🔒️(backend) throttle the start recording endpoint

Each recording start writes a Recording row and spins up a recording
worker, so a user or buggy client hammering the endpoint is costly even
when the calls end in a conflict or a worker failure.

Throttle it per authenticated user, mirroring room creation: a short-term
limit of 10/minute absorbs bursts and a daily cap of 100/day bounds
sustained use. Both are configurable via START_RECORDING_THROTTLE_RATES
and START_RECORDING_DAILY_THROTTLE_RATES.

Only starting a recording is throttled, as it is the costly action.
Stopping a recording only releases resources, so it is left unthrottled
and a throttled user can always stop an ongoing recording.

CHANGELOG.md

@@ -11,7 +11,7 @@ and this project adheres to
 ### Added
 
 - ⚡️(backend) add UPPER(email) index for case-insensitive user lookups
-- ✨(backend) authenticate external API calls with Menshen exchanged tokens
+- 🔒️(backend) throttle the start recording endpoint
 
 ## [1.35.0] - 2026-10-13
 

compose.yml

@@ -5,17 +5,17 @@ services:
     env_file:
       - env.d/development/postgresql
     ports:
-      - "15432:5432"
+      - "127.0.0.1:15432:5432"
 
   redis:
     image: redis:5
     ports:
-      - "6379:6379"
+      - "127.0.0.1:6379:6379"
 
   mailcatcher:
     image: sj26/mailcatcher:latest
     ports:
-      - "1081:1080"
+      - "127.0.0.1:1081:1080"
 
   garage:
     user: ${DOCKER_USER:-1000}
@@ -71,7 +71,7 @@ services:
       - env.d/development/common
       - env.d/development/postgresql
     ports:
-      - "8071:8000"
+      - "127.0.0.1:8071:8000"
     volumes:
       - ./src/backend:/app
       - ./data/static:/data/static
@@ -137,7 +137,7 @@ services:
   nginx:
     image: nginx:1.25
     ports:
-      - "8083:8083"
+      - "127.0.0.1:8083:8083"
     volumes:
       - ./docker/files/etc/nginx/conf.d:/etc/nginx/conf.d:ro
     depends_on:
@@ -159,7 +159,7 @@ services:
         VITE_APP_TITLE: "LaSuite Meet"
     image: meet:frontend-development
     ports:
-      - "3000:8080"
+      - "127.0.0.1:3000:8080"
 
   dockerize:
     image: jwilder/dockerize
@@ -185,7 +185,7 @@ services:
   kc_postgresql:
     image: postgres:14.3
     ports:
-      - "5433:5432"
+      - "127.0.0.1:5433:5432"
     env_file:
       - env.d/development/kc_postgresql
 
@@ -213,7 +213,7 @@ services:
       KC_DB_SCHEMA: public
       PROXY_ADDRESS_FORWARDING: 'true'
     ports:
-      - "8080:8080"
+      - "127.0.0.1:8080:8080"
     depends_on:
       - kc_postgresql
 
@@ -222,10 +222,10 @@ services:
     entrypoint: /livekit-server --dev --bind 0.0.0.0 --config ./config.yaml
     ports:
       - "7880:7880"
-      - "7881:7881"
-      - "7882:7882/udp"
-      - "3478:3478/udp"
-      - "30000-30100:30000-30100/udp"
+      - "127.0.0.1:7881:7881"
+      - "127.0.0.1:7882:7882/udp"
+      - "127.0.0.1:3478:3478/udp"
+      - "127.0.0.1:30000-30100:30000-30100/udp"
     volumes:
       - ./docker/livekit/config/livekit-server.yaml:/config.yaml
     depends_on:
@@ -283,7 +283,7 @@ services:
     env_file:
       - env.d/development/summary
     ports:
-      - "8001:8000"
+      - "127.0.0.1:8001:8000"
     volumes:
       - ./src/summary:/app
     depends_on:

docker/compose.d/compose.bureautix.yml

@@ -45,4 +45,4 @@ services:
   # The local proxy listens on 8080 and collides with Keycloak's published admin port.
   keycloak:
     ports: !override
-      - "8081:8080"
+      - "127.0.0.1:8081:8080"

docs/installation/kubernetes.md

@@ -335,6 +335,8 @@ These are the environmental options available on meet backend.
 | SESSION_COOKIE_AGE                              | Session cookie expiration in seconds                                                                                                                         | 43200 (12 hours)                                                                                                                                             |
 | ROOM_CREATION_THROTTLE_RATES                    | Room creation throttle rate per authenticated user | 50/minute                                                                                               | 50/minute                                                                                                                                                    |
 | ROOM_CREATION_DAILY_THROTTLE_RATES              | Daily room creation cap per authenticated user                                                                                                               | 1000/day                                                                                                                                                     |
+| START_RECORDING_THROTTLE_RATES                  | Recording start throttle rate per authenticated user                                                                                                         | 10/minute                                                                                                                                                    |
+| START_RECORDING_DAILY_THROTTLE_RATES            | Daily recording start cap per authenticated user                                                                                                             | 100/day                                                                                                                                                      |
 | REQUEST_ENTRY_THROTTLE_RATES                    | Entry request throttle rates                                                                                                                                 | 150/minute                                                                                                                                                   |
 | CREATION_CALLBACK_THROTTLE_RATES                | Creation callback throttle rates                                                                                                                             | 600/minute                                                                                                                                                   |
 | SPECTACULAR_SETTINGS_ENABLE_DJANGO_DEPLOY_CHECK | Enable Django deploy check                                                                                                                                   | false                                                                                                                                                        |

src/backend/core/api/throttling.py

@@ -47,6 +47,18 @@ class RoomCreationDailyUserRateThrottle(RoomCreationUserRateThrottle):
     scope = "room_creation_daily"
 
