomFactory(access_level=RoomAccessLevel.RESTRICTED)
+
+    lobby_service._save_participant(
+        room.id,
+        LobbyParticipant(
+            id=participant_id,
+            username="accepted-name",
+            status=LobbyParticipantStatus.ACCEPTED,
+            color="#123456",
+            entered_at="2025-01-01T10:00:00+00:00",
+        ),
+    )
+
+    mock_generate_config.return_value = {"token": "test-token"}
+
+    participant, livekit_config = lobby_service.request_entry(
+        room, user, "spoofed-name", participant_id=participant_id
+    )
+
+    assert participant.status == LobbyParticipantStatus.ACCEPTED
+    assert livekit_config == {"token": "test-token"}
+    assert mock_generate_config.call_args.kwargs["username"] == "accepted-name"
 
 
 @mock.patch("core.utils.generate_livekit_config")
 def test_request_entry_participant_with_role(
-    mock_generate_config, lobby_service, participant_id, username
+    mock_generate_config, lobby_service, participant_id, username, settings
 ):
     """Test requesting entry for a participant with a role on the room."""
-    request = mock.Mock()
-    request.user = UserFactory()
-    request.COOKIES = {settings.LOBBY_COOKIE_NAME: participant_id}
+    settings.LOBBY_KEY_PREFIX = "mocked-cache-prefix"
+
+    user = UserFactory()
 
     room = RoomFactory(access_level=RoomAccessLevel.RESTRICTED)
 
-    UserResourceAccessFactory(resource=room, user=request.user, role="administrator")
+    UserResourceAccessFactory(resource=room, user=user, role="administrator")
 
-    mocked_participant = LobbyParticipant(
-        status=LobbyParticipantStatus.ACCEPTED,
-        username=username,
-        id=participant_id,
-        color="#123456",
-        entered_at="2025-01-01T10:00:00+00:00",
+    cache.set(
+        f"mocked-cache-prefix_{room.id}_{participant_id}",
+        {
+            "id": participant_id,
+            "username": username,
+            "status": "accepted",
+            "color": "#123456",
+            "entered_at": "2025-01-01T10:00:00+00:00",
+        },
     )
-    lobby_service._get_or_create_participant_id = mock.Mock(return_value=participant_id)
-    lobby_service._get_participant = mock.Mock(return_value=mocked_participant)
 
     mock_generate_config.return_value = {"token": "test-token"}
 
-    participant, livekit_config = lobby_service.request_entry(room, request, username)
+    participant, livekit_config = lobby_service.request_entry(
+        room, user, username, participant_id=participant_id
+    )
 
     assert participant.status == LobbyParticipantStatus.ACCEPTED
     assert livekit_config == {"token": "test-token"}
     mock_generate_config.assert_called_once_with(
         room_id=str(room.id),
-        user=request.user,
+        user=user,
         username=username,
         color="#123456",
         configuration=room.configuration,
         participant_id="test-participant-id",
         role="administrator",
     )
-    lobby_service._get_participant.assert_called_once_with(room.id, participant_id)
 
 
 @mock.patch("core.services.lobby.cache")
@@ -495,87 +492,70 @@ def test_refresh_waiting_status(mock_cache, lobby_service, participant_id):
     room = RoomFactory(access_level=RoomAccessLevel.RESTRICTED)
     lobby_service.refresh_waiting_status(room.id, participant_id)
     mock_cache.touch.assert_called_once_with(
-        "mocked_cache_key", settings.LOBBY_WAITING_TIMEOUT
+        "mocked_cache_key", django_settings.LOBBY_WAITING_TIMEOUT
     )
     lobby_service._index_touch.assert_called_once_with(room.id)
 
 
-# pylint: disable=R0917
 @mock.patch("core.services.lobby.cache")
 @mock.patch("core.utils.generate_color")
 @mock.patch("core.utils.notify_participants")
 @mock.patch("core.services.lobby.LobbyService._index_add")
 @freeze_time("2025-01-01 10:00:00")
-def test_enter_success(
+def test_create_participant_not_persisted_until_saved(
     mock_index_add,
     mock_notify,
     mock_generate_color,
     mock_cache,
     lobby_service,
-    participant_id,
     username,
 ):
-    """Test successful participant entry."""
+    """Creation is in-memory; explicitly saving persists and indexes the participant."""
     mock_generate_color.return_value = "#123456"
     lobby_service._get_cache_key = mock.Mock(return_value="mocked_cache_key")
 
     room = RoomFactory(access_level=RoomAccessLevel.RESTRICTED)
-    participant = lobby_service.enter(room.id, participant_id, username)
+    participant = lobby_service._create_participant(username)
 
-    mock_generate_color.assert_called_once_with(participant_id)
+    # The identifier is minted server-side
+    uuid.UUID(participant.id)
+    mock_generate_color.assert_called_once_with(participant.id)
     assert participant.status == LobbyParticipantStatus.WAITING
     assert participant.username == username
-    assert participant.id == participant_id
     assert participant.color == "#123456"
     assert participant.entered_at == "2025-01-01T10:00:00+00:00"
 
-    lobby_service._get_cache_key.assert_called_once_with(room.id, participant_id)
+    mock_cache.set.assert_not_called()
+    mock_index_add.assert_not_called()
+    lobby_service._save_participant(room.id, participant)
+
+    lobby_service._get_cache_key.assert_called_once_with(room.id, participant.id)
 
     mock_cache.set.assert_called_once_with(
         "mocked_cache_key",
         participant.to_dict(),
-        timeout=settings.LOBBY_WAITING_TIMEOUT,
+        timeout=django_settings.LOBBY_WAITING_TIMEOUT,
     )
-    mock_notify.assert_called_once_with(
-        room_name=str(room.pk), notification_data={"type": "participantWaiting"}
-    )
-    mock_index_add.assert_called_once_with(room.id, participant_id)
+    mock_index_add.assert_called_once_with(room.id, participant.id)
 
 
-# pylint: disable=R0917
-@mock.patch("core.services.lobby.cache")
-@mock.patch("core.utils.generate_color")
 @mock.patch("core.utils.notify_participants")
 @mock.patch("core.services.lobby.LobbyService._index_add")
 def test_enter_with_notification_error(
     mock_index_add,
     mock_notify,
-    mock_generate_color,
-    mock_cache,
     lobby_service,
     participant_id,
     username,
 ):
-    """Test participant entry with notification error."""
-    mock_generate_color.return_value = "#123456"
+    """A notification error must not break the entry request flow."""
     mock_notify.side_effect = NotificationError("Error notifying")
-    lobby_service._get_cache_key = mock.Mock(return_value="mocked_cache_key")
 
-    room = RoomFactory(access_level=RoomAccessLevel.RESTRICTED)
-    participant = lobby_service.enter(room.id, participant_id, username)
+    lobby_service._notify_entry_request("room-id")
 
-    mock_generate_color.assert_called_once_with(participant_id)
-    assert participant.status == LobbyParticipantStatus.WAITING
-    assert participant.username == username
-
-    lobby_service._get_cache_key.assert_called_once_with(room.id, participant_id)
-
-    mock_cache.set.assert_called_once_with(
-        "mocked_cache_key",
-        participant.to_dict(),
-        timeout=settings.LOBBY_WAITING_TIMEOUT,
+    mock_notify.assert_called_once_with(
+        room_name="room-id", notification_data={"type": "participantWaiting"}
     )
-    mock_index_add.assert_called_once_with(room.id, participant_id)
 
 
 @mock.patch("core.services.lobby.cache")
@@ -627,7 +607,9 @@ def test_list_waiting_participants_empty(mock_cache, lobby_service):
 
 
 @mock.patch("core.services.lobby.cache")
-def test_list_waiting_participants(mock_cache, lobby_service, participant_dict):
+def test_list_waiting_participants(
+    mock_cache, lobby_service, participant_dict, settings
+):
     """Test listing waiting participants with valid data."""
     room = RoomFactory(access_level=RoomAccessLevel.RESTRICTED)
     cache_key = f"{settings.LOBBY_KEY_PREFIX}_{room.id!s}_participant1"
@@ -649,8 +631,8 @@ def test_list_waiting_participants(mock_cache, lobby_service, participant_dict):
 def test_list_waiting_participants_multiple(mock_cache, lobby_service):
     """Test listing multiple waiting participants with valid data."""
     room = RoomFactory(access_level=RoomAccessLevel.RESTRICTED)
-    cache_key1 = f"{settings.LOBBY_KEY_PREFIX}_{room.id!s}_participant1"
-    cache_key2 = f"{settings.LOBBY_KEY_PREFIX}_{room.id!s}_participant2"
+    cache_key1 = f"{django_settings.LOBBY_KEY_PREFIX}_{room.id!s}_participant1"
+    cache_key2 = f"{django_settings.LOBBY_KEY_PREFIX}_{room.id!s}_participant2"
 
     participant1 = {
         "status": "waiting",
@@ -694,7 +676,7 @@ def test_list_waiting_participants_multiple(mock_cache, lobby_service):
 
 
 @mock.patch("core.services.lobby.cache")
-def test_list_waiting_participants_corrupted_data(mock_cache, lobby_service):
+def test_list_waiting_participants_corrupted_data(mock_cache, lobby_service, settings):
     """Test listing waiting participants with corrupted data."""
     room = RoomFactory(access_level=RoomAccessLevel.RESTRICTED)
     cache_key = f"{settings.LOBBY_KEY_PREFIX}_{room.id!s}_participant1"
@@ -712,8 +694,8 @@ def test_list_waiting_participants_corrupted_data(mock_cache, lobby_service):
 def test_list_waiting_participants_partially_corrupted(mock_cache, lobby_service):
     """Test listing waiting participants with one valid and one corrupted entry."""
     room = RoomFactory(access_level=RoomAccessLevel.RESTRICTED)
-    cache_key1 = f"{settings.LOBBY_KEY_PREFIX}_{room.id!s}_participant1"
-    cache_key2 = f"{settings.LOBBY_KEY_PREFIX}_{room.id!s}_participant2"
+    cache_key1 = f"{django_settings.LOBBY_KEY_PREFIX}_{room.id!s}_participant1"
+    cache_key2 = f"{django_settings.LOBBY_KEY_PREFIX}_{room.id!s}_participant2"
 
     valid_participant = {
         "status": "waiting",
@@ -753,8 +735,8 @@ def test_list_waiting_participants_partially_corrupted(mock_cache, lobby_service
 def test_list_waiting_participants_non_waiting(mock_cache, lobby_service):
     """Test listing only waiting participants (not accepted/denied)."""
     room = RoomFactory(access_level=RoomAccessLevel.RESTRICTED)
-    cache_key1 = f"{settings.LOBBY_KEY_PREFIX}_{room.id!s}_participant1"
-    cache_key2 = f"{settings.LOBBY_KEY_PREFIX}_{room.id!s}_participant2"
+    cache_key1 = f"{django_settings.LOBBY_KEY_PREFIX}_{room.id!s}_participant1"
+    cache_key2 = f"{django_settings.LOBBY_KEY_PREFIX}_{room.id!s}_participant2"
 
     participant1 = {
         "status": "waiting",
@@ -797,7 +779,7 @@ def test_handle_participant_entry_allow(mock_update, lobby_service, participant_
         room.id,
         participant_id,
         status=LobbyParticipantStatus.ACCEPTED,
-        timeout=settings.LOBBY_ACCEPTED_TIMEOUT,
+        timeout=django_settings.LOBBY_ACCEPTED_TIMEOUT,
     )
 
