🧑‍💻(devx) add a WebRTC stats and network throttling devtool

Introduce an in-app devtool that monitors WebRTC statistics in real time and lets developers simulate various network scenarios, including constraining the uplink and downlink bandwidth. Makes it much easier to reproduce and investigate connectivity or quality issues locally without depending on external tools. The code was AI generated, and might contain some smell. It's only enabled in dev, and not included in the production build. Feel free to enhance it as needed.
🔧(devx) configure a TURN server on the local LiveKit dev stack
2026-10-01 23:19:59 +00:00 · 2026-09-01 19:40:48 +02:00 · 2026-09-01 19:40:43 +02:00
236 changed files with 4396 additions and 13895 deletions
@@ -1,9 +0,0 @@
 [codespell]
 # Files that are not English, or generated
 skip = ./.git,*.pdf,*.po,*.pot,*.json,*.lock,package-lock.json,
  ./LICENSES,
  ./src/summary/summary/core/locales,
  ./src/summary/summary/core/prompt.py
 # Valid words in French (connexion) or in the code (statics)
 ignore-words-list = connexion,statics
 check-filenames = true
@@ -1,20 +0,0 @@
 # Debian 13 base image (python:3.14-slim): no fixed version available yet.
 # Review regularly and remove entries once Debian ships a fix.
 # util-linux
 CVE-2026-76642
 CVE-2026-78408
 CVE-2026-78409
 CVE-2026-78410
 # acl
 CVE-2026-54369
 # ncurses
 CVE-2025-69720
 # systemd
 CVE-2026-16742
 # perl-base (fix deferred by Debian)
 CVE-2026-9538
@@ -0,0 +1,28 @@
 ---
 name: 🐛 Bug Report
 about: If something is not working as expected 🤔.
 ---
 ## Bug Report
 **Problematic behavior**
 A clear and concise description of the behavior.
 **Expected behavior/code**
 A clear and concise description of what you expected to happen (or code).
 **Steps to Reproduce**
 1. Do this...
 2. Then this...
 3. And then the bug happens!
 **Environment**
 - Meet version:
 - Platform:
 **Possible Solution**
 <!--- Only if you have suggestions on a fix for the bug -->
 **Additional context/Screenshots**
 Add any other context about the problem here. If applicable, add screenshots to help explain.
@@ -0,0 +1,23 @@
 ---
 name: ✨ Feature Request
 about: I have a suggestion (and may want to build it 💪)!
 ---
 ## Feature Request
 **Is your feature request related to a problem or unsupported use case? Please describe.**
 A clear and concise description of what the problem is. For example: I need to do some task and I have an issue...
 **Describe the solution you'd like**
 A clear and concise description of what you want to happen. Add any considered drawbacks.
 **Describe alternatives you've considered**
 A clear and concise description of any alternative solutions or features you've considered.
 **Discovery, Documentation, Adoption, Migration Strategy**
 If you can, explain how users will be able to use this and possibly write out a version the docs (if applicable).
 Maybe a screenshot or design?
 **Do you want to work on it through a Pull Request?**
 <!-- Make sure to coordinate with us before you spend too much time working on an implementation! -->
@@ -0,0 +1,22 @@
 ---
 name: 🤗 Support Question
 about: If you have a question 💬, or something was not clear from the docs!
 ---
 <!-- ^ Click "Preview" for a nicer view! ^
 We primarily use GitHub as an issue tracker. If however you're encountering an issue not covered in the docs, we may be able to help! -->
 ---
 Please make sure you have read our [main Readme](https://github.com/numerique-gouv/meet).
 Also make sure it was not already answered in [an open or close issue](https://github.com/numerique-gouv/meet/issues).
 If your question was not covered, and you feel like it should be, fire away! We'd love to improve our docs! 👌
 **Topic**
 What's the general area of your question: for example, docker setup, database schema, search functionality,...
 **Question**
 Try to be as specific as possible so we can help you as best we can. Please be patient 🙏
@@ -0,0 +1,11 @@
 ## Purpose
 Description...
 ## Proposal
 Description...
 - [] item 1...
 - [] item 2...
@@ -1,19 +0,0 @@
 name: Changelog Workflow
 on:
  push:
    branches:
      - main
  pull_request:
    types: [opened, synchronize, reopened, labeled, unlabeled]
 permissions:
  contents: read
 concurrency:
  group: ${{ github.workflow }}-${{ github.ref }}-${{ github.event.pull_request.number || github.sha }}
  cancel-in-progress: true
 jobs:
  changelog:
    uses: suitenumerique/ci/.github/workflows/_changelog.yml@ca6401ac83e981e5b0a94f06f68baaa6e6d0a436 # v0.0.1
@@ -1,235 +0,0 @@
 name: CI
 on:
  push:
    branches:
      - main
  pull_request:
    branches:
      - "*"
 permissions:
  contents: read
 jobs:
  lint-python:
    name: lint ${{ matrix.service }}
    strategy:
      fail-fast: false
      matrix:
        include:
          - service: backend
            working_directory: src/backend
            pylint_targets: meet demo core
          - service: agents
            working_directory: src/agents
            pylint_targets: ""
          - service: summary
            working_directory: src/summary
            pylint_targets: ""
    uses: suitenumerique/ci/.github/workflows/_python-lint.yml@ca6401ac83e981e5b0a94f06f68baaa6e6d0a436 # v0.0.1
    with:
      working_directory: ${{ matrix.working_directory }}
      python_version: "3.13"
      pylint_targets: ${{ matrix.pylint_targets }}
  test-back:
    runs-on: ubuntu-latest
    permissions:
      contents: read
    defaults:
      run:
        working-directory: src/backend
    services:
      postgres:
        image: postgres:16
        env:
          POSTGRES_DB: meet
          POSTGRES_USER: dinum
          POSTGRES_PASSWORD: pass
        ports:
          - 5432:5432
        # needed because the postgres container does not provide a healthcheck
        options: --health-cmd pg_isready --health-interval 10s --health-timeout 5s --health-retries 5
      redis:
        image: redis:5
        ports:
          - 6379:6379
        # Set health checks to wait until redis has started
        options: >-
          --health-cmd "redis-cli ping"
          --health-interval 10s
          --health-timeout 5s
          --health-retries 5
    env:
      DJANGO_CONFIGURATION: Test
      DJANGO_SETTINGS_MODULE: meet.settings
      DJANGO_SECRET_KEY: ThisIsAnExampleKeyForTestPurposeOnly
      OIDC_OP_JWKS_ENDPOINT: /endpoint-for-test-purpose-only
      DB_HOST: localhost
      DB_NAME: meet
      DB_USER: dinum
      DB_PASSWORD: pass
      DB_PORT: 5432
      REDIS_URL: redis://localhost:6379/1
      STORAGES_STATICFILES_BACKEND: django.contrib.staticfiles.storage.StaticFilesStorage
      AWS_S3_ENDPOINT_URL: http://localhost:9000
      AWS_S3_ACCESS_KEY_ID: meet-access-key
      AWS_S3_SECRET_ACCESS_KEY: meet-secret-access-key
      AWS_S3_REGION_NAME: local
      OIDC_RS_CLIENT_ID: meet
      OIDC_RS_CLIENT_SECRET: ThisIsAnExampleKeyForDevPurposeOnly
      OIDC_OP_INTROSPECTION_ENDPOINT: https://oidc.example.com/introspect
      OIDC_OP_URL: https://oidc.example.com
      MEDIA_BASE_URL: http://localhost:8083
    steps:
      - name: Checkout repository
        uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6.1.0
      - name: Create writable /data
        run: |
          sudo mkdir -p /data/media && \
          sudo mkdir -p /data/static
      - name: Build or restore the mail templates
        uses: suitenumerique/ci/actions/mail-templates@ca6401ac83e981e5b0a94f06f68baaa6e6d0a436 # v0.0.1
      # Creates the access key and the bucket on startup
      - name: Start Garage
        run: |
          docker run -d --name garage \
            -p 9000:9000 \
            -v "${GITHUB_WORKSPACE}/docker/files/etc/garage/garage.toml:/etc/garage.toml:ro" \
            -e "GARAGE_RPC_SECRET=$(openssl rand -hex 32)" \
            -e "GARAGE_DEFAULT_ACCESS_KEY=meet-access-key" \
            -e "GARAGE_DEFAULT_SECRET_KEY=meet-secret-access-key" \
            -e "GARAGE_DEFAULT_BUCKET=meet-media-storage" \
            dxflrs/garage:v2.4.1 \
            /garage server --single-node --default-bucket
      - name: Wait for Garage to be ready
        run: |
          timeout 30 sh -c 'until docker exec garage /garage health; do sleep 1; done'
      - name: Install Python
        uses: actions/setup-python@ece7cb06caefa5fff74198d8649806c4678c61a1 # v6.3.0
        with:
          python-version: "3.13"
      - name: Install uv
        uses: astral-sh/setup-uv@37802adc94f370d6bfd71619e3f0bf239e1f3b78 # v7.6.0
      - name: Install the dependencies
        run: uv sync --locked --all-extras
      - name: Install gettext (required to compile messages)
        run: |
          sudo apt-get update
          sudo apt-get install -y gettext
      - name: Generate a MO file from strings extracted from the project
        run: uv run --no-sync --no-build python manage.py compilemessages
      - name: Run tests
        run: uv run --no-sync --no-build pytest -n 2
  test-summary:
    runs-on: ubuntu-latest
    permissions:
      contents: read
    defaults:
      run:
        working-directory: src/summary
    env:
      AUTHORIZED_TENANTS: '[{"id": "test-tenant", "api_key": "test-api-token", "webhook_url": "https://example.com/webhook", "webhook_api_key": "test-webhook-api-key"}]'
      AWS_STORAGE_BUCKET_NAME: "http://meet-media-storage"
      AWS_S3_ENDPOINT_URL: "garage:9000"
      AWS_S3_ACCESS_KEY_ID: "meet-access-key"
      AWS_S3_SECRET_ACCESS_KEY: "meet-secret-access-key"
      WHISPERX_BASE_URL: "https://configure-your-url.com"
      WHISPERX_ASR_MODEL: "large-v2"
      WHISPERX_API_KEY: "test-whisperx-secret"
      WHISPERX_DEFAULT_LANGUAGE: "fr"
      LLM_BASE_URL: "https://configure-your-url.com"
      LLM_API_KEY: "test-llm-secret"
      LLM_MODEL: "test-llm-model"
    steps:
      - name: Checkout repository
        uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6.1.0
      - name: Install ffmpeg
        run: |
          sudo apt-get update
          sudo apt-get install -y ffmpeg
      - name: Install Python
        uses: actions/setup-python@ece7cb06caefa5fff74198d8649806c4678c61a1 # v6.3.0
        with:
          python-version: "3.13"
      - name: Install uv
        uses: astral-sh/setup-uv@37802adc94f370d6bfd71619e3f0bf239e1f3b78 # v7.6.0
      - name: Install the project
        run: uv sync --locked --all-extras
      - name: Run summary tests
        run: uv run --no-sync --no-build pytest
  lint-front:
    runs-on: ubuntu-latest
    permissions:
      contents: read
    steps:
      - name: Checkout repository
        uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6.1.0
      - name: Install dependencies
        run: cd src/frontend/ && npm ci --ignore-scripts
      - name: Check linting
        run: cd src/frontend/ && npm run lint
      - name: Check format
        run: cd src/frontend/ && npm run check
  lint-sdk:
    runs-on: ubuntu-latest
    permissions:
      contents: read
    defaults:
      run:
        working-directory: src/sdk/library
    steps:
      - name: Checkout repository
        uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6.1.0
      - name: Install dependencies
        run: npm ci --ignore-scripts
      - name: Check linting
        run: npm run lint
      - name: Check format
        run: npm run check
  build-sdk:
    runs-on: ubuntu-latest
    permissions:
      contents: read
    needs: lint-sdk
    defaults:
      run:
        working-directory: src/sdk/library
    steps:
      - name: Checkout repository
        uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6.1.0
      - name: Install dependencies
        run: npm ci --ignore-scripts
      - name: Build SDK
        run: npm run build
@@ -1,14 +0,0 @@
 name: Project quality Workflow
 on:
  pull_request:
 permissions:
  contents: read
 jobs:
  quality:
    uses: suitenumerique/ci/.github/workflows/_project-quality.yml@ca6401ac83e981e5b0a94f06f68baaa6e6d0a436 # v0.0.1
    with:
      print_check_paths: src/backend src/summary src/agents
      codespell_ignore_words: "unsecure"
@@ -0,0 +1,33 @@
 name: Download Crowdin translations
 on:
  workflow_dispatch:
    types: [file-fully-translated]
 permissions:
  contents: write
  pull-requests: write
 jobs:
  crowdin:
    runs-on: ubuntu-latest
    steps:
      - name: Checkout
        uses: actions/checkout@v6
      - name: Download Crowdin files
        uses: crowdin/github-action@v2
        with:
          upload_sources: false
          upload_translations: false
          download_translations: true
          localization_branch_name: l10n_crowdin_translations
          create_pull_request: true
          pull_request_title: "New Crowdin translations"
          pull_request_body: "New Crowdin pull request with translations"
          pull_request_base_branch_name: "main"
        env:
          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
          CROWDIN_PROJECT_ID: ${{ secrets.CROWDIN_PROJECT_ID }}
          CROWDIN_PERSONAL_TOKEN: ${{ secrets.CROWDIN_PERSONAL_TOKEN }}
          CROWDIN_BASE_PATH: ${{ github.workspace }}
@@ -1,5 +1,5 @@
-name: Docker images
+name: Docker Hub Workflow
-run-name: Docker images
+run-name: Docker Hub Workflow
 on:
  workflow_dispatch:
@@ -15,62 +15,265 @@ on:
 permissions:
  contents: read
 env:
  DOCKER_USER: 1001:127
  DOCKER_CONTAINER_REGISTRY_HOSTNAME: docker.io
  DOCKER_CONTAINER_REGISTRY_NAMESPACE: lasuite
  IS_MULTI_PLATFORM_BUILD: ${{ startsWith(github.ref, 'refs/tags/v') }}
  BUILD_PLATFORMS: ${{ startsWith(github.ref, 'refs/tags/v') && 'linux/amd64,linux/arm64' || 'linux/amd64' }}
 jobs:
-  build-and-push:
+  build-and-push-backend:
-    name: ${{ matrix.service }}
+    runs-on: ubuntu-latest
-    strategy:
+    permissions:
-      fail-fast: false
+      contents: read
-      matrix:
+    steps:
-        include:
+      -
-          - service: backend
+        name: Checkout repository
-            image_name: lasuite/meet-backend
+        uses: actions/checkout@v6
-            context: .
+      -
-            file: ./Dockerfile
+        name: Set up QEMU
-            target: backend-production
+        if: env.IS_MULTI_PLATFORM_BUILD == 'true'
-          - service: frontend
+        uses: docker/setup-qemu-action@v3
-            image_name: lasuite/meet-frontend
+      -
-            context: .
+        name: Set up Docker Buildx
-            file: ./src/frontend/Dockerfile
+        uses: docker/setup-buildx-action@v3
-            target: frontend-production
+      -
-          - service: frontend-dinum
+        name: Docker meta
-            image_name: lasuite/meet-frontend-dinum
+        id: meta
-            context: .
+        uses: docker/metadata-action@v5
-            file: ./docker/dinum-frontend/Dockerfile
+        with:
-            target: frontend-production
+          images: '${{ env.DOCKER_CONTAINER_REGISTRY_NAMESPACE }}/meet-backend'
-          - service: summary
+      -
-            image_name: lasuite/meet-summary
+        name: Login to DockerHub
-            context: ./src/summary
+        if: github.event_name != 'pull_request' || startsWith(github.head_ref, 'integration/')
-            file: ./src/summary/Dockerfile
+        uses: docker/login-action@v3
-            target: production
+        with:
-          - service: agents
+          username: ${{ secrets.DOCKER_HUB_USER }}
-            image_name: lasuite/meet-agents
+          password: ${{ secrets.DOCKER_HUB_PASSWORD }}
-            context: ./src/agents
+      -
-            file: ./src/agents/Dockerfile
+        name: Run trivy scan
-            target: production
+        uses: numerique-gouv/action-trivy-cache@main
-    uses: suitenumerique/ci/.github/workflows/_docker-publish.yml@ca6401ac83e981e5b0a94f06f68baaa6e6d0a436 # v0.0.1
+        with:
-    with:
+          docker-build-args: '--target backend-production -f Dockerfile'
-      image_name: ${{ matrix.image_name }}
+          docker-image-name: '${{ env.DOCKER_CONTAINER_REGISTRY_HOSTNAME }}/${{ env.DOCKER_CONTAINER_REGISTRY_NAMESPACE }}/meet-backend:${{ github.sha }}'
-      context: ${{ matrix.context }}
+      -
-      file: ${{ matrix.file }}
+        name: Build and push
-      target: ${{ matrix.target }}
+        uses: docker/build-push-action@v6
-      docker_user: "1001:127"
+        with:
-      is_multi_platform: ${{ startsWith(github.ref, 'refs/tags/v') }}
+          context: .
-      should_push: ${{ github.event_name != 'pull_request' || startsWith(github.head_ref, 'integration/') }}
+          target: backend-production
-      trivy_scan: true
+          platforms: ${{ env.BUILD_PLATFORMS }}
-      trivy_ignore_files: ./.github/.trivyignore
+          build-args: DOCKER_USER=${{ env.DOCKER_USER }}:-1000
-    secrets:
+          push: ${{ github.event_name != 'pull_request' || startsWith(github.head_ref, 'integration/') }}
-      DOCKER_HUB_USER: ${{ secrets.DOCKER_HUB_USER }}
+          tags: ${{ steps.meta.outputs.tags }}
-      DOCKER_HUB_PASSWORD: ${{ secrets.DOCKER_HUB_PASSWORD }}
+          labels: ${{ steps.meta.outputs.labels }}
  build-and-push-frontend-generic:
    runs-on: ubuntu-latest
    permissions:
      contents: read
    steps:
      -
        name: Checkout repository
        uses: actions/checkout@v6
      -
        name: Set up QEMU
        if: env.IS_MULTI_PLATFORM_BUILD == 'true'
        uses: docker/setup-qemu-action@v3
      -
        name: Set up Docker Buildx
        uses: docker/setup-buildx-action@v3
      -
        name: Docker meta
        id: meta
        uses: docker/metadata-action@v5
        with:
          images: '${{ env.DOCKER_CONTAINER_REGISTRY_NAMESPACE }}/meet-frontend'
      -
        name: Login to DockerHub
        if: github.event_name != 'pull_request' || startsWith(github.head_ref, 'integration/')
        uses: docker/login-action@v3
        with:
          username: ${{ secrets.DOCKER_HUB_USER }}
          password: ${{ secrets.DOCKER_HUB_PASSWORD }}
      -
        name: Run trivy scan
        uses: numerique-gouv/action-trivy-cache@main
        with:
          docker-build-args: '-f src/frontend/Dockerfile --target frontend-production'
          docker-image-name: '${{ env.DOCKER_CONTAINER_REGISTRY_HOSTNAME }}/${{ env.DOCKER_CONTAINER_REGISTRY_NAMESPACE }}/meet-frontend:${{ github.sha }}'
      -
        name: Build and push
        uses: docker/build-push-action@v6
        with:
          context: .
          file: ./src/frontend/Dockerfile
          target: frontend-production
          platforms: ${{ env.BUILD_PLATFORMS }}
          build-args: DOCKER_USER=${{ env.DOCKER_USER }}:-1000
          push: ${{ github.event_name != 'pull_request' || startsWith(github.head_ref, 'integration/') }}
          tags: ${{ steps.meta.outputs.tags }}
          labels: ${{ steps.meta.outputs.labels }}
  build-and-push-frontend-dinum:
    runs-on: ubuntu-latest
    permissions:
      contents: read
    steps:
      -
        name: Checkout repository
        uses: actions/checkout@v6
      -
        name: Set up QEMU
        if: env.IS_MULTI_PLATFORM_BUILD == 'true'
        uses: docker/setup-qemu-action@v3
      -
        name: Set up Docker Buildx
        uses: docker/setup-buildx-action@v3
      -
        name: Docker meta
        id: meta
        uses: docker/metadata-action@v5
        with:
          images: '${{ env.DOCKER_CONTAINER_REGISTRY_NAMESPACE }}/meet-frontend-dinum'
      -
        name: Login to DockerHub
        if: github.event_name != 'pull_request' || startsWith(github.head_ref, 'integration/')
        uses: docker/login-action@v3
        with:
          username: ${{ secrets.DOCKER_HUB_USER }}
          password: ${{ secrets.DOCKER_HUB_PASSWORD }}
      -
        name: Run trivy scan
        uses: numerique-gouv/action-trivy-cache@main
        with:
          docker-build-args: '-f docker/dinum-frontend/Dockerfile --target frontend-production'
          docker-image-name: '${{ env.DOCKER_CONTAINER_REGISTRY_HOSTNAME }}/${{ env.DOCKER_CONTAINER_REGISTRY_NAMESPACE }}/meet-frontend-dinum:${{ github.sha }}'
      -
        name: Build and push
        uses: docker/build-push-action@v6
        with:
          context: .
          file: ./docker/dinum-frontend/Dockerfile
          target: frontend-production
          platforms: ${{ env.BUILD_PLATFORMS }}
          build-args: DOCKER_USER=${{ env.DOCKER_USER }}:-1000
          push: ${{ github.event_name != 'pull_request' || startsWith(github.head_ref, 'integration/') }}
          tags: ${{ steps.meta.outputs.tags }}
          labels: ${{ steps.meta.outputs.labels }}
  build-and-push-summary:
    runs-on: ubuntu-latest
    permissions:
      contents: read
    steps:
      -
        name: Checkout repository
        uses: actions/checkout@v6
      -
        name: Set up QEMU
        if: env.IS_MULTI_PLATFORM_BUILD == 'true'
        uses: docker/setup-qemu-action@v3
      -
        name: Set up Docker Buildx
        uses: docker/setup-buildx-action@v3
      -
        name: Docker meta
        id: meta
        uses: docker/metadata-action@v5
        with:
          images: '${{ env.DOCKER_CONTAINER_REGISTRY_NAMESPACE }}/meet-summary'
      -
        name: Login to DockerHub
        if: github.event_name != 'pull_request' || startsWith(github.head_ref, 'integration/')
        uses: docker/login-action@v3
        with:
          username: ${{ secrets.DOCKER_HUB_USER }}
          password: ${{ secrets.DOCKER_HUB_PASSWORD }}
      -
        name: Run trivy scan
        uses: numerique-gouv/action-trivy-cache@main
        continue-on-error: true
        with:
          docker-build-args: '-f src/summary/Dockerfile --target production'
          docker-image-name: '${{ env.DOCKER_CONTAINER_REGISTRY_HOSTNAME }}/${{ env.DOCKER_CONTAINER_REGISTRY_NAMESPACE }}/meet-summary:${{ github.sha }}'
          docker-context: './src/summary'
      -
        name: Build and push
        uses: docker/build-push-action@v6
        with:
          context: ./src/summary
          file: ./src/summary/Dockerfile
          target: production
          platforms: ${{ env.BUILD_PLATFORMS }}
          build-args: DOCKER_USER=${{ env.DOCKER_USER }}:-1000
          push: ${{ github.event_name != 'pull_request' || startsWith(github.head_ref, 'integration/') }}
          tags: ${{ steps.meta.outputs.tags }}
          labels: ${{ steps.meta.outputs.labels }}
  build-and-push-agents:
    runs-on: ubuntu-latest
    permissions:
      contents: read
    steps:
      -
        name: Checkout repository
        uses: actions/checkout@v6
      -
        name: Set up QEMU
        if: env.IS_MULTI_PLATFORM_BUILD == 'true'
        uses: docker/setup-qemu-action@v3
      -
        name: Set up Docker Buildx
        uses: docker/setup-buildx-action@v3
      -
        name: Docker meta
        id: meta
        uses: docker/metadata-action@v5
        with:
          images: lasuite/meet-agents
      -
        name: Login to DockerHub
        if: github.event_name != 'pull_request' || startsWith(github.head_ref, 'integration/')
        uses: docker/login-action@v3
        with:
          username: ${{ secrets.DOCKER_HUB_USER }}
          password: ${{ secrets.DOCKER_HUB_PASSWORD }}
      -
        name: Run trivy scan
        uses: numerique-gouv/action-trivy-cache@main
        continue-on-error: true
        with:
          docker-build-args: '-f src/agents/Dockerfile --target production'
          docker-image-name: '${{ env.DOCKER_CONTAINER_REGISTRY_HOSTNAME }}/${{ env.DOCKER_CONTAINER_REGISTRY_NAMESPACE }}/meet-agents:${{ github.sha }}'
          docker-context: './src/agents'
      -
        name: Build and push
        uses: docker/build-push-action@v6
        with:
          context: ./src/agents
          file: ./src/agents/Dockerfile
          target: production
          platforms: ${{ env.BUILD_PLATFORMS }}
          build-args: DOCKER_USER=${{ env.DOCKER_USER }}:-1000
          push: ${{ github.event_name != 'pull_request' || startsWith(github.head_ref, 'integration/') }}
          tags: ${{ steps.meta.outputs.tags }}
          labels: ${{ steps.meta.outputs.labels }}
  notify-argocd:
    permissions:
      contents: read
    needs:
-      - build-and-push
+      - build-and-push-frontend-generic
      - build-and-push-frontend-dinum
      - build-and-push-backend
      - build-and-push-summary
      - build-and-push-agents
    runs-on: ubuntu-latest
    if: github.event_name != 'pull_request'
    steps:
-      - uses: suitenumerique/ci/actions/argocd-webhook-notification@ca6401ac83e981e5b0a94f06f68baaa6e6d0a436 # v0.0.1
+      - uses: numerique-gouv/action-argocd-webhook-notification@main
        id: notify
        with:
          deployment_repo_path: "${{ secrets.DEPLOYMENT_REPO_URL }}"
@@ -0,0 +1,395 @@
 name: meet Workflow
 on:
  push:
    branches:
      - main
  pull_request:
    branches:
      - "*"
 permissions:
  contents: read
 jobs:
  lint-git:
    runs-on: ubuntu-latest
    if: github.event_name == 'pull_request' # Makes sense only for pull requests
    permissions:
      contents: read
    steps:
      - name: Checkout repository
        uses: actions/checkout@v6
        with:
          fetch-depth: 0
      - name: show
        run: git log
      - name: Enforce absence of print statements in code
        if: always()
        run: |
          ! git diff origin/${{ github.event.pull_request.base.ref }}..HEAD -- . ':(exclude)**/meet.yml' | grep "print("
      - name: Check absence of fixup commits
        if: always()
        run: |
          ! git log | grep 'fixup!'