 
+class StartRecordingUserRateThrottle(MonitoredUserRateThrottle):
+    """Throttle recording starts per authenticated user."""
+
+    scope = "start_recording"
+
+
+class StartRecordingDailyUserRateThrottle(StartRecordingUserRateThrottle):
+    """Cap recording starts per authenticated user over a day."""
+
+    scope = "start_recording_daily"
+
+
 class RequestEntryAuthenticatedUserRateThrottle(MonitoredUserRateThrottle):
     """Throttle authenticated user requesting room entry"""
 

src/backend/core/api/viewsets.py

@@ -406,6 +406,10 @@ class RoomViewSet(
         permission_classes=[
             permissions.HasPrivilegesOnRoom,
         ],
+        throttle_classes=[
+            throttling.StartRecordingUserRateThrottle,
+            throttling.StartRecordingDailyUserRateThrottle,
+        ],
     )
     @FeatureFlag.require("recording")
     def start_room_recording(self, request, pk=None):  # pylint: disable=unused-argument

src/backend/core/authentication/backends.py

@@ -82,6 +82,9 @@ class OIDCAuthenticationBackend(LaSuiteOIDCAuthenticationBackend):
                 "User info contained an invalid sub claim"
             ) from err
 
+        if len(sub) > 255:
+            raise SuspiciousOperation("User info contained an invalid sub claim")
+
         try:
             return User.objects.get(sub=sub)
         except User.DoesNotExist:

src/backend/core/external_api/authentication.py

@@ -4,107 +4,21 @@
 # ruff: noqa: PLR0913
 
 import logging
-from dataclasses import asdict
-from functools import lru_cache
 
 from django.conf import settings
 from django.contrib.auth import get_user_model
-from django.core.exceptions import SuspiciousOperation, ValidationError
+from django.core.exceptions import SuspiciousOperation
 
-import requests
 from lasuite.oidc_resource_server.backend import ResourceServerBackend as LaSuiteBackend
-from menshen_client import Configuration, IntrospectionRequest, TokenExchangeClient
-from menshen_client.exceptions import ResponseParsingError
 from rest_framework import authentication, exceptions
 
-from core.models import Application, ApplicationScope
+from core.models import Application
 from core.services import jwt_token
-from core.validators import sub_validator
 
 User = get_user_model()
 logger = logging.getLogger(__name__)
 
 
-def get_token(request, token_type):
-    """Extract the token from the Authorization header.
-
-    Args:
-        request: The incoming request
-        token_type: Expected Authorization scheme (e.g. Bearer), matched
-            case-insensitively
-
-    Returns:
-        Token string, or None if the request carries no token of this type
-
-    Raises:
-        AuthenticationFailed: If the Authorization header is malformed
-    """
-
-    auth_header = authentication.get_authorization_header(request).split()
-
-    if not auth_header or auth_header[0].lower() != token_type.lower().encode():
-        return None
-
-    if len(auth_header) != 2:
-        logger.warning("Invalid token header format")
-        raise exceptions.AuthenticationFailed("Invalid token header.")
-
-    try:
-        return auth_header[1].decode("utf-8")
-    except UnicodeError as e:
-        logger.warning("Token decode error: %s", e)
-        raise exceptions.AuthenticationFailed("Invalid token encoding.") from e
-
-
-def get_or_create_user_by_sub(sub, email=None):
-    """Retrieve the user matching a token subject, creating it if allowed.
-
-    Shared by the resource server backends, so that tokens introspected with the
-    OIDC provider or with Menshen resolve users the same way.
-
-    Args:
-        sub: Subject identifier from the introspected token
-        email: Email to store on a newly created user
-
-    Returns:
-        User instance, or None if unknown and OIDC_CREATE_USER is unset
-
-    Raises:
-        SuspiciousOperation: If the sub is invalid, the email of a user to create
-            is already used, or the user account is disabled
-    """
-
-    try:
-        sub_validator(sub)
-    except ValidationError as err:
-        raise SuspiciousOperation("User info contained an invalid sub claim") from err
-
-    try:
-        user = User.objects.get(sub=sub)
-    except User.DoesNotExist:
-        if not settings.OIDC_CREATE_USER:
-            return None
-
-        # Users are never identified by email here. But a second account with the
-        # same email (e.g. provisionnal account) would break the lookups by email:
-        # refuse it.
-        if email and User.objects.filter(email__iexact=email).exists():
-            logger.warning("Email already used, not creating user: %s", sub)
-            raise SuspiciousOperation(
-                "Email already used by another account."
-            ) from None
-
-        user = User(sub=sub, email=email)
-        user.set_unusable_password()
-        user.save()
-
-    if not user.is_active:
-        logger.warning("Inactive user attempted authentication: %s", user.pk)
-        raise SuspiciousOperation("User account is disabled.")
-
-    return user
-
-
 class BaseJWTAuthentication(authentication.BaseAuthentication):
     """Base JWT authentication class."""
 