 
@@ -811,7 +793,7 @@ def test_handle_participant_entry_deny(mock_update, lobby_service, participant_i
         room.id,
         participant_id,
         status=LobbyParticipantStatus.DENIED,
-        timeout=settings.LOBBY_DENIED_TIMEOUT,
+        timeout=django_settings.LOBBY_DENIED_TIMEOUT,
     )
 
 
@@ -958,12 +940,12 @@ def test_clear_room_empty(settings, lobby_service):
     assert cache.keys(f"test-lobby_{room_id!s}_*") == []
 
 
-def test_clear_participant_cache(lobby_service):
+def test_clear_participant_cache(lobby_service, settings):
     """Test clearing a specific participant entry from cache."""
     room_id = uuid.uuid4()
     participant_id = "test-participant-id"
 
-    cache_key = f"{settings.LOBBY_KEY_PREFIX}_{room_id!s}_{participant_id}"
+    cache_key = f"{django_settings.LOBBY_KEY_PREFIX}_{room_id!s}_{participant_id}"
     participant_data = {
         "status": "waiting",
         "username": "test-username",
@@ -986,7 +968,7 @@ def test_clear_participant_cache_nonexistent(lobby_service):
     room_id = uuid.uuid4()
     participant_id = "nonexistent-participant"
 
-    cache_key = f"{settings.LOBBY_KEY_PREFIX}_{room_id!s}_{participant_id}"
+    cache_key = f"{django_settings.LOBBY_KEY_PREFIX}_{room_id!s}_{participant_id}"
     assert cache.get(cache_key) is None
 
     lobby_service.clear_participant_cache(room_id, participant_id)
@@ -994,7 +976,7 @@ def test_clear_participant_cache_nonexistent(lobby_service):
     assert cache.get(cache_key) is None
 
 
-def test_index_add_members_remove_roundtrip(lobby_service):
+def test_index_add_members_remove_roundtrip(lobby_service, settings):
     """The room index records, lists and forgets participant ids."""
     room_id = uuid.uuid4()
 
@@ -1023,9 +1005,10 @@ def test_enter_registers_participant_in_room_index(
     """Entering the lobby must index the participant id for the room."""
     room_id = uuid.uuid4()
 
-    lobby_service.enter(room_id, participant_id, username)
+    participant = lobby_service._create_participant(username)
+    lobby_service._save_participant(room_id, participant)
 
-    assert lobby_service._index_members(room_id) == frozenset([participant_id])
+    assert lobby_service._index_members(room_id) == frozenset([participant.id])
 
 
 def test_list_waiting_participants_prunes_stale_index_ids(settings, lobby_service):
@@ -1074,3 +1057,70 @@ def test_refresh_waiting_status_rearms_room_index_ttl(lobby_service, participant
 
     assert redis_client.ttl(index_key) > 10
     assert lobby_service._index_members(room_id) == frozenset([participant_id])
+
+
+@pytest.mark.parametrize(
+    "cached_status",
+    [None, LobbyParticipantStatus.WAITING, LobbyParticipantStatus.ACCEPTED],
+)
+def test_bypass_clears_lobby_admission_before_room_becomes_restricted(
+    lobby_service, cached_status
+):
+    """Bypass writes no admission; later restricted entry requires approval."""
+    room = RoomFactory(access_level=RoomAccessLevel.PUBLIC)
+    user = AnonymousUser()
+    participant_id = None
+    if cached_status is not None:
+        participant_id = str(uuid.uuid4())
+        participant = LobbyParticipant(
+            status=cached_status,
+            username="Guest",
+            id=participant_id,
+            color="#123456",
+            entered_at="2025-01-01T10:00:00+00:00",
+        )
+        lobby_service._save_participant(room.id, participant)
+
+    with (
+        mock.patch.object(
+            utils, "generate_livekit_config", return_value={"token": "test"}
+        ) as generate_config,
+        mock.patch.object(lobby_service, "_notify_entry_request") as notify,
+        mock.patch.object(
+            lobby_service, "_save_participant", wraps=lobby_service._save_participant
+        ) as save,
+        mock.patch.object(
+            lobby_service,
+            "clear_participant_cache",
+            wraps=lobby_service.clear_participant_cache,
+        ) as clear,
+    ):
+        admitted, config = lobby_service.request_entry(
+            room, user, "Guest", participant_id=participant_id
+        )
+        assert admitted.status == LobbyParticipantStatus.ACCEPTED
+        assert config == {"token": "test"}
+        assert lobby_service._get_participant(room.id, admitted.id) is None
+        assert admitted.id not in lobby_service._index_members(room.id)
+        notify.assert_not_called()
+        save.assert_not_called()
+        if cached_status is None:
+            clear.assert_not_called()
+        else:
+            clear.assert_called_once_with(room.id, participant_id)
+
+        room.access_level = RoomAccessLevel.RESTRICTED
+        generate_config.reset_mock()
+        waiting, config = lobby_service.request_entry(
+            room, user, "Guest", participant_id=admitted.id
+        )
+
+        assert waiting.status == LobbyParticipantStatus.WAITING
+        assert config is None
+        generate_config.assert_not_called()
+        notify.assert_called_once_with(str(room.id))
+        save.assert_called_once_with(room.id, waiting)
+        cached = lobby_service._get_participant(room.id, waiting.id)
+        assert cached is not None
+        assert cached.status == LobbyParticipantStatus.WAITING
+        assert waiting.id in lobby_service._index_members(room.id)

src/backend/core/tests/services/test_transit_code.py

@@ -0,0 +1,58 @@
+"""
+Unit tests for the TransitCodeService.
+"""
+
+from unittest.mock import patch
+
+import pytest
+
+from core.factories import UserFactory
+from core.services.transit_code import TransitCodeService
+
+pytestmark = pytest.mark.django_db
+
+
+def test_create_code_returns_unique_opaque_codes():
+    """Each created code should be a distinct high-entropy string."""
+    user = UserFactory()
+    service = TransitCodeService()
+
+    codes = {service.create_code(user) for _ in range(5)}
+
+    assert len(codes) == 5
+    for code in codes:
+        assert len(code) >= 43
+
+
+def test_consume_code_returns_stored_data_once():
+    """Consuming a code should return its data exactly once."""
+    user = UserFactory()
+    service = TransitCodeService()
+
+    code = service.create_code(user, client_id="my-app")
+
+    assert service.consume_code(code) == {
+        "user_id": str(user.id),
+        "client_id": "my-app",
+    }
+    # Single use: a second consumption fails
+    assert service.consume_code(code) is None
+
+
+def test_consume_code_unknown_or_empty():
+    """Unknown or empty codes should not be consumable."""
+    service = TransitCodeService()
+
+    assert service.consume_code("unknown-code") is None
+    assert service.consume_code("") is None
+    assert service.consume_code(None) is None
+
+
+@patch("core.services.transit_code.cache.delete", return_value=False)
+def test_consume_code_returns_none_when_delete_loses_the_race(mock_delete):
+    """If the code was already deleted by a concurrent request, consumption fails."""
+    user = UserFactory()
+    service = TransitCodeService()
+    code = service.create_code(user, client_id="my-app")
+    assert service.consume_code(code) is None
+    mock_delete.assert_called_once()