      - name: Install gitlint
        if: always()
        run: pip install --user requests gitlint
      - name: Lint commit messages added to main
        if: always()
        run: ~/.local/bin/gitlint --commits origin/${{ github.event.pull_request.base.ref }}..HEAD
  check-changelog:
    runs-on: ubuntu-latest
    if: |
      contains(github.event.pull_request.labels.*.name, 'noChangeLog') == false &&
      github.event_name == 'pull_request'
    permissions:
        contents: read
    steps:
      - name: Checkout repository
        uses: actions/checkout@v6
        with:
          fetch-depth: 50
      - name: Check that the CHANGELOG has been modified in the current branch
        run: git diff --name-only ${{ github.event.pull_request.base.sha }} ${{ github.event.after }} | grep 'CHANGELOG.md'
  lint-changelog:
    runs-on: ubuntu-latest
    permissions:
      contents: read
    steps:
      - name: Checkout repository
        uses: actions/checkout@v6
      - name: Check CHANGELOG max line length
        run: |
          max_line_length=$(cat CHANGELOG.md | grep -Ev "^\[.*\]: https://github.com" | wc -L)
          if [ $max_line_length -ge 80 ]; then
            echo "ERROR: CHANGELOG has lines longer than 80 characters."
            exit 1
          fi
  build-mails:
    runs-on: ubuntu-latest
    permissions:
      contents: read
    defaults:
      run:
        working-directory: src/mail
    steps:
      - name: Checkout repository
        uses: actions/checkout@v6
      - name: Install Node.js
        uses: actions/setup-node@v6
        with:
          node-version: "22"
      - name: Restore the mail templates
        uses: actions/cache@v5
        id: mail-templates
        with:
          path: "src/backend/core/templates/mail"
          key: mail-templates-${{ hashFiles('src/mail/mjml') }}
      - name: Install yarn
        if: steps.mail-templates.outputs.cache-hit != 'true'
        run: npm install -g yarn
      - name: Install node dependencies
        if: steps.mail-templates.outputs.cache-hit != 'true'
        run: yarn install --frozen-lockfile
      - name: Build mails
        if: steps.mail-templates.outputs.cache-hit != 'true'
        run: yarn build
      - name: Cache mail templates
        if: steps.mail-templates.outputs.cache-hit != 'true'
        uses: actions/cache@v5
        with:
          path: "src/backend/core/templates/mail"
          key: mail-templates-${{ hashFiles('src/mail/mjml') }}
  lint-back:
    runs-on: ubuntu-latest
    permissions:
      contents: read
    defaults:
      run:
        working-directory: src/backend
    steps:
      - name: Checkout repository
        uses: actions/checkout@v6
      - name: Install Python
        uses: actions/setup-python@v6
        with:
          python-version: "3.13"
      - name: Install uv
        uses: astral-sh/setup-uv@v7
      - name: Install the project
        run: uv sync --locked --all-extras
      - name: Check code formatting with ruff
        run: uv run ruff format . --diff
      - name: Lint code with ruff
        run: uv run ruff check .
      - name: Lint code with pylint
        run: uv run pylint meet demo core
  lint-agents:
    runs-on: ubuntu-latest
    permissions:
      contents: read
    defaults:
      run:
        working-directory: src/agents
    steps:
      - name: Checkout repository
        uses: actions/checkout@v6
      - name: Install Python
        uses: actions/setup-python@v6
        with:
          python-version: "3.13"
      - name: Install uv
        uses: astral-sh/setup-uv@v7
      - name: Install the project
        run: uv sync --locked --all-extras
      - name: Check code formatting with ruff
        run: uv run ruff format . --diff
      - name: Lint code with ruff
        run: uv run ruff check .
  lint-summary:
    runs-on: ubuntu-latest
    permissions:
      contents: read
    defaults:
      run:
        working-directory: src/summary
    steps:
      - name: Checkout repository
        uses: actions/checkout@v6
      - name: Install Python
        uses: actions/setup-python@v6
        with:
          python-version: "3.13"
          cache: "pip"
      - name: Install development dependencies
        run: pip install --user .[dev]
      - name: Check code formatting with ruff
        run: ~/.local/bin/ruff format . --diff
      - name: Lint code with ruff
        run: ~/.local/bin/ruff check .
  test-back:
    runs-on: ubuntu-latest
    needs: build-mails
    permissions:
      contents: read
    defaults:
      run:
        working-directory: src/backend
    services:
      postgres:
        image: postgres:16
        env:
          POSTGRES_DB: meet
          POSTGRES_USER: dinum
          POSTGRES_PASSWORD: pass
        ports:
          - 5432:5432
        # needed because the postgres container does not provide a healthcheck
        options: --health-cmd pg_isready --health-interval 10s --health-timeout 5s --health-retries 5
      redis:
        image: redis:5
        ports:
          - 6379:6379
        # Set health checks to wait until redis has started
        options: >-
          --health-cmd "redis-cli ping"
          --health-interval 10s
          --health-timeout 5s
          --health-retries 5
    env:
      DJANGO_CONFIGURATION: Test
      DJANGO_SETTINGS_MODULE: meet.settings
      DJANGO_SECRET_KEY: ThisIsAnExampleKeyForTestPurposeOnly
      OIDC_OP_JWKS_ENDPOINT: /endpoint-for-test-purpose-only
      DB_HOST: localhost
      DB_NAME: meet
      DB_USER: dinum
      DB_PASSWORD: pass
      DB_PORT: 5432
      REDIS_URL: redis://localhost:6379/1
      STORAGES_STATICFILES_BACKEND: django.contrib.staticfiles.storage.StaticFilesStorage
      AWS_S3_ENDPOINT_URL: http://localhost:9000
      AWS_S3_ACCESS_KEY_ID: meet
      AWS_S3_SECRET_ACCESS_KEY: password
      OIDC_RS_CLIENT_ID: meet
      OIDC_RS_CLIENT_SECRET: ThisIsAnExampleKeyForDevPurposeOnly
      OIDC_OP_INTROSPECTION_ENDPOINT: https://oidc.example.com/introspect
      OIDC_OP_URL: https://oidc.example.com
      MEDIA_BASE_URL: http://localhost:8083
    steps:
      - name: Checkout repository
        uses: actions/checkout@v6
      - name: Create writable /data
        run: |
          sudo mkdir -p /data/media && \
          sudo mkdir -p /data/static
      - name: Restore the mail templates
        uses: actions/cache@v5
        id: mail-templates
        with:
          path: "src/backend/core/templates/mail"
          key: mail-templates-${{ hashFiles('src/mail/mjml') }}
      - name: Start MinIO
        run: |
          docker pull minio/minio
          docker run -d --name minio \
            -p 9000:9000 \
            -e "MINIO_ACCESS_KEY=meet" \
            -e "MINIO_SECRET_KEY=password" \
            -v /data/media:/data \
            minio/minio server --console-address :9001 /data
      # Tool to wait for a service to be ready
      - name: Install Dockerize
        run: |
          curl -sSL https://github.com/jwilder/dockerize/releases/download/v0.8.0/dockerize-linux-amd64-v0.8.0.tar.gz | sudo tar -C /usr/local/bin -xzv
      - name: Wait for MinIO to be ready
        run: |
          dockerize -wait tcp://localhost:9000 -timeout 10s
      - name: Configure MinIO
        run: |
          MINIO=$(docker ps | grep minio/minio | sed -E 's/.*\s+([a-zA-Z0-9_-]+)$/\1/')
          docker exec ${MINIO} sh -c \
            "mc alias set meet http://localhost:9000 meet password && \
            mc alias ls && \
            mc mb meet/meet-media-storage"
      - name: Install Python
        uses: actions/setup-python@v6
        with:
          python-version: "3.13"
      - name: Install uv
        uses: astral-sh/setup-uv@v7
      - name: Install the dependencies
        run: uv sync --locked --all-extras
      - name: Install gettext (required to compile messages)
        run: |
          sudo apt-get update
          sudo apt-get install -y gettext
      - name: Generate a MO file from strings extracted from the project
        run: uv run python manage.py compilemessages
      - name: Run tests
        run: uv run pytest -n 2
  test-summary:
    runs-on: ubuntu-latest
    permissions:
      contents: read
    defaults:
      run:
        working-directory: src/summary
    env:
      AUTHORIZED_TENANTS: '[{"id": "test-tenant", "api_key": "test-api-token", "webhook_url": "https://example.com/webhook", "webhook_api_key": "test-webhook-api-key"}]'
      AWS_STORAGE_BUCKET_NAME: "http://meet-media-storage"
      AWS_S3_ENDPOINT_URL: "minio:9000"
      AWS_S3_ACCESS_KEY_ID: "meet"
      AWS_S3_SECRET_ACCESS_KEY: "password"
      WHISPERX_BASE_URL: "https://configure-your-url.com"
      WHISPERX_ASR_MODEL: "large-v2"
      WHISPERX_API_KEY: "test-whisperx-secret"
      WHISPERX_DEFAULT_LANGUAGE: "fr"
      LLM_BASE_URL: "https://configure-your-url.com"
      LLM_API_KEY: "test-llm-secret"
      LLM_MODEL: "test-llm-model"
    steps:
      - name: Checkout repository
        uses: actions/checkout@v6
      - name: Install ffmpeg
        run: |
          sudo apt-get update
          sudo apt-get install -y ffmpeg
      - name: Install Python
        uses: actions/setup-python@v6
        with:
          python-version: "3.13"
          cache: "pip"
      - name: Install development dependencies
        run: pip install --user .[dev]
      - name: Run summary tests
        run: ~/.local/bin/pytest
  lint-front:
    runs-on: ubuntu-latest
    permissions:
      contents: read
    steps:
      - name: Checkout repository
        uses: actions/checkout@v6
      - name: Install dependencies
        run: cd src/frontend/ && npm ci
      - name: Check linting
        run: cd src/frontend/ && npm run lint
      - name: Check format
        run: cd src/frontend/ && npm run check
  lint-sdk:
    runs-on: ubuntu-latest
    permissions:
      contents: read
    defaults:
      run:
        working-directory: src/sdk/library
    steps:
      - name: Checkout repository
        uses: actions/checkout@v6
      - name: Install dependencies
        run: npm ci
      - name: Check linting
        run: npm run lint
      - name: Check format
        run: npm run check
  build-sdk:
    runs-on: ubuntu-latest
    permissions:
      contents: read
    needs: lint-sdk
    defaults:
      run:
        working-directory: src/sdk/library
    steps:
      - name: Checkout repository
        uses: actions/checkout@v6
      - name: Install dependencies
        run: npm ci
      - name: Build SDK
        run: npm run build
@@ -1,17 +1,33 @@
-name: Release Helm chart
+name: Release Chart
 run-name: Release Chart
 on:
  push:
    branches:
      - main
    paths:
      - src/helm/meet/**
 permissions:
  contents: read
 jobs:
  release:
    permissions:
      contents: write
-    uses: suitenumerique/ci/.github/workflows/_release-helm-chart.yml@ca6401ac83e981e5b0a94f06f68baaa6e6d0a436 # v0.0.1
+    runs-on: ubuntu-latest
    steps:
      - name: Checkout
        uses: actions/checkout@v6
        with:
          fetch-depth: 0
      - name: Cleanup
        run: rm -rf ./src/helm/extra
      - name: Install Helm
        uses: azure/setup-helm@v4
        env:
          GITHUB_TOKEN: "${{ secrets.GITHUB_TOKEN }}"
      - name: Publish Helm charts
        uses: numerique-gouv/helm-gh-pages@add-overwrite-option
        with:
          charts_dir: ./src/helm
          linting: on
          token: ${{ secrets.GITHUB_TOKEN }}
@@ -1,21 +0,0 @@
 name: Security analysis
 on:
  push:
    branches:
      - main
  pull_request:
    branches:
      - "**"
 permissions: {}
 jobs:
  zizmor:
    permissions:
      contents: read
      actions: read
      security-events: write
    uses: suitenumerique/ci/.github/workflows/_zizmor.yml@ca6401ac83e981e5b0a94f06f68baaa6e6d0a436 # v0.0.1
    with:
      config: .github/zizmor.yml
@@ -1,5 +0,0 @@
 rules:
  unpinned-uses:
    config:
      policies:
        "suitenumerique/*": ref-pin
@@ -86,6 +86,3 @@ docker/livekit/rootCA.pem
 # Frontend rollup-plugin-visualizer
 /src/frontend/rollup-plugin-visualizer/*
 # NixOS
 .devenv
@@ -10,138 +10,12 @@ and this project adheres to
 ### Added
 - 🔒(backend) throttle meeting link generation
 - 🔒️(backend) add a daily cap on room creation
 ### Fixed
 - 🐛(frontend) enforce recording-mode permissions on the checkboxes
 - 🔒️(agents) fix util-linux CVEs reported by Cyberwatch
 - 🔒️(backend) fix HIGH CVEs in Django and urllib3
 - 🔒️(agents) upgrade libpcre2-8-0 to fix CVE-2026-103111
 ## [1.33.0] - 2026-09-30
 ### Added
 - ✨(backend) purge rooms inactive for a configurable period
 - 🔨(makefile) add targets to list and download files stored in Garage
 ### Changed
 - ⬆️(backend) update python dependencies
 - ⬆️(summary) update python dependencies
 - ⬆️(agents) update python dependencies
 - ♻️(agents) replace the minio client by boto3
 - 🔧(compose) replace MinIO by Garage for local development
 - 🔧(helm) point media services to Garage by default
 ### Fixed
 - 🔒️(backend) fix critical and high CVEs in PyJWT
 - ⚡️(frontend) disable posthog-js periodic feature flag reloads
 ## [1.32.1] - 2026-09-25
 ### Fixed
 - 🔒️(backend) fix CVE-2026-73228 and CVE-2026-73229 in drf
 - 🔒️(agent) fix CRITICAL CVE-2026-63072 / CVE-2026-63073 in libssl3t64
 ## [1.32.0] - 2026-09-25
 ### Added
 - ✨(backend) make the LiveKit default video codec configurable
 - 🔧(dev) add support for Bureautix workstations
 - ✨(frontend) add screen share zoom controls #1498
 ### Changed
 - 🔥(backend) remove unused API viewset and permission helpers
 - 🔊(backend) pin the dockerflow logger level to WARNING
 - 🚑️(summary) serve health endpoints with the dockerflow router
 - ♻️(backend) serve the dockerflow views early in the middleware stack
 - 📈(frontend) include LiveKit SIDs in the connection analytics event
 - 🔇(backend) silence expected 401 warnings on /me
 - 🔇(backend) silence noisy request summary info logs
 - ⚡️(frontend) defer loading the Crisp script until idle
 - ⬆️(frontend) upgrade react-i18next from 17.0.10 to 17.0.12
 - ⬆️(frontend) upgrade posthog-js from 1.414.0 to 1.418.10
 - ⬆️(addons) upgrade i18next from 26.3.6 to 26.4.0
 - ⬆️(frontend) upgrade humanize-duration from 3.33.2 to 3.34.1
 - ⬆️(addons) upgrade i18next from 26.4.0 to 26.4.2
 - 🔖(helm) release chart 0.0.28
 - ♻️(backend) decouple recording event handling from LiveKit egress statuses
 ### Fixed
 - 🐛(helm) probe liveness on __lbheartbeat__ and readiness on __heartbeat__
 - 🐛(helm) render periodSeconds and failureThreshold on probes
 - 🐛(backend) report the app release to Sentry instead of "NA"
 - 🐛(frontend) play the waiting room notification sound on every arrival
 - 🐛(frontend) apply saved reception resolution when joining a meeting #1714
 - 🐛(backend) acknowledge unknown LiveKit webhook events instead of 422
 - 🔒️(backend) enforce display name setting on rename API
 - 🔒️(backend) reject inactive users in resource server backend
 - 🐛(frontend) fix file permissions in the Docker image
 - 🚸(frontend) inform user that recording waits until a track is published
 - 🔒(backend) upgrade base image to python:3.13.5-alpine3.24
 - 🐛(backend) handle failed and aborted egresses
 - 🩹(frontend) notify participants when a recording fails or is aborted
 - 🔒️(frontend) fix HIGH CVE-2026-93990 in libexpat
 ## [1.31.0] - 2026-09-08
 ### Added
 - ✨(frontend) add 1080p sending resolution option #1660
 - ✨(backend) add Traefik support via configurable media-auth url header #1649
 - ✨(backend) update a room's attributes from the external API
 - 🔊(backend) log request duration in Gunicorn workers
 - 📈(frontend) track missing lobby participant on accept/reject
 - ✨(backend) sort waiting participants by their arrival time
 ### Changed
 - ⬆️(dev) pin LiveKit server to v1.13.6
 - 🔒(frontend) upgrade base image to 1.30.4-alpine3.24
 ### Fixed
 - 🐛(backend) allow any printable ASCII characters in user sub field #1673
 - 🐛(frontend) keep the sending resolution picked while the camera is off #1667
 - 🐛(frontend) restore automatic lower-hand on speaking
 - 🐛(frontend) center Avatar initials with a font-aware cap-height ratio
 - 🐛(frontend) keep feedback buttons on one line for fr/es/en
 - ⚡️(frontend) increase lobby polling interval on both sides
 - ⚡️(frontend) add trailing slash on the /me endpoint call
 - ⚡️(backend) refactor lobby storage to bound key lookups per room
 - ⚡️(backend) refactor presence cache to bound key lookups per room
 - 💄(frontend) position the login hint dynamically next to the button
 ## [1.30.0] - 2026-09-01
 ### Added
 - ✨(agent) support Voxtral realtime as inference engine
 - 🌐(i18n) add Spanish language support
 - ✨(frontend) expose publish permissions on the media state element #1661
 ### Changed
 - 🔥(backend) remove the S3 storage-event webhook for recordings
 - ♻️(backend) always finalize recordings using the LiveKit egress_ended webhook
 - ⬆️(frontend) upgrade posthog-js from 1.409.5 to 1.414.0
 - ⬆️(frontend) upgrade @fontsource-variable/lexend from 5.2.11 to 5.3.0
 - ⬆️(frontend) upgrade @fontsource/opendyslexic from 5.2.5 to 5.3.0
 - ⬆️(addons) upgrade core-js from 3.49.0 to 3.50.0
 - ♻️(backend) factorize s3 client creation in utils
 - ♿️(frontend) close side panel with Escape key #1507
 ### Fixed
 - 🐛(frontend) fix chat text-area bug
 ## [1.29.0] - 2026-08-25
@@ -407,7 +281,7 @@ and this project adheres to
 ### Fixed
- ♿️(frontend) improve accessibility of the Effects panel #1401
+- ♿️(frontend) improve accessibilty of the Effects panel #1401
 ## [1.20.0] - 2026-06-12
@@ -1,7 +1,7 @@
 # Django Meet
 # ---- base image to inherit from ----
-FROM python:3.13.15-alpine3.24 AS base
+FROM python:3.13.5-alpine3.21 AS base
 # Upgrade pip to its latest release to speed up dependencies installation
 RUN python -m pip install --upgrade pip
@@ -37,13 +37,14 @@ RUN --mount=type=cache,target=/root/.cache/uv \
  uv sync --locked --no-dev
 # ---- mails ----
-FROM node:22-alpine AS mail-builder
+FROM node:22 AS mail-builder
 COPY ./src/mail /mail/app
 WORKDIR /mail/app
-RUN npm ci --ignore-scripts && npm run build
+RUN yarn install --frozen-lockfile && \
  yarn build
 # ---- static link collector ----
@@ -39,16 +39,14 @@ DB_PORT            = 5432
 DOCKER_UID          = $(shell id -u)
 DOCKER_GID          = $(shell id -g)
 DOCKER_USER         = $(DOCKER_UID):$(DOCKER_GID)
-COMPOSE                  = DOCKER_USER=$(DOCKER_USER) docker compose
+COMPOSE             = DOCKER_USER=$(DOCKER_USER) docker compose
-COMPOSE_EXEC             = $(COMPOSE) exec
+COMPOSE_EXEC        = $(COMPOSE) exec
-COMPOSE_EXEC_APP         = $(COMPOSE_EXEC) app-dev
+COMPOSE_EXEC_APP    = $(COMPOSE_EXEC) app-dev
-COMPOSE_RUN              = $(COMPOSE) run --rm
+COMPOSE_RUN         = $(COMPOSE) run --rm
-COMPOSE_RUN_APP          = $(COMPOSE_RUN) app-dev
+COMPOSE_RUN_APP     = $(COMPOSE_RUN) app-dev
-COMPOSE_RUN_LINT_BACK    = $(COMPOSE_RUN) --no-deps app-dev
+COMPOSE_RUN_LINT    = $(COMPOSE_RUN) --no-deps app-dev
-COMPOSE_RUN_LINT_AGENTS  = $(COMPOSE_RUN) --no-deps multi-user-transcriber-dev
+COMPOSE_RUN_CROWDIN = $(COMPOSE_RUN) crowdin crowdin
-COMPOSE_RUN_LINT_SUMMARY = $(COMPOSE_RUN) --no-deps app-summary-dev
+WAIT_DB             = @$(COMPOSE_RUN) dockerize -wait tcp://$(DB_HOST):$(DB_PORT) -timeout 60s
 COMPOSE_RUN_CROWDIN      = $(COMPOSE_RUN) crowdin crowdin
 WAIT_DB                  = @$(COMPOSE_RUN) dockerize -wait tcp://$(DB_HOST):$(DB_PORT) -timeout 60s
 # -- Backend
 MANAGE              = $(COMPOSE_RUN_APP) python manage.py
@@ -61,30 +59,10 @@ LINT_PYLINT         = pylint meet demo core
 LINT_BACK           = echo 'lint:ruff-format started…' && $(LINT_RUFF_FORMAT) \
  && echo 'lint:ruff-check started…' && $(LINT_RUFF_CHECK) \
  && echo 'lint:pylint started…' && $(LINT_PYLINT)
 LINT_AGENTS         = echo 'lint:ruff-format started…' && $(LINT_RUFF_FORMAT) \
  && echo 'lint:ruff-check started…' && $(LINT_RUFF_CHECK)
 LINT_SUMMARY        = echo 'lint:ruff-format started…' && $(LINT_RUFF_FORMAT) \
  && echo 'lint:ruff-check started…' && $(LINT_RUFF_CHECK)
 # -- Frontend
 PATH_FRONT          = ./src/frontend
 # -- Storage
 GARAGE_BUCKET       = meet-media-storage
 STORAGE_FOLDERS     = recordings transcripts summaries
 STORAGE_DIRS        = $(addprefix data/,$(STORAGE_FOLDERS))