@@ -158,12 +72,25 @@ class BaseJWTAuthentication(authentication.BaseAuthentication):
         if not self.is_enabled:
             return None
 
-        token = get_token(request, self._token_type)
+        auth_header = authentication.get_authorization_header(request).split()
 
-        if token is None:
+        if (
+            not auth_header
+            or auth_header[0].lower() != self._token_type.lower().encode()
+        ):
             # Defer to next authentication backend
             return None
 
+        if len(auth_header) != 2:
+            logger.warning("Invalid token header format")
+            raise exceptions.AuthenticationFailed("Invalid token header.")
+
+        try:
+            token = auth_header[1].decode("utf-8")
+        except UnicodeError as e:
+            logger.warning("Token decode error: %s", e)
+            raise exceptions.AuthenticationFailed("Invalid token encoding.") from e
+
         return self.authenticate_credentials(token)
 
     def decode_jwt(self, token):
@@ -329,127 +256,6 @@ class AddonsJWTAuthentication(BaseJWTAuthentication):
         )
 
 
-# Menshen grants scopes following La Suite's "service:resource:action" convention.
-# Map them to the scopes expected by the external API permissions.
-MENSHEN_SCOPES_MAPPING = {
-    "meet:room:create": ApplicationScope.ROOMS_CREATE,
-}
-
-
-@lru_cache(1)
-def _get_token_exchange_client(client_id, client_secret, server_url):
-    return TokenExchangeClient(
-        config=Configuration(
-            client_id,
-            client_secret,
-            server_url,
-        )
-    )
-
-
-class MenshenAuthentication(authentication.BaseAuthentication):
-    """Authentication for tokens exchanged through Menshen.
-
-    Menshen is La Suite's OAuth 2.0 token exchange server (RFC 8693): another service
-    exchanges its user's access token for a token targeting Meet, then calls the external
-    API on behalf of that user. Tokens are validated by introspection (RFC 7662). Menshen
-    only reports a token as active when Meet is among its audiences.
-    """
-
-    def __init__(self):
-        """Initialize the Menshen client from Django settings."""
-
-        super().__init__()
-
-        self._client = None
-
-        if not settings.MENSHEN_ENABLED:
-            return
-
-        self._client = _get_token_exchange_client(
-            settings.MENSHEN_CLIENT_ID,
-            settings.MENSHEN_CLIENT_SECRET,
-            settings.MENSHEN_SERVER_URL,
-        )
-
-    def authenticate(self, request):
-        """Introspect the bearer token with Menshen.
-
-        Returns:
-            Tuple of (user, payload) if the token is active, None otherwise
-        """
-
-        if self._client is None:
-            return None
-
-        token = get_token(request, "bearer")
-
-        if token is None:
-            return None
-
-        try:
-            response = self._client.introspect(IntrospectionRequest(token=token))
-        except (requests.RequestException, ResponseParsingError) as e:
-            logger.warning("Menshen introspection failed: %s", e)
-            return None
-
-        # Permission classes expect a dict payload in request.auth
-        payload = asdict(response)
-
-        if not payload.get("active"):
-            # Not a Menshen token, or an expired or revoked one: defer to next
-            # authentication backend
-            return None
-
-        user = self.get_or_create_user(payload)
-
-        scopes = payload.get("scope") or ""
-        payload["scope"] = [
-            MENSHEN_SCOPES_MAPPING[scope]
-            for scope in scopes.split()
-            if scope in MENSHEN_SCOPES_MAPPING
-        ]
-
-        return (user, payload)
-
-    def get_or_create_user(self, payload):
-        """Retrieve or create the user from the introspection response.
-
-        Menshen forwards the `sub` and `email` of the subject token, as introspected
-        with the OIDC provider.
-
-        Args:
-            payload: Introspection response dict
-
-        Returns:
-            User instance
-
-        Raises:
-            AuthenticationFailed: If user not found or inactive
-        """
-
-        sub = payload.get("sub")
-
-        if not sub:
-            logger.warning("Missing 'sub' in Menshen introspection response")
-            raise exceptions.AuthenticationFailed("Invalid token claims.")
-
-        try:
-            user = get_or_create_user_by_sub(sub, email=payload.get("email"))
-        except SuspiciousOperation as e:
-            raise exceptions.AuthenticationFailed(str(e)) from e
-
-        if user is None:
-            logger.warning("User not found: %s", sub)
-            raise exceptions.AuthenticationFailed("User not found.")
-
-        return user
-
-    def authenticate_header(self, request):
-        """Return authentication scheme for WWW-Authenticate header."""
-        return "bearer"
-
-
 class ResourceServerBackend(LaSuiteBackend):
     """OIDC Resource Server backend for user creation and retrieval."""
 