src/backend/core/tests/test_api_user_access_token_authentication.py

@@ -0,0 +1,270 @@
+"""
+Tests for user access JWT authentication on the core API.
+
+The token authenticates the user on the whole API, exactly like a session
+cookie would (similar to lib-jitsi-meet's token authentication): the
+existing role-based permissions apply unchanged. Room endpoint coverage
+with a user access token lives in the room test files.
+"""
+
+from datetime import datetime, timedelta, timezone
+
+from django.conf import settings as django_settings
+
+import jwt
+import pytest
+from rest_framework.test import APIClient
+
+from core.factories import ApplicationFactory, RoomFactory, UserFactory
+from core.models import ApplicationScope, RoleChoices
+
+pytestmark = pytest.mark.django_db
+
+
+def generate_user_access_token(user, application=None, **overrides):
+    """Generate a valid user access JWT signed with the token secret."""
+    now = datetime.now(timezone.utc)
+
+    if application is None:
+        application = ApplicationFactory(scopes=[ApplicationScope.USERS_SESSION])
+
+    payload = {
+        "iss": django_settings.USER_ACCESS_TOKEN_ISSUER,
+        "aud": django_settings.USER_ACCESS_TOKEN_AUDIENCE,
+        "iat": now,
+        "exp": now + timedelta(seconds=django_settings.USER_ACCESS_TOKEN_TTL),
+        "user_id": str(user.id),
+        "token_type": "user_access",
+        "client_id": application.client_id,
+        "scope": "user:access",
+    }
+    payload.update(overrides)
+    payload = {key: value for key, value in payload.items() if value is not None}
+
+    return jwt.encode(
+        payload,
+        django_settings.USER_ACCESS_TOKEN_SECRET_KEY,
+        algorithm=django_settings.USER_ACCESS_TOKEN_ALG,
+    )
+
+
+def test_user_access_token_users_me():
+    """A user access token should authenticate the user on /users/me/."""
+    user = UserFactory()
+
+    client = APIClient()
+    client.credentials(HTTP_AUTHORIZATION=f"Bearer {generate_user_access_token(user)}")
+
+    response = client.get("/api/v1.0/users/me/")
+
+    assert response.status_code == 200
+    assert response.data["email"] == user.email
+
+
+def test_user_access_token_expired():
+    """An expired user access token should be rejected."""
+    user = UserFactory()
+
+    now = datetime.now(timezone.utc)
+    token = generate_user_access_token(
+        user,
+        iat=now - timedelta(hours=3),
+        exp=now - timedelta(hours=1),
+    )
+    client = APIClient()
+    client.credentials(HTTP_AUTHORIZATION=f"Bearer {token}")
+
+    response = client.get("/api/v1.0/users/me/")
+
+    assert response.status_code == 401
+    assert "token expired" in str(response.data).lower()
+
+
+def test_user_access_token_wrong_token_type():
+    """A verified token with the wrong 'token_type' claim should be rejected."""
+    user = UserFactory()
+
+    token = generate_user_access_token(user, token_type="addons")
+    client = APIClient()
+    client.credentials(HTTP_AUTHORIZATION=f"Bearer {token}")
+
+    response = client.get("/api/v1.0/users/me/")
+
+    assert response.status_code == 401
+    assert "invalid token type" in str(response.data).lower()
+
+
+def test_user_access_token_invalid_signature():
+    """A token signed with the wrong key should defer and end unauthenticated."""
+    user = UserFactory()
+
+    now = datetime.now(timezone.utc)
+    token = jwt.encode(
+        {
+            "iss": django_settings.USER_ACCESS_TOKEN_ISSUER,
+            "aud": django_settings.USER_ACCESS_TOKEN_AUDIENCE,
+            "iat": now,
+            "exp": now + timedelta(seconds=600),
+            "user_id": str(user.id),
+            "token_type": "user_access",
+            "client_id": "test-app",
+        },
+        "wrong-secret-key-padded-for-minimum-len!",
+        algorithm=django_settings.USER_ACCESS_TOKEN_ALG,
+    )
+    client = APIClient()
+    client.credentials(HTTP_AUTHORIZATION=f"Bearer {token}")
+
+    # UserAccessJWTAuthentication defers, session auth finds no session
+    response = client.get("/api/v1.0/users/me/")
+
+    assert response.status_code == 401
+
+
+def test_user_access_token_missing_client_id_claim():
+    """A token without the issuance-audit claim should be rejected."""
+    user = UserFactory()
+
+    token = generate_user_access_token(user, client_id=None)
+    client = APIClient()
+    client.credentials(HTTP_AUTHORIZATION=f"Bearer {token}")
+
+    response = client.get("/api/v1.0/users/me/")
+
+    assert response.status_code == 401
+    assert "invalid token claims" in str(response.data).lower()
+
+
+def test_user_access_token_inactive_user():
+    """A user access token for an inactive user should be rejected."""
+    user = UserFactory(is_active=False)
+
+    client = APIClient()
+    client.credentials(HTTP_AUTHORIZATION=f"Bearer {generate_user_access_token(user)}")
+
+    response = client.get("/api/v1.0/users/me/")
+
+    assert response.status_code == 401
+
+
+def test_user_access_token_feature_disabled(settings):
+    """When the feature is disabled, user access tokens should be ignored."""
+    settings.USER_ACCESS_TOKEN_ENABLED = False
+
+    user = UserFactory()
+
+    client = APIClient()
+    client.credentials(HTTP_AUTHORIZATION=f"Bearer {generate_user_access_token(user)}")
+
+    response = client.get("/api/v1.0/users/me/")
+
+    assert response.status_code == 401
+
+
+def test_user_access_token_does_not_break_session_authentication():
+    """A session-authenticated user should keep full access to the API."""
+    user = UserFactory()
+    RoomFactory(users=[(user, RoleChoices.OWNER)])
+
+    client = APIClient()
+    client.force_login(user)
+    response = client.get("/api/v1.0/rooms/")
+
+    assert response.status_code == 200
+    assert response.data["count"] == 1
+
+
+def test_user_access_token_application_jwt_not_accepted_on_core_api():
+    """An application-delegation JWT must not authenticate on the core API."""
+    user = UserFactory()
+
+    now = datetime.now(timezone.utc)
+    token = jwt.encode(
+        {
+            "iss": django_settings.APPLICATION_JWT_ISSUER,
+            "aud": django_settings.APPLICATION_JWT_AUDIENCE,
+            "iat": now,
+            "exp": now + timedelta(seconds=600),
+            "user_id": str(user.id),
+            "client_id": "some-client",
+            "delegated": True,
+            "scope": "rooms:retrieve",
+        },
+        django_settings.APPLICATION_JWT_SECRET_KEY,
+        algorithm=django_settings.APPLICATION_JWT_ALG,
+    )
+    client = APIClient()
+    client.credentials(HTTP_AUTHORIZATION=f"Bearer {token}")
+
+    # The user token backend must defer (wrong signature) and the request
+    # must end up unauthenticated.
+    response = client.get("/api/v1.0/users/me/")
+
+    assert response.status_code == 401
+
+
+def test_user_access_token_application_scope_revoked():
+    """Revoking the application's grant invalidates its outstanding tokens."""
+    user = UserFactory()
+    application = ApplicationFactory(scopes=[ApplicationScope.USERS_SESSION])
+
+    token = generate_user_access_token(user, application=application)
+
+    application.scopes = []
+    application.save()
+
+    client = APIClient()
+    client.credentials(HTTP_AUTHORIZATION=f"Bearer {token}")
+    response = client.get("/api/v1.0/users/me/")
+
+    assert response.status_code == 401
+    assert "application access revoked" in str(response.data).lower()
+
+
+def test_user_access_token_application_deactivated():
+    """Deactivating the application invalidates its outstanding tokens."""
+    user = UserFactory()
+    application = ApplicationFactory(scopes=[ApplicationScope.USERS_SESSION])
+
+    token = generate_user_access_token(user, application=application)
+
+    application.is_active = False
+    application.save()
+
+    client = APIClient()
+    client.credentials(HTTP_AUTHORIZATION=f"Bearer {token}")
+    response = client.get("/api/v1.0/users/me/")
+
+    assert response.status_code == 401
+    assert "application access revoked" in str(response.data).lower()
+
+
+def test_user_access_token_unknown_application():
+    """A token whose client_id matches no application is refused."""
+    user = UserFactory()
+
+    token = generate_user_access_token(user, client_id="not-an-application")
+    client = APIClient()
+    client.credentials(HTTP_AUTHORIZATION=f"Bearer {token}")
+
+    response = client.get("/api/v1.0/users/me/")
+
+    assert response.status_code == 401
+    assert "application access revoked" in str(response.data).lower()
+
+
+def test_user_access_token_does_not_override_existing_session():
+    """A Bearer token must not override the identity of a live session."""
+    session_user = UserFactory()
+    token_user = UserFactory()
+
+    client = APIClient()
+    client.force_login(session_user)
+    client.credentials(
+        HTTP_AUTHORIZATION=f"Bearer {generate_user_access_token(token_user)}"
+    )
+
+    response = client.get("/api/v1.0/users/me/")
+
+    assert response.status_code == 200
+    assert response.data["email"] == session_user.email