 COMPOSE_RUN_AWS     = $(COMPOSE_RUN) --user $(DOCKER_USER)
 AWS_CLI             = garage-cors --endpoint-url=http://garage:9000
 # Extensions listed in each folder (skips the Egress manifests in recordings/)
 recordings_EXTENSIONS  = mp4 ogg
 transcripts_EXTENSIONS = json
 summaries_EXTENSIONS   = txt
 # $(1): folder. Lists its objects with a known extension, most recent first
 storage_list        = s3api list-objects-v2 --bucket $(GARAGE_BUCKET) \
  --prefix $(1)/
 storage_query       = reverse(sort_by(Contents[?$(foreach ext,$($(1)_EXTENSIONS), \
  ends_with(Key, `".$(ext)"`) ||) `false`] || `[]`, &LastModified))
 # ==============================================================================
 # RULES
@@ -93,9 +71,6 @@ default: help
 data/media:
 	@mkdir -p data/media
 $(STORAGE_DIRS):
 	@mkdir -p $@
 data/static:
 	@mkdir -p data/static
@@ -104,7 +79,6 @@ data/static:
 create-env-files: ## Copy the dist env files to env files
 create-env-files: \
 	env.d/development/common \
 	env.d/development/garage \
 	env.d/development/crowdin \
 	env.d/development/postgresql \
 	env.d/development/kc_postgresql \
@@ -224,37 +198,23 @@ demo: ## flush db then create a demo for load testing purpose
 	@$(MANAGE) create_demo
 .PHONY: demo
-lint: ## lint all python sources (back-end, agents, summary)
+lint: ## lint back-end python sources
-	@$(MAKE) lint-back
+	@$(COMPOSE_RUN_LINT) sh -c "$(LINT_BACK)"
 	@$(MAKE) lint-agents
 	@$(MAKE) lint-summary
 .PHONY: lint
 lint-back: ## lint back-end python sources
 	@$(COMPOSE_RUN_LINT_BACK) sh -c "$(LINT_BACK)"
 .PHONY: lint-back
 lint-agents: ## lint agents python sources
 	@$(COMPOSE_RUN_LINT_AGENTS) sh -c "$(LINT_AGENTS)"
 .PHONY: lint-agents
 lint-summary: ## lint summary python sources
 	@$(COMPOSE_RUN_LINT_SUMMARY) sh -c "$(LINT_SUMMARY)"
 .PHONY: lint-summary
 lint-ruff-format: ## format back-end python sources with ruff
 	@echo 'lint:ruff-format started…'
-	@$(COMPOSE_RUN_LINT_BACK) $(LINT_RUFF_FORMAT)
+	@$(COMPOSE_RUN_LINT) $(LINT_RUFF_FORMAT)
 .PHONY: lint-ruff-format
 lint-ruff-check: ## lint back-end python sources with ruff
 	@echo 'lint:ruff-check started…'
-	@$(COMPOSE_RUN_LINT_BACK) $(LINT_RUFF_CHECK)
+	@$(COMPOSE_RUN_LINT) $(LINT_RUFF_CHECK)
 .PHONY: lint-ruff-check
 lint-pylint: ## lint back-end python sources with pylint only on changed files from main
 	@echo 'lint:pylint started…'
-	@$(COMPOSE_RUN_LINT_BACK) $(LINT_PYLINT)
+	@$(COMPOSE_RUN_LINT) $(LINT_PYLINT)
 .PHONY: lint-pylint
 test: ## run project tests; pass extra pytest args via ARGS, e.g. `make test ARGS="-vv"`
@@ -312,7 +272,7 @@ shell: ## connect to database shell
 # -- Database
 dbshell: ## connect to database shell
-	@$(COMPOSE_EXEC_APP) python manage.py dbshell
+	docker compose exec app-dev python manage.py dbshell
 .PHONY: dbshell
 resetdb: FLUSH_ARGS ?=
@@ -337,38 +297,12 @@ env.d/development/summary:
 env.d/development/kube-secret:
 	cp -n env.d/development/kube-secret.dist env.d/development/kube-secret
 env.d/development/garage:
 	sed "s/^GARAGE_RPC_SECRET=.*/GARAGE_RPC_SECRET=$$(openssl rand -hex 32)/" \
 		env.d/development/garage.dist > env.d/development/garage
 env.d/development/multi_user_transcriber:
 	cp -n env.d/development/multi_user_transcriber.dist env.d/development/multi_user_transcriber
 env.d/development/metadata_collector:
 	cp -n env.d/development/metadata_collector.dist env.d/development/metadata_collector
 # -- Storage
 recordings-download-latest: ## download the latest recording from Garage into data/recordings
 transcripts-download-latest: ## download the latest transcript from Garage into data/transcripts
 summaries-download-latest: ## download the latest summary from Garage into data/summaries
 $(STORAGE_FOLDERS:%=%-download-latest): %-download-latest: data/%
 	@key=$$($(COMPOSE_RUN_AWS) -T $(AWS_CLI) $(call storage_list,$*) \
 		--query '$(call storage_query,$*)[0].Key' --output text) && \
 	if [ "$$key" = "None" ]; then echo "No $* found"; exit 1; fi && \
 	$(COMPOSE_RUN_AWS) --volume $(CURDIR)/data/$*:/aws/data/$* \
 		$(AWS_CLI) s3 cp "s3://$(GARAGE_BUCKET)/$$key" data/$*/
 .PHONY: $(STORAGE_FOLDERS:%=%-download-latest)
 recordings-list: ## list recordings stored in Garage, most recent first
 transcripts-list: ## list transcripts stored in Garage, most recent first
 summaries-list: ## list summaries stored in Garage, most recent first
 $(STORAGE_FOLDERS:%=%-list): %-list:
 	@$(COMPOSE_RUN_AWS) $(AWS_CLI) $(call storage_list,$*) \
 		--query '$(call storage_query,$*)[].{Date: LastModified, Key: Key, "Size (bytes)": Size}' \
 		--output table
 .PHONY: $(STORAGE_FOLDERS:%=%-list)
 # -- Internationalization
 env.d/development/crowdin:
@@ -16,46 +16,6 @@ the following command inside your docker container:
 ## [Unreleased]
 ### Purging inactive rooms
 Rooms now keep track of the last time they were started (`last_started_at`), fed by LiveKit's `room_started` webhook. A new `purge_inactive_rooms` management command permanently deletes the rooms that have not been started for `ROOM_INACTIVITY_DELETION_DAYS` days. See [the room purge documentation](docs/features/room-purge.md).
 - The feature is **disabled by default**: nothing is deleted unless you set `ROOM_INACTIVITY_DELETION_DAYS`.
 - The migration marks every existing room as started at the time of the upgrade, so no existing room can be purged before a full inactivity period has elapsed after upgrading.
 - Rooms holding a saved recording their users may still access are kept: any saved recording, or, when `RECORDING_EXPIRATION_DAYS` is set, a saved recording created within that window.
 - Inactivity is measured from LiveKit's `room_started` webhook: if it is not delivered to your backend, rooms in daily use look inactive and get purged.
 - When a room is purged, all it's configuration and access rights are also deleted. Its slug becomes available again and can be reused when a meeting is created from that same URL.
 * With `ALLOW_UNREGISTERED_ROOMS=false`, only an authenticated user can navigate to a previously existing link after the room has been purged. Doing so recreates the room in the database with a fresh configuration, with that user associated with it and granted admin rights.
 * With `ALLOW_UNREGISTERED_ROOMS=true`, any user can reopen the purged room by navigating to the same URL. In that case, the room is created dynamically and no corresponding room entry is persisted in the database.
 ### Local development: MinIO replaced by Garage
 The development stacks now use [Garage](https://garagehq.deuxfleurs.fr/) instead of MinIO as S3 storage. Garage keeps its own format in `data/media/meta` and `data/media/data` and cannot read what MinIO left there, so local recordings and files will be lost.
 To migrate a local environment:
 1. Stop the stack and remove its containers, including the former `minio` one: `docker compose down --remove-orphans`
 2. Optionally reclaim the space used by MinIO: `rm -rf data/media && make data/media`
 3. In your `env.d/development/*` files, replace `minio:9000` by `garage:9000`, the `meet` / `password` credentials by `meet-access-key` / `meet-secret-access-key`, and add `AWS_S3_REGION_NAME=local` (or delete these files and run `make create-env-files`)
 4. Run `make create-env-files` to generate `env.d/development/garage`, which holds a random RPC secret for Garage.
 5. Rebuild the images, since the summary and agent images now install boto3 instead of minio
 ### Summary service and metadata collector: boto3 replaces the minio client
 The summary service and the metadata collector agent now talk to S3 through boto3 instead of the minio client, with the same settings.
 Requests are now signed for `AWS_S3_REGION_NAME` as-is. When it is not set, the region is no longer looked up from the bucket: boto3 falls back to `AWS_DEFAULT_REGION`, then to `us-east-1`. If you left `AWS_S3_REGION_NAME` unset, set it to your provider's region before upgrading, or providers that check the signing region will reject the transcripts, summaries and meeting metadata uploads, as well as their signed URLs.
 Also:
 - Signed URLs to transcripts and summaries are now always path-style (`<endpoint>/<bucket>/<key>`), whereas the minio client used virtual-hosted-style URLs
 - The metadata collector now accepts `AWS_S3_ENDPOINT_URL` with or without a scheme, like the summary service: the scheme always follows `AWS_S3_SECURE_ACCESS`.
 ### Helm chart: media services default to Garage
 The `meet` chart now defaults `serviceMedia.host` and `serviceMediaFiles.host` to `garage.meet.svc.cluster.local`, and the `upstream-vhost` annotation of `ingressMedia` and `ingressMediaFiles` to `garage.meet.svc.cluster.local:9000`. If you relied on the former `minio.meet.svc.cluster.local` defaults, set these values explicitly to your S3 service before upgrading, or recordings and files stop being served under `/media`.
 ## v1.30.0
 ### Removing S3 storage-event webhooks for recordings
 Recordings were previously confirmed as saved by an S3 storage-event webhook posting to `/api/v1.0/recordings/storage-hook/`. That endpoint has been removed: recordings are now always finalized from LiveKit's own `egress_ended` webhook, which has been the default path since v1.22.0.
@@ -104,8 +104,8 @@ k8s_yaml(secret_yaml_generic(
 k8s_yaml(local('cd ../src/helm && helmfile -n meet -e ${DEV_ENV:-dev-keycloak} template .'))
-k8s_resource('garage-cors', resource_deps=['garage'])
+k8s_resource('minio-bucket', resource_deps=['minio'])
-k8s_resource('meet-backend', resource_deps=['postgresql', 'garage-cors', 'redis', 'livekit-livekit-server'])
+k8s_resource('meet-backend', resource_deps=['postgresql', 'minio', 'redis', 'livekit-livekit-server'])
 k8s_resource('meet-celery-backend', resource_deps=['redis'])
 k8s_resource('meet-celery-summarize', resource_deps=['redis'])
 k8s_resource('meet-celery-summary-backend', resource_deps=['redis'])
@@ -5,7 +5,7 @@ set -eo pipefail
 REPO_DIR="$(cd "$( dirname "${BASH_SOURCE[0]}" )/.." && pwd)"
 UNSET_USER=0
-export COMPOSE_FILE="${COMPOSE_FILE:-${REPO_DIR}/compose.yml}"
+COMPOSE_FILE="${REPO_DIR}/compose.yml"
 COMPOSE_PROJECT="meet"
@@ -42,6 +42,7 @@ function _docker_compose() {
    echo "🐳(compose) project: '${COMPOSE_PROJECT}' file: '${COMPOSE_FILE}'"
    docker compose \
        -p "${COMPOSE_PROJECT}" \
        -f "${COMPOSE_FILE}" \
        --project-directory "${REPO_DIR}" \
        "$@"
 }
@@ -55,12 +56,12 @@ function _docker_compose() {
 function _dc_run() {
    _set_user
-    user_args=()
+    user_args="--user=$USER_ID"
-    if [ -n "$USER_ID" ]; then
+    if [ -z $USER_ID ]; then
-        user_args=("--user=$USER_ID")
+        user_args=""
    fi
-    _docker_compose run --rm "${user_args[@]}" "$@"
+    _docker_compose run --rm $user_args "$@"
 }
 # _dc_exec: wrap docker compose exec command
@@ -74,12 +75,12 @@ function _dc_exec() {
    echo "🐳(compose) exec command: '\$@'"
-    user_args=()
+    user_args="--user=$USER_ID"
-    if [ -n "$USER_ID" ]; then
+    if [ -z $USER_ID ]; then
-        user_args=("--user=$USER_ID")
+        user_args=""
    fi
-    _docker_compose exec "${user_args[@]}" "$@"
+    _docker_compose exec $user_args "$@"
 }
 # _django_manage: wrap django's manage.py command with docker compose
@@ -40,7 +40,7 @@ if [ -n "$CUSTOM_LOGO_URL" ]; then
    [[ "$IS_SVG" == false ]] && echo "[custom-logo] ERROR: not a valid SVG file" >&2 && exit 1
    mv -f "$TMP_FILE" "$LOGO_FILE"
-    echo "[custom-logo] INFO: Custom logo downloaded successfully"
+    echo "[custom-logo] INFO: Custom logo downloaded successfuly"
 fi
 mv src/backend/* ./
@@ -7,7 +7,7 @@ gunicorn -b 0.0.0.0:8000 meet.wsgi:application --log-file - &
 bin/run &
 # if the current shell is killed, also terminate all its children     
-trap 'pkill -TERM -P $$' SIGTERM
+trap "pkill SIGTERM -P $$" SIGTERM
 # wait for a single child to finish,
 wait -n
@@ -0,0 +1,6 @@
 #!/usr/bin/env bash
 # shellcheck source=bin/_config.sh
 source "$(dirname "${BASH_SOURCE[0]}")/_config.sh"
 _docker_compose "$@"
@@ -1,6 +1,7 @@
 #!/usr/bin/env bash
 set -o errexit
 CURRENT_DIR=$(pwd)
 NAMESPACE=${1:-meet}
 SECRET_NAME=${2:-bitwarden-cli-meet}
 TEMP_SECRET_FILE=$(mktemp)
@@ -29,10 +30,10 @@ check_secret_exists() {
 # Collect user input securely
 get_user_input() {
    echo "Please provide the following information:"
-    read -r -p "Enter your Vaultwarden email login: " LOGIN
+    read -p "Enter your Vaultwarden email login: " LOGIN
-    read -r -s -p "Enter your Vaultwarden password: " PASSWORD
+    read -s -p "Enter your Vaultwarden password: " PASSWORD
    echo
-    read -r -p "Enter your Vaultwarden server url: " URL
+    read -p "Enter your Vaultwarden server url: " URL
 }
 # Create and apply the secret
@@ -76,7 +77,7 @@ main() {
        exit 0
    fi
-    echo -e "${TEMP_SECRET_FILE}"
+    echo -e ${TEMP_SECRET_FILE}
    get_user_input
    echo -e "\nCreating Vaultwarden secret…"
@@ -3,7 +3,7 @@
 mkdir -p "$(dirname -- "${BASH_SOURCE[0]}")/../.git/hooks/"
 PRE_COMMIT_FILE="$(dirname -- "${BASH_SOURCE[0]}")/../.git/hooks/pre-commit"
-cat <<'EOF' >"$PRE_COMMIT_FILE"
+cat <<'EOF' >$PRE_COMMIT_FILE
 #!/bin/bash
 # directories containing potential secrets
@@ -27,4 +27,4 @@ for d in $DIRS; do
 done
 EOF
-chmod +x "$PRE_COMMIT_FILE"
+chmod +x $PRE_COMMIT_FILE
@@ -68,7 +68,7 @@ fi
 # Ask user for release version number
 echo ""
-read -r -p "Enter release version number (e.g., 1.2.3): " VERSION
+read -p "Enter release version number (e.g., 1.2.3): " VERSION
 # Validate version format (basic semver check)
 if ! [[ $VERSION =~ ^[0-9]+\.[0-9]+\.[0-9]+$ ]]; then
@@ -110,12 +110,6 @@ cd -
 # Update summary pyproject.toml
 update_python_version "summary"
 # Run uv lock in summary
 print_info "Running uv lock in summary..."
 cd "src/summary"
 uv lock
 cd -
 # Update agents pyproject.toml
 update_python_version "agents"
@@ -169,7 +163,6 @@ echo "      - src/mail/package.json"
 echo "      - src/backend/pyproject.toml"
 echo "      - src/backend/uv.lock"
 echo "      - src/summary/pyproject.toml"
 echo "      - src/summary/uv.lock"
 echo "      - src/agents/pyproject.toml"
 echo "      - src/agents/uv.lock"
 echo "      - CHANGELOG.md"
@@ -1,5 +1,4 @@
 #!/usr/bin/env bash
 git submodule update --init --recursive
 # shellcheck disable=SC2016
 git submodule foreach 'git fetch origin; git checkout $(git rev-parse --abbrev-ref HEAD); git reset --hard origin/$(git rev-parse --abbrev-ref HEAD); git submodule update --recursive; git clean -dfx'
@@ -8,6 +8,6 @@ environments=$(awk '/environments:/ {flag=1; next} flag && NF {print} !NF {flag=
 for env in $environments; do
 	echo "################### $env lint ###################"
-	helmfile -e "$env" -f src/helm/helmfile.yaml lint || exit 1
+	helmfile -e $env -f src/helm/helmfile.yaml lint || exit 1
 	echo -e "\n"
 done
@@ -15,44 +15,36 @@ services:
    ports:
      - "1081:1080"
-  garage:
+  minio:
    user: ${DOCKER_USER:-1000}
-    image: dxflrs/garage:v2.4.1
+    image: minio/minio
    command: /garage server --single-node --default-bucket
    env_file:
      - env.d/development/garage
    environment:
-      - GARAGE_DEFAULT_ACCESS_KEY=meet-access-key
+      - MINIO_ROOT_USER=meet
-      - GARAGE_DEFAULT_SECRET_KEY=meet-secret-access-key
+      - MINIO_ROOT_PASSWORD=password
      - GARAGE_DEFAULT_BUCKET=meet-media-storage
    ports:
-      - '127.0.0.1:9000:9000'
+      - '9000:9000'
      - '9001:9001'
    healthcheck:
-      test: [ "CMD", "/garage", "health" ]
+      test: [ "CMD", "mc", "ready", "local" ]
      interval: 1s
      timeout: 20s
      retries: 300
    entrypoint: ""
    command: minio server --console-address :9001 /data
    volumes:
-      - ./docker/files/etc/garage/garage.toml:/etc/garage.toml:ro
+      - ./data/media:/data
      - ./data/media:/var/lib/garage
-  # Garage denies cross-origin requests by default: allow the frontend to upload files
+  createbuckets:
-  garage-cors:
+    image: minio/mc
    image: amazon/aws-cli:2.37.1
    environment:
      - AWS_ACCESS_KEY_ID=meet-access-key
      - AWS_SECRET_ACCESS_KEY=meet-secret-access-key
      - AWS_DEFAULT_REGION=local
    depends_on:
-      garage:
+      minio:
        condition: service_healthy
        restart: true
-    command:
+    entrypoint: >
-      - s3api
+      sh -c "
-      - put-bucket-cors
+      /usr/bin/mc alias set meet http://minio:9000 meet password && \
-      - --endpoint-url=http://garage:9000
+      /usr/bin/mc mb meet/meet-media-storage && \
-      - --bucket=meet-media-storage
+      exit 0;"
      - '--cors-configuration={"CORSRules": [{"AllowedOrigins": ["http://localhost:3000"], "AllowedMethods": ["GET", "HEAD", "PUT"], "AllowedHeaders": ["*"], "ExposeHeaders": ["ETag"]}]}'
  app-dev:
    build:
@@ -78,7 +70,7 @@ services:
        - postgresql
        - mailcatcher
        - redis
-        - garage-cors
+        - createbuckets
    extra_hosts:
      - "127.0.0.1.nip.io:host-gateway"
    networks:
@@ -118,7 +110,7 @@ services:
      - postgresql
      - redis
      - livekit
-      - garage
+      - minio
  celery:
    user: ${DOCKER_USER:-1000}
@@ -172,7 +164,7 @@ services:
    working_dir: /app
  node:
-    image: node:22-alpine
+    image: node:22
    user: "${DOCKER_USER:-1000}"
    environment:
      HOME: /tmp
@@ -215,7 +207,7 @@ services:
      - kc_postgresql
  livekit:
-    image: livekit/livekit-server:v1.13.6
+    image: livekit/livekit-server
    entrypoint: /livekit-server --dev --bind 0.0.0.0 --config ./config.yaml
    ports:
      - "7880:7880"
@@ -243,7 +235,6 @@ services:
    build:
      context: ./src/agents
      target: development
    user: ${DOCKER_USER:-1000}
    command: ["python", "metadata_collector.py", "dev"]
    env_file:
      - env.d/development/metadata_collector
@@ -252,7 +243,7 @@ services:
      - /app/.venv
    depends_on:
      - livekit
-      - garage
+      - minio
    develop:
      watch:
        - action: rebuild
@@ -262,7 +253,6 @@ services:
    build:
      context: ./src/agents
      target: development
    user: ${DOCKER_USER:-1000}
    command: ["python", "multi_user_transcriber.py", "dev"]
    env_file:
      - env.d/development/multi_user_transcriber
@@ -271,7 +261,7 @@ services:
      - /app/.venv
  redis-summary:
-    image: redis:5
+    image: redis
    ports:
      - "6379:6379"
@@ -305,7 +295,7 @@ services:
    depends_on:
      - redis-summary
      - app-summary-dev
-      - garage
+      - minio
    develop:
      watch:
        - action: rebuild
@@ -325,7 +315,7 @@ services:
    depends_on:
      - redis-summary
      - app-summary-dev
-      - garage
+      - minio
    develop:
      watch:
        - action: rebuild
@@ -1,47 +0,0 @@
 {
  "nodes": {
    "devenv": {
      "locked": {
        "dir": "src/modules",
        "lastModified": 1778705847,
        "narHash": "sha256-EQnZCy7r4VMO6KDoytxHBa0mFbM1D9g1kaDfs/s0YZA=",
        "ref": "refs/tags/v2.1.2",
        "rev": "ea3d94ac9d6bf6a1313773170122ca4e2ef5a0be",
        "revCount": 6569,
        "type": "git",
        "url": "https://github.com/cachix/devenv"
      },
      "original": {
        "dir": "src/modules",
        "ref": "refs/tags/v2.1.2",
        "type": "git",
        "url": "https://github.com/cachix/devenv"
      }
    },
    "nixpkgs": {
      "locked": {
        "lastModified": 1789542786,
        "narHash": "sha256-ajQuqcxnj6RYnwCjA/9FTCnrdR2+BDzstE8UembXf60=",
        "ref": "nixos-26.05",
        "rev": "4c7870105e7f1fdf9c48688c8d7efc21abf0688a",
        "shallow": true,
        "type": "git",
        "url": "https://github.com/NixOS/nixpkgs"
      },
      "original": {
        "ref": "nixos-26.05",
        "shallow": true,
        "type": "git",
        "url": "https://github.com/NixOS/nixpkgs"
      }
    },
    "root": {
      "inputs": {
        "devenv": "devenv",
        "nixpkgs": "nixpkgs"
      }
    }
  },
  "root": "root",
  "version": 7
 }
@@ -1,265 +0,0 @@
 # =============================================================================
 #  devenv.nix — La Suite Meet ("Visio") developer environment
 # =============================================================================
 {
  pkgs,
  lib,
  config,
  ...