@@ -479,4 +285,28 @@ class ResourceServerBackend(LaSuiteBackend):
             logger.debug(message)
             raise SuspiciousOperation(message)
 
-        return get_or_create_user_by_sub(sub)
+        user = self.get_user(access_token, id_token, payload)
+
+        if user is None and settings.OIDC_CREATE_USER:
+            user = self.create_user(sub)
+
+        if user is not None and not user.is_active:
+            logger.warning("Inactive user attempted authentication: %s", user.pk)
+            raise SuspiciousOperation("User account is disabled.")
+
+        return user
+
+    def create_user(self, sub):
+        """Create new user from subject claim.
+
+        Args:
+            sub: Subject identifier from token
+
+        Returns:
+            Newly created User instance
+        """
+        user = self.UserModel(sub=sub)
+        user.set_unusable_password()
+        user.save()
+
+        return user

src/backend/core/external_api/viewsets.py

@@ -166,7 +166,6 @@ class RoomViewSet(
     authentication_classes = [
         authentication.ApplicationJWTAuthentication,
         authentication.AddonsJWTAuthentication,
-        authentication.MenshenAuthentication,
         ResourceServerAuthentication,
     ]
     permission_classes = [

src/backend/core/tests/rooms/test_api_rooms_start_recording_throttling.py

@@ -0,0 +1,212 @@
+"""
+Test rooms API endpoints in the Meet core app: start recording throttling.
+"""
+
+# pylint: disable=redefined-outer-name,unused-argument
+
+from unittest import mock
+
+import pytest
+from rest_framework.test import APIClient
+
+from ...api.throttling import (
+    StartRecordingDailyUserRateThrottle,
+    StartRecordingUserRateThrottle,
+)
+from ...factories import RoomFactory, UserFactory
+from ...models import Recording
+
+pytestmark = pytest.mark.django_db
+
+
+@pytest.fixture
+def start_recording_throttle(monkeypatch):
+    """Lower the start recording rates."""
+    rates = StartRecordingUserRateThrottle.THROTTLE_RATES
+    monkeypatch.setitem(rates, "start_recording", "2/minute")
+    monkeypatch.setitem(rates, "start_recording_daily", "100/day")
+
+
+@pytest.fixture
+def daily_start_recording_throttle(monkeypatch):
+    """Lower the daily start recording rate and control the clock."""
+    rates = StartRecordingDailyUserRateThrottle.THROTTLE_RATES
+    monkeypatch.setitem(rates, "start_recording", "100/minute")
+    monkeypatch.setitem(rates, "start_recording_daily", "3/day")
+    now = [1_000_000.0]
+    monkeypatch.setattr(StartRecordingUserRateThrottle, "timer", lambda self: now[0])
+    return now
+
+
+@mock.patch("core.api.viewsets.WorkerServiceMediator")
+@mock.patch("core.api.viewsets.get_worker_service")
+def test_start_recording_throttled(
+    mock_get_worker_service, mock_mediator_class, start_recording_throttle, settings
+):
+    """Starting a recording should return 429 when exceeding the per-minute rate."""
+    settings.RECORDING_ENABLE = True
+    user = UserFactory()
+    client = APIClient()
+    client.force_login(user)
+
+    for _ in range(2):
+        room = RoomFactory(users=[(user, "owner")])
+        response = client.post(
+            f"/api/v1.0/rooms/{room.id}/start-recording/",
+            {"mode": "screen_recording"},
+        )
+        assert response.status_code == 201
+
+    room = RoomFactory(users=[(user, "owner")])
+    response = client.post(
+        f"/api/v1.0/rooms/{room.id}/start-recording/",
+        {"mode": "screen_recording"},
+    )
+
+    assert response.status_code == 429
+    assert 0 < int(response["Retry-After"]) <= 60
+    assert Recording.objects.count() == 2
+    assert mock_mediator_class.return_value.start.call_count == 2
+
+
+@mock.patch("core.api.viewsets.WorkerServiceMediator")
+@mock.patch("core.api.viewsets.get_worker_service")
+def test_start_recording_throttle_counts_failed_attempts(
+    mock_get_worker_service, mock_mediator_class, start_recording_throttle, settings
+):
+    """Failed recording starts should count toward the rate."""
+    settings.RECORDING_ENABLE = True
+    user = UserFactory()
+    room = RoomFactory(users=[(user, "owner")])
+    Recording.objects.create(room=room, mode="screen_recording", status="active")
+    client = APIClient()
+    client.force_login(user)
+
+    for _ in range(2):
+        response = client.post(
+            f"/api/v1.0/rooms/{room.id}/start-recording/",
+            {"mode": "screen_recording"},
+        )
+        assert response.status_code == 409
+
+    response = client.post(
+        f"/api/v1.0/rooms/{room.id}/start-recording/",
+        {"mode": "screen_recording"},
+    )
+
+    assert response.status_code == 429
+
+
+@mock.patch("core.api.viewsets.WorkerServiceMediator")
+@mock.patch("core.api.viewsets.get_worker_service")
+def test_start_recording_throttle_per_user(
+    mock_get_worker_service, mock_mediator_class, start_recording_throttle, settings
+):
+    """Starting a recording should succeed when another user is throttled."""
+    settings.RECORDING_ENABLE = True
+    client = APIClient()
+
+    user = UserFactory()
+    client.force_login(user)
+    for _ in range(2):
+        room = RoomFactory(users=[(user, "owner")])
+        response = client.post(
+            f"/api/v1.0/rooms/{room.id}/start-recording/",
+            {"mode": "screen_recording"},
+        )
+        assert response.status_code == 201
+
+    room = RoomFactory(users=[(user, "owner")])
+    response = client.post(
+        f"/api/v1.0/rooms/{room.id}/start-recording/",
+        {"mode": "screen_recording"},
+    )
+    assert response.status_code == 429
+
+    other_user = UserFactory()
+    client.force_login(other_user)
+    room = RoomFactory(users=[(other_user, "owner")])
+    response = client.post(
+        f"/api/v1.0/rooms/{room.id}/start-recording/",
+        {"mode": "screen_recording"},
+    )
+
+    assert response.status_code == 201
+
+
+@mock.patch("core.api.viewsets.WorkerServiceMediator")
+@mock.patch("core.api.viewsets.get_worker_service")
+def test_start_recording_throttle_does_not_limit_other_actions(
+    mock_get_worker_service, mock_mediator_class, start_recording_throttle, settings
+):
+    """Other room actions should succeed when starting a recording is throttled."""
+    settings.RECORDING_ENABLE = True
+    user = UserFactory()
+    client = APIClient()
+    client.force_login(user)
+
+    rooms = RoomFactory.create_batch(3, users=[(user, "owner")])
+    for room in rooms[:2]:
+        response = client.post(
+            f"/api/v1.0/rooms/{room.id}/start-recording/",
+            {"mode": "screen_recording"},
+        )
+        assert response.status_code == 201
+
+    response = client.post(
+        f"/api/v1.0/rooms/{rooms[2].id}/start-recording/",
+        {"mode": "screen_recording"},
+    )
+    assert response.status_code == 429
+
+    Recording.objects.filter(room=rooms[0]).update(status="active")
+    response = client.post(f"/api/v1.0/rooms/{rooms[0].id}/stop-recording/")
+    assert response.status_code == 200
+
+    response = client.get("/api/v1.0/rooms/")
+    assert response.status_code == 200
+
+    response = client.post("/api/v1.0/rooms/", {"name": "New room"})
+    assert response.status_code == 201
+
+
+@mock.patch("core.api.viewsets.WorkerServiceMediator")
+@mock.patch("core.api.viewsets.get_worker_service")
+def test_start_recording_daily_throttled(
+    mock_get_worker_service,
+    mock_mediator_class,
+    daily_start_recording_throttle,
+    settings,
+):
+    """Starting a recording should return 429 when exceeding the daily rate."""
+    settings.RECORDING_ENABLE = True
+    now = daily_start_recording_throttle
+    user = UserFactory()
+    client = APIClient()
+    client.force_login(user)
+
+    for _ in range(3):
+        room = RoomFactory(users=[(user, "owner")])
+        response = client.post(
+            f"/api/v1.0/rooms/{room.id}/start-recording/",
+            {"mode": "screen_recording"},
+        )
+        assert response.status_code == 201
+        now[0] += 120
+
+    room = RoomFactory(users=[(user, "owner")])
+    response = client.post(
+        f"/api/v1.0/rooms/{room.id}/start-recording/",
+        {"mode": "screen_recording"},
+    )
+    assert response.status_code == 429
+    assert 60 < int(response["Retry-After"]) <= 86400
+
+    now[0] += 86400
+    room = RoomFactory(users=[(user, "owner")])
+    response = client.post(
+        f"/api/v1.0/rooms/{room.id}/start-recording/",
+        {"mode": "screen_recording"},
+    )
+
+    assert response.status_code == 201