src/backend/core/tests/test_api_users_exchange_access_token.py

@@ -0,0 +1,262 @@
+"""
+Test users API endpoints in the Meet core app: exchange transit code.
+"""
+
+# pylint: disable=W0621
+
+import secrets
+
+import jwt
+import pytest
+from rest_framework.test import APIClient
+
+from core.factories import ApplicationFactory, UserFactory
+from core.models import ApplicationScope
+from core.services.transit_code import TransitCodeService
+
+pytestmark = pytest.mark.django_db
+
+
+def decode_user_access_token(token, settings):
+    """Decode a user access token with the token secret."""
+    return jwt.decode(
+        token,
+        settings.USER_ACCESS_TOKEN_SECRET_KEY,
+        algorithms=[settings.USER_ACCESS_TOKEN_ALG],
+        issuer=settings.USER_ACCESS_TOKEN_ISSUER,
+        audience=settings.USER_ACCESS_TOKEN_AUDIENCE,
+    )
+
+
+def generate_unknown_code(settings):
+    """Generate a well-formed code that was never stored."""
+    return secrets.token_urlsafe(settings.TRANSIT_CODE_NBYTES)
+
+
+@pytest.fixture
+def client():
+    """Return an anonymous API client with a random source IP.
+
+    A fresh IP per test isolates the anonymous throttle history, both
+    between the tests of this module and between test runs.
+    """
+    # `secrets` rather than `random`: the global random module is seeded
+    # deterministically by the factories, its sequence repeats across runs.
+    remote_addr = (
+        f"10.{secrets.randbelow(256)}.{secrets.randbelow(256)}"
+        f".{secrets.randbelow(254) + 1}"
+    )
+    return APIClient(REMOTE_ADDR=remote_addr)
+
+
+def test_exchange_access_token_missing_code(client):
+    """The exchange endpoint should validate its input."""
+    response = client.post("/api/v1.0/users/exchange-access-token/")
+
+    assert response.status_code == 400
+    assert "code" in response.data
+
+
+def test_exchange_access_token_get_method(client):
+    """The exchange endpoint should not accept GET."""
+
+    response = client.get("/api/v1.0/users/exchange-access-token/")
+    assert response.status_code == 405
+
+
+def test_exchange_access_token_malformed_code(client):
+    """A code whose length cannot match a generated one should be a 400."""
+    response = client.post(
+        "/api/v1.0/users/exchange-access-token/",
+        {"code": "not-a-valid-code"},
+    )
+
+    assert response.status_code == 400
+    assert "invalid transit code format" in str(response.data).lower()
+
+
+def test_exchange_access_token_unknown_code(client, settings):
+    """A well-formed but unknown code should be denied."""
+    response = client.post(
+        "/api/v1.0/users/exchange-access-token/",
+        {"code": generate_unknown_code(settings)},
+    )
+
+    assert response.status_code == 403
+    assert "invalid, expired or already used" in str(response.data).lower()
+
+
+def test_exchange_access_token_success(client, settings):
+    """A valid transit code should be exchangeable for an access token."""
+    user = UserFactory()
+
+    application = ApplicationFactory(scopes=[ApplicationScope.USERS_SESSION])
+    code = TransitCodeService().create_code(user, client_id=application.client_id)
+
+    response = client.post("/api/v1.0/users/exchange-access-token/", {"code": code})
+
+    assert response.status_code == 200
+    assert response.data["token_type"] == settings.USER_ACCESS_TOKEN_TYPE
+    assert response.data["expires_in"] == settings.USER_ACCESS_TOKEN_TTL
+    assert response.data["scope"] == "user:access"
+
+    payload = decode_user_access_token(response.data["access_token"], settings)
+    assert payload["user_id"] == str(user.id)
+    assert payload["client_id"] == application.client_id
+    assert payload["exp"] - payload["iat"] == settings.USER_ACCESS_TOKEN_TTL
+
+
+def test_exchange_access_token_single_use(client):
+    """A transit code should be exchangeable exactly once."""
+    user = UserFactory()
+
+    application = ApplicationFactory(scopes=[ApplicationScope.USERS_SESSION])
+    code = TransitCodeService().create_code(user, client_id=application.client_id)
+
+    response = client.post("/api/v1.0/users/exchange-access-token/", {"code": code})
+    assert response.status_code == 200
+
+    # Replaying the same code must be denied
+    response = client.post("/api/v1.0/users/exchange-access-token/", {"code": code})
+    assert response.status_code == 403
+    assert "invalid, expired or already used" in str(response.data).lower()
+
+
+def test_exchange_access_token_inactive_user(client):
+    """A code minted for a now-inactive user should be denied."""
+    user = UserFactory()
+
+    application = ApplicationFactory(scopes=[ApplicationScope.USERS_SESSION])
+    code = TransitCodeService().create_code(user, client_id=application.client_id)
+
+    user.is_active = False
+    user.save()
+
+    response = client.post("/api/v1.0/users/exchange-access-token/", {"code": code})
+
+    assert response.status_code == 403
+    assert "no longer access" in str(response.data).lower()
+
+
+def test_exchange_access_token_feature_disabled(client, settings):
+    """The exchange endpoint should return 404 when the feature is disabled."""
+    settings.USER_ACCESS_TOKEN_ENABLED = False
+
+    user = UserFactory()
+    application = ApplicationFactory(scopes=[ApplicationScope.USERS_SESSION])
+    code = TransitCodeService().create_code(user, client_id=application.client_id)
+
+    response = client.post("/api/v1.0/users/exchange-access-token/", {"code": code})
+
+    assert response.status_code == 404
+
+
+def test_exchange_access_token_throttled(client, settings):
+    """Anonymous exchange attempts should be rate limited."""
+    throttle_rates = settings.REST_FRAMEWORK["DEFAULT_THROTTLE_RATES"]
+    initial_rate = throttle_rates["exchange_access_token"]
+    # The rates dict is mutated in place: restore it explicitly, the
+    # `settings` fixture only rolls back attribute assignments.
+    throttle_rates["exchange_access_token"] = "2/minute"
+
+    try:
+        for _ in range(2):
+            response = client.post(
+                "/api/v1.0/users/exchange-access-token/",
+                {"code": generate_unknown_code(settings)},
+            )
+            assert response.status_code == 403
+
+        response = client.post(
+            "/api/v1.0/users/exchange-access-token/",
+            {"code": generate_unknown_code(settings)},
+        )
+        assert response.status_code == 429
+    finally:
+        throttle_rates["exchange_access_token"] = initial_rate
+
+
+def test_exchange_access_token_refused_when_already_authenticated(client):
+    """A session-authenticated browser must not exchange a transit code."""
+    user = UserFactory()
+    session_user = UserFactory()
+
+    application = ApplicationFactory(scopes=[ApplicationScope.USERS_SESSION])
+    code = TransitCodeService().create_code(user, client_id=application.client_id)
+
+    client.force_login(session_user)
+    response = client.post("/api/v1.0/users/exchange-access-token/", {"code": code})
+
+    assert response.status_code == 403
+    assert "already authenticated" in str(response.data).lower()
+
+    # The code was not consumed: it stays valid for its intended,
+    # cookieless embedded context.
+    client.logout()
+    response = client.post("/api/v1.0/users/exchange-access-token/", {"code": code})
+    assert response.status_code == 200
+
+
+def test_exchange_access_token_application_scope_revoked(client):
+    """A code is refused once the application's grant is revoked."""
+    user = UserFactory()
+
+    application = ApplicationFactory(scopes=[ApplicationScope.USERS_SESSION])
+    code = TransitCodeService().create_code(user, client_id=application.client_id)
+
+    application.scopes = []
+    application.save()
+
+    response = client.post("/api/v1.0/users/exchange-access-token/", {"code": code})
+
+    assert response.status_code == 403
+    assert "no longer create user sessions" in str(response.data).lower()
+
+
+def test_exchange_access_token_application_deactivated(client):
+    """A code is refused once the application is disabled."""
+    user = UserFactory()
+
+    application = ApplicationFactory(scopes=[ApplicationScope.USERS_SESSION])
+    code = TransitCodeService().create_code(user, client_id=application.client_id)
+
+    application.is_active = False
+    application.save()
+
+    response = client.post("/api/v1.0/users/exchange-access-token/", {"code": code})
+
+    assert response.status_code == 403
+    assert "no longer create user sessions" in str(response.data).lower()
+
+
+def test_exchange_access_token_unknown_application(client):
+    """A code whose client_id matches no application is refused."""
+    user = UserFactory()
+
+    code = TransitCodeService().create_code(user, client_id="not-an-application")
+
+    response = client.post("/api/v1.0/users/exchange-access-token/", {"code": code})
+
+    assert response.status_code == 403
+    assert "no longer create user sessions" in str(response.data).lower()
+
+
+def test_exchange_access_token_end_to_end(client):
+    """A token obtained from the exchange must authenticate on the core API.
+
+    Regression test: token issuance and token validation must stay in
+    sync on the claims they set and require (e.g. 'token_type').
+    """
+    user = UserFactory()
+    application = ApplicationFactory(scopes=[ApplicationScope.USERS_SESSION])
+    code = TransitCodeService().create_code(user, client_id=application.client_id)
+
+    response = client.post("/api/v1.0/users/exchange-access-token/", {"code": code})
+    assert response.status_code == 200
+
+    api_client = APIClient()
+    api_client.credentials(HTTP_AUTHORIZATION=f"Bearer {response.data['access_token']}")
+    me = api_client.get("/api/v1.0/users/me/")
+
+    assert me.status_code == 200
+    assert me.data["email"] == user.email

src/backend/core/tests/test_dockerflow.py

@@ -1,78 +0,0 @@
-"""Tests for the Dockerflow health endpoints backing the Kubernetes probes."""
-
-from unittest import mock
-
-from django.core import checks
-from django.test.utils import override_settings
-
-import pytest
-from dockerflow.django.views import django_check_registry
-
-pytestmark = pytest.mark.django_db
-
-
-@pytest.mark.parametrize("path", ["/__lbheartbeat__", "/__heartbeat__"])
-def test_dockerflow_endpoints_are_anonymous(client, path):
-    """Both endpoints answer without authentication."""
-    response = client.get(path)
-
-    assert response.status_code == 200
-
-
-def test_dockerflow_lbheartbeat_is_a_liveness_signal(client, django_assert_num_queries):
-    """The load balancer heartbeat answers 200 without touching the database."""
-    with django_assert_num_queries(0):
-        response = client.get("/__lbheartbeat__")
-
-    assert response.status_code == 200
-
-
-def test_dockerflow_lbheartbeat_ignores_allowed_hosts(client):
-    """The probes are served before ALLOWED_HOSTS is enforced."""
-    response = client.get("/__lbheartbeat__", headers={"host": "1.2.3.4:8000"})
-
-    assert response.status_code == 200
-
-
-def test_dockerflow_heartbeat_reports_the_configured_checks(client):
-    """The heartbeat runs the database, migrations and redis checks."""
-    with override_settings(DEBUG=True):
-        response = client.get("/__heartbeat__")
-
-    assert response.status_code == 200
-
-    payload = response.json()
-    assert payload["status"] == "ok"
-    assert payload["details"] == {}
-    assert payload["checks"]["check_database_connected"] == "ok"
-    assert payload["checks"]["check_migrations_applied"] == "ok"
-
-
-def test_dockerflow_heartbeat_is_a_readiness_signal(client):
-    """A check reporting an error takes the heartbeat down with a 500."""
-
-    def failing_check(**kwargs):
-        return [checks.Error("Could not connect to database", id="health.E001")]
-
-    with mock.patch.object(
-        django_check_registry, "get_checks", return_value=[failing_check]
-    ):
-        response = client.get("/__heartbeat__")
-
-    assert response.status_code == 500
-    assert response.json()["status"] == "error"
-
-
-def test_dockerflow_heartbeat_tolerates_warnings(client):
-    """A warning in the check should not affect the probes."""
-
-    def warning_check(**kwargs):
-        return [checks.Warning("Unapplied migration", id="health.W001")]
-
-    with mock.patch.object(
-        django_check_registry, "get_checks", return_value=[warning_check]
-    ):
-        response = client.get("/__heartbeat__")
-
-    assert response.status_code == 200
-    assert response.json()["status"] == "warning"