 }:
 let
  python = pkgs.python313;
  nodejs = pkgs.nodejs_22;
  backendDir = "src/backend";
  agentsDir = "src/agents";
  summaryDir = "src/summary";
  frontendDir = "src/frontend";
  readDotEnv =
    file:
    let
      lines = lib.splitString "\n" (builtins.readFile file);
      unquote =
        v:
        let
          len = builtins.stringLength v;
        in
        if len >= 2 && lib.hasPrefix "\"" v && lib.hasSuffix "\"" v then
          builtins.substring 1 (len - 2) v
        else if len >= 2 && lib.hasPrefix "'" v && lib.hasSuffix "'" v then
          builtins.substring 1 (len - 2) v
        else
          v;
      parseLine =
        line:
        let
          m = builtins.match "[ \t]*([A-Za-z_][A-Za-z0-9_]*)[ \t]*=[ \t]*(.*)" line;
        in
        if m == null then null else { name = builtins.elemAt m 0; value = unquote (builtins.elemAt m 1); };
    in
    builtins.listToAttrs (builtins.filter (x: x != null) (map parseLine lines));
  # Reuse existing .env
  dotEnv =
    (readDotEnv ./env.d/development/common.dist)
    // (readDotEnv ./env.d/development/postgresql.dist);
  sharedEnv = builtins.removeAttrs dotEnv [ "PYTHONPATH" ]; # only makes sense inside the backend container.
 in
 {
  options.meet = {
    agents.enable = lib.mkEnableOption "tooling for the LiveKit agents in src/agents";
    summary.enable = lib.mkEnableOption "tooling for the summary service in src/summary";
    k8s.enable = lib.mkEnableOption "Kubernetes dev utilities";
  };
  config = {
    # Profile can be activated with devenv --profile <profile> shell
    profiles = {
      agents.module = {
        meet.agents.enable = true;
      };
      summary.module = {
        meet.summary.enable = true;
      };
      k8s.module = {
        meet.k8s.enable = true;
      };
    };
    languages.python = {
      enable = true;
      package = python;
      directory = backendDir;
      manylinux.enable = pkgs.stdenv.hostPlatform.isLinux;
      libraries = [
        "${config.devenv.dotfile}/profile"
        pkgs.file
        pkgs.zlib
        pkgs.libffi
        pkgs.openssl
      ];
      uv.enable = true;
      uv.sync.enable = false;
      venv.enable = false;
      lsp.enable = true;
    };
    languages.javascript = {
      enable = true;
      package = nodejs;
      directory = frontendDir;
      npm.enable = true;
      yarn.enable = true;
      corepack.enable = false;
    };
    languages.typescript.enable = false;
    languages.nix.enable = true;
    packages =
      with pkgs;
      [
        gnumake
        file
        shared-mime-info
        gettext
        postgresql_16
        git
        curl
        jq
        podman
        podman-compose
        docker-client
      ]
      # -- LiveKit agents
      ++ lib.optionals config.meet.agents.enable [
        glib
        portaudio
        livekit-cli
      ]
      # -- summary service
      ++ lib.optionals config.meet.summary.enable [
        redis
      ]
      # -- Kubernetes tools
      ++ lib.optionals config.meet.k8s.enable [
        kubectl
        kubernetes-helm
        helmfile
        tilt
        kind
        mkcert
      ];
    env = sharedEnv // {
      UV_LINK_MODE = "copy";
      PYTHONDONTWRITEBYTECODE = "1";
      PYTHONUNBUFFERED = "1";
      UV_PROJECT_ENVIRONMENT = lib.mkForce ".venv";
      COMPOSE_PROJECT_NAME = "meet";
      DJANGO_DATA_DIR = "${config.devenv.root}/data";
      # Database / Pgsql
      DB_HOST = "127.0.0.1";
      DB_PORT = "15432";
      PGHOST = "127.0.0.1";
      PGPORT = "15432";
      PGDATABASE = sharedEnv.DB_NAME;
      PGUSER = sharedEnv.DB_USER;
      PGPASSWORD = sharedEnv.DB_PASSWORD;
      REDIS_URL = "redis://127.0.0.1:6379/1";
      CELERY_BROKER_URL = "redis://127.0.0.1:6379/0";
      # S3 / Garage
      AWS_S3_ENDPOINT_URL = "http://127.0.0.1:9000";
      # OIDC
      OIDC_OP_JWKS_ENDPOINT = "http://localhost:8083/realms/meet/protocol/openid-connect/certs";
      OIDC_OP_TOKEN_ENDPOINT = "http://localhost:8083/realms/meet/protocol/openid-connect/token";
      OIDC_OP_USER_ENDPOINT = "http://localhost:8083/realms/meet/protocol/openid-connect/userinfo";
      OIDC_OP_INTROSPECTION_ENDPOINT = "http://localhost:8083/realms/meet/protocol/openid-connect/token/introspect";
      # summary service
      SUMMARY_SERVICE_ENDPOINT = "http://127.0.0.1:8001/api/v2/async-jobs/transcribe/";
      SUMMARY_SERVICE_VERSION = "2";
      # Mail
      DJANGO_EMAIL_HOST = "127.0.0.1";
    };
    scripts = {
      meet-venv = {
        description = "Create/refresh meet uv virtualenvs for backend, agents and summary";
        exec = ''
          set -euo pipefail
          cd "$DEVENV_ROOT"
          echo "==> ${backendDir} (uv sync --locked, dependency-groups)"
          ( cd "${backendDir}" && uv sync --locked --all-groups )
          echo "==> ${agentsDir} (uv sync --locked --all-extras)"
          ( cd "${agentsDir}" && uv sync --locked --all-extras )
          echo "==> ${summaryDir} (uv sync --locked --all-extras)"
          ( cd "${summaryDir}" && uv sync --locked --all-extras )
          echo
          echo "Synced the following virtualenvs successfully:"
          echo "  ${backendDir}/.venv"
          echo "  ${agentsDir}/.venv"
          echo "  ${summaryDir}/.venv"
        '';
      };
    };
    enterShell = ''
      # Make podman socket accessible in order to launch regular docker commands.
      # Set MEET_PODMAN_SOCKET=0 to keep the DOCKER_HOST of the calling environment.
      case "''${MEET_PODMAN_SOCKET:-1}" in
        0|false|no|off) ;;
        *)
          _rundir="''${XDG_RUNTIME_DIR:-/run/user/$(id -u)}"
          export DOCKER_HOST="unix://$_rundir/podman/podman.sock"
          unset _rundir
          ;;
      esac
      # Compose files to merge
      _compose_dir="${config.devenv.root}/docker/compose.d"
      _compose_files="${config.devenv.root}/compose.yml"
      export DOCKER_USER="$(id -u):$(id -g)"
      case "''${DOCKER_HOST:-}" in
        *podman*)
          _compose_files="$_compose_files:$_compose_dir/compose.podman.yml"
          # Build images with Podman/Buildah rather than BuildKit. `docker
          # compose build` otherwise has buildx boot a moby/buildkit container,
          # and that container lands in its own network namespace with neither
          # the proxy in its environment nor any route to it.
          # Buildah has neither problem: base images are resolved by the Podman systemd
          # service, which inherits the proxy from its systemd socket activated unit, and
          # RUN steps execute in the *host* network namespace
          export DOCKER_BUILDKIT=0
          export COMPOSE_BAKE=false
          ;;
      esac
      # Apply Bureautix override
      if [ -n "''${http_proxy:-}" ]; then
        _compose_files="$_compose_files:$_compose_dir/compose.bureautix.yml"
      fi
      export COMPOSE_FILE="$_compose_files"
      unset _compose_dir _compose_files
      # Make binaries accessible
      for _d in \
        "$DEVENV_ROOT/${backendDir}/.venv/bin" \
        "$DEVENV_ROOT/${agentsDir}/.venv/bin" \
        "$DEVENV_ROOT/${summaryDir}/.venv/bin" \
        "$DEVENV_ROOT/${frontendDir}/node_modules/.bin"
      do
        [ -d "$_d" ] && export PATH="$_d:$PATH"
      done
      unset _d
    '';
  };
 }
@@ -1,5 +0,0 @@
 inputs:
  nixpkgs:
    url: git+https://github.com/NixOS/nixpkgs?ref=nixos-26.05&shallow=1
  devenv:
    url: git+https://github.com/cachix/devenv?ref=refs/tags/v2.1.2&dir=src/modules
@@ -1,48 +0,0 @@
 # Bureautix proxy overrides
 #
 # Builds submitted through the Docker API of the Podman service get none of
 # the proxy variables in their RUN steps. We need to pass the http_proxy explicitly
 # otherwise all connections fail during the build.
 x-proxy-vars: &proxy-vars
  http_proxy: ${http_proxy:-}
  https_proxy: ${https_proxy:-}
  no_proxy: ${no_proxy:-}
 services:
  app:
    build:
      args:
        <<: *proxy-vars
  app-dev:
    build:
      args:
        <<: *proxy-vars
  frontend:
    build:
      args:
        <<: *proxy-vars
  metadata-collector-dev:
    build:
      args:
        <<: *proxy-vars
  multi-user-transcriber-dev:
    build:
      args:
        <<: *proxy-vars
  app-summary-dev:
    build:
      args:
        <<: *proxy-vars
  celery-summary-transcribe:
    build:
      args:
        <<: *proxy-vars
  celery-summary-summarize:
    build:
      args:
        <<: *proxy-vars
  # The local proxy listens on 8080 and collides with Keycloak's published admin port.
  keycloak:
    ports: !override
      - "8081:8080"
@@ -1,35 +0,0 @@
 # Rootless Podman override for compose.yml.
 #
 # Rootless Podman maps container UID 0 to the host user and every other
 # container UID to a subuid that owns nothing in the worktree. Meet compose.ymlruns
 # its containers as DOCKER_USER=$(id -u):$(id -g), which would land on such a
 # subuid and make every bind mount effectively read-only.
 #
 # `userns_mode: keep-id` maps the host user to the same UID and GID inside the
 # container instead, so DOCKER_USER keeps its Docker value and files written
 # through a bind mount are owned by the host user on both sides.
 #
 # Only the services that mount the worktree and run as DOCKER_USER are listed.
 x-keep-id: &keep-id
  userns_mode: keep-id
 services:
  app-dev:
    <<: *keep-id
  celery-dev:
    <<: *keep-id
  garage:
    <<: *keep-id
  garage-cors:
    <<: *keep-id
  node:
    <<: *keep-id
  crowdin:
    <<: *keep-id
  metadata-collector-dev:
    <<: *keep-id
  multi-user-transcriber-dev:
    <<: *keep-id
  app-summary-dev:
    <<: *keep-id
@@ -54,12 +54,18 @@ RUN npx webpack --mode production
 # ---- Front-end image ----
-FROM nginxinc/nginx-unprivileged:1.30.4-alpine3.24 AS frontend-production
+FROM nginxinc/nginx-unprivileged:1.30.3-alpine3.23 AS frontend-production
 USER root
-RUN apk upgrade --no-cache libexpat && \
+
-    apk del curl
+# Security patches for known CVEs
-USER nginx
+RUN apk update && apk upgrade  \
    libcrypto3>=3.5.7-r0 \
    libssl3>=3.5.7-r0 \
    musl \
    musl-utils \
    zlib>=1.3.2-r0 \
    && apk del curl
 USER nginx
@@ -1,6 +1,5 @@
 :root {
    --fonts-sans: 'Marianne', ui-sans-serif, system-ui, sans-serif;
    --avatar-cap-height: 0.7;
 }
 .Header-beforeLogo {
@@ -1,15 +0,0 @@
 # Garage configuration for local development only: single node, no replication.
 # See https://garagehq.deuxfleurs.fr/documentation/reference-manual/configuration/
 metadata_dir = "/var/lib/garage/meta"
 data_dir = "/var/lib/garage/data"
 db_engine = "lmdb"
 replication_factor = 1
 rpc_bind_addr = "127.0.0.1:3901"
 rpc_public_addr = "127.0.0.1:3901"
 [s3_api]
 api_bind_addr = "[::]:9000"
 # Clients must sign their requests for this region (AWS_S3_REGION_NAME)
 s3_region = "local"
@@ -17,9 +17,9 @@ server {
        proxy_set_header X-Amz-Date $authDate;
        proxy_set_header X-Amz-Content-SHA256 $authContentSha256;
-        # Get resource from Garage
+        # Get resource from Minio
-        proxy_pass http://garage:9000/meet-media-storage/;
+        proxy_pass http://minio:9000/meet-media-storage/;
-        proxy_set_header Host garage:9000;
+        proxy_set_header Host minio:9000;
        # To use with ds_proxy
        # proxy_pass http://ds-proxy:4444/upstream/meet-media-storage/;
        # proxy_set_header Host ds-proxy:4444;
@@ -14,4 +14,3 @@ accesslog = "-"
 # Using '-' for the error log file makes gunicorn log errors to stderr
 errorlog = "-"
 loglevel = "info"
 access_log_format = '%(h)s %(l)s %(u)s %(t)s "%(r)s" %(s)s %(b)s "%(f)s" "%(a)s" %(M)s'
@@ -1,4 +1,4 @@
-FROM livekit/livekit-server:v1.13.6
+FROM livekit/livekit-server:v1.9.4
 # We inject the nip.io certificate manually because the livekit chart doesn't support volume mounting
 COPY rootCA.pem /etc/ssl/certs/
@@ -21,10 +21,3 @@ turn:
    - 192.168.0.0/16
    - 172.16.0.0/12
 rtc:
  node_ip: 127.0.0.1
  advertise_internal_ip: true
  udp_port: 7882
  tcp_port: 7881
  use_external_ip: false
@@ -13,7 +13,7 @@ These components rely on a few key services:
 - PostgreSQL for storing data (users, rooms, recordings)
 - Redis for caching and inter-service communication
- Garage for storing files (room recordings)
+- MinIO for storing files (room recordings)
 - Celery workers for meeting transcript (optional, required for AI beta features)
 We provide two stack options for getting Visio up and running for development:
@@ -1,40 +0,0 @@
 # Room purge
 Rooms pile up over time and most of them are only used once. The `purge_inactive_rooms` management command permanently deletes the rooms that have not been started for a configurable number of days. It is disabled by default.
 ## How it works
 Each time LiveKit tells the backend that a room has started (`room_started` webhook), the backend records the date on the room (`last_started_at`).
 A room is inactive when:
 - it was last started more than `ROOM_INACTIVITY_DELETION_DAYS` days ago, or
 - it was never started and was created more than `ROOM_INACTIVITY_DELETION_DAYS` days ago.
 Rooms that existed before this feature was deployed are considered started on the day of the release, so none of them can be purged before a full inactivity period has elapsed.
 The command is meant to run once a day. The Helm chart schedules it in `backend.cronjobs` (`purge-inactive-rooms`, 01:00); it does nothing until `ROOM_INACTIVITY_DELETION_DAYS` is set.
 ```bash
 python manage.py purge_inactive_rooms            # delete the inactive rooms
 python manage.py purge_inactive_rooms --dry-run  # only list the rooms that would be deleted
 ```
 ## Rooms that are kept
 A recording can only be reached through its room. An inactive room is kept as long as it holds a saved recording its users may still access:
 - with `RECORDING_EXPIRATION_DAYS` set, a saved recording created less than that many days ago,
 - with `RECORDING_EXPIRATION_DAYS` unset, any saved recording.
 ## What happens to a purged room
 The room is deleted from the database, along with its accesses, its telephony PIN code, and the recording entries it still holds — the expired ones and those that were never saved, since any other recording would have protected the room — together with their own accesses.
 The recording **files in the bucket are left untouched**: the backend never deletes anything from the storage, it only drops the database entries pointing at it. Removing the files is the job of the bucket lifecycle policy, which should match `RECORDING_EXPIRATION_DAYS` (see the [recording documentation](recording.md)). When the two do not match, the purge leaves objects behind: they become unreachable, since serving a recording requires its database entry, but they keep costing storage.
 ⚠️ When a room is purged, all it's configuration and access rights are also deleted. Its slug becomes available again
 and can be reused when a meeting is created from that same URL.
 * With `ALLOW_UNREGISTERED_ROOMS=false`, only an authenticated user can navigate to a previously existing link after the room has been purged. Doing so recreates the room in the database with a fresh configuration, with that user associated with it and granted admin rights.
 * With `ALLOW_UNREGISTERED_ROOMS=true`, any user can reopen the purged room by navigating to the same URL. In that case, the room is created dynamically and no corresponding room entry is persisted in the database.
@@ -42,7 +42,7 @@ sequenceDiagram
  participant Backend as Backend API
  participant Summary as Summary Service
  participant Celery as Celery Workers (transcribe-queue)
-  participant S3 as S3 (Object Storage)
+  participant MinIO as MinIO (Object Storage)
  participant STT as WhisperX API
  participant Docs as LaSuite Docs
@@ -50,7 +50,7 @@ sequenceDiagram
  Note right of Backend: Payload contains 7 params: owner_id, filename, email, sub, room, recording_date, recording_time
  Summary->>Celery: Register task (transcribe-queue)
-  Celery->>S3: Fetch audio file
+  Celery->>MinIO: Fetch audio file
  Celery->>STT: Transcribe audio (WhisperX)
  STT-->>Celery: Segmented transcript
@@ -72,12 +72,11 @@ sequenceDiagram
 | celery_result_backend    | String    | `"redis://redis/0"`                                                   | Celery result backend URL.                                                                                                                                              |
 | celery_max_retries       | Integer   | `1`                                                                   | Maximum number of retries for Celery tasks.                                                                                                                             |
 | transcribe_queue         | String    | `"transcribe-queue"`                                                  | Name of the Celery queue for transcription tasks.                                                                                                                       |
-| aws_storage_bucket_name  | String    | —                                                                     | Name of the S3 bucket used for storing recordings.                                                                                                                      |
+| aws_storage_bucket_name  | String    | —                                                                     | Name of the S3/MinIO bucket used for storing recordings.                                                                                                                |
-| aws_s3_endpoint_url      | String    | —                                                                     | Endpoint URL of the S3 storage.                                                                                                                                         |
+| aws_s3_endpoint_url      | String    | —                                                                     | Endpoint URL of the S3/MinIO storage.                                                                                                                                   |
-| aws_s3_access_key_id     | String    | —                                                                     | Access key for S3.                                                                                                                                                      |
+| aws_s3_access_key_id     | String    | —                                                                     | Access key for S3/MinIO.                                                                                                                                                |
-| aws_s3_secret_access_key | Secret    | —                                                                     | Secret key for S3.                                                                                                                                                      |
+| aws_s3_secret_access_key | Secret    | —                                                                     | Secret key for S3/MinIO.                                                                                                                                                |
-| aws_s3_secure_access     | Boolean   | `True`                                                                | Use HTTPS for S3 requests.                                                                                                                                              |
+| aws_s3_secure_access     | Boolean   | `True`                                                                | Use HTTPS for S3/MinIO requests.                                                                                                                                        |
 | aws_s3_region_name       | String    | —                                                                     | Region used to sign S3 requests, passed as-is to boto3.                                                                                                                 |
 | whisperx_api_key         | Secret    | —                                                                     | API key for accessing WhisperX.                                                                                                                                         |
 | whisperx_base_url        | String    | `"https://api.whisperx.com/v1"`                                       | Base URL for the WhisperX API.                                                                                                                                          |
 | whisperx_asr_model       | String    | `"whisper-1"`                                                         | ASR model used for transcription.                                                                                                                                       |
@@ -14,7 +14,7 @@ All services are required to run the minimalist instance of LaSuite Meet. Click
 | **OIDC Provider** | User authentication | [Keycloak setup](../examples/compose/keycloak/README.md) |
 | **SMTP Service**  | Email notifications | -                                                        |
-> [!NOTE] Some advanced features, as Recording and transcription, require additional services (S3-compatible object storage, email). See `/features` folder for details.
+> [!NOTE] Some advanced features, as Recording and transcription, require additional services (MinIO, email). See `/features` folder for details.
 ## Software Requirements
@@ -14,7 +14,7 @@ This document is a step-by-step guide that describes how to install LaSuite Meet
 If you do not have a kubernetes test cluster, you can install everything on a local kind cluster. In this case, the simplest way is to use our script located in this repo under **bin/start-kind.sh**.
-IMPORTANT: The kind method will only deploy meet as a local instance(127.0.0.1) that can only be accessed from the device where it has been deployed.
+IMPORTANT: The kind method will only deploy meet as a local instance(127.0.0.1) that can only be accessed from the device where it has been deployed. 
 To be able to use the script, you will need to install the following components:
@@ -311,122 +311,119 @@ frontend:
 These are the environmental options available on meet backend.