src/backend/core/tests/test_api_user_access_token_authentication.py

@@ -35,20 +35,6 @@ def test_user_access_token_users_me():
     assert response.data["email"] == user.email
 
 
-def test_user_access_token_custom_token_type(settings):
-    """The Authorization scheme should match the configured token type."""
-    settings.USER_ACCESS_TOKEN_TYPE = "Token"
-    user = UserFactory()
-
-    client = APIClient()
-    client.credentials(HTTP_AUTHORIZATION=f"Token {generate_user_access_token(user)}")
-
-    response = client.get("/api/v1.0/users/me/")
-
-    assert response.status_code == 200
-    assert response.data["email"] == user.email
-
-
 def test_user_access_token_expired():
     """An expired user access token should be rejected."""
     user = UserFactory()

src/backend/core/tests/test_external_api_authentication.py

@@ -67,19 +67,6 @@ def test_resource_server_backend_get_or_create_user_no_creation(settings):
     assert not User.objects.filter(sub="new-sub").exists()
 
 
-def test_resource_server_backend_get_or_create_user_invalid_sub(settings):
-    """A sub longer than 255 characters should be rejected without creating a user."""
-
-    settings.OIDC_CREATE_USER = True
-
-    with pytest.raises(SuspiciousOperation, match="invalid sub claim"):
-        ResourceServerBackend().get_or_create_user(
-            access_token="token", id_token=None, payload=_payload("a" * 256)
-        )
-
-    assert not User.objects.exists()
-
-
 @responses.activate
 def test_api_rooms_list_resource_server_inactive_user(settings):
     """End to end: a valid introspected token for an inactive user should get 401."""