src/backend/core/tests/test_external_api_users.py

@@ -0,0 +1,209 @@
+"""
+Tests for external API /users endpoints (transit codes)
+"""
+
+# pylint: disable=W0621
+
+from datetime import datetime, timedelta, timezone
+from unittest import mock
+
+from django.conf import settings as django_settings
+
+import jwt
+import pytest
+from lasuite.oidc_resource_server.authentication import ResourceServerAuthentication
+from rest_framework.test import APIClient
+
+from core.factories import ApplicationFactory, UserFactory
+from core.models import ApplicationScope
+from core.services.transit_code import TransitCodeService
+
+pytestmark = pytest.mark.django_db
+
+
+def generate_addons_test_token(user, scopes):
+    """Generate a valid JWT token signed with the addons secret for testing."""
+    now = datetime.now(timezone.utc)
+
+    payload = {
+        "iss": django_settings.ADDONS_TOKEN_ISSUER,
+        "aud": django_settings.ADDONS_TOKEN_AUDIENCE,
+        "iat": now,
+        "exp": now + timedelta(seconds=django_settings.ADDONS_TOKEN_TTL),
+        "scope": " ".join(scopes),
+        "user_id": str(user.id),
+    }
+
+    return jwt.encode(
+        payload,
+        django_settings.ADDONS_TOKEN_SECRET_KEY,
+        algorithm=django_settings.ADDONS_TOKEN_ALG,
+    )
+
+
+def generate_test_token(user, scopes, application=None):
+    """Generate a valid application JWT token for testing."""
+    now = datetime.now(timezone.utc)
+    scope_string = " ".join(scopes)
+
+    if application is None:
+        application = ApplicationFactory(scopes=scopes)
+
+    payload = {
+        "iss": django_settings.APPLICATION_JWT_ISSUER,
+        "aud": django_settings.APPLICATION_JWT_AUDIENCE,
+        "iat": now,
+        "exp": now
+        + timedelta(seconds=django_settings.APPLICATION_JWT_EXPIRATION_SECONDS),
+        "client_id": str(application.client_id),
+        "scope": scope_string,
+        "user_id": str(user.id),
+        "delegated": True,
+    }
+
+    return jwt.encode(
+        payload,
+        django_settings.APPLICATION_JWT_SECRET_KEY,
+        algorithm=django_settings.APPLICATION_JWT_ALG,
+    )
+
+
+def test_api_users_transit_code_requires_authentication():
+    """Minting a transit code without authentication should return 401."""
+    client = APIClient()
+    response = client.post("/external-api/v1.0/users/transit-code/")
+
+    assert response.status_code == 401
+
+
+def test_api_users_transit_code_missing_scope():
+    """A token without the 'users:session' scope should be rejected."""
+    user = UserFactory()
+
+    token = generate_test_token(user, [ApplicationScope.ROOMS_RETRIEVE])
+
+    client = APIClient()
+    client.credentials(HTTP_AUTHORIZATION=f"Bearer {token}")
+    response = client.post("/external-api/v1.0/users/transit-code/")
+
+    assert response.status_code == 403
+    assert "users:session" in str(response.data)
+
+
+def test_api_users_transit_code_success(settings):
+    """A delegated user with the scope should be able to mint a transit code."""
+    user = UserFactory()
+
+    token = generate_test_token(user, [ApplicationScope.USERS_SESSION])
+
+    client = APIClient()
+    client.credentials(HTTP_AUTHORIZATION=f"Bearer {token}")
+    response = client.post("/external-api/v1.0/users/transit-code/")
+
+    assert response.status_code == 200
+    assert response.data["expires_in"] == settings.TRANSIT_CODE_TTL
+
+    code = response.data["transit_code"]
+    # Opaque, high-entropy random string
+    assert len(code) == (4 * settings.TRANSIT_CODE_NBYTES + 2) // 3
+
+    # The code is stored server-side and references the delegated user
+    code_data = TransitCodeService().consume_code(code)
+    assert code_data == {
+        "user_id": str(user.id),
+        "client_id": mock.ANY,
+    }
+
+
+def test_api_users_transit_code_scope_claim_exceeding_db_grant():
+    """A 'users:session' claim beyond the grant recorded in database is refused."""
+    user = UserFactory()
+    application = ApplicationFactory(scopes=[ApplicationScope.ROOMS_RETRIEVE])
+
+    token = generate_test_token(
+        user, [ApplicationScope.USERS_SESSION], application=application
+    )
+
+    client = APIClient()
+    client.credentials(HTTP_AUTHORIZATION=f"Bearer {token}")
+    response = client.post("/external-api/v1.0/users/transit-code/")
+
+    assert response.status_code == 403
+    assert "not granted" in str(response.data)
+
+
+def test_api_users_transit_code_get_forbidden():
+    """Minting a transit code with a GET should not be allowed."""
+    user = UserFactory()
+
+    token = generate_test_token(user, [ApplicationScope.USERS_SESSION])
+
+    client = APIClient()
+    client.credentials(HTTP_AUTHORIZATION=f"Bearer {token}")
+    response = client.get("/external-api/v1.0/users/transit-code/")
+
+    assert response.status_code == 405
+
+
+def test_api_users_transit_code_resource_server_not_supported():
+    """A resource server token must not be able to mint a transit code."""
+    user = UserFactory()
+
+    with mock.patch.object(
+        ResourceServerAuthentication,
+        "authenticate",
+        return_value=(user, {"scope": "users:session", "client_id": "rs-client"}),
+    ) as mock_rs_authenticate:
+        client = APIClient()
+        client.credentials(HTTP_AUTHORIZATION="Bearer some-opaque-rs-token")
+        response = client.post("/external-api/v1.0/users/transit-code/")
+
+    assert response.status_code == 401
+    mock_rs_authenticate.assert_not_called()
+
+
+def test_api_users_transit_code_feature_disabled(settings):
+    """Minting a transit code should return 404 when the feature is disabled."""
+    settings.USER_ACCESS_TOKEN_ENABLED = False
+
+    user = UserFactory()
+    token = generate_test_token(user, [ApplicationScope.USERS_SESSION])
+
+    client = APIClient()
+    client.credentials(HTTP_AUTHORIZATION=f"Bearer {token}")
+    response = client.post("/external-api/v1.0/users/transit-code/")
+
+    assert response.status_code == 404
+
+
+def test_api_users_transit_code_inactive_user():
+    """An inactive user should not be able to mint a transit code."""
+    user = UserFactory(is_active=False)
+
+    token = generate_test_token(user, [ApplicationScope.USERS_SESSION])
+
+    client = APIClient()
+    client.credentials(HTTP_AUTHORIZATION=f"Bearer {token}")
+    response = client.post("/external-api/v1.0/users/transit-code/")
+
+    assert response.status_code == 401
+
+
+def test_api_users_transit_code_rejects_addons_token():
+    """An addons token must not be able to mint a transit code.
+
+    The token carries the 'users:session' scope and is signed with the addons
+    secret, so only the missing backend stands between it and a transit code.
+    """
+    user = UserFactory()
+    token = generate_addons_test_token(user, [ApplicationScope.USERS_SESSION])
+
+    client = APIClient()
+    client.credentials(HTTP_AUTHORIZATION=f"Bearer {token}")
+
+    with mock.patch.object(
+        ResourceServerAuthentication, "authenticate", return_value=None
+    ):
+        response = client.post("/external-api/v1.0/users/transit-code/")
+
+    assert response.status_code == 401

src/backend/core/tests/test_models_recording.py

@@ -157,7 +157,6 @@ def test_models_recording_is_savable_normal():
 @pytest.mark.parametrize(
     "status",
     [
-        RecordingStatusChoices.FAILED,
         RecordingStatusChoices.FAILED_TO_STOP,
         RecordingStatusChoices.FAILED_TO_START,
         RecordingStatusChoices.ABORTED,
@@ -280,7 +279,6 @@ def test_models_recording_is_saved_false_initiated():
 @pytest.mark.parametrize(
     "status",
     [
-        RecordingStatusChoices.FAILED,
         RecordingStatusChoices.FAILED_TO_STOP,
         RecordingStatusChoices.FAILED_TO_START,
         RecordingStatusChoices.ABORTED,

src/backend/core/tests/test_models_rooms.py

@@ -92,12 +92,6 @@ def test_models_rooms_access_level_default():
     assert room.access_level == RoomAccessLevel.PUBLIC
 
 
-def test_models_rooms_last_started_at_default():
-    """Should have no last access date until the room is started."""
-    room = Room.objects.create(name="room")
-    assert room.last_started_at is None
-
-
 # Access rights methods
 
 

src/backend/core/urls.py

@@ -48,6 +48,11 @@ external_router.register(
     external_viewsets.RoomViewSet,
     basename="external_room",
 )
+external_router.register(
+    "users",
+    external_viewsets.UserViewSet,
+    basename="external_user",
+)
 
 urlpatterns = [
     path(

src/backend/meet/settings.py

@@ -287,7 +287,6 @@ class Base(Configuration):
 
     MIDDLEWARE = [
         "django.middleware.security.SecurityMiddleware",
-        "dockerflow.django.middleware.DockerflowMiddleware",
         "whitenoise.middleware.WhiteNoiseMiddleware",
         "django.contrib.sessions.middleware.SessionMiddleware",
         "django.middleware.locale.LocaleMiddleware",
@@ -297,6 +296,7 @@ class Base(Configuration):
         "django.middleware.csrf.CsrfViewMiddleware",
         "django.contrib.auth.middleware.AuthenticationMiddleware",
         "django.contrib.messages.middleware.MessageMiddleware",
+        "dockerflow.django.middleware.DockerflowMiddleware",
     ]
 
     AUTHENTICATION_BACKENDS = [
@@ -347,6 +347,7 @@ class Base(Configuration):
     REST_FRAMEWORK = {
         "DEFAULT_AUTHENTICATION_CLASSES": (
             "core.authentication.backends.SessionAuthenticationWith401",
+            "core.authentication.user_token.UserAccessJWTAuthentication",
         ),
         "DEFAULT_PARSER_CLASSES": [
             "rest_framework.parsers.JSONParser",
@@ -366,6 +367,11 @@ class Base(Configuration):
                 environ_name="REQUEST_ENTRY_THROTTLE_RATES",
                 environ_prefix=None,
             ),
+            "exchange_access_token": values.Value(
+                default="30/minute",
+                environ_name="EXCHANGE_ACCESS_TOKEN_THROTTLE_RATES",
+                environ_prefix=None,
+            ),
             "creation_callback": values.Value(
                 default="600/minute",
                 environ_name="CREATION_CALLBACK_THROTTLE_RATES",
@@ -730,9 +736,6 @@ class Base(Configuration):
     ALLOW_UNREGISTERED_ROOMS = values.BooleanValue(
         True, environ_name="ALLOW_UNREGISTERED_ROOMS", environ_prefix=None
     )
-    ROOM_INACTIVITY_DELETION_DAYS = values.PositiveIntegerValue(
-        None, environ_name="ROOM_INACTIVITY_DELETION_DAYS", environ_prefix=None
-    )
     # if provided, treat as suspicious (possible privilege escalation attempt).
     PARTICIPANT_FORBIDDEN_PERMISSION_FIELDS = values.ListValue(
         ["hidden", "recorder", "agent"],
@@ -901,11 +904,6 @@ class Base(Configuration):
         environ_name="LOBBY_NOTIFICATION_TYPE",
         environ_prefix=None,
     )
-    LOBBY_COOKIE_NAME = values.Value(
-        "lobbyParticipantId",
-        environ_name="LOBBY_COOKIE_NAME",
-        environ_prefix=None,
-    )
 
     # Calendar integrations
     ROOM_CREATION_CALLBACK_CACHE_TIMEOUT = values.PositiveIntegerValue(
@@ -1028,6 +1026,66 @@ class Base(Configuration):
         environ_name="APPLICATION_BASE_URL",
         environ_prefix=None,
     )
+
+    # User access tokens (embedded frontend / iframe support)
+    USER_ACCESS_TOKEN_ENABLED = values.BooleanValue(
+        False, environ_name="USER_ACCESS_TOKEN_ENABLED", environ_prefix=None
+    )
+    USER_ACCESS_TOKEN_SECRET_KEY = SecretFileValue(
+        None, environ_name="USER_ACCESS_TOKEN_SECRET_KEY", environ_prefix=None
+    )
+    USER_ACCESS_TOKEN_ALG = values.Value(
+        "HS256",
+        environ_name="USER_ACCESS_TOKEN_ALG",
+        environ_prefix=None,
+    )
+    USER_ACCESS_TOKEN_ISSUER = values.Value(
+        "lasuite-meet",
+        environ_name="USER_ACCESS_TOKEN_ISSUER",
+        environ_prefix=None,
+    )
+    USER_ACCESS_TOKEN_AUDIENCE = values.Value(
+        None,
+        environ_name="USER_ACCESS_TOKEN_AUDIENCE",
+        environ_prefix=None,
+    )
+    # Lifetime of the user access token obtained through the exchange
+    # endpoint. It never transits through a URL, so it can cover a full
+    # meeting (default: 2 hours).
+    USER_ACCESS_TOKEN_TTL = values.PositiveIntegerValue(
+        7200,
+        environ_name="USER_ACCESS_TOKEN_TTL",
+        environ_prefix=None,
+    )
+    # Lifetime of the single-use transit code handed to the frontend
+    # through a URL fragment. Kept very short by design: it must only
+    # survive the redirect and the exchange call.
+    TRANSIT_CODE_TTL = values.PositiveIntegerValue(
+        60,
+        environ_name="TRANSIT_CODE_TTL",
+        environ_prefix=None,
+    )
+    TRANSIT_CODE_CACHE_PREFIX = values.Value(
+        "transit-code",
+        environ_name="TRANSIT_CODE_CACHE_PREFIX",
+        environ_prefix=None,
+    )
+    # Number of random bytes per code (48 bytes -> 64 url-safe characters)
+    TRANSIT_CODE_NBYTES = values.PositiveIntegerValue(
+        48,
+        environ_name="TRANSIT_CODE_NBYTES",
+        environ_prefix=None,
+    )
+    USER_ACCESS_TOKEN_TYPE = values.Value(
+        "Bearer",
+        environ_name="USER_ACCESS_TOKEN_TYPE",
+        environ_prefix=None,
+    )
+    USER_ACCESS_TOKEN_TYPE_CLAIM = values.Value(
+        "user_token",
+        environ_name="USER_ACCESS_TOKEN_TYPE_CLAIM",
+        environ_prefix=None,
+    )
     # Warning: EXTERNAL_API_ALLOW_PUBLIC_ACCESS is ignored when
     # EXTERNAL_API_DEFAULT_ACCESS_LEVEL=public.
     EXTERNAL_API_ALLOW_PUBLIC_ACCESS = values.BooleanValue(
@@ -1176,13 +1234,6 @@ class Base(Configuration):
                     environ_prefix="",
                 )
             },
-            "dockerflow": {
-                "level": values.Value(
-                    "WARNING",
-                    environ_name="LOGGING_LEVEL_DOCKERFLOW",
-                    environ_prefix="",
-                )
-            },
             "core": {
                 "handlers": ["console"],
                 "level": values.Value(
@@ -1252,25 +1303,6 @@ class Base(Configuration):
                 stacklevel=2,
             )
 