-| Option                                          | Description                                                                                                                                                  | default                                                                                                                                                      |
+| Option                                          | Description                                                                                                                                                  | default                                                                                                                                                       |
-|-------------------------------------------------|--------------------------------------------------------------------------------------------------------------------------------------------------------------|--------------------------------------------------------------------------------------------------------------------------------------------------------------|
+|-------------------------------------------------|--------------------------------------------------------------------------------------------------------------------------------------------------------------|---------------------------------------------------------------------------------------------------------------------------------------------------------------|
-| DATA_DIR                                        | Data directory location                                                                                                                                      | /data                                                                                                                                                        |
+| DATA_DIR                                        | Data directory location                                                                                                                                      | /data                                                                                                                                                         |
-| DJANGO_ALLOWED_HOSTS                            | Hosts that are allowed                                                                                                                                       | []                                                                                                                                                           |
+| DJANGO_ALLOWED_HOSTS                            | Hosts that are allowed                                                                                                                                       | []                                                                                                                                                            |
-| DJANGO_SECRET_KEY                               | Secret key used for Django security                                                                                                                          |                                                                                                                                                              |
+| DJANGO_SECRET_KEY                               | Secret key used for Django security                                                                                                                          |                                                                                                                                                               |
-| DJANGO_SILENCED_SYSTEM_CHECKS                   | Silence Django system checks                                                                                                                                 | []                                                                                                                                                           |
+| DJANGO_SILENCED_SYSTEM_CHECKS                   | Silence Django system checks                                                                                                                                 | []                                                                                                                                                            |
-| DJANGO_ALLOW_UNSECURE_USER_LISTING              | Allow unsecure user listing                                                                                                                                  | false                                                                                                                                                        |
+| DJANGO_ALLOW_UNSECURE_USER_LISTING              | Allow unsecure user listing                                                                                                                                  | false                                                                                                                                                         |
-| DB_ENGINE                                       | Database engine used                                                                                                                                         | django.db.backends.postgresql_psycopg2                                                                                                                       |
+| DB_ENGINE                                       | Database engine used                                                                                                                                         | django.db.backends.postgresql_psycopg2                                                                                                                        |
-| DB_NAME                                         | Name of the database                                                                                                                                         | meet                                                                                                                                                         |
+| DB_NAME                                         | Name of the database                                                                                                                                         | meet                                                                                                                                                          |
-| DB_USER                                         | User used to connect to database                                                                                                                             | dinum                                                                                                                                                        |
+| DB_USER                                         | User used to connect to database                                                                                                                             | dinum                                                                                                                                                         |
-| DB_PASSWORD                                     | Password used to connect to the database                                                                                                                     | pass                                                                                                                                                         |
+| DB_PASSWORD                                     | Password used to connect to the database                                                                                                                     | pass                                                                                                                                                          |
-| DB_HOST                                         | Hostname of the database                                                                                                                                     | localhost                                                                                                                                                    |
+| DB_HOST                                         | Hostname of the database                                                                                                                                     | localhost                                                                                                                                                     |
-| DB_PORT                                         | Port to connect to database                                                                                                                                  | 5432                                                                                                                                                         |
+| DB_PORT                                         | Port to connect to database                                                                                                                                  | 5432                                                                                                                                                          |
-| STORAGES_STATICFILES_BACKEND                    | Static file serving engine                                                                                                                                   | whitenoise.storage.CompressedManifestStaticFilesStorage                                                                                                      |
+| STORAGES_STATICFILES_BACKEND                    | Static file serving engine                                                                                                                                   | whitenoise.storage.CompressedManifestStaticFilesStorage                                                                                                       |
-| AWS_S3_ENDPOINT_URL                             | S3 host endpoint                                                                                                                                             |                                                                                                                                                              |
+| AWS_S3_ENDPOINT_URL                             | S3 host endpoint                                                                                                                                             |                                                                                                                                                               |
-| AWS_S3_ACCESS_KEY_ID                            | S3 access key                                                                                                                                                |                                                                                                                                                              |
+| AWS_S3_ACCESS_KEY_ID                            | S3 access key                                                                                                                                                |                                                                                                                                                               |
-| AWS_S3_SECRET_ACCESS_KEY                        | S3 secret key                                                                                                                                                |                                                                                                                                                              |
+| AWS_S3_SECRET_ACCESS_KEY                        | S3 secret key                                                                                                                                                |                                                                                                                                                               |
-| AWS_S3_REGION_NAME                              | S3 region                                                                                                                                                    |                                                                                                                                                              |
+| AWS_S3_REGION_NAME                              | S3 region                                                                                                                                                    |                                                                                                                                                               |
-| AWS_STORAGE_BUCKET_NAME                         | S3 bucket name                                                                                                                                               | meet-media-storage                                                                                                                                           |
+| AWS_STORAGE_BUCKET_NAME                         | S3 bucket name                                                                                                                                               | meet-media-storage                                                                                                                                            |
-| DJANGO_LANGUAGE_CODE                            | Default language                                                                                                                                             | en-us                                                                                                                                                        |
+| DJANGO_LANGUAGE_CODE                            | Default language                                                                                                                                             | en-us                                                                                                                                                         |
-| REDIS_URL                                       | Redis endpoint                                                                                                                                               | redis://redis:6379/1                                                                                                                                         |
+| REDIS_URL                                       | Redis endpoint                                                                                                                                               | redis://redis:6379/1                                                                                                                                          |
-| SESSION_COOKIE_AGE                              | Session cookie expiration in seconds                                                                                                                         | 43200 (12 hours)                                                                                                                                             |
+| SESSION_COOKIE_AGE                              | Session cookie expiration in seconds                                                                                                                         | 43200 (12 hours)                                                                                                                                              |
-| ROOM_CREATION_THROTTLE_RATES                    | Room creation throttle rate per authenticated user | 50/minute                                                                                               | 50/minute                                                                                                                                                    |
+| REQUEST_ENTRY_THROTTLE_RATES                    | Entry request throttle rates                                                                                                                                 | 150/minute                                                                                                                                                    |
-| ROOM_CREATION_DAILY_THROTTLE_RATES              | Daily room creation cap per authenticated user                                                                                                               | 1000/day                                                                                                                                                     |
+| CREATION_CALLBACK_THROTTLE_RATES                | Creation callback throttle rates                                                                                                                             | 600/minute                                                                                                                                                    |
-| REQUEST_ENTRY_THROTTLE_RATES                    | Entry request throttle rates                                                                                                                                 | 150/minute                                                                                                                                                   |
+| SPECTACULAR_SETTINGS_ENABLE_DJANGO_DEPLOY_CHECK | Enable Django deploy check                                                                                                                                   | false                                                                                                                                                         |
-| CREATION_CALLBACK_THROTTLE_RATES                | Creation callback throttle rates                                                                                                                             | 600/minute                                                                                                                                                   |
+| CSRF_TRUSTED_ORIGINS                            | CSRF trusted origins list                                                                                                                                    | []                                                                                                                                                            |
-| SPECTACULAR_SETTINGS_ENABLE_DJANGO_DEPLOY_CHECK | Enable Django deploy check                                                                                                                                   | false                                                                                                                                                        |
+| FRONTEND_CUSTOM_CSS_URL                         | URL of an additional CSS file to load in the frontend app. If set, a `<link>` tag with this URL as href is added to the `<head>` of the frontend app         |                                                                                                                                                               |
-| CSRF_TRUSTED_ORIGINS                            | CSRF trusted origins list                                                                                                                                    | []                                                                                                                                                           |
+| FRONTEND_ANALYTICS                              | Analytics information                                                                                                                                        | {}                                                                                                                                                            |
-| FRONTEND_CUSTOM_CSS_URL                         | URL of an additional CSS file to load in the frontend app. If set, a `<link>` tag with this URL as href is added to the `<head>` of the frontend app         |                                                                                                                                                              |
+| FRONTEND_SUPPORT                                | Crisp frontend support configuration, also you can pass help articles, with `help_article_transcript`, `help_article_recording`, `help_article_more_tools`   | {}                                                                                                                                                            |
-| FRONTEND_ANALYTICS                              | Analytics information                                                                                                                                        | {}                                                                                                                                                           |
+| FRONTEND_MANIFEST_LINK                          | Link to the "Learn more" button on the homepage                                                                                                              | {}                                                                                                                                                            |
-| FRONTEND_SUPPORT                                | Crisp frontend support configuration, also you can pass help articles, with `help_article_transcript`, `help_article_recording`, `help_article_more_tools`   | {}                                                                                                                                                           |
+| FRONTEND_SILENCE_LIVEKIT_DEBUG                  | Silence LiveKit debug logs                                                                                                                                   | false                                                                                                                                                         |
-| FRONTEND_MANIFEST_LINK                          | Link to the "Learn more" button on the homepage                                                                                                              | {}                                                                                                                                                           |
+| FRONTEND_IS_SILENT_LOGIN_ENABLED                | Enable silent login feature                                                                                                                                  | true                                                                                                                                                          |
-| FRONTEND_SILENCE_LIVEKIT_DEBUG                  | Silence LiveKit debug logs                                                                                                                                   | false                                                                                                                                                        |
+| FRONTEND_FEEDBACK                               | Frontend feedback configuration                                                                                                                              | {}                                                                                                                                                            |
-| FRONTEND_IS_SILENT_LOGIN_ENABLED                | Enable silent login feature                                                                                                                                  | true                                                                                                                                                         |
+| FRONTEND_DOCUMENTATION_URL                      | URL of the documentation opened from the room options menu. If unset, the documentation menu item is hidden                                                  |                                                                                                                                                               |
-| FRONTEND_FEEDBACK                               | Frontend feedback configuration                                                                                                                              | {}                                                                                                                                                           |
+| FRONTEND_USE_FRENCH_GOV_FOOTER                  | Show the French government footer in the homepage                                                                                                            | false                                                                                                                                                         |
-| FRONTEND_DOCUMENTATION_URL                      | URL of the documentation opened from the room options menu. If unset, the documentation menu item is hidden                                                  |                                                                                                                                                              |
+| FRONTEND_USE_PROCONNECT_BUTTON                  | Show a "Login with ProConnect" button in the homepage instead of a "Login" button                                                                            | false                                                                                                                                                         |
-| FRONTEND_USE_FRENCH_GOV_FOOTER                  | Show the French government footer in the homepage                                                                                                            | false                                                                                                                                                        |
+| DJANGO_EMAIL_BACKEND                            | Email backend library                                                                                                                                        | django.core.mail.backends.smtp.EmailBackend                                                                                                                   |
-| FRONTEND_USE_PROCONNECT_BUTTON                  | Show a "Login with ProConnect" button in the homepage instead of a "Login" button                                                                            | false                                                                                                                                                        |
+| DJANGO_EMAIL_HOST                               | Host of the email server                                                                                                                                     |                                                                                                                                                               |
-| DJANGO_EMAIL_BACKEND                            | Email backend library                                                                                                                                        | django.core.mail.backends.smtp.EmailBackend                                                                                                                  |
+| DJANGO_EMAIL_HOST_USER                          | User to connect to the email server                                                                                                                          |                                                                                                                                                               |
-| DJANGO_EMAIL_HOST                               | Host of the email server                                                                                                                                     |                                                                                                                                                              |
+| DJANGO_EMAIL_HOST_PASSWORD                      | Password to connect to the email server                                                                                                                      |                                                                                                                                                               |
-| DJANGO_EMAIL_HOST_USER                          | User to connect to the email server                                                                                                                          |                                                                                                                                                              |
+| DJANGO_EMAIL_PORT                               | Port to connect to the email server                                                                                                                          |                                                                                                                                                               |
-| DJANGO_EMAIL_HOST_PASSWORD                      | Password to connect to the email server                                                                                                                      |                                                                                                                                                              |
+| DJANGO_EMAIL_USE_TLS                            | Enable TLS on email connection                                                                                                                               | false                                                                                                                                                         |
-| DJANGO_EMAIL_PORT                               | Port to connect to the email server                                                                                                                          |                                                                                                                                                              |
+| DJANGO_EMAIL_USE_SSL                            | Enable SSL on email connection                                                                                                                               | false                                                                                                                                                         |
-| DJANGO_EMAIL_USE_TLS                            | Enable TLS on email connection                                                                                                                               | false                                                                                                                                                        |
+| DJANGO_EMAIL_FROM                               | Email from account                                                                                                                                           | from@example.com                                                                                                                                              |
-| DJANGO_EMAIL_USE_SSL                            | Enable SSL on email connection                                                                                                                               | false                                                                                                                                                        |
+| EMAIL_BRAND_NAME                                | Email branding name                                                                                                                                          |                                                                                                                                                               |
-| DJANGO_EMAIL_FROM                               | Email from account                                                                                                                                           | from@example.com                                                                                                                                             |
+| EMAIL_SUPPORT_EMAIL                             | Support email address                                                                                                                                        |                                                                                                                                                               |
-| EMAIL_BRAND_NAME                                | Email branding name                                                                                                                                          |                                                                                                                                                              |
+| EMAIL_LOGO_IMG                                  | Email logo image                                                                                                                                             |                                                                                                                                                               |
-| EMAIL_SUPPORT_EMAIL                             | Support email address                                                                                                                                        |                                                                                                                                                              |
+| EMAIL_DOMAIN                                    | Email domain                                                                                                                                                 |                                                                                                                                                               |
-| EMAIL_LOGO_IMG                                  | Email logo image                                                                                                                                             |                                                                                                                                                              |
+| EMAIL_APP_BASE_URL                              | Email app base URL                                                                                                                                           |                                                                                                                                                               |
-| EMAIL_DOMAIN                                    | Email domain                                                                                                                                                 |                                                                                                                                                              |
+| DJANGO_CORS_ALLOW_ALL_ORIGINS                   | Allow all CORS origins                                                                                                                                       | false                                                                                                                                                         |
-| EMAIL_APP_BASE_URL                              | Email app base URL                                                                                                                                           |                                                                                                                                                              |
+| DJANGO_CORS_ALLOWED_ORIGINS                     | Origins to allow (string list)                                                                                                                               | []                                                                                                                                                            |
-| DJANGO_CORS_ALLOW_ALL_ORIGINS                   | Allow all CORS origins                                                                                                                                       | false                                                                                                                                                        |
+| DJANGO_CORS_ALLOWED_ORIGIN_REGEXES              | Origins to allow (regex patterns)                                                                                                                            | []                                                                                                                                                            |
-| DJANGO_CORS_ALLOWED_ORIGINS                     | Origins to allow (string list)                                                                                                                               | []                                                                                                                                                           |
+| SENTRY_DSN                                      | Sentry server DSN                                                                                                                                            |                                                                                                                                                               |
-| DJANGO_CORS_ALLOWED_ORIGIN_REGEXES              | Origins to allow (regex patterns)                                                                                                                            | []                                                                                                                                                           |
+| DJANGO_CELERY_BROKER_URL                        | Celery broker host                                                                                                                                           | redis://redis:6379/0                                                                                                                                          |
-| SENTRY_DSN                                      | Sentry server DSN                                                                                                                                            |                                                                                                                                                              |
+| DJANGO_CELERY_BROKER_TRANSPORT_OPTIONS          | Celery broker options                                                                                                                                        | {}                                                                                                                                                            |
-| DJANGO_CELERY_BROKER_URL                        | Celery broker host                                                                                                                                           | redis://redis:6379/0                                                                                                                                         |
+| OIDC_CREATE_USER                                | Create OIDC user if not exists                                                                                                                               | true                                                                                                                                                          |
-| DJANGO_CELERY_BROKER_TRANSPORT_OPTIONS          | Celery broker options                                                                                                                                        | {}                                                                                                                                                           |
+| OIDC_VERIFY_SSL                                 | Verify SSL for OIDC                                                                                                                                          | true                                                                                                                                                          |
-| OIDC_CREATE_USER                                | Create OIDC user if not exists                                                                                                                               | true                                                                                                                                                         |
+| OIDC_FALLBACK_TO_EMAIL_FOR_IDENTIFICATION       | Fallback to email for identification                                                                                                                         | false                                                                                                                                                         |
-| OIDC_VERIFY_SSL                                 | Verify SSL for OIDC                                                                                                                                          | true                                                                                                                                                         |
+| OIDC_RP_SIGN_ALGO                               | Token verification algorithm used by OIDC                                                                                                                    | RS256                                                                                                                                                         |
-| OIDC_FALLBACK_TO_EMAIL_FOR_IDENTIFICATION       | Fallback to email for identification                                                                                                                         | false                                                                                                                                                        |
+| OIDC_RP_CLIENT_ID                               | OIDC client ID                                                                                                                                               | meet                                                                                                                                                          |
-| OIDC_RP_SIGN_ALGO                               | Token verification algorithm used by OIDC                                                                                                                    | RS256                                                                                                                                                        |
+| OIDC_RP_CLIENT_SECRET                           | OIDC client secret                                                                                                                                           |                                                                                                                                                               |
-| OIDC_RP_CLIENT_ID                               | OIDC client ID                                                                                                                                               | meet                                                                                                                                                         |
+| OIDC_OP_JWKS_ENDPOINT                           | OIDC endpoint for JWKS                                                                                                                                       |                                                                                                                                                               |
-| OIDC_RP_CLIENT_SECRET                           | OIDC client secret                                                                                                                                           |                                                                                                                                                              |
+| OIDC_OP_AUTHORIZATION_ENDPOINT                  | OIDC endpoint for authorization                                                                                                                              |                                                                                                                                                               |
-| OIDC_OP_JWKS_ENDPOINT                           | OIDC endpoint for JWKS                                                                                                                                       |                                                                                                                                                              |
+| OIDC_OP_TOKEN_ENDPOINT                          | OIDC endpoint for token                                                                                                                                      |                                                                                                                                                               |
-| OIDC_OP_AUTHORIZATION_ENDPOINT                  | OIDC endpoint for authorization                                                                                                                              |                                                                                                                                                              |
+| OIDC_OP_USER_ENDPOINT                           | OIDC endpoint for user                                                                                                                                       |                                                                                                                                                               |
-| OIDC_OP_TOKEN_ENDPOINT                          | OIDC endpoint for token                                                                                                                                      |                                                                                                                                                              |
+| OIDC_OP_USER_ENDPOINT_FORMAT                    | OIDC endpoint format (AUTO, JWT, JSON)                                                                                                                       | AUTO                                                                                                                                                          |
-| OIDC_OP_USER_ENDPOINT                           | OIDC endpoint for user                                                                                                                                       |                                                                                                                                                              |
+| OIDC_OP_LOGOUT_ENDPOINT                         | OIDC endpoint for logout                                                                                                                                     |                                                                                                                                                               |
-| OIDC_OP_USER_ENDPOINT_FORMAT                    | OIDC endpoint format (AUTO, JWT, JSON)                                                                                                                       | AUTO                                                                                                                                                         |
+| OIDC_AUTH_REQUEST_EXTRA_PARAMS                  | Extra parameters for OIDC request                                                                                                                            | {}                                                                                                                                                            |
-| OIDC_OP_LOGOUT_ENDPOINT                         | OIDC endpoint for logout                                                                                                                                     |                                                                                                                                                              |
+| OIDC_RP_SCOPES                                  | OIDC scopes                                                                                                                                                  | openid email                                                                                                                                                  |
-| OIDC_AUTH_REQUEST_EXTRA_PARAMS                  | Extra parameters for OIDC request                                                                                                                            | {}                                                                                                                                                           |
+| OIDC_USE_NONCE                                  | Use nonce for OIDC                                                                                                                                           | true                                                                                                                                                          |
-| OIDC_RP_SCOPES                                  | OIDC scopes                                                                                                                                                  | openid email                                                                                                                                                 |
+| OIDC_REDIRECT_REQUIRE_HTTPS                     | Require HTTPS for OIDC                                                                                                                                       | false                                                                                                                                                         |
-| OIDC_USE_NONCE                                  | Use nonce for OIDC                                                                                                                                           | true                                                                                                                                                         |
+| OIDC_REDIRECT_ALLOWED_HOSTS                     | Allowed redirect hosts for OIDC                                                                                                                              | []                                                                                                                                                            |
-| OIDC_REDIRECT_REQUIRE_HTTPS                     | Require HTTPS for OIDC                                                                                                                                       | false                                                                                                                                                        |
+| OIDC_STORE_ID_TOKEN                             | Store OIDC ID token                                                                                                                                          | true                                                                                                                                                          |
-| OIDC_REDIRECT_ALLOWED_HOSTS                     | Allowed redirect hosts for OIDC                                                                                                                              | []                                                                                                                                                           |
+| OIDC_REDIRECT_FIELD_NAME                        | Redirect field for OIDC                                                                                                                                      | returnTo                                                                                                                                                      |
-| OIDC_STORE_ID_TOKEN                             | Store OIDC ID token                                                                                                                                          | true                                                                                                                                                         |
+| OIDC_USERINFO_FULLNAME_FIELDS                   | Full name claim from OIDC token                                                                                                                              | ["given_name", "usual_name"]                                                                                                                                  |
-| OIDC_REDIRECT_FIELD_NAME                        | Redirect field for OIDC                                                                                                                                      | returnTo                                                                                                                                                     |
+| OIDC_USERINFO_SHORTNAME_FIELD                   | Short name claim from OIDC token                                                                                                                             | given_name                                                                                                                                                    |
-| OIDC_USERINFO_FULLNAME_FIELDS                   | Full name claim from OIDC token                                                                                                                              | ["given_name", "usual_name"]                                                                                                                                 |
+| OIDC_USERINFO_ESSENTIAL_CLAIMS                  | Required claims from OIDC token                                                                                                                              | []                                                                                                                                                            |
-| OIDC_USERINFO_SHORTNAME_FIELD                   | Short name claim from OIDC token                                                                                                                             | given_name                                                                                                                                                   |
+| OIDC_USE_PKCE                                   | Enable the use of PKCE (Proof Key for Code Exchange) during the OAuth 2.0 authorization code flow. Recommended for enhanced security.                        | False                                                                                                                                                         |
-| OIDC_USERINFO_ESSENTIAL_CLAIMS                  | Required claims from OIDC token                                                                                                                              | []                                                                                                                                                           |
+| OIDC_PKCE_CODE_CHALLENGE_METHOD                 | Method used to generate the PKCE code challenge. Common values include S256 and plain. Refer to the mozilla-django-oidc documentation for supported options. | S256                                                                                                                                                          |
-| OIDC_USE_PKCE                                   | Enable the use of PKCE (Proof Key for Code Exchange) during the OAuth 2.0 authorization code flow. Recommended for enhanced security.                        | False                                                                                                                                                        |
+| OIDC_PKCE_CODE_VERIFIER_SIZE                    | Length of the random string used as the PKCE code verifier. Must be an integer between 43 and 128, inclusive.                                                | 64                                                                                                                                                            |
-| OIDC_PKCE_CODE_CHALLENGE_METHOD                 | Method used to generate the PKCE code challenge. Common values include S256 and plain. Refer to the mozilla-django-oidc documentation for supported options. | S256                                                                                                                                                         |
+| LOGIN_REDIRECT_URL                              | Login redirect URL                                                                                                                                           |                                                                                                                                                               |
-| OIDC_PKCE_CODE_VERIFIER_SIZE                    | Length of the random string used as the PKCE code verifier. Must be an integer between 43 and 128, inclusive.                                                | 64                                                                                                                                                           |
+| LOGIN_REDIRECT_URL_FAILURE                      | Login redirect URL for failure                                                                                                                               |                                                                                                                                                               |
-| LOGIN_REDIRECT_URL                              | Login redirect URL                                                                                                                                           |                                                                                                                                                              |
+| LOGOUT_REDIRECT_URL                             | URL to redirect to on logout                                                                                                                                 |                                                                                                                                                               |
-| LOGIN_REDIRECT_URL_FAILURE                      | Login redirect URL for failure                                                                                                                               |                                                                                                                                                              |
+| ALLOW_LOGOUT_GET_METHOD                         | Allow logout through GET method                                                                                                                              | true                                                                                                                                                          |
-| LOGOUT_REDIRECT_URL                             | URL to redirect to on logout                                                                                                                                 |                                                                                                                                                              |
+| LIVEKIT_API_KEY                                 | LiveKit API key                                                                                                                                              |                                                                                                                                                               |
-| ALLOW_LOGOUT_GET_METHOD                         | Allow logout through GET method                                                                                                                              | true                                                                                                                                                         |
+| LIVEKIT_API_SECRET                              | LiveKit API secret                                                                                                                                           |                                                                                                                                                               |
-| LIVEKIT_API_KEY                                 | LiveKit API key                                                                                                                                              |                                                                                                                                                              |
+| LIVEKIT_API_URL                                 | LiveKit API URL                                                                                                                                              |                                                                                                                                                               |
-| LIVEKIT_API_SECRET                              | LiveKit API secret                                                                                                                                           |                                                                                                                                                              |
+| LIVEKIT_VERIFY_SSL                              | Verify SSL for LiveKit connections                                                                                                                           | true                                                                                                                                                          |
-| LIVEKIT_API_URL                                 | LiveKit API URL                                                                                                                                              |                                                                                                                                                              |
+| LIVEKIT_FORCE_WSS_PROTOCOL                      | Enables WSS protocol conversion for legacy browser compatibility (Firefox <124, Chrome <125, Edge <125) where HTTPS URLs fail in WebSocket() constructor.    | false                                                                                                                                                         |
-| LIVEKIT_VERIFY_SSL                              | Verify SSL for LiveKit connections                                                                                                                           | true                                                                                                                                                         |
+| LIVEKIT_ENABLE_FIREFOX_PROXY_WORKAROUND         | Firefox-only connection warmup: pre-calls WebSocket endpoint (expecting 401) to initialize cache, resolving proxy/network connectivity issues.               | false                                                                                                                                                         |
-| LIVEKIT_FORCE_WSS_PROTOCOL                      | Enables WSS protocol conversion for legacy browser compatibility (Firefox <124, Chrome <125, Edge <125) where HTTPS URLs fail in WebSocket() constructor.    | false                                                                                                                                                        |
+| RESOURCE_DEFAULT_ACCESS_LEVEL                   | Default resource access level for rooms                                                                                                                      | public                                                                                                                                                        |
-| LIVEKIT_ENABLE_FIREFOX_PROXY_WORKAROUND         | Firefox-only connection warmup: pre-calls WebSocket endpoint (expecting 401) to initialize cache, resolving proxy/network connectivity issues.               | false                                                                                                                                                        |
+| ALLOW_UNREGISTERED_ROOMS                        | Allow usage of unregistered rooms                                                                                                                            | true                                                                                                                                                          |
-| RESOURCE_DEFAULT_ACCESS_LEVEL                   | Default resource access level for rooms                                                                                                                      | public                                                                                                                                                       |
+| RECORDING_ENABLE                                | Record meeting option                                                                                                                                        | false                                                                                                                                                         |
-| ALLOW_UNREGISTERED_ROOMS                        | Allow usage of unregistered rooms                                                                                                                            | true                                                                                                                                                         |
+| RECORDING_OUTPUT_FOLDER                         | Folder to store meetings                                                                                                                                     | recordings                                                                                                                                                    |
 | ROOM_INACTIVITY_DELETION_DAYS                   | Days without being started after which a room is purged. Unset to never purge                                                                                |                                                                                                                                                              |
 | RECORDING_ENABLE                                | Record meeting option                                                                                                                                        | false                                                                                                                                                        |
 | RECORDING_OUTPUT_FOLDER                         | Folder to store meetings                                                                                                                                     | recordings                                                                                                                                                   |
 | RECORDING_WORKER_CLASSES                        | Worker classes for recording                                                                                                                                 | {"screen_recording": "core.recording.worker.services.VideoCompositeEgressService","transcript": "core.recording.worker.services.AudioCompositeEgressService"} |
-| RECORDING_EXPIRATION_DAYS                       | Recording expiration in days                                                                                                                                 |                                                                                                                                                              |
+| RECORDING_EXPIRATION_DAYS                       | Recording expiration in days                                                                                                                                 |                                                                                                                                                               |
-| RECORDING_MAX_DURATION                          | Maximum recording duration in milliseconds. Must match LiveKit Egress configuration exactly.                                                                 |                                                                                                                                                              |
+| RECORDING_MAX_DURATION                          | Maximum recording duration in milliseconds. Must match LiveKit Egress configuration exactly.                                                                 |                                                                                                                                                               |
-| SCREEN_RECORDING_BASE_URL                       | Screen recording base URL                                                                                                                                    |                                                                                                                                                              |
+| SCREEN_RECORDING_BASE_URL                       | Screen recording base URL                                                                                                                                    |                                                                                                                                                               |
-| SUMMARY_SERVICE_ENDPOINT                        | Summary service endpoint                                                                                                                                     |                                                                                                                                                              |
+| SUMMARY_SERVICE_ENDPOINT                        | Summary service endpoint                                                                                                                                     |                                                                                                                                                               |
-| SUMMARY_SERVICE_API_TOKEN                       | API token for summary service                                                                                                                                |                                                                                                                                                              |
+| SUMMARY_SERVICE_API_TOKEN                       | API token for summary service                                                                                                                                |                                                                                                                                                               |
-| SIGNUP_NEW_USER_TO_MARKETING_EMAIL              | Signup users to marketing emails                                                                                                                             | false                                                                                                                                                        |
+| SIGNUP_NEW_USER_TO_MARKETING_EMAIL              | Signup users to marketing emails                                                                                                                             | false                                                                                                                                                         |
-| MARKETING_SERVICE_CLASS                         | Marketing service class                                                                                                                                      | core.services.marketing.BrevoMarketingService                                                                                                                |
+| MARKETING_SERVICE_CLASS                         | Marketing service class                                                                                                                                      | core.services.marketing.BrevoMarketingService                                                                                                                 |
-| BREVO_API_KEY                                   | Brevo API key for marketing emails                                                                                                                           |                                                                                                                                                              |
+| BREVO_API_KEY                                   | Brevo API key for marketing emails                                                                                                                           |                                                                                                                                                               |
-| BREVO_API_CONTACT_LIST_IDS                      | Brevo API contact list IDs                                                                                                                                   | []                                                                                                                                                           |
+| BREVO_API_CONTACT_LIST_IDS                      | Brevo API contact list IDs                                                                                                                                   | []                                                                                                                                                            |
-| DJANGO_BREVO_API_CONTACT_ATTRIBUTES             | Brevo contact attributes                                                                                                                                     | {"VISIO_USER": true}                                                                                                                                         |
+| DJANGO_BREVO_API_CONTACT_ATTRIBUTES             | Brevo contact attributes                                                                                                                                     | {"VISIO_USER": true}                                                                                                                                          |
-| BREVO_API_TIMEOUT                               | Brevo timeout in seconds                                                                                                                                     | 1                                                                                                                                                            |
+| BREVO_API_TIMEOUT                               | Brevo timeout in seconds                                                                                                                                     | 1                                                                                                                                                             |
-| LOBBY_KEY_PREFIX                                | Lobby key prefix                                                                                                                                             | room_lobby                                                                                                                                                   |
+| LOBBY_KEY_PREFIX                                | Lobby key prefix                                                                                                                                             | room_lobby                                                                                                                                                    |
-| LOBBY_WAITING_TIMEOUT                           | Lobby waiting timeout in seconds                                                                                                                             | 3                                                                                                                                                            |
+| LOBBY_WAITING_TIMEOUT                           | Lobby waiting timeout in seconds                                                                                                                             | 3                                                                                                                                                             |
-| LOBBY_DENIED_TIMEOUT                            | Lobby deny timeout in seconds                                                                                                                                | 5                                                                                                                                                            |
+| LOBBY_DENIED_TIMEOUT                            | Lobby deny timeout in seconds                                                                                                                                | 5                                                                                                                                                             |
-| LOBBY_ACCEPTED_TIMEOUT                          | Lobby accept timeout in seconds                                                                                                                              | 21600 (6 hours)                                                                                                                                              |
+| LOBBY_ACCEPTED_TIMEOUT                          | Lobby accept timeout in seconds                                                                                                                              | 21600 (6 hours)                                                                                                                                               |
-| LOBBY_NOTIFICATION_TYPE                         | Lobby notification types                                                                                                                                     | participantWaiting                                                                                                                                           |
+| LOBBY_NOTIFICATION_TYPE                         | Lobby notification types                                                                                                                                     | participantWaiting                                                                                                                                            |
-| LOBBY_COOKIE_NAME                               | Lobby cookie name                                                                                                                                            | lobbyParticipantId                                                                                                                                           |
+| LOBBY_COOKIE_NAME                               | Lobby cookie name                                                                                                                                            | lobbyParticipantId                                                                                                                                            |
-| ROOM_CREATION_CALLBACK_CACHE_TIMEOUT            | Room creation callback cache timeout                                                                                                                         | 600 (10 minutes)                                                                                                                                             |
+| ROOM_CREATION_CALLBACK_CACHE_TIMEOUT            | Room creation callback cache timeout                                                                                                                         | 600 (10 minutes)                                                                                                                                              |
-| ROOM_TELEPHONY_ENABLED                          | Enable SIP telephony feature                                                                                                                                 | false                                                                                                                                                        |
+| ROOM_TELEPHONY_ENABLED                          | Enable SIP telephony feature                                                                                                                                 | false                                                                                                                                                         |
-| ROOM_TELEPHONY_PIN_LENGTH                       | Telephony PIN length                                                                                                                                         | 10                                                                                                                                                           |
+| ROOM_TELEPHONY_PIN_LENGTH                       | Telephony PIN length                                                                                                                                         | 10                                                                                                                                                            |
-| ROOM_TELEPHONY_PIN_MAX_RETRIES                  | Telephony PIN maximum retries                                                                                                                                | 5                                                                                                                                                            |
+| ROOM_TELEPHONY_PIN_MAX_RETRIES                  | Telephony PIN maximum retries                                                                                                                                | 5                                                                                                                                                             |
@@ -16,11 +16,11 @@ info:
    * `rooms:list` – List rooms accessible to the delegated user.