src/backend/core/tests/test_external_api_menshen.py

@@ -1,302 +0,0 @@
-"""Tests for the external API MenshenAuthentication."""
-
-from unittest import mock
-
-import pytest
-import responses
-from lasuite.oidc_resource_server.authentication import ResourceServerAuthentication
-from rest_framework.test import APIClient
-
-from core.factories import UserFactory
-from core.models import RoleChoices, Room, User
-
-pytestmark = pytest.mark.django_db
-
-SERVER_URL = "https://menshen.example.com"
-INTROSPECTION_ENDPOINT = f"{SERVER_URL}/auth/token/introspect/"
-TOKEN = "menshen-exchanged-token"
-
-
-@pytest.fixture(autouse=True)
-def menshen_settings(settings):
-    """Enable Menshen authentication."""
-    settings.MENSHEN_ENABLED = True
-    settings.MENSHEN_SERVER_URL = SERVER_URL
-    settings.MENSHEN_CLIENT_ID = "meet"
-    settings.MENSHEN_CLIENT_SECRET = "meet-secret"
-
-
-def _introspection(sub, scope="meet:room:create", **overrides):
-    return {
-        "active": True,
-        "sub": sub,
-        "email": "user@example.com",
-        "scope": scope,
-        "aud": "meet",
-        "client_id": "menshen",
-        **overrides,
-    }
-
-
-def _create_room(token=TOKEN):
-    client = APIClient()
-    client.credentials(HTTP_AUTHORIZATION=f"Bearer {token}")
-    return client.post("/external-api/v1.0/rooms/", {}, format="json")
-
-
-@responses.activate
-def test_menshen_active_token():
-    """An active token with a mapped scope should create a room owned by the user."""
-
-    user = UserFactory()
-
-    # Catch and mock external HTTP requests
-    responses.add(
-        responses.POST,
-        INTROSPECTION_ENDPOINT,
-        json=_introspection(user.sub),
-        match=[responses.matchers.urlencoded_params_matcher({"token": TOKEN})],
-    )
-
-    response = _create_room()
-
-    assert response.status_code == 201
-    room = Room.objects.get(id=response.data["id"])
-    assert room.get_role(user) == RoleChoices.OWNER
-    assert responses.calls[0].request.headers["Authorization"].startswith("Basic ")
-
-
-@responses.activate
-@mock.patch.object(ResourceServerAuthentication, "authenticate", return_value=None)
-def test_menshen_other_token_type_ignored(mock_rs_authenticate):
-    """A token sent with another scheme than Bearer should not be introspected."""
-
-    client = APIClient()
-    client.credentials(HTTP_AUTHORIZATION=f"Token {TOKEN}")
-    response = client.post("/external-api/v1.0/rooms/", {}, format="json")
-
-    assert response.status_code == 401
-    assert len(responses.calls) == 0
-    mock_rs_authenticate.assert_called_once()
-
-
-@responses.activate
-@mock.patch.object(ResourceServerAuthentication, "authenticate", return_value=None)
-def test_menshen_disabled(mock_rs_authenticate, settings):
-    """Menshen should not be called when disabled."""
-
-    settings.MENSHEN_ENABLED = False
-
-    response = _create_room()
-
-    assert response.status_code == 401
-    assert len(responses.calls) == 0
-    mock_rs_authenticate.assert_called_once()
-
-
-@responses.activate
-@mock.patch.object(ResourceServerAuthentication, "authenticate", return_value=None)
-def test_menshen_inactive_token_defers(mock_rs_authenticate):
-    """An inactive token should defer to the next authentication backend."""
-
-    user = UserFactory()
-
-    responses.add(
-        responses.POST,
-        INTROSPECTION_ENDPOINT,
-        json=_introspection(user.sub, scope="meet:room:create", active=False),
-    )
-
-    response = _create_room()
-
-    assert response.status_code == 401
-    mock_rs_authenticate.assert_called_once()
-
-
-@responses.activate
-@mock.patch.object(ResourceServerAuthentication, "authenticate", return_value=None)
-def test_menshen_error_defers(mock_rs_authenticate):
-    """A Menshen error should defer to the next authentication backend."""
-
-    responses.add(responses.POST, INTROSPECTION_ENDPOINT, status=500)
-
-    response = _create_room()
-
-    assert response.status_code == 401
-    mock_rs_authenticate.assert_called_once()
-
-
-@responses.activate
-@mock.patch.object(ResourceServerAuthentication, "authenticate", return_value=None)
-def test_menshen_unparsable_response_defers(mock_rs_authenticate):
-    """A response the client can't parse should defer to the next backend."""
-
-    responses.add(
-        responses.POST,
-        INTROSPECTION_ENDPOINT,
-        json={"active": True, "unexpected": "field"},
-    )
-
-    response = _create_room()
-
-    assert response.status_code == 401
-    mock_rs_authenticate.assert_called_once()
-
-
-@responses.activate
-def test_menshen_resource_server_token(settings):
-    """End to end: a token issued by the OIDC provider is unknown to Menshen and