-        if cls.ROOM_INACTIVITY_DELETION_DAYS:
-            if not cls.RECORDING_EXPIRATION_DAYS:
-                warnings.warn(
-                    "ROOM_INACTIVITY_DELETION_DAYS is set but "
-                    "RECORDING_EXPIRATION_DAYS is not. Recordings never expire, so "
-                    "inactive rooms holding a saved recording will never be purged.",
-                    UserWarning,
-                    stacklevel=2,
-                )
-            elif cls.RECORDING_EXPIRATION_DAYS >= cls.ROOM_INACTIVITY_DELETION_DAYS:
-                warnings.warn(
-                    "RECORDING_EXPIRATION_DAYS is greater than or equal to "
-                    "ROOM_INACTIVITY_DELETION_DAYS. Inactive rooms holding a saved "
-                    "recording will be kept past the inactivity period, until their "
-                    "recordings expire.",
-                    UserWarning,
-                    stacklevel=2,
-                )
-
         # The SENTRY_DSN setting should be available to activate sentry for an environment
         if cls.SENTRY_DSN is not None:
             sentry_sdk.init(
@@ -1376,6 +1408,9 @@ class Test(Base):
     ADDONS_ENABLED = True
     ADDONS_CSRF_SECRET = "secret-key-padded-for-minimum-len!-addons"  # noqa:S105
     ADDONS_TOKEN_SECRET_KEY = "secret-key-padded-for-minimum-len!-addons"  # noqa:S105
+    USER_ACCESS_TOKEN_ENABLED = True
+    USER_ACCESS_TOKEN_SECRET_KEY = "secret-key-padded-for-minimum-len!-room"  # noqa:S105
+    USER_ACCESS_TOKEN_AUDIENCE = "Test inc."  # noqa:S105
 
     CONNECTION_TEST_ENABLED = True
 

src/backend/pyproject.toml

@@ -2,12 +2,12 @@
 # Meet package
 #
 [build-system]
-requires = ["uv_build>=0.12.6,<0.13.0"]
+requires = ["uv_build>=0.11.16,<0.12.0"]
 build-backend = "uv_build"
 
 [project]
 name = "meet"
-version = "1.32.1"
+version = "1.31.0"
 authors = [{ "name" = "DINUM", "email" = "dev@mail.numerique.gouv.fr" }]
 classifiers = [
     "Development Status :: 5 - Production/Stable",
@@ -24,7 +24,7 @@ keywords = ["Django", "Contacts", "Templates", "RBAC"]
 license = "MIT"
 requires-python = ">=3.13"
 dependencies = [
-    "boto3==1.43.80",
+    "boto3==1.43.56",
     "Brotli==1.2.0",
     "brevo-python==1.2.0",
     "celery[redis]==5.6.3",
@@ -33,7 +33,7 @@ dependencies = [
     "django-cors-headers==4.9.0",
     "django-countries==9.0.0",
     "django-filter==26.1",
-    "django-lasuite[all]==0.0.29",
+    "django-lasuite[all]==0.0.27",
     "django-parler==2.4",
     "redis==5.2.1",
     "django-redis==7.0.0",
@@ -41,30 +41,30 @@ dependencies = [
     "django-timezone-field>=5.1",
     "django-pydantic-field==0.5.4",
     "django==5.2.16",
-    "djangorestframework==3.18.0",
+    "djangorestframework==3.17.1",
     "drf_spectacular==0.30.0",
     "dockerflow==2026.3.4",
     "easy_thumbnails==2.10.1",
     "factory_boy==3.3.3",
-    "gunicorn==26.2.0",
+    "gunicorn==26.0.0",
     "jsonschema==4.26.0",
-    "markdown==3.10.3",
+    "markdown==3.10.2",
     "nested-multipart-parser==1.6.0",
-    "posthog==7.44.0",
+    "posthog==7.29.0",
     "psycopg[binary]==3.3.4",
     "pydantic==2.13.4",
     "PyJWT==2.13.0",
     "python-frontmatter==1.3.0",
     "python-magic==0.4.27",
     "requests==2.34.2",
-    "sentry-sdk==2.68.1",
+    "sentry-sdk==2.66.1",
     "whitenoise==6.12.0",
     "mozilla-django-oidc==5.0.2",
     "livekit-api==1.2.0",
     "aiohttp==3.14.3",
     "urllib3==2.7.0",
-    "phonenumbers==9.0.37",
-    "cryptography==50.0.1", # CVE-2026-69247
+    "phonenumbers==9.0.34",
+    "cryptography==50.0.0", # CVE-2026-69247
 ]
 
 [project.urls]
@@ -76,20 +76,20 @@ dependencies = [
 [dependency-groups]
 dev = [
     "django-extensions==4.1",
-    "drf-spectacular-sidecar==2026.8.1",
+    "drf-spectacular-sidecar==2026.7.1",
     "freezegun==1.5.5",
     "ipdb==0.13.13",
-    "ipython==9.16.1",
+    "ipython==9.15.0",
     "pyfakefs==6.2.0",
     "pylint-django==2.8.0",
     "pylint<4.0.0",
     "pytest-cov==7.1.0",
-    "pytest-django==4.14.0",
+    "pytest-django==4.12.0",
     "pytest==9.1.1",
     "pytest-icdiff==0.9",
     "pytest-xdist==3.8.0",
     "responses==0.26.2",
-    "ruff==0.16.4",
+    "ruff==0.16.0",
     "types-requests==2.33.0.20260712",
 ]
 

src/frontend/Dockerfile

@@ -45,8 +45,7 @@ RUN npm run build
 FROM nginxinc/nginx-unprivileged:1.30.4-alpine3.24 AS frontend-production
 
 USER root
-RUN apk upgrade --no-cache libexpat && \
-    apk del curl
+RUN apk del curl
 USER nginx
 
 # Un-privileged user running the application

src/frontend/package-lock.json

@@ -1,12 +1,12 @@
 {
   "name": "meet",
-  "version": "1.32.1",
+  "version": "1.31.0",
   "lockfileVersion": 3,
   "requires": true,
   "packages": {
     "": {
       "name": "meet",
-      "version": "1.32.1",
+      "version": "1.31.0",
       "dependencies": {
         "@fontsource-variable/atkinson-hyperlegible-next": "5.3.0",
         "@fontsource-variable/lexend": "5.3.0",

src/frontend/package.json

@@ -1,7 +1,7 @@
 {
   "name": "meet",
   "private": true,
-  "version": "1.32.1",
+  "version": "1.31.0",
   "type": "module",
   "scripts": {
     "dev": "panda codegen && vite",

src/frontend/src/App.tsx

@@ -12,6 +12,7 @@ import { routes } from './routes'
 import './i18n/init'
 import { queryClient } from '@/api/queryClient'
 import { AppInitialization } from '@/components/AppInitialization'
+import { TransitCodeGate } from '@/features/auth/components/TransitCodeGate'
 import { useIsSdkContext } from '@/features/sdk/hooks/useIsSdkContext'
 import { useApplyA11yFonts } from '@/hooks/useApplyA11yFonts'
 
@@ -24,23 +25,29 @@ function App() {
 
   return (
     <QueryClientProvider client={queryClient}>
-      {!isSDKContext && <AppInitialization />}
-      <Suspense fallback={null}>
-        <I18nProvider locale={i18n.language}>
-          <Layout>
-            <Switch>
-              {Object.entries(routes).map(([, route], i) => (
-                <Route key={i} path={route.path} component={route.Component} />
-              ))}
-              <Route component={NotFoundScreen} />
-            </Switch>
-          </Layout>
-          <ReactQueryDevtools
-            initialIsOpen={false}
-            buttonPosition="bottom-left"
-          />
-        </I18nProvider>
-      </Suspense>
+      <TransitCodeGate>
+        {!isSDKContext && <AppInitialization />}
+        <Suspense fallback={null}>
+          <I18nProvider locale={i18n.language}>
+            <Layout>
+              <Switch>
+                {Object.entries(routes).map(([, route], i) => (
+                  <Route
+                    key={i}
+                    path={route.path}
+                    component={route.Component}
+                  />
+                ))}
+                <Route component={NotFoundScreen} />
+              </Switch>
+            </Layout>
+            <ReactQueryDevtools
+              initialIsOpen={false}
+              buttonPosition="bottom-left"
+            />
+          </I18nProvider>
+        </Suspense>
+      </TransitCodeGate>
     </QueryClientProvider>
   )
 }

src/frontend/src/api/fetchApi.ts

@@ -1,17 +1,23 @@
 import { ApiError } from './ApiError'
 import { apiUrl } from './apiUrl'
+import { getAccessToken } from '@/stores/accessToken'
 
 export const fetchApi = async <T = Record<string, unknown>>(
   url: string,
   options?: RequestInit
 ): Promise<T> => {
   const csrfToken = getCsrfToken()
+  // Embedded (iframe) mode: the user access token obtained through the
+  // transit code exchange authenticates requests in place of the session
+  // cookie, which is blocked in third-party contexts.
+  const accessToken = getAccessToken()
   const response = await fetch(apiUrl(url), {
     credentials: 'include',
     ...options,
     headers: {
       'Content-Type': 'application/json',
       ...(!!csrfToken && { 'X-CSRFToken': csrfToken }),
+      ...(!!accessToken && { Authorization: `Bearer ${accessToken}` }),
       ...options?.headers,
     },
   })