    * `rooms:retrieve` – Retrieve details of a specific room.
    * `rooms:create` – Create new rooms.
-    * `rooms:update` – Update the access level and configuration of existing rooms.
+    * `rooms:update` – **Coming soon** Update existing rooms, e.g., add attendees to a room.
    * `rooms:delete` – **Coming soon** Delete rooms generated by the application.
-
+    
    #### Upcoming Features
-
+    
    * **Add attendees to a room:** You will be able to update a room to include a list of attendees, allowing them to bypass the lobby system automatically.
    * **Delete application-generated rooms:** Rooms created via the application can be deleted when no longer needed.
@@ -310,67 +310,6 @@ paths:
        '404':
          $ref: '#/components/responses/RoomNotFoundError'
    patch:
      tags:
        - Rooms
      summary: Update a room
      description: |
        Partially updates a room. Only the delegated user's rooms where they are
        administrator or owner can be updated; any other role gets a `403`.
        **Updatable fields:** `access_level` and `configuration`. Every other field
        (`id`, `name`, `slug`, `pin_code`) is read-only and silently ignored when sent.
        `configuration` is replaced as a whole, it is not merged with the stored one.
        Send the complete object you want the room to end up with.
        Full replacement (`PUT`) is not supported. Use `PATCH` instead.
      operationId: updateRoom
      security:
        - BearerAuth: [rooms:update]
      parameters:
        - name: id
          in: path
          required: true
          description: Room UUID
          schema:
            type: string
            format: uuid
      requestBody:
        required: true
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/RoomUpdate'
            examples:
              accessLevelOnly:
                summary: Change the access level
                value:
                  access_level: "restricted"
              configurationOnly:
                summary: Replace the room configuration
                value:
                  configuration:
                    everyone_can_mute: true
      responses:
        '200':
          description: Room updated successfully
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Room'
        '400':
          $ref: '#/components/responses/BadRequestError'
        '401':
          $ref: '#/components/responses/UnauthorizedError'
        '403':
          $ref: '#/components/responses/ForbiddenError'
        '404':
          $ref: '#/components/responses/RoomNotFoundError'
        '405':
          description: |
            Method not allowed, `PUT` is not supported on this endpoint.
 components:
  securitySchemes:
    BearerAuth:
@@ -447,17 +386,6 @@ components:
        configuration:
          $ref: '#/components/schemas/RoomConfiguration'
    RoomUpdate:
      type: object
      description: |
        Fields that can be updated on an existing room. Both are optional, omitted
        fields keep their current value.
      properties:
        access_level:
          $ref: '#/components/schemas/RoomAccessLevel'
        configuration:
          $ref: '#/components/schemas/RoomConfiguration'
    RoomConfiguration:
      type: object
      description: |
@@ -499,9 +427,6 @@ components:
        - `public`: Anyone with the room link can join directly, no authentication required.
        - `trusted`: Authenticated users join directly. Unauthenticated users wait in the lobby for approval.
        - `restricted`: Only participants explicitly trusted by the owner bypass the lobby. Everyone else waits for approval regardless of authentication.
        `public` is rejected with a `400` unless the deployment explicitly enables it
        for this API. This applies both when creating a room and when updating one.
      example: "trusted"
    Room:
@@ -20,7 +20,7 @@ info:
    * `lasuite_visio:rooms:list` – List rooms accessible to the delegated user.
    * `lasuite_visio:rooms:retrieve` – Retrieve details of a specific room.
    * `lasuite_visio:rooms:create` – Create new rooms.
-    * `lasuite_visio:rooms:update` – Update the access level and configuration of existing rooms.
+    * `lasuite_visio:rooms:update` – **Coming soon** Update existing rooms, e.g., add attendees to a room.
    * `lasuite_visio:rooms:delete` – **Coming soon** Delete rooms generated by the application.
    #### Upcoming Features
@@ -206,67 +206,6 @@ paths:
        '404':
          $ref: '#/components/responses/RoomNotFoundError'
    patch:
      tags:
        - Rooms
      summary: Update a room
      description: |
        Partially updates a room. Only rooms where the user is administrator or
        owner can be updated; any other role gets a `403`.
        **Updatable fields:** `access_level` and `configuration`. Every other field
        (`id`, `name`, `slug`, `pin_code`) is read-only and silently ignored when sent.
        `configuration` is replaced as a whole, it is not merged with the stored one.
        Send the complete object you want the room to end up with.
        Full replacement (`PUT`) is not supported. Use `PATCH` instead.
      operationId: updateRoom
      security:
        - BearerAuth: [rooms:update]
      parameters:
        - name: id
          in: path
          required: true
          description: Room UUID
          schema:
            type: string
            format: uuid
      requestBody:
        required: true
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/RoomUpdate'
            examples:
              accessLevelOnly:
                summary: Change the access level
                value:
                  access_level: "restricted"
              configurationOnly:
                summary: Replace the room configuration
                value:
                  configuration:
                    everyone_can_mute: true
      responses:
        '200':
          description: Room updated successfully
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Room'
        '400':
          $ref: '#/components/responses/BadRequestError'
        '401':
          $ref: '#/components/responses/UnauthorizedError'
        '403':
          $ref: '#/components/responses/ForbiddenError'
        '404':
          $ref: '#/components/responses/RoomNotFoundError'
        '405':
          description: |
            Method not allowed, `PUT` is not supported on this endpoint.
 components:
  securitySchemes:
    BearerAuth:
@@ -288,17 +227,6 @@ components:
        configuration:
          $ref: '#/components/schemas/RoomConfiguration'
    RoomUpdate:
      type: object
      description: |
        Fields that can be updated on an existing room. Both are optional, omitted
        fields keep their current value.
      properties:
        access_level:
          $ref: '#/components/schemas/RoomAccessLevel'
        configuration:
          $ref: '#/components/schemas/RoomConfiguration'
    RoomConfiguration:
      type: object
      description: |
@@ -340,9 +268,6 @@ components:
        - `public`: Anyone with the room link can join directly, no authentication required.
        - `trusted`: Authenticated users join directly. Unauthenticated users wait in the lobby for approval.
        - `restricted`: Only participants explicitly trusted by the owner bypass the lobby. Everyone else waits for approval regardless of authentication.
        `public` is rejected with a `400` unless the deployment explicitly enables it
        for this API. This applies both when creating a room and when updating one.
      example: "trusted"
    Room:
@@ -34,7 +34,6 @@ Let's say you want to change the font of our application to a custom font. You c
 :root {
  --fonts-sans: 'Roboto', ui-sans-serif, system-ui, sans-serif;
  --avatar-cap-height: 0.7;
 }
 ```
@@ -24,10 +24,9 @@ MEET_BASE_URL="http://localhost:8072"
 # Media
 STORAGES_STATICFILES_BACKEND=django.contrib.staticfiles.storage.StaticFilesStorage
 AWS_S3_DOMAIN_REPLACE=http://localhost:9000
-AWS_S3_ENDPOINT_URL=http://garage:9000
+AWS_S3_ENDPOINT_URL=http://minio:9000
-AWS_S3_ACCESS_KEY_ID=meet-access-key
+AWS_S3_ACCESS_KEY_ID=meet
-AWS_S3_SECRET_ACCESS_KEY=meet-secret-access-key
+AWS_S3_SECRET_ACCESS_KEY=password
 AWS_S3_REGION_NAME=local
 MEDIA_BASE_URL=http://localhost:3000
 FILE_UPLOAD_ENABLED=True
@@ -64,8 +63,7 @@ ALLOW_UNREGISTERED_ROOMS=False
 # Recording
 RECORDING_ENABLE=True
-SUMMARY_SERVICE_VERSION=2
+SUMMARY_SERVICE_ENDPOINT=http://app-summary-dev:8000/api/v2/async-jobs/transcribe/
 SUMMARY_SERVICE_ENDPOINT=http://app-summary-dev:8000/api/v2/async-jobs/transcribe
 SUMMARY_SERVICE_API_TOKEN=password
 SUMMARY_SERVICE_WEBHOOK_API_TOKEN=webhook-password
 RECORDING_DOWNLOAD_BASE_URL=http://localhost:3000/recording
@@ -1,2 +0,0 @@
 # Filled with a random value by `make create-env-files`
 GARAGE_RPC_SECRET=
@@ -2,9 +2,8 @@ LIVEKIT_URL=ws://livekit:7880
 LIVEKIT_API_KEY=devkey
 LIVEKIT_API_SECRET=secret
-AWS_S3_ENDPOINT_URL=garage:9000
+AWS_S3_ENDPOINT_URL=minio:9000
-AWS_S3_ACCESS_KEY_ID=meet-access-key
+AWS_S3_ACCESS_KEY_ID=meet
-AWS_S3_SECRET_ACCESS_KEY=meet-secret-access-key
+AWS_S3_SECRET_ACCESS_KEY=password
 AWS_S3_REGION_NAME=local
 AWS_STORAGE_BUCKET_NAME=meet-media-storage
 AWS_S3_SECURE_ACCESS=False
@@ -1,7 +1,6 @@
-AWS_S3_ENDPOINT_URL=garage:9000
+AWS_S3_ENDPOINT_URL=minio:9000
-AWS_S3_ACCESS_KEY_ID=meet-access-key
+AWS_S3_ACCESS_KEY_ID=meet
-AWS_S3_SECRET_ACCESS_KEY=meet-secret-access-key
+AWS_S3_SECRET_ACCESS_KEY=password
 AWS_S3_REGION_NAME=local
 LIVEKIT_URL=ws://livekit:7880
 LIVEKIT_API_KEY=devkey
@@ -2,12 +2,11 @@ APP_NAME="meet-app-summary-dev"
 APP_API_TOKEN="password"
 AWS_STORAGE_BUCKET_NAME="meet-media-storage"
-AWS_S3_ENDPOINT_URL="garage:9000"
+AWS_S3_ENDPOINT_URL="minio:9000"
 AWS_S3_SECURE_ACCESS=false
-AWS_S3_ACCESS_KEY_ID="meet-access-key"
+AWS_S3_ACCESS_KEY_ID="meet"
-AWS_S3_SECRET_ACCESS_KEY="meet-secret-access-key"
+AWS_S3_SECRET_ACCESS_KEY="password"
 AWS_S3_REGION_NAME="local"
 WHISPERX_BASE_URL="https://configure-your-url.com"
 WHISPERX_ASR_MODEL="large-v2"
@@ -3,14 +3,14 @@ Gitlint extra rule to validate that the message title is of the form
 "<gitmoji>(<scope>) <subject>"
 """
-import json
+from __future__ import unicode_literals
 import re
-import urllib.request
+
 import requests
 from gitlint.rules import CommitMessageTitle, LineRule, RuleViolation
 GITMOJIS_URL = "https://raw.githubusercontent.com/carloscuesta/gitmoji/master/packages/gitmojis/src/gitmojis.json"
 class GitmojiTitle(LineRule):
    """
@@ -28,9 +28,10 @@ class GitmojiTitle(LineRule):
        Download the list possible gitmojis from the project's github repository and check that
        title contains one of them.
        """
-        with urllib.request.urlopen(GITMOJIS_URL, timeout=10) as response:
+        gitmojis = requests.get(
-            gitmojis = json.load(response)["gitmojis"]
+            "https://raw.githubusercontent.com/carloscuesta/gitmoji/master/packages/gitmojis/src/gitmojis.json"
-        emojis = [re.escape(item["emoji"]) for item in gitmojis]
+        ).json()["gitmojis"]
        emojis = [item["emoji"] for item in gitmojis]
        pattern = r"^({:s})\(.*\)\s[a-z].*$".format("|".join(emojis))
        if not re.search(pattern, title):
            violation_msg = 'Title does not match regex "<gitmoji>(<scope>) <subject>"'
@@ -1,5 +1,5 @@
 {
-  "extends": ["github>suitenumerique/ci//renovate/default"],
+  "extends": ["github>numerique-gouv/renovate-configuration"],
  "dependencyDashboard": true,
  "labels": ["dependencies", "noChangeLog"],
  "packageRules": [
@@ -9,8 +9,8 @@
      "version": "0.0.1",
      "license": "MIT",
      "dependencies": {
-        "core-js": "3.50.0",
+        "core-js": "3.49.0",
-        "i18next": "26.4.2",
+        "i18next": "^26.3.6",
        "i18next-browser-languagedetector": "8.2.1",
        "regenerator-runtime": "0.14.1"
      },
@@ -6863,14 +6863,11 @@
      }
    },
    "node_modules/core-js": {
-      "version": "3.50.0",
+      "version": "3.49.0",
-      "resolved": "https://registry.npmjs.org/core-js/-/core-js-3.50.0.tgz",
+      "resolved": "https://registry.npmjs.org/core-js/-/core-js-3.49.0.tgz",
-      "integrity": "sha512-BRWgOLKkFeCgRudR6zrs8p9XJZcE14grzKMMssoYrk6krtuEZ7MTKPIY5RzOnqsEKIR9kst7wNzphttraT+Yqw==",
+      "integrity": "sha512-es1U2+YTtzpwkxVLwAFdSpaIMyQaq0PBgm3YD1W3Qpsn1NAmO3KSgZfu+oGSWVu6NvLHoHCV/aYcsE5wiB7ALg==",
      "hasInstallScript": true,
      "license": "MIT",
      "engines": {
        "node": "*"
      },
      "funding": {
        "type": "opencollective",
        "url": "https://opencollective.com/core-js"
@@ -9367,9 +9364,9 @@
      }
    },
    "node_modules/i18next": {
-      "version": "26.4.2",
+      "version": "26.3.6",
-      "resolved": "https://registry.npmjs.org/i18next/-/i18next-26.4.2.tgz",
+      "resolved": "https://registry.npmjs.org/i18next/-/i18next-26.3.6.tgz",
-      "integrity": "sha512-RX+R0VLg13IbvRuJSxnqykUFS9vQZTl8wYpWPCIUDWVrSGjsQywB5Y+pjzrkboxGAuYfJZVH1InFTdgBdxq6ug==",
+      "integrity": "sha512-Bu5Z2nAXgfVyM8xvW3jk9EKRIuX37PudsrBViThNFx7CR7aaYTpP01cxNB/E4c4UUzTDiAZRstEhsRfPOL/8xA==",
      "funding": [
        {
          "type": "individual",
@@ -26,8 +26,8 @@
    "watch": "webpack --mode development --watch"
  },
  "dependencies": {
-    "core-js": "3.50.0",
+    "core-js": "3.49.0",
-    "i18next": "26.4.2",
+    "i18next": "26.3.6",
    "i18next-browser-languagedetector": "8.2.1",
    "regenerator-runtime": "0.14.1"
  },
@@ -21,7 +21,7 @@ const { initI18n, translateUI } = require("../common/i18n");
        document.querySelector("#close-msg").style.display = "block";
      })
      .catch((e) => {
-        console.error(`Error occurred: ${e}`);
+        console.error(`Error occured: ${e}`);
      })
      .finally(() => {
        // NOTE: doesn't work with the desktop client — the browser considers
@@ -1,12 +1,9 @@
-FROM python:3.14.7-slim AS base
+FROM python:3.14.6-slim AS base
-# Install system dependencies required by LiveKit, fetching packages over HTTPS only for Bureautix proxy
+# Install system dependencies required by LiveKit
-RUN sed -i "s|^URIs: http://|URIs: https://|" /etc/apt/sources.list.d/debian.sources \
+RUN apt-get update && apt-get install -y \
    && apt-get update && apt-get install -y --no-install-recommends  \
    libglib2.0-0 \
    libgobject-2.0-0 \
    libpcre2-8-0 \
    libssl3t64 \
    && rm -rf /var/lib/apt/lists/*
@@ -6,11 +6,9 @@ import logging
 import os
 from dataclasses import asdict, dataclass
 from datetime import datetime, timezone
 from io import BytesIO
 from typing import List, Optional
 import boto3
 from botocore.config import Config
 from botocore.exceptions import BotoCoreError, ClientError
 from dotenv import load_dotenv
 from livekit import api, rtc
 from livekit.agents import (
@@ -30,6 +28,8 @@ from livekit.agents import (
    room_io as lk_room_io,
 )
 from livekit.plugins import silero
 from minio import Minio
 from minio.error import S3Error
 from exceptions import MissingConfigError
 from observability import configure_sentry, set_job_context
@@ -59,30 +59,6 @@ server = AgentServer(
 server.setup_fnc = prewarm
 def create_s3_client():
    """Create an S3 client for the configured endpoint and region.
    The endpoint may be given with or without a scheme: the scheme always
    follows AWS_S3_SECURE_ACCESS.
    """
    endpoint = (
        os.getenv("AWS_S3_ENDPOINT_URL", "")
        .removeprefix("https://")
        .removeprefix("http://")
        .rstrip("/")
    )
    secure = os.getenv("AWS_S3_SECURE_ACCESS", "False").lower() == "true"
    return boto3.client(
        "s3",
        endpoint_url=f"{'https' if secure else 'http'}://{endpoint}",
        aws_access_key_id=os.getenv("AWS_S3_ACCESS_KEY_ID"),
        aws_secret_access_key=os.getenv("AWS_S3_SECRET_ACCESS_KEY"),
        region_name=os.getenv("AWS_S3_REGION_NAME"),
        config=Config(signature_version="s3v4", s3={"addressing_style": "path"}),
    )
@dataclass
 class MetadataEvent:
    """A single timestamped event recorded during a meeting."""