-    should still authenticate through the resource server."""
-
-    settings.OIDC_OP_INTROSPECTION_ENDPOINT = "https://oidc.example.com/introspect"
-    settings.OIDC_OP_URL = "https://oidc.example.com"
-
-    user = UserFactory()
-    token = "oidc-access-token"
-
-    menshen_introspection = responses.add(
-        responses.POST,
-        INTROSPECTION_ENDPOINT,
-        json={"active": False},
-        match=[responses.matchers.urlencoded_params_matcher({"token": token})],
-    )
-    oidc_introspection = responses.add(
-        responses.POST,
-        "https://oidc.example.com/introspect",
-        json={
-            "iss": "https://oidc.example.com",
-            "active": True,
-            "sub": user.sub,
-            "scope": "openid lasuite_meet rooms:create",
-            "client_id": "app",
-        },
-    )
-
-    response = _create_room(token)
-
-    assert response.status_code == 201
-    room = Room.objects.get(id=response.data["id"])
-    assert room.get_role(user) == RoleChoices.OWNER
-    assert menshen_introspection.call_count == 1
-    assert oidc_introspection.call_count == 1
-
-
-@responses.activate
-def test_menshen_unmapped_scope():
-    """Scopes granted for other services or other Meet actions should not grant access."""
-
-    user = UserFactory()
-
-    responses.add(
-        responses.POST,
-        INTROSPECTION_ENDPOINT,
-        json=_introspection(user.sub, scope="drive:item:create meet:room:list"),
-    )
-
-    response = _create_room()
-
-    assert response.status_code == 403
-    assert "insufficient permissions." in str(response.data).lower()
-    assert not Room.objects.exists()
-
-
-@responses.activate
-def test_menshen_missing_sub():
-    """An active token without sub should be rejected."""
-
-    responses.add(responses.POST, INTROSPECTION_ENDPOINT, json=_introspection(None))
-
-    response = _create_room()
-
-    assert response.status_code == 401
-    assert "invalid token claims." in str(response.data).lower()
-
-
-@responses.activate
-def test_menshen_invalid_sub(settings):
-    """An active token with an invalid sub should be rejected without creating a user."""
-
-    settings.OIDC_CREATE_USER = True
-
-    responses.add(
-        responses.POST, INTROSPECTION_ENDPOINT, json=_introspection("invalid\nsub")
-    )
-
-    response = _create_room()
-
-    assert response.status_code == 401
-    assert "invalid sub claim" in str(response.data).lower()
-    assert not User.objects.exists()
-
-
-@responses.activate
-def test_menshen_inactive_user():
-    """An active token for an inactive user should be rejected."""
-
-    user = UserFactory(is_active=False)
-
-    responses.add(responses.POST, INTROSPECTION_ENDPOINT, json=_introspection(user.sub))
-
-    response = _create_room()
-
-    assert response.status_code == 401
-    assert "user account is disabled." in str(response.data).lower()
-
-
-@responses.activate
-def test_menshen_unknown_user_created(settings):
-    """An unknown sub should create a user when OIDC_CREATE_USER is set."""
-
-    settings.OIDC_CREATE_USER = True
-
-    responses.add(
-        responses.POST, INTROSPECTION_ENDPOINT, json=_introspection("new-sub")
-    )
-
-    response = _create_room()
-
-    assert response.status_code == 201
-    user = User.objects.get(sub="new-sub")
-    assert user.email == "user@example.com"
-    assert user.is_active is True
-
-
-@responses.activate
-def test_menshen_unknown_user_not_created(settings):
-    """An unknown sub should be rejected when OIDC_CREATE_USER is unset."""
-
-    settings.OIDC_CREATE_USER = False
-
-    responses.add(
-        responses.POST, INTROSPECTION_ENDPOINT, json=_introspection("new-sub")
-    )
-
-    response = _create_room()
-
-    assert response.status_code == 401
-    assert "user not found." in str(response.data).lower()
-    assert not User.objects.filter(sub="new-sub").exists()
-
-
-@responses.activate
-@pytest.mark.parametrize("existing_sub", [None, "other-sub"])
-def test_menshen_unknown_user_email_already_used(settings, existing_sub):
-    """An unknown sub should not create a second account with an email already
-    used, by a provisional user or a user with another sub."""
-
-    settings.OIDC_CREATE_USER = True
-
-    existing_user = UserFactory(sub=existing_sub, email="User@Example.com")
-
-    responses.add(
-        responses.POST, INTROSPECTION_ENDPOINT, json=_introspection("new-sub")
-    )
-
-    response = _create_room()
-
-    assert response.status_code == 401
-    assert "email already used by another account." in str(response.data).lower()
-    assert User.objects.count() == 1
-    existing_user.refresh_from_db()
-    assert existing_user.sub == existing_sub
-    assert not Room.objects.exists()