src/frontend/src/features/analytics/hooks/useAnalytics.ts

@@ -41,7 +41,6 @@ export const useAnalytics = ({
         api_host: host,
         flags_api_host: flags_api_host,
         person_profiles: 'always',
-        remote_config_refresh_interval_ms: 0,
         capture_pageview: 'history_change',
         capture_pageleave: true,
         capture_exceptions: {

src/frontend/src/features/auth/api/exchangeAccessToken.ts

@@ -0,0 +1,72 @@
+import { fetchApi } from '@/api/fetchApi'
+import { setAccessToken } from '@/stores/accessToken'
+import {
+  consumeTransitCodeFromFragment,
+  isEmbedded,
+} from '../utils/transitCode'
+
+type ApiAccessToken = {
+  access_token: string
+  token_type: string
+  expires_in: number
+  scope: string
+}
+
+/**
+ * Exchange a single-use transit code for a user access token.
+ *
+ * The endpoint is unauthenticated: the code itself is the credential.
+ */
+export const exchangeAccessToken = (code: string): Promise<ApiAccessToken> => {
+  return fetchApi<ApiAccessToken>('/users/exchange-access-token/', {
+    method: 'POST',
+    body: JSON.stringify({ code }),
+  })
+}
+
+const runInitialization = async (): Promise<void> => {
+  const code = consumeTransitCodeFromFragment()
+
+  if (!code) {
+    return
+  }
+
+  if (!isEmbedded()) {
+    console.warn('Transit code ignored outside an embedded context')
+    return
+  }
+
+  try {
+    const { access_token } = await exchangeAccessToken(code)
+    setAccessToken(access_token)
+  } catch (error) {
+    console.warn('Transit code exchange failed:', error)
+  }
+}
+
+let initialization: Promise<void> | null = null
+
+/**
+ * Bootstrap the embedded (iframe) authentication, if applicable.
+ *
+ * When, and only when, a transit code is present in the URL fragment,
+ * exchange it for a user access token and keep it in the in-memory
+ * accessToken store: fetchApi then sends it as a Bearer header on every
+ * api call, authenticating the user exactly like a session cookie would.
+ *
+ * Must complete before anything fires an authenticated query, which the
+ * TransitCodeGate component guarantees by gating the app tree on it.
+ *
+ * Memoized: the fragment is consumed and the code exchanged exactly once,
+ * however many times this is called (StrictMode double-invoked effects,
+ * among others). Subsequent calls await the same promise.
+ *
+ * A failed exchange (expired or already used code) is not fatal: the app
+ * starts unauthenticated, falling back to the regular session flow.
+ */
+export const initializeAccessTokenFromFragment = (): Promise<void> => {
+  if (!initialization) {
+    initialization = runInitialization()
+  }
+  return initialization
+}

src/frontend/src/features/auth/api/fetchUser.ts

@@ -2,6 +2,7 @@ import { ApiError } from '@/api/ApiError'
 import { fetchApi } from '@/api/fetchApi'
 import { type ApiUser } from './ApiUser'
 import { attemptSilentLogin, canAttemptSilentLogin } from '../utils/silentLogin'
+import { getAccessToken } from '@/stores/accessToken'
 
 /**
  * fetch the logged-in user from the api.
@@ -25,7 +26,13 @@ export const fetchUser = (
         if (error instanceof ApiError && error.statusCode === 401) {
           // make sure to not resolve the promise while trying to silent login
           // so that consumers of fetchUser don't think the work already ended
-          if (opts.attemptSilent && canAttemptSilentLogin()) {
+          // Never attempt a silent login in embedded (token) mode: an OIDC
+          // redirect inside the iframe would break the embed.
+          if (
+            opts.attemptSilent &&
+            !getAccessToken() &&
+            canAttemptSilentLogin()
+          ) {
             attemptSilentLogin(30)
           } else {
             resolve(false)

src/frontend/src/features/auth/components/TransitCodeGate.tsx

@@ -0,0 +1,67 @@
+import { useEffect, useState } from 'react'
+import { LoadingScreen } from '@/components/LoadingScreen'
+import { useHash } from '@/hooks/useHash'
+import { initializeAccessTokenFromFragment } from '../api/exchangeAccessToken'
+import { hasTransitCodeInFragment } from '../utils/transitCode'
+
+/**
+ * Gates the app tree on the embedded (iframe) authentication bootstrap.
+ *
+ * Without a transit code in the URL fragment — the overwhelmingly common
+ * case — the component early returns children synchronously: no state,
+ * no effect, no extra render, no loading screen.
+ *
+ * When a transit code is present, children are not mounted until it has
+ * been exchanged for a user access token, so that every authenticated
+ * query already carries the Authorization header. A loading screen is
+ * displayed in the meantime, as UserAware does.
+ */
+export const TransitCodeGate = ({
+  children,
+}: {
+  children: React.ReactNode
+}) => {
+  const hash = useHash()
+
+  // Note: the exchange only happens in an embedding context. This check lives
+  // in initializeAccessTokenFromFragment, the single funnel for all bootstrap paths.
+  // The gate still mounts top-level to scrub the fragment, but bootstrap then resolves
+  // immediately without exchanging.
+  //
+  // Latch the decision on the initial hash: bootstrap scrubs it immediately, and the
+  // gate must not switch back to the fast path while the exchange is in flight.
+  const [needsExchange] = useState(() => hasTransitCodeInFragment(hash))
+
+  if (!needsExchange) {
+    return children
+  }
+
+  return <TransitCodeExchange>{children}</TransitCodeExchange>
+}
+
+/**
+ * Only ever mounted when a transit code is present: runs the memoized
+ * bootstrap (safe against StrictMode double-invoked effects) and holds
+ * children back until it settles.
+ */
+const TransitCodeExchange = ({ children }: { children: React.ReactNode }) => {
+  const [isReady, setIsReady] = useState(false)
+
+  useEffect(() => {
+    let isMounted = true
+    initializeAccessTokenFromFragment().finally(() => {
+      if (isMounted) {
+        setIsReady(true)
+      }
+    })
+    return () => {
+      isMounted = false
+    }
+  }, [])
+
+  return isReady ? (
+    children
+  ) : (
+    <LoadingScreen header={false} footer={false} delay={1000} />
+  )
+}

src/frontend/src/features/auth/utils/transitCode.ts

@@ -0,0 +1,59 @@
+const TRANSIT_CODE_FRAGMENT_PARAM = 'transit_code'
+
+/**
+ * Whether the app is rendered inside an embedding context (iframe).
+ *
+ * Comparing window references never throws, even when the parent is
+ * cross-origin. Defaults to false outside a browser environment.
+ */
+export const isEmbedded = (): boolean => {
+  if (typeof window === 'undefined') {
+    return false
+  }
+  return window.self !== window.top
+}
+
+/**
+ * Whether a URL fragment carries a transit code. Pure check, does not
+ * consume anything.
+ */
+export const hasTransitCodeInFragment = (hash: string): boolean => {
+  if (!hash) {
+    return false
+  }
+  return new URLSearchParams(hash.replace(/^#/, '')).has(
+    TRANSIT_CODE_FRAGMENT_PARAM
+  )
+}
+
+/**
+ * Extract the transit code from the URL fragment, if any.
+ *
+ * The fragment is scrubbed from the address bar immediately, before any
+ * network call, so the code never lingers in the browser history. Any
+ * other fragment content is preserved.
+ */
+export const consumeTransitCodeFromFragment = (): string | null => {
+  if (typeof window === 'undefined' || !window.location.hash) {
+    return null
+  }
+
+  const params = new URLSearchParams(window.location.hash.substring(1))
+  const code = params.get(TRANSIT_CODE_FRAGMENT_PARAM)
+
+  if (!code) {
+    return null
+  }
+
+  params.delete(TRANSIT_CODE_FRAGMENT_PARAM)
+  const remaining = params.toString()
+  window.history.replaceState(
+    null,
+    '',
+    window.location.pathname +
+      window.location.search +
+      (remaining ? `#${remaining}` : '')
+  )
+
+  return code
+}

src/frontend/src/features/files/hooks/useResolvedMediaUrls.ts

@@ -0,0 +1,56 @@
+import { useCallback, useEffect, useState } from 'react'
+import { useSnapshot } from 'valtio'
+import { accessTokenStore } from '@/stores/accessToken'
+import { resolveMediaUrl } from '../utils/resolveMediaUrl'
+
+/**
+ * Reactive companion of resolveMediaUrl for browser-native consumers
+ * (CSS url(), img src attributes): resolves a list of /media/ URLs and
+ * returns a stable lookup, identity in regular mode.
+ *
+ * Object URLs come from the shared session-lifetime cache and are never
+ * revoked here: they may be used concurrently by the background
+ * processors.
+ */
+export const useResolvedMediaUrls = (
+  urls: (string | null | undefined)[]
+): ((url: string) => string) => {
+  const [resolved, setResolved] = useState<Record<string, string>>({})
+  const { accessToken } = useSnapshot(accessTokenStore)
+
+  // Stable dependency for the effect, insensitive to array identity
+  const urlsKey = urls.filter(Boolean).sort().join('\n')
+
+  useEffect(() => {
+    if (!accessToken || !urlsKey) {
+      return
+    }
+
+    let isMounted = true
+
+    const resolveAll = async () => {
+      const entries = await Promise.all(
+        urlsKey.split('\n').map(async (url) => {
+          try {
+            return [url, await resolveMediaUrl(url)] as const
+          } catch (error) {
+            console.warn(error)
+            return [url, url] as const
+          }
+        })
+      )
+      if (isMounted) {
+        setResolved(Object.fromEntries(entries))
+      }
+    }
+    resolveAll()
+
+    return () => {
+      isMounted = false
+    }
+  }, [accessToken, urlsKey])
+
+  // Stable identity so that consumers can safely list the resolver in
+  // their memo dependencies: it only changes when resolutions land.
+  return useCallback((url: string) => resolved[url] ?? url, [resolved])
+}

src/frontend/src/features/files/utils/resolveMediaUrl.ts

@@ -0,0 +1,47 @@
+import { getAccessToken } from '@/stores/accessToken'
+
+// Session-lifetime cache: object URLs are shared between every consumer
+// of a given media (background processors, thumbnails) and are therefore
+// never revoked - their number is bounded by the user's custom
+// backgrounds, and they die with the page like the access token does.
+const objectUrlCache = new Map<string, string>()
+
+/**
+ * Resolve an authenticated /media/ URL for the embedded (token) mode.
+ *
+ * Media files are served behind an nginx auth_request subrequest that
+ * authenticates the original request. In regular mode the session cookie
+ * rides along browser-native loads (img.src, CSS url()) and the URL is
+ * returned unchanged, without any fetch. In embedded mode the
+ * third-party cookie is blocked and native loads cannot carry the
+ * Authorization header, so the media is fetched here with the Bearer
+ * header - which the media-auth endpoint accepts, as it sits behind the
+ * default authentication stack - and exposed as a blob object URL.
+ */
+export const resolveMediaUrl = async (url: string): Promise<string> => {
+  const accessToken = getAccessToken()
+
+  if (!accessToken) {
+    return url
+  }
+
+  const cached = objectUrlCache.get(url)
+  if (cached) {
+    return cached
+  }
+
+  const response = await fetch(url, {
+    headers: { Authorization: `Bearer ${accessToken}` },
+  })
+
+  if (!response.ok) {
+    throw new Error(
+      `Failed to resolve media url ${url}: HTTP ${response.status}`
+    )
+  }
+
+  const objectUrl = URL.createObjectURL(await response.blob())
+  objectUrlCache.set(url, objectUrl)
+
+  return objectUrl
+}