@@ -145,13 +121,18 @@ class MetadataCollector:
    def __init__(self, ctx: JobContext, recording_id: str):
        """Initialize metadata agent."""
        self.minio_client = Minio(
            endpoint=os.getenv("AWS_S3_ENDPOINT_URL"),
            access_key=os.getenv("AWS_S3_ACCESS_KEY_ID"),
            secret_key=os.getenv("AWS_S3_SECRET_ACCESS_KEY"),
            secure=os.getenv("AWS_S3_SECURE_ACCESS", "False").lower() == "true",
        )
        if (bucket_name := os.getenv("AWS_STORAGE_BUCKET_NAME")) is not None:
            self.bucket_name = bucket_name
        else:
            raise MissingConfigError
        self.s3_client = create_s3_client()
        self.ctx = ctx
        self._sessions: dict[str, AgentSession] = {}
        self._tasks: set[asyncio.Task] = set()
@@ -220,18 +201,20 @@ class MetadataCollector:
        }
        data = json.dumps(payload, indent=2).encode("utf-8")
        stream = BytesIO(data)
        try:
-            self.s3_client.put_object(
+            self.minio_client.put_object(
-                Bucket=self.bucket_name,
+                self.bucket_name,
-                Key=self.output_filename,
+                self.output_filename,
-                Body=data,
+                stream,
-                ContentType="application/json",
+                length=len(data),
                content_type="application/json",
            )
            logger.info(
                "Uploaded speaker meeting metadata",
            )
-        except (BotoCoreError, ClientError):
+        except S3Error:
            logger.exception(
                "Failed to upload meeting metadata",
            )
@@ -1,24 +1,24 @@
 [project]
 name = "agents"
-version = "1.33.0"
+version = "1.29.0"
 requires-python = ">=3.12"
 dependencies = [
-    "livekit-agents==1.7.0",
+    "livekit-agents==1.6.7",
-    "livekit-plugins-deepgram==1.7.0",
+    "livekit-plugins-deepgram==1.6.7",
-    "livekit-plugins-silero==1.7.0",
+    "livekit-plugins-silero==1.6.7",
    "livekit-plugins-kyutai-lasuite==0.0.6",
-    "boto3==1.43.56",
+    "python-dotenv==1.2.2",
-    "python-dotenv==1.2.3",
+    "protobuf==6.33.6",
-    "protobuf==7.36.0",
+    "minio==7.2.20",
-    "sentry-sdk==2.68.1",
+    "sentry-sdk==2.66.1",
    "websockets==17.1",
    "httpx==0.28.1",
 ]
 [project.optional-dependencies]
 dev = [
-    "ruff==0.16.4",
+    "ruff==0.16.0",
 ]
 [tool.uv]
@@ -279,16 +279,9 @@ class RoomAdmin(admin.ModelAdmin):
    inlines = (ResourceAccessInline,)
    search_fields = ["name", "slug", "=id"]
-    list_display = [
+    list_display = ["name", "slug", "access_level", "get_owner", "created_at"]
-        "name",
+    list_filter = ["access_level", "created_at"]
-        "slug",
+    readonly_fields = ["id", "created_at", "updated_at"]
        "access_level",
        "get_owner",
        "created_at",
        "last_started_at",
    ]
    list_filter = ["access_level", "created_at", "last_started_at"]
    readonly_fields = ["id", "created_at", "updated_at", "last_started_at"]
    def get_queryset(self, request):
        """Optimize queries by prefetching related access and user data to avoid N+1 queries."""
@@ -8,7 +8,6 @@ class AnalyticsEvent(StrEnum):
    # Rooms
    ROOM_CREATED = "room_created"
    ROOM_UPDATED = "room_updated"
    # Roomkit (meeting-room SIP devices)
    ROOMKIT_JOINED = "roomkit_joined"
@@ -71,7 +71,6 @@ def get_frontend_configuration(request):
            "force_wss_protocol": settings.LIVEKIT_FORCE_WSS_PROTOCOL,
            "enable_firefox_proxy_workaround": settings.LIVEKIT_ENABLE_FIREFOX_PROXY_WORKAROUND,
            "default_sources": settings.LIVEKIT_DEFAULT_SOURCES,
            "default_video_codec": settings.LIVEKIT_DEFAULT_VIDEO_CODEC,
        },
        "authenticated_users_can_edit_display_name": (
            settings.AUTHENTICATED_PARTICIPANTS_CAN_EDIT_DISPLAY_NAME
@@ -12,6 +12,10 @@ from ..services.participants_management import (
    ParticipantsManagementException,
 )
 ACTION_FOR_METHOD_TO_PERMISSION = {
    "versions_detail": {"DELETE": "versions_destroy", "GET": "versions_retrieve"}
 }
 class IsAuthenticated(permissions.BasePermission):
    """
@@ -23,6 +27,15 @@ class IsAuthenticated(permissions.BasePermission):
        return bool(request.auth) or request.user.is_authenticated
 class IsAuthenticatedOrSafe(IsAuthenticated):
    """Allows access to authenticated users (or anonymous users but only on safe methods)."""
    def has_permission(self, request, view):
        if request.method in permissions.SAFE_METHODS:
            return True
        return super().has_permission(request, view)
 class IsSelf(IsAuthenticated):
    """
    Allows access only to authenticated users. Alternative method checking the presence
@@ -20,33 +20,6 @@ class MonitoredUserRateThrottle(MonitoredThrottleMixin, UserRateThrottle):
    """Throttle for the monitored scoped rate throttle."""
 class RoomCreationUserRateThrottle(MonitoredUserRateThrottle):
    """Throttle room creation per authenticated user.
    Can be declared at the viewset level: every action other than "create"
    is left unthrottled, so the same class can be reused on any viewset
    exposing a room creation endpoint.
    """
    scope = "room_creation"
    def get_cache_key(self, request, view):
        """Throttle only room creations."""
        if getattr(view, "action", None) != "create":
            return None
        return super().get_cache_key(request, view)
 class RoomCreationDailyUserRateThrottle(RoomCreationUserRateThrottle):
    """Cap room creation per authenticated user over a day.
    Complements the short-term RoomCreationUserRateThrottle, which absorbs
    bursts but lets a user steadily create rooms over hours or days.
    """
    scope = "room_creation_daily"
 class RequestEntryAuthenticatedUserRateThrottle(MonitoredUserRateThrottle):
    """Throttle authenticated user requesting room entry"""
@@ -75,7 +75,11 @@ from core.services.participants_management import (
    ParticipantsManagementException,
 )
 from core.services.room_creation import RoomCreation
-from core.services.room_management import RoomManagement
+from core.services.room_management import (
    RoomManagement,
    RoomManagementException,
    RoomNotFoundException,
 )
 from core.services.room_roles import (
    RoomRoleError,
    RoomRoleService,
@@ -95,6 +99,60 @@ from .feature_flag import FeatureFlag
 logger = getLogger(__name__)
 class NestedGenericViewSet(viewsets.GenericViewSet):
    """
    A generic Viewset aims to be used in a nested route context.
    e.g: `/api/v1.0/resource_1/<resource_1_pk>/resource_2/<resource_2_pk>/`
    It allows to define all url kwargs and lookup fields to perform the lookup.
    """
    lookup_fields: list[str] = ["pk"]
    lookup_url_kwargs: list[str] = []
    def __getattribute__(self, file):
        """
        This method is overridden to allow to get the last lookup field or lookup url kwarg
        when accessing the `lookup_field` or `lookup_url_kwarg` attribute. This is useful
        to keep compatibility with all methods used by the parent class `GenericViewSet`.
        """
        if file in ["lookup_field", "lookup_url_kwarg"]:
            return getattr(self, file + "s", [None])[-1]
        return super().__getattribute__(file)
    def get_queryset(self):
        """
        Get the list of files for this view.
        `lookup_fields` attribute is enumerated here to perform the nested lookup.
        """
        queryset = super().get_queryset()
        # The last lookup field is removed to perform the nested lookup as it corresponds
        # to the object pk, it is used within get_object method.
        lookup_url_kwargs = (
            self.lookup_url_kwargs[:-1]
            if self.lookup_url_kwargs
            else self.lookup_fields[:-1]
        )
        filter_kwargs = {}
        for index, lookup_url_kwarg in enumerate(lookup_url_kwargs):
            if lookup_url_kwarg not in self.kwargs:
                raise KeyError(
                    f"Expected view {self.__class__.__name__} to be called with a URL "
                    f'keyword argument named "{lookup_url_kwarg}". Fix your URL conf, or '
                    "set the `.lookup_fields` attribute on the view correctly."
                )
            filter_kwargs.update(
                {self.lookup_fields[index]: self.kwargs[lookup_url_kwarg]}
            )
        return queryset.filter(**filter_kwargs)
 class SerializerPerActionMixin:
    """
    A mixin to allow to define serializer classes for each action.
@@ -180,10 +238,6 @@ class RoomViewSet(
    permission_classes = [permissions.RoomPermissions]
    queryset = models.Room.objects.all()
    serializer_class = serializers.RoomSerializer
    throttle_classes = [
        throttling.RoomCreationUserRateThrottle,
        throttling.RoomCreationDailyUserRateThrottle,
    ]
    def get_object(self):
        """Allow getting a room by its slug."""
@@ -302,7 +356,26 @@ class RoomViewSet(
        ):
            return
-        RoomManagement.sync_room_metadata(room)
+        metadata = {
            "configuration": room.configuration,
            "access_level": room.access_level,
        }
        try:
            RoomManagement().update_metadata(
                room_name=str(room.id),
                metadata=metadata,
            )
        except RoomNotFoundException:
            logger.info(
                "LiveKit room %s does not exist yet, skipping metadata sync",
                room.id,
            )
        except RoomManagementException:
            logger.warning(
                "Failed to sync metadata to LiveKit for room %s",
                room.id,
            )
    @decorators.action(
        detail=True,
@@ -859,15 +932,6 @@ class RoomViewSet(
        """Rename the current participant in the room."""
        room = self.get_object()
        if (
            not settings.AUTHENTICATED_PARTICIPANTS_CAN_EDIT_DISPLAY_NAME
            and request.user.is_authenticated
        ):
            return drf_response.Response(
                {"error": "Authenticated participants cannot edit their display name"},
                status=drf_status.HTTP_403_FORBIDDEN,
            )
        serializer = serializers.RenameParticipantSerializer(data=request.data)
        serializer.is_valid(raise_exception=True)
@@ -1012,10 +1076,9 @@ class RecordingViewSet(
    def _auth_get_original_url(self, request):
        """
-        Extracts and parses the original URL from the configured header.
+        Extracts and parses the original URL from the "HTTP_X_ORIGINAL_URL" header.
        Raises PermissionDenied if the header is missing.
-        The original url is passed by the reverse proxy in the header named by the
+        The original url is passed by nginx in the "HTTP_X_ORIGINAL_URL" header.
        MEDIA_AUTH_ORIGINAL_URL_HEADER setting, which defaults to "HTTP_X_ORIGINAL_URL".
        See corresponding ingress configuration in Helm chart and read about the
        nginx.ingress.kubernetes.io/auth-url annotation to understand how the Nginx ingress
        is configured to do this.
@@ -1025,13 +1088,9 @@ class RecordingViewSet(
        reasons.
        """
        # Extract the original URL from the request header
-        original_url = request.META.get(settings.MEDIA_AUTH_ORIGINAL_URL_HEADER)
+        original_url = request.META.get("HTTP_X_ORIGINAL_URL")
        if not original_url:
-            logger.warning(
+            logger.warning("Missing HTTP_X_ORIGINAL_URL header in subrequest")
                "Missing %s header in subrequest. Set MEDIA_AUTH_ORIGINAL_URL_HEADER "
                "to the header your reverse proxy sends.",
                settings.MEDIA_AUTH_ORIGINAL_URL_HEADER,
            )
            raise drf_exceptions.PermissionDenied()
        logger.debug("Original url: '%s'", original_url)
@@ -1356,8 +1415,7 @@ class FileViewSet(
        Authorize access based on the original URL of an Nginx subrequest
        and user permissions. Returns a dictionary of URL parameters if authorized.
-        The original url is passed by the reverse proxy in the header named by the
+        The original url is passed by nginx in the "HTTP_X_ORIGINAL_URL" header.
        MEDIA_AUTH_ORIGINAL_URL_HEADER setting, which defaults to "HTTP_X_ORIGINAL_URL".
        See corresponding ingress configuration in Helm chart and read about the
        nginx.ingress.kubernetes.io/auth-url annotation to understand how the Nginx ingress
        is configured to do this.
@@ -1376,13 +1434,9 @@ class FileViewSet(
        - PermissionDenied if authorization fails.
        """
        # Extract the original URL from the request header
-        original_url = request.META.get(settings.MEDIA_AUTH_ORIGINAL_URL_HEADER)
+        original_url = request.META.get("HTTP_X_ORIGINAL_URL")
        if not original_url:
-            logger.warning(
+            logger.warning("Missing HTTP_X_ORIGINAL_URL header in subrequest")
                "Missing %s header in subrequest. Set MEDIA_AUTH_ORIGINAL_URL_HEADER "
                "to the header your reverse proxy sends.",
                settings.MEDIA_AUTH_ORIGINAL_URL_HEADER,
            )
            raise drf_exceptions.PermissionDenied()
        parsed_url = urlparse(original_url)
@@ -3,11 +3,7 @@
 import contextlib
 from django.conf import settings
-from django.core.exceptions import (
+from django.core.exceptions import ImproperlyConfigured, SuspiciousOperation
    ImproperlyConfigured,
    SuspiciousOperation,
    ValidationError,
 )
 from django.utils.translation import gettext_lazy as _
 from lasuite.oidc_login.backends import (
@@ -21,7 +17,6 @@ from core.services.marketing import (
    ContactData,
    get_marketing_service,
 )
 from core.validators import sub_validator
 class OIDCAuthenticationBackend(LaSuiteOIDCAuthenticationBackend):
@@ -89,19 +84,6 @@ class OIDCAuthenticationBackend(LaSuiteOIDCAuthenticationBackend):
    def get_existing_user(self, sub, email):
        """Fetch existing user by sub or email."""
        sub = str(sub)
        try:
            sub_validator(sub)
        except ValidationError as err:
            raise SuspiciousOperation(
                "User info contained an invalid sub claim"
            ) from err
        if len(sub) > 255:
            raise SuspiciousOperation("User info contained an invalid sub claim")
        try:
            return User.objects.get(sub=sub)
        except User.DoesNotExist:
@@ -286,10 +286,6 @@ class ResourceServerBackend(LaSuiteBackend):
        if user is None and settings.OIDC_CREATE_USER:
            user = self.create_user(sub)
        if user is not None and not user.is_active:
            logger.warning("Inactive user attempted authentication: %s", user.pk)
            raise SuspiciousOperation("User account is disabled.")
        return user
    def create_user(self, sub):
@@ -1,6 +1,5 @@
 """External API endpoints"""
 import copy
 from logging import getLogger
 from django.conf import settings
@@ -26,7 +25,6 @@ from rest_framework import (
 from core import analytics, api, models
 from core.api.feature_flag import FeatureFlag
 from core.services.jwt_token import JwtTokenService
 from core.services.room_management import RoomManagement
 from ..services.provisional_user_service import (
    ProvisionalUserCreationDisabledError,
@@ -144,7 +142,6 @@ class RoomViewSet(
    mixins.CreateModelMixin,
    mixins.RetrieveModelMixin,
    mixins.ListModelMixin,
    mixins.UpdateModelMixin,
    viewsets.GenericViewSet,
 ):
    """Application-delegated API for room management.
@@ -157,12 +154,8 @@ class RoomViewSet(
    - list: List rooms the user has access to (requires 'rooms:list' scope)
    - retrieve: Get room details (requires 'rooms:retrieve' scope)
    - create: Create a new room owned by the user (requires 'rooms:create' scope)
    - partial_update: Update a room's access level and configuration, for
      administrators and owners only (requires 'rooms:update' scope)
    """
    http_method_names = ["get", "post", "patch", "head", "options"]
    authentication_classes = [
        authentication.ApplicationJWTAuthentication,
        authentication.AddonsJWTAuthentication,
@@ -196,39 +189,7 @@ class RoomViewSet(
        serializer = self.get_serializer(queryset, many=True)
        return drf_response.Response(serializer.data)
-    def _track_room_event(self, room, event, **extra_properties):
+    def perform_create(self, serializer):
        """Log a room operation for auditing and forward it to analytics."""
        auth_method = type(self.request.successful_authenticator).__name__
        client_id = (self.request.auth or {}).get("client_id", "unknown")
        # Log for auditing
        details = "".join(f", {key}={value}" for key, value in extra_properties.items())
        logger.info(
            "Room %s via application: room_id=%s, user_id=%s, client_id=%s, auth_method=%s%s",
            event.removeprefix("room_"),
            room.id,
            self.request.user.id,
            client_id,
            auth_method,
            details,
        )
        analytics.capture(
            self.request.user,
            event,
            {
                "room_id": str(room.pk),
                "access_level": room.access_level,
                "client_id": client_id,
                "external_api": True,
                "auth_method": auth_method,
                **extra_properties,
                "$set": {"email": self.request.user.email},
            },
        )
    def perform_create(self, serializer: serializers.RoomSerializer):
        """Set the current user as owner of the newly created room."""
        room = serializer.save()
        models.ResourceAccess.objects.create(
@@ -237,31 +198,27 @@ class RoomViewSet(
            role=models.RoleChoices.OWNER,
        )
-        self._track_room_event(room, analytics.AnalyticsEvent.ROOM_CREATED)
+        auth_method = type(self.request.successful_authenticator).__name__
        client_id = (self.request.auth or {}).get("client_id", "unknown")
-    def perform_update(self, serializer: serializers.RoomSerializer):
+        # Log for auditing
-        """Persist the room update, sync it to LiveKit, then log and track it."""
+        logger.info(
-
+            "Room created via application: room_id=%s, user_id=%s, client_id=%s, auth_method=%s",
-        previous_values = {
+            room.id,
-            "access_level": serializer.instance.access_level,
+            self.request.user.id,
-            "configuration": copy.deepcopy(serializer.instance.configuration),
+            client_id,
-        }
+            auth_method,
        room = serializer.save()
        # Report the fields that actually changed, not the ones that were submitted.
        updated_fields = sorted(
            field
            for field, previous_value in previous_values.items()
            if getattr(room, field) != previous_value
        )
-        if updated_fields:
+        analytics.capture(
-            RoomManagement.sync_room_metadata(room)
+            self.request.user,
-
+            analytics.AnalyticsEvent.ROOM_CREATED,
-        self._track_room_event(
+            {
-            room,
+                "room_id": str(room.pk),
-            analytics.AnalyticsEvent.ROOM_UPDATED,
+                "access_level": room.access_level,
-            updated_fields=updated_fields,
+                "client_id": client_id,
-            previous_access_level=previous_values["access_level"],
+                "external_api": True,
                "auth_method": auth_method,
                "$set": {"email": self.request.user.email},
            },
        )
@@ -48,6 +48,8 @@ class ResourceFactory(factory.django.DjangoModelFactory):
                else:
                    UserResourceAccessFactory(resource=self, user=item[0], role=item[1])
        self.save()
 class UserResourceAccessFactory(factory.django.DjangoModelFactory):
    """Create fake resource user accesses for testing."""
@@ -95,6 +97,8 @@ class RecordingFactory(factory.django.DjangoModelFactory):
                        recording=self, user=item[0], role=item[1]
                    )
            self.save()
 class UserRecordingAccessFactory(factory.django.DjangoModelFactory):
    """Create fake recording user accesses for testing."""
@@ -1,25 +0,0 @@
 """Logging filters for the core application."""
 import logging
 from django.conf import settings
 class SilenceExpected401(logging.Filter):
    """Drop the expected 401 from anonymous hits on the /me endpoint.
    The frontend probes `/users/me/` to check authentication; a 401 for
    anonymous users is normal, not a warning worth logging.
    """
    def filter(self, record):
        """Return False for a 401 on a silenced path, True otherwise."""
        if getattr(record, "status_code", None) != 401:
            return True
        request = getattr(record, "request", None)
        path = getattr(request, "path", None)
        if not path:
            return True
        return path not in settings.LOGGING_SILENCED_401_PATHS
@@ -1,94 +0,0 @@
 """Purge inactive rooms."""
 from datetime import timedelta
 from itertools import batched
 from logging import getLogger
 from django.conf import settings
 from django.core.management.base import BaseCommand
 from django.db.models import Exists, OuterRef, Q
 from django.utils import timezone
 from core.models import Recording, RecordingStatusChoices, Room
 logger = getLogger(__name__)
 CHUNK_SIZE = 500
 class Command(BaseCommand):
    """
    Delete rooms that have not been started for ROOM_INACTIVITY_DELETION_DAYS days:
    - rooms which were last started before that period
    - rooms never started and created before that period
    Rooms holding a saved recording that has not expired are kept.
    """
    help = "Purge inactive rooms"
    def add_arguments(self, parser):
        parser.add_argument(
            "--dry-run",
            action="store_true",
            help="List the rooms that would be purged without deleting them",
        )
    def handle(self, *args, **options):
        """Browse inactive rooms and delete them chunk by chunk."""
        if not settings.ROOM_INACTIVITY_DELETION_DAYS:
            self.stdout.write(
                "Purging inactive rooms is disabled "
                "(ROOM_INACTIVITY_DELETION_DAYS is not set)."
            )
            return
        now = timezone.now()
        inactive_rooms = self.get_inactive_rooms(now)
        inactive_count = inactive_rooms.count()
        if not inactive_count:
            self.stdout.write("No inactive room to purge.")
            return
        if options["dry_run"]:
            self.stdout.write(
                f"[dry-run] {inactive_count} inactive room(s) would be purged:"
            )
            names = inactive_rooms.values_list("name", flat=True)
            for name in names.iterator(chunk_size=CHUNK_SIZE):
                self.stdout.write(f"- {name}")
            return
        purged_count = 0
        rooms = inactive_rooms.values_list("pk", "slug").iterator(chunk_size=CHUNK_SIZE)
        for chunk in batched(rooms, CHUNK_SIZE, strict=False):
            for room_id, slug in chunk:
                logger.info("Purging inactive room %s (%s)", room_id, slug)
            _, deleted_by_model = inactive_rooms.filter(
                pk__in=[room_id for room_id, _ in chunk]
            ).delete()
            purged_count += deleted_by_model.get("core.Room", 0)
        self.stdout.write(f"Purged {purged_count} inactive room(s).")