src/backend/core/tests/test_models_users.py

@@ -69,7 +69,7 @@ def test_models_users_sub_validator(sub, is_valid):
     else:
         with pytest.raises(
             ValidationError,
-            match="Enter a valid sub. This value should be printable ASCII only, with 255 characters or less.",
+            match="Enter a valid sub. This value should be printable ASCII only.",
         ):
             user.full_clean()
 

src/backend/core/validators.py

@@ -17,13 +17,7 @@ def sub_validator(value):
     ``isprintable()`` is false exactly for those control characters, while
     space (U+0020) remains allowed.
     """
-    msg = "Enter a valid sub. This value should be printable ASCII only, with 255 characters or less."
-
-    if value is None:
-        raise ValidationError(_(msg))
-
-    if len(value) > 255:
-        raise ValidationError(_(msg))
-
     if not value.isascii() or not value.isprintable():
-        raise ValidationError(_(msg))
+        raise ValidationError(
+            _("Enter a valid sub. This value should be printable ASCII only.")
+        )

src/backend/meet/settings.py

@@ -395,6 +395,16 @@ class Base(Configuration):
                 environ_name="ROOM_CREATION_DAILY_THROTTLE_RATES",
                 environ_prefix=None,
             ),
+            "start_recording": values.Value(
+                default="10/minute",
+                environ_name="START_RECORDING_THROTTLE_RATES",
+                environ_prefix=None,
+            ),
+            "start_recording_daily": values.Value(
+                default="100/day",
+                environ_name="START_RECORDING_DAILY_THROTTLE_RATES",
+                environ_prefix=None,
+            ),
             "request_entry": values.Value(
                 default="150/minute",
                 environ_name="REQUEST_ENTRY_THROTTLE_RATES",
@@ -709,20 +719,6 @@ class Base(Configuration):
         default=None, environ_name="OIDC_RS_SCOPES_PREFIX", environ_prefix=None
     )
 
-    # Menshen, La Suite's OAuth 2.0 token exchange server
-    MENSHEN_ENABLED = values.BooleanValue(
-        False, environ_name="MENSHEN_ENABLED", environ_prefix=None
-    )
-    MENSHEN_SERVER_URL = values.Value(
-        None, environ_name="MENSHEN_SERVER_URL", environ_prefix=None
-    )
-    MENSHEN_CLIENT_ID = values.Value(
-        None, environ_name="MENSHEN_CLIENT_ID", environ_prefix=None
-    )
-    MENSHEN_CLIENT_SECRET = SecretFileValue(
-        None, environ_name="MENSHEN_CLIENT_SECRET", environ_prefix=None
-    )
-
     # Video conference configuration
     LIVEKIT_CONFIGURATION = {
         "api_key": SecretFileValue(environ_name="LIVEKIT_API_KEY", environ_prefix=None),

src/backend/pyproject.toml

@@ -49,7 +49,6 @@ dependencies = [
     "gunicorn==26.2.0",
     "jsonschema==4.26.0",
     "markdown==3.10.3",
-    "menshen-client==0.2.0",
     "nested-multipart-parser==1.6.0",
     "posthog==7.44.0",
     "psycopg[binary]==3.3.4",

src/backend/uv.lock

@@ -1,5 +1,5 @@
 version = 1
-revision = 5
+revision = 3
 requires-python = ">=3.13"
 
 [[package]]
@@ -1327,7 +1327,6 @@ dependencies = [
     { name = "jsonschema" },
     { name = "livekit-api" },
     { name = "markdown" },
-    { name = "menshen-client" },
     { name = "mozilla-django-oidc" },
     { name = "nested-multipart-parser" },
     { name = "phonenumbers" },
@@ -1393,7 +1392,6 @@ requires-dist = [
     { name = "jsonschema", specifier = "==4.26.0" },
     { name = "livekit-api", specifier = "==1.2.0" },
     { name = "markdown", specifier = "==3.10.3" },
-    { name = "menshen-client", specifier = "==0.2.0" },
     { name = "mozilla-django-oidc", specifier = "==5.0.2" },
     { name = "nested-multipart-parser", specifier = "==1.6.0" },
     { name = "phonenumbers", specifier = "==9.0.37" },
@@ -1430,18 +1428,6 @@ dev = [
     { name = "types-requests", specifier = "==2.33.0.20260712" },
 ]
 
-[[package]]
-name = "menshen-client"
-version = "0.2.0"
-source = { registry = "https://pypi.org/simple" }
-dependencies = [
-    { name = "requests" },
-]
-sdist = { url = "https://files.pythonhosted.org/packages/57/a2/5862b0a39d5f96301e1daff146445f591b1980412c20417162f5cfd6aa34/menshen_client-0.2.0.tar.gz", hash = "sha256:548c4224c38b2c844a76325b5a4b65da520ea9eba23aafb004da0f430a7e4fcf", size = 6326, upload-time = "2026-10-13T10:19:34.344Z" }
-wheels = [
-    { url = "https://files.pythonhosted.org/packages/53/4d/932efd81c340d12d07b1c33633c6e7a4a2d0c9086ac0da7ffe9a1ce17068/menshen_client-0.2.0-py3-none-any.whl", hash = "sha256:415eaba30184452bc393b528c6088ed6e37cbd00ce60716aef9e2d9bd0697221", size = 7149, upload-time = "2026-10-13T10:19:33.272Z" },
-]
-
 [[package]]
 name = "mozilla-django-oidc"
 version = "5.0.2"