src/frontend/src/features/notifications/MainNotificationToast.tsx

@@ -96,10 +96,6 @@ export const MainNotificationToast = () => {
         case NotificationType.ScreenRecordingStopped:
         case NotificationType.TranscriptionLimitReached:
         case NotificationType.ScreenRecordingLimitReached:
-        case NotificationType.TranscriptionFailed:
-        case NotificationType.ScreenRecordingFailed:
-        case NotificationType.TranscriptionAborted:
-        case NotificationType.ScreenRecordingAborted:
           toastQueue.add(
             {
               participant,

src/frontend/src/features/notifications/NotificationProvider.tsx

@@ -1,6 +1,5 @@
 import { Div } from '@/primitives'
 import { ToastProvider } from './components/ToastProvider'
-import { RecordingWaitingForTracksNotification } from './components/RecordingWaitingForTracksNotification'
 import { WaitingParticipantNotification } from './components/WaitingParticipantNotification'
 
 export const NotificationProvider = ({
@@ -13,6 +12,5 @@ export const NotificationProvider = ({
   <Div position="absolute" bottom={bottom} right={right} zIndex={1000}>
     <ToastProvider />
     <WaitingParticipantNotification />
-    <RecordingWaitingForTracksNotification />
   </Div>
 )

src/frontend/src/features/notifications/NotificationType.ts

@@ -10,15 +10,11 @@ export enum NotificationType {
   TranscriptionStarted = 'transcriptionStarted',
   TranscriptionStopped = 'transcriptionStopped',
   TranscriptionLimitReached = 'transcriptionLimitReached',
-  TranscriptionFailed = 'transcriptionFailed',
-  TranscriptionAborted = 'transcriptionAborted',
   TranscriptionRequested = 'transcriptionRequested',
   ScreenRecordingStarted = 'screenRecordingStarted',
   ScreenRecordingStopped = 'screenRecordingStopped',
   ScreenRecordingRequested = 'screenRecordingRequested',
   ScreenRecordingLimitReached = 'screenRecordingLimitReached',
-  ScreenRecordingFailed = 'screenRecordingFailed',
-  ScreenRecordingAborted = 'screenRecordingAborted',
   RecordingSaving = 'recordingSaving',
   PermissionsRemoved = 'permissionsRemoved',
   RoleChanged = 'roleChanged',

src/frontend/src/features/notifications/components/RecordingWaitingForTracksNotification.tsx

@@ -1,41 +0,0 @@
-import { useTranslation } from 'react-i18next'
-import { Text } from '@/primitives'
-import { css } from '@/styled-system/css'
-import { HStack } from '@/styled-system/jsx'
-import { RecordingMode } from '@/features/recording'
-import { useRecordingWaitingForTracks } from '@/features/recording/hooks/useRecordingWaitingForTracks'
-import { StyledToastContainer } from './StyledToastContainer'
-
-export const RecordingWaitingForTracksNotification = () => {
-  const { t } = useTranslation('notifications')
-  const isTranscriptWaiting = useRecordingWaitingForTracks(
-    RecordingMode.Transcript
-  )
-  const isScreenRecordingWaiting = useRecordingWaitingForTracks(
-    RecordingMode.ScreenRecording
-  )
-
-  if (!isTranscriptWaiting && !isScreenRecordingWaiting) return null
-
-  return (
-    <StyledToastContainer role="status">
-      <HStack padding={14}>
-        <Text
-          margin={false}
-          className={css({
-            maxWidth: '22rem',
-            wordBreak: 'break-word',
-            overflowWrap: 'break-word',
-            whiteSpace: 'normal',
-          })}
-        >
-          {t(
-            isTranscriptWaiting
-              ? 'transcript.waitingForTracks'
-              : 'screenRecording.waitingForTracks'
-          )}
-        </Text>
-      </HStack>
-    </StyledToastContainer>
-  )
-}

src/frontend/src/features/notifications/components/ToastAnyRecording.tsx

@@ -22,20 +22,12 @@ export function ToastAnyRecording({ state, ...props }: Readonly<ToastProps>) {
         return 'transcript.stopped'
       case NotificationType.TranscriptionLimitReached:
         return 'transcript.limitReached'
-      case NotificationType.TranscriptionFailed:
-        return 'transcript.failed'
-      case NotificationType.TranscriptionAborted:
-        return 'transcript.aborted'
       case NotificationType.ScreenRecordingStarted:
         return 'screenRecording.started'
       case NotificationType.ScreenRecordingStopped:
         return 'screenRecording.stopped'
       case NotificationType.ScreenRecordingLimitReached:
         return 'screenRecording.limitReached'
-      case NotificationType.ScreenRecordingFailed:
-        return 'screenRecording.failed'
-      case NotificationType.ScreenRecordingAborted:
-        return 'screenRecording.aborted'
       default:
         return
     }

src/frontend/src/features/notifications/components/ToastRegion.tsx

@@ -58,10 +58,6 @@ const renderToast = (
     case NotificationType.ScreenRecordingStarted:
     case NotificationType.ScreenRecordingStopped:
     case NotificationType.ScreenRecordingLimitReached:
-    case NotificationType.TranscriptionFailed:
-    case NotificationType.ScreenRecordingFailed:
-    case NotificationType.TranscriptionAborted:
-    case NotificationType.ScreenRecordingAborted:
       return <ToastAnyRecording key={toast.key} toast={toast} state={state} />
 
     case NotificationType.TranscriptionRequested:

src/frontend/src/features/participantTile/components/ParticipantTile.tsx

@@ -20,7 +20,6 @@ import { Track } from 'livekit-client'
 import { ParticipantPlaceholder } from './ParticipantPlaceholder'
 import { ParticipantTileFocus } from './participantTileFocus/ParticipantTileFocus'
 import { FullScreenShareWarning } from './FullScreenShareWarning'
-import { ScreenShareZoomableVideo } from '@/features/rooms/livekit/components/ScreenShareZoomableVideo'
 import { useTranslation } from 'react-i18next'
 import { getShortcutDescriptorById } from '@/features/shortcuts/catalog'
 import { formatShortcutLabel } from '@/features/shortcuts/formatLabels'
@@ -90,8 +89,6 @@ export const ParticipantTile: (
   )
 
   const isScreenShare = trackReference.source != Track.Source.Camera
-  const isRemoteScreenShare =
-    isScreenShare && !trackReference.participant.isLocal
   const [hasKeyboardFocus, setHasKeyboardFocus] = React.useState(false)
 
   const participantColor = getParticipantColor(trackReference.participant)
@@ -101,23 +98,11 @@ export const ParticipantTile: (
   })
   const participantName = name || identity || 'Unknown'
 
-  // tileRef: fullscreen target, and the node the focus overlay listens on.
-  // setRefs merges it with the forwarded ref on the same node.
-  const tileRef = React.useRef<HTMLDivElement>(null)
-  const setRefs = React.useCallback(
-    (node: HTMLDivElement | null) => {
-      ;(tileRef as React.MutableRefObject<HTMLDivElement | null>).current = node
-      if (typeof ref === 'function') ref(node)
-      else if (ref)
-        (ref as React.MutableRefObject<HTMLDivElement | null>).current = node
-    },
-    [ref]
-  )
-
   const { t } = useTranslation('rooms', { keyPrefix: 'participantTileFocus' })
 
   const interactiveProps = {
     ...elementProps,
+    // Ensure the tile is focusable to expose contextual controls to keyboard users.
     tabIndex: 0,
     'aria-label': t('containerLabel', { name: participantName }),
     onFocus: (event: React.FocusEvent<HTMLDivElement>) => {
@@ -135,41 +120,8 @@ export const ParticipantTile: (
     },
   }
 
-  const isVideoTrack =
-    isTrackReference(trackReference) &&
-    trackReference.publication.kind === 'video'
-
-  let trackMedia: React.ReactNode = null
-  if (isVideoTrack) {
-    const videoTrack = (
-      <VideoTrack
-        trackRef={trackReference}
-        onSubscriptionStatusChanged={handleSubscribe}
-        manageSubscription={autoManageSubscription}
-      />
-    )
-    // Zoom toolbar stays out of picture-in-picture: that window has its own
-    // document and the fullscreen API is off. Follow-up PR can restore zoom
-    // there without the dead fullscreen button.
-    trackMedia =
-      isRemoteScreenShare && !disableTileControls ? (
-        <ScreenShareZoomableVideo tileRef={tileRef}>
-          {videoTrack}
-        </ScreenShareZoomableVideo>
-      ) : (
-        videoTrack
-      )
-  } else if (isTrackReference(trackReference)) {
-    trackMedia = (
-      <AudioTrack
-        trackRef={trackReference}
-        onSubscriptionStatusChanged={handleSubscribe}
-      />
-    )
-  }
-
   return (
-    <div ref={setRefs} style={{ position: 'relative' }} {...interactiveProps}>
+    <div ref={ref} style={{ position: 'relative' }} {...interactiveProps}>
       <TrackRefContextIfNeeded trackRef={trackReference}>
         <ParticipantContextIfNeeded participant={trackReference.participant}>
           {trackReference.participant.isLocal && (
@@ -177,7 +129,23 @@ export const ParticipantTile: (
           )}
           {children ?? (
             <>
-              {trackMedia}
+              {isTrackReference(trackReference) &&
+              (trackReference.publication?.kind === 'video' ||
+                trackReference.source === Track.Source.Camera ||
+                trackReference.source === Track.Source.ScreenShare) ? (
+                <VideoTrack
+                  trackRef={trackReference}
+                  onSubscriptionStatusChanged={handleSubscribe}
+                  manageSubscription={autoManageSubscription}
+                />
+              ) : (
+                isTrackReference(trackReference) && (
+                  <AudioTrack
+                    trackRef={trackReference}
+                    onSubscriptionStatusChanged={handleSubscribe}
+                  />
+                )
+              )}
               <div className="lk-participant-placeholder">
                 <ParticipantPlaceholder
                   color={participantColor}
@@ -196,7 +164,6 @@ export const ParticipantTile: (
           {!disableMetadata && !disableTileControls && (
             <ParticipantTileFocus
               trackRef={trackReference}
-              tileRef={tileRef}
               hasKeyboardFocus={hasKeyboardFocus}
             />
           )}