    @staticmethod
    def get_inactive_rooms(now):
        """Return the rooms inactive for too long that no recording protects."""
        threshold = now - timedelta(days=settings.ROOM_INACTIVITY_DELETION_DAYS)
        is_inactive = Q(last_started_at__lt=threshold) | Q(
            last_started_at__isnull=True, created_at__lt=threshold
        )
        protected_recordings = Recording.objects.filter(
            room=OuterRef("pk"), status__in=RecordingStatusChoices.saved_statuses()
        )
        if settings.RECORDING_EXPIRATION_DAYS:
            protected_recordings = protected_recordings.filter(
                created_at__gte=now - timedelta(days=settings.RECORDING_EXPIRATION_DAYS)
            )
        return Room.objects.filter(is_inactive, ~Exists(protected_recordings))
@@ -8,8 +8,6 @@ import uuid
 from django.conf import settings
 from django.db import migrations, models
 import core.validators
 class Migration(migrations.Migration):
@@ -43,7 +41,7 @@ class Migration(migrations.Migration):
                ('id', models.UUIDField(default=uuid.uuid4, editable=False, help_text='primary key for the record as UUID', primary_key=True, serialize=False, verbose_name='id')),
                ('created_at', models.DateTimeField(auto_now_add=True, help_text='date and time at which a record was created', verbose_name='created on')),
                ('updated_at', models.DateTimeField(auto_now=True, help_text='date and time at which a record was last updated', verbose_name='updated on')),
-                ('sub', models.CharField(blank=True, help_text='Optional for pending users; required upon account activation. 255 characters or fewer. Printable ASCII characters only.', max_length=255, null=True, unique=True, validators=[core.validators.sub_validator], verbose_name='sub')),
+                ('sub', models.CharField(blank=True, help_text='Optional for pending users; required upon account activation. 255 characters or fewer. Letters, numbers, and @/./+/-/_ characters only.', max_length=255, null=True, unique=True, validators=[django.core.validators.RegexValidator(message='Enter a valid sub. This value may contain only letters, numbers, and @/./+/-/_ characters.', regex='^[\\w.@+-]+\\Z')], verbose_name='sub')),
                ('email', models.EmailField(blank=True, max_length=254, null=True, verbose_name='identity email address')),
                ('admin_email', models.EmailField(blank=True, max_length=254, null=True, unique=True, verbose_name='admin email address')),
                ('language', models.CharField(choices=settings.LANGUAGES, default=settings.LANGUAGE_CODE, help_text='The language in which the user wants to see the interface.', max_length=10, verbose_name='language')),
@@ -1,18 +0,0 @@
 # Generated by Django 5.2.16 on 2026-09-23 16:49
 from django.db import migrations, models
 class Migration(migrations.Migration):
    dependencies = [
        ('core', '0022_user_default_room_access_level_and_more'),
    ]
    operations = [
        migrations.AlterField(
            model_name='recording',
            name='status',
            field=models.CharField(choices=[('initiated', 'Initiated'), ('active', 'Active'), ('stopped', 'Stopped'), ('saved', 'Saved'), ('aborted', 'Aborted'), ('failed', 'Failed'), ('failed_to_start', 'Failed to Start'), ('failed_to_stop', 'Failed to Stop'), ('notification_succeeded', 'Notification succeeded'), ('external_process_successful', 'External process successful'), ('external_process_failed', 'External process failed')], default='initiated', max_length=50),
        ),
    ]
@@ -1,18 +0,0 @@
 from django.db import migrations, models
 import django.utils.timezone
 class Migration(migrations.Migration):
    dependencies = [
        ('core', '0023_alter_recording_status'),
    ]
    operations = [
        migrations.AddField(
            model_name='room',
            name='last_started_at',
            field=models.DateTimeField(blank=True, default=django.utils.timezone.now, editable=False, help_text='date and time at which the room was last started', null=True, verbose_name='last started at'),
            preserve_default=False,
        ),
    ]
@@ -27,7 +27,6 @@ from timezone_field import TimeZoneField
 from . import fields, utils
 from .recording.enums import FileExtension
 from .validators import sub_validator
 logger = getLogger(__name__)
@@ -58,7 +57,6 @@ class RecordingStatusChoices(models.TextChoices):
    STOPPED = "stopped", _("Stopped")
    SAVED = "saved", _("Saved")
    ABORTED = "aborted", _("Aborted")
    FAILED = "failed", _("Failed")
    FAILED_TO_START = "failed_to_start", _("Failed to Start")
    FAILED_TO_STOP = "failed_to_stop", _("Failed to Stop")
    NOTIFICATION_SUCCEEDED = "notification_succeeded", _("Notification succeeded")
@@ -80,7 +78,6 @@ class RecordingStatusChoices(models.TextChoices):
            cls.STOPPED,
            cls.SAVED,
            cls.ABORTED,
            cls.FAILED,
            cls.EXTERNAL_PROCESS_SUCCESSFUL,
            cls.EXTERNAL_PROCESS_FAILED,
            cls.FAILED_TO_START,
@@ -88,15 +85,9 @@ class RecordingStatusChoices(models.TextChoices):
        }
    @classmethod
-    def saved_statuses(cls):
+    def is_unsuccessful(cls, status):
-        """Return the statuses of a recording whose file users can access."""
+        """Determine if the recording status represents an unsuccessful state."""
-
+        return status in {cls.ABORTED, cls.FAILED_TO_START, cls.FAILED_TO_STOP}
        return {
            cls.NOTIFICATION_SUCCEEDED,
            cls.SAVED,
            cls.EXTERNAL_PROCESS_SUCCESSFUL,
            cls.EXTERNAL_PROCESS_FAILED,
        }
 class RecordingModeChoices(models.TextChoices):
@@ -154,11 +145,19 @@ class BaseModel(models.Model):
 class User(AbstractBaseUser, BaseModel, auth_models.PermissionsMixin):
    """User model to work with OIDC only authentication."""
    sub_validator = validators.RegexValidator(
        regex=r"^[\w.@+-]+\Z",
        message=_(
            "Enter a valid sub. This value may contain only letters, "
            "numbers, and @/./+/-/_ characters."
        ),
    )
    sub = models.CharField(
        _("sub"),
        help_text=_(
            "Optional for pending users; required upon account activation. "
-            "255 characters or fewer. Printable ASCII characters only."
+            "255 characters or fewer. Letters, numbers, and @/./+/-/_ characters only."
        ),
        max_length=255,
        unique=True,
@@ -437,13 +436,6 @@ class Room(Resource):
        verbose_name=_("Room PIN code"),
        help_text=_("Unique n-digit code that identifies this room in telephony mode."),
    )
    last_started_at = models.DateTimeField(
        verbose_name=_("last started at"),
        help_text=_("date and time at which the room was last started"),
        blank=True,
        null=True,
        editable=False,
    )
    class Meta:
        db_table = "meet_room"
@@ -597,7 +589,6 @@ class Recording(BaseModel):
    4. NOTIFICATION_SUCCEEDED: External service has been notified of this recording
    Error States:
    - FAILED: Egress failed mid-recording
    - FAILED_TO_START: Worker failed to initialize recording
    - FAILED_TO_STOP: Worker failed during stop operation
    - ABORTED: Recording was terminated before completion
@@ -700,7 +691,12 @@ class Recording(BaseModel):
    @property
    def is_saved(self) -> bool:
        """Check if the recording is in a saved state."""
-        return self.status in RecordingStatusChoices.saved_statuses()
+        return self.status in {
            RecordingStatusChoices.NOTIFICATION_SUCCEEDED,
            RecordingStatusChoices.SAVED,
            RecordingStatusChoices.EXTERNAL_PROCESS_SUCCESSFUL,
            RecordingStatusChoices.EXTERNAL_PROCESS_FAILED,
        }
    @property
    def extension(self):
@@ -8,50 +8,3 @@ class FileExtension(Enum):
    OGG = "ogg"
    MP4 = "mp4"
 class RecordingWorkerEvent(Enum):
    """Lifecycle events a recording worker reports about a recording.
    It is intended to be free of SFU-specific vocabulary.
    """
    # The worker accepted the request but is not recording yet.
    STARTING = "starting"
    # The worker is recording.
    STARTED = "started"
    # The worker stopped recording and is flushing the media file.
    SAVING = "saving"
    # The recording ended, its media file is available.
    COMPLETED = "completed"
    # The recording ended on its configured limit, its media file is available.
    LIMIT_REACHED = "limit reached"
    # The worker stopped before it ever started recording, there is no media file.
    ABORTED = "aborted"
    # The worker hit a runtime error once recording had started; its media file
    # may be available.
    FAILED = "failed"
    @classmethod
    def is_terminal(cls, event):
        """Determine if the event ends the recording's lifecycle (successful or not)."""
        return event in TERMINAL_EVENTS
 SUCCESSFUL_EVENTS = frozenset(
    {
        RecordingWorkerEvent.COMPLETED,
        RecordingWorkerEvent.LIMIT_REACHED,
    }
 )
 UNSUCCESSFUL_EVENTS = frozenset(
    {
        RecordingWorkerEvent.ABORTED,
        RecordingWorkerEvent.FAILED,
    }
 )
 TERMINAL_EVENTS = SUCCESSFUL_EVENTS | UNSUCCESSFUL_EVENTS
@@ -1,13 +1,13 @@
-"""Recording-related Events Service"""
+"""Recording-related LiveKit Events Service"""
 # pylint: disable=no-member
 from logging import getLogger
 from livekit import api
 from core import models, utils
 from core.models import Recording
 from core.recording.enums import (
    UNSUCCESSFUL_EVENTS,
    RecordingWorkerEvent,
 )
 from core.recording.event.notification import notification_service
 from core.services.room_management import (
    RoomManagement,
@@ -26,113 +26,25 @@ class RecordingNotSavableError(Exception):
    """Recording cannot be saved because it is either in an error state or has already been saved"""
 # Notification sent to the room's participants, per event and recording mode.
 NOTIFICATION_PREFIXES = {
    models.RecordingModeChoices.SCREEN_RECORDING: "screenRecording",
    models.RecordingModeChoices.TRANSCRIPT: "transcription",
 }
 NOTIFICATION_SUFFIXES = {
    RecordingWorkerEvent.LIMIT_REACHED: "LimitReached",
    RecordingWorkerEvent.FAILED: "Failed",
    RecordingWorkerEvent.ABORTED: "Aborted",
 }
 def get_notification_type(recording_mode, event):
    """Generate corresponding notification type string."""
    try:
        return f"{NOTIFICATION_PREFIXES[recording_mode]}{NOTIFICATION_SUFFIXES[event]}"
    except KeyError:
        return None
 # Recording status in the room's metadata, per event.
 ROOM_METADATA_RECORDING_STATUSES = {
    RecordingWorkerEvent.STARTED: "started",
    RecordingWorkerEvent.SAVING: "saving",
 }
 class RecordingEventsService:
-    """Handles recording-related worker events.
+    """Handles recording-related LiveKit webhook events."""
    Two entry points: `handle_update` for the events a running recording
    reports, and `handle_terminal_event` for the one ending it.
    """
    @staticmethod
-    def log_worker_error(recording, event, error=None, error_code=None):
+    def handle_update(recording: Recording, egress_status):
-        """Log FAILED at error level and expected ABORTED outcomes at info level."""
+        """Handle egress status updates and sync recording state to room metadata."""
        if event == RecordingWorkerEvent.FAILED:
            log = logger.error
        elif event == RecordingWorkerEvent.ABORTED:
            log = logger.info
        else:
            return
        log(
            "Recording worker reported %s for recording %s (room=%s, mode=%s): %s (error_code=%s)",
            event.value,
            recording.id,
            recording.room.id,
            recording.mode,
            error or "no error reported",
            error_code or "no error_code reported",
        )
    @staticmethod
    def _notify_participants(recording: Recording, event: RecordingWorkerEvent):
        """Notify the room's participants that a recording ended on the given event."""
        recording_mode = recording.options.get("original_mode", None) or recording.mode
        notification_type = get_notification_type(recording_mode, event)
        if not notification_type:
            logger.warning(
                "Could not find notification type for: "
                "room=%s, recording_id=%s, mode=%s, event=%s",
                recording.room.id,
                recording.id,
                recording_mode,
                event.value,
            )
            return
        try:
            utils.notify_participants(
                room_name=str(recording.room.id),
                notification_data={"type": notification_type},
            )
        except utils.NotificationError as e:
            raise RecordingEventsError(
                f"Failed to notify participants in room '{recording.room.id}' about "
                f"recording {event.value} (recording_id={recording.id})"
            ) from e
    @staticmethod
    def _log_notification_failure(recording, event: RecordingWorkerEvent):
        """Log a participant notification error on an unsuccessful recording."""
        logger.exception(
            "Failed to notify participants that recording %s %s (room=%s)",
            recording.id,
            event.value,
            recording.room.id,
        )
    @staticmethod
    def handle_update(recording: Recording, event: RecordingWorkerEvent):
        """Handle non-terminal worker events and sync recording state to room metadata.
        Terminal events are dispatched through `handle_terminal_event` instead.
        """
        room_name = str(recording.room.id)
-        recording_status = ROOM_METADATA_RECORDING_STATUSES.get(event)
+        status_mapping = {
            api.EgressStatus.EGRESS_ACTIVE: "started",
            api.EgressStatus.EGRESS_ENDING: "saving",
            api.EgressStatus.EGRESS_ABORTED: "aborted",
        }
        recording_status = status_mapping.get(egress_status)
        if recording_status:
            try:
-                RoomManagement.update_metadata(
+                RoomManagement().update_metadata(
                    room_name, {"recording_status": recording_status}
                )
            except RoomNotFoundException:
@@ -143,113 +55,42 @@ class RecordingEventsService:
            except RoomManagementException as e:
                logger.exception("Failed to update room's metadata: %s", e)
-    def handle_terminal_event(self, recording: Recording, event: RecordingWorkerEvent):
+    @staticmethod
-        """Run the appropriate handlers for a terminal event, given the recording's state."""
+    def handle_limit_reached(recording: Recording):
        if not RecordingWorkerEvent.is_terminal(event):
            logger.warning(
                "Ignoring non-terminal event %s dispatched as a terminal event "
                "for recording %s.",
                event.value,
                recording.id,
            )
            return
        if event in UNSUCCESSFUL_EVENTS:
            self._flag_unsuccessful_recording(recording, event)
        else:
            self._save_successful_recording(recording, event)
    def _flag_unsuccessful_recording(
        self, recording: Recording, event: RecordingWorkerEvent
    ):
        """Persist the outcome of a recording the worker announced as unsuccessful."""
        # Aborted
        if event == RecordingWorkerEvent.ABORTED:
            if recording.status == models.RecordingStatusChoices.ACTIVE:
                self._apply_outcome(recording, event, self._handle_aborted)
            return
        # Failed
        if event == RecordingWorkerEvent.FAILED:
            if recording.is_savable():
                self._apply_outcome(recording, event, self._handle_failed)
            return
        logger.error(
            "Unsuccessful event %s has no handler; recording %s keeps status '%s'.",
            event.value,
            recording.id,
            recording.status,
        )
    def _save_successful_recording(
        self, recording: Recording, event: RecordingWorkerEvent
    ):
        """Save a recording whose media file the worker made available."""
        # Limit reached
        if (
            event == RecordingWorkerEvent.LIMIT_REACHED
            and recording.status == models.RecordingStatusChoices.ACTIVE
        ):
            self._apply_outcome(recording, event, self._handle_limit_reached)
        try:
            self._handle_successful(recording)
        except RecordingNotSavableError:
            logger.warning(
                "Recording %s is not savable on a completed recording "
                "(already saved or in an error state); ignoring.",
                recording.id,
            )
    def _apply_outcome(
        self, recording: Recording, event: RecordingWorkerEvent, handler
    ):
        """Keep notification failure non-fatal."""
        try:
            handler(recording)
        except RecordingEventsError:
            self._log_notification_failure(recording, event)
    @classmethod
    def _handle_limit_reached(cls, recording: Recording):
        """Stop recording and notify participants when limit is reached."""
        recording.status = models.RecordingStatusChoices.STOPPED
        recording.save()
-        cls._notify_participants(recording, RecordingWorkerEvent.LIMIT_REACHED)
+        notification_mapping = {
            models.RecordingModeChoices.SCREEN_RECORDING: "screenRecordingLimitReached",
            models.RecordingModeChoices.TRANSCRIPT: "transcriptionLimitReached",
        }
-    @classmethod
+        notification_type = notification_mapping.get(recording.mode)
-    def _handle_failed(cls, recording: Recording):
+        if not notification_type:
-        """Set recording status to failed, matching the worker event, and notify participants.
+            return
-        FAILED: used when an actual runtime/pipeline error occurs after the
+        try:
-        recording has started
+            utils.notify_participants(
-        """
+                room_name=str(recording.room.id),
-        recording.status = models.RecordingStatusChoices.FAILED
+                notification_data={"type": notification_type},
-        recording.save()
+            )
-
+        except utils.NotificationError as e:
-        cls._notify_participants(recording, RecordingWorkerEvent.FAILED)
+            logger.exception(
-
+                "Failed to notify participants about recording limit reached: "
-    @classmethod
+                "room=%s, recording_id=%s, mode=%s",
-    def _handle_aborted(cls, recording: Recording):
+                recording.room.id,
-        """Set recording status to aborted, matching the worker event, and notify participants.
+                recording.id,
-
+                recording.mode,
-        ABORTED: used when the worker stops before it ever became
+            )
-        active/recording
+            raise RecordingEventsError(
-        """
+                f"Failed to notify participants in room '{recording.room.id}' about "
-        recording.status = models.RecordingStatusChoices.ABORTED
+                f"recording limit reached (recording_id={recording.id})"
-        recording.save()
+            ) from e
        cls._notify_participants(recording, RecordingWorkerEvent.ABORTED)
    @staticmethod
-    def _handle_successful(recording: Recording):
+    def handle_complete(recording: Recording):
        """Notify external services and save recording."""
        if not recording.is_savable():
@@ -68,7 +68,7 @@ class WorkerServiceMediator:
        mode = recording.options.get("original_mode", None) or recording.mode
        try:
-            RoomManagement.update_metadata(
+            RoomManagement().update_metadata(
                room_name, {"recording_mode": mode, "recording_status": "starting"}
            )
        except RoomNotFoundException:
@@ -2,8 +2,6 @@
 # pylint: disable=no-member
 import logging
 from asgiref.sync import async_to_sync
 from livekit import api as livekit_api
@@ -12,8 +10,6 @@ from ..enums import FileExtension
 from .exceptions import WorkerConnectionError, WorkerResponseError
 from .factories import WorkerServiceConfig
 logger = logging.getLogger(__name__)
 class BaseEgressService:
    """Base egress defining common methods to manage and interact with LiveKit egress processes."""
@@ -24,7 +20,7 @@ class BaseEgressService:
    def _get_filepath(self, filename: str, extension: str) -> str:
        """Construct the file path for a given filename and extension.
-        Insecure method, doesn't handle paths robustly and securely.
+        Unsecure method, doesn't handle paths robustly and securely.
        """
        return f"{self._config.output_folder}/{filename}.{extension}"
@@ -53,22 +49,6 @@ class BaseEgressService:
        finally:
            await lkapi.aclose()
    @staticmethod
    def _log_egress_error(response, event: str):
        """Log the reason LiveKit reported an unsuccessful egress on stop.
        Mirrors the logging done in the 'egress_ended' webhook. The
        StopEgress response carries the same error fields.
        """
        logger.error(
            "Egress %s on stop (egress_id=%s, status=%s): %s (error_code=%s)",
            event,
            response.egress_id,
            livekit_api.EgressStatus.Name(response.status),
            response.error or "no error reported",
            response.error_code or "no error_code reported",
        )
    def stop(self, worker_id: str) -> str:
        """Stop an ongoing egress worker.
        The StopEgressRequest is shared among all types of egress,
@@ -86,26 +66,14 @@ class BaseEgressService:
                "LiveKit response is missing the recording status."
            )
        # To avoid exposing EgressStatus values and coupling with LiveKit outside of this class,
        # the response status is mapped to simpler "ABORTED", "STOPPED" or "FAILED_TO_STOP" strings.
        if response.status == livekit_api.EgressStatus.EGRESS_ABORTED:
            return "ABORTED"
        if response.status == livekit_api.EgressStatus.EGRESS_ENDING:
            return "STOPPED"
        if response.status == livekit_api.EgressStatus.EGRESS_LIMIT_REACHED:
            return "STOPPED"
        # Cases below should be very infrequent as status changes should be
        # received and processed by `handle_ended`, thus `stop` would not
        # be called (unless failure and stop are very close in time).
        # We therefore accept not to notify the user in this code branch.
        # This could be fixed in a future refactoring.
        if response.status == livekit_api.EgressStatus.EGRESS_ABORTED:
            self._log_egress_error(response, "aborted")
            return "ABORTED"
        if response.status == livekit_api.EgressStatus.EGRESS_FAILED:
            self._log_egress_error(response, "failed")
            return "FAILED"
        self._log_egress_error(response, "failed to stop")
        return "FAILED_TO_STOP"
    def start(self, room_name, recording_id):
@@ -8,17 +8,19 @@ from enum import Enum
 from logging import getLogger
 from django.conf import settings
 from django.utils import timezone
 from livekit import api
 from core import models
 from core.recording.enums import RecordingWorkerEvent
 from core.recording.services.metadata_collector import (
    MetadataCollectorException,
    MetadataCollectorService,
 )
-from core.recording.services.recording_events import RecordingEventsService
+from core.recording.services.recording_events import (
    RecordingEventsError,
    RecordingEventsService,
    RecordingNotSavableError,
 )
 from .lobby import LobbyService
 from .presence import PresenceCache
@@ -50,6 +52,12 @@ class InvalidPayloadError(LiveKitWebhookError):
    status_code = 400
 class UnsupportedEventTypeError(LiveKitWebhookError):
    """Unsupported event type."""
    status_code = 422
 class ActionFailedError(LiveKitWebhookError):
    """Webhook action fails to process or complete."""
@@ -66,7 +74,6 @@ class LiveKitWebhookEventType(Enum):
    # Participant events
    PARTICIPANT_JOINED = "participant_joined"
    PARTICIPANT_LEFT = "participant_left"
    PARTICIPANT_CONNECTION_ABORTED = "participant_connection_aborted"
    # Track events
    TRACK_PUBLISHED = "track_published"
@@ -82,30 +89,6 @@ class LiveKitWebhookEventType(Enum):
    INGRESS_ENDED = "ingress_ended"
 # LiveKit egress statuses mapped to recording worker event statuses
 EGRESS_STATUS_TO_RECORDING_EVENT = {
    api.EgressStatus.EGRESS_STARTING: RecordingWorkerEvent.STARTING,
    api.EgressStatus.EGRESS_ACTIVE: RecordingWorkerEvent.STARTED,
    api.EgressStatus.EGRESS_ENDING: RecordingWorkerEvent.SAVING,
    api.EgressStatus.EGRESS_COMPLETE: RecordingWorkerEvent.COMPLETED,
    api.EgressStatus.EGRESS_LIMIT_REACHED: RecordingWorkerEvent.LIMIT_REACHED,
    api.EgressStatus.EGRESS_ABORTED: RecordingWorkerEvent.ABORTED,
    api.EgressStatus.EGRESS_FAILED: RecordingWorkerEvent.FAILED,
 }
 def to_recording_event(egress_status):
    """Translate a LiveKit egress status into a recording worker event."""
    event = EGRESS_STATUS_TO_RECORDING_EVENT.get(egress_status)
    if event is None:
        logger.warning(
            "Unmapped LiveKit egress status '%s', ignoring the event.",
            egress_status,
        )
    return event
 class LiveKitEventsService:
    """Service for processing and handling LiveKit webhook events and notifications."""
@@ -170,13 +153,10 @@ class LiveKitEventsService:
        try:
            webhook_type = LiveKitWebhookEventType(data.event)
-        except ValueError:
+        except ValueError as e:
-            logger.warning(
+            raise UnsupportedEventTypeError(
-                "Ignoring unknown LiveKit webhook event type '%s' for room '%s'",
+                f"Unknown webhook type: {data.event}"
-                data.event,
+            ) from e
                room_name,
            )
            return
        # Handle according to received webhook type
        handler = self._webhook_handlers.get(webhook_type.value)
@@ -195,20 +175,12 @@ class LiveKitEventsService:
                f"Recording with worker ID {egress_id} does not exist"
            ) from err
-        event = to_recording_event(data.egress_info.status)
+        egress_status = data.egress_info.status
-        if event is None:
+        self.recording_events.handle_update(recording, egress_status)
            return
        self.recording_events.handle_update(recording, event)
    def _handle_egress_ended(self, data):
-        """Handle 'egress_ended' event.
+        """Handle 'egress_ended' event."""
        Egress ended is sent with one of these statuses:
        EGRESS_COMPLETE, EGRESS_FAILED, EGRESS_ABORTED, EGRESS_LIMIT_REACHED
        """
        # Fetch recording
        try:
            recording = models.Recording.objects.select_related("room").get(
                worker_id=data.egress_info.egress_id
@@ -218,20 +190,9 @@ class LiveKitEventsService:
                f"Recording with worker ID {data.egress_info.egress_id} does not exist"
            ) from err
        event = to_recording_event(data.egress_info.status)
        # Log if/why the recording failed
        self.recording_events.log_worker_error(
            recording,
            event,
            error=data.egress_info.error,
            error_code=data.egress_info.error_code,
        )
        # Update room
        try:
            room_name = str(recording.room.id)
-            RoomManagement.update_metadata(
+            RoomManagement().update_metadata(
                room_name, remove_keys=["recording_mode", "recording_status"]
            )
        except RoomNotFoundException:
@@ -242,17 +203,38 @@ class LiveKitEventsService:
        except RoomManagementException as e:
            logger.exception("Failed to update room's metadata: %s", e)
        # Stop metadata collector
        if recording.options.get("metadata_collector_dispatch_id", None) is not None:
            try:
                MetadataCollectorService().stop(recording)
            except MetadataCollectorException:
                logger.warning("Failed to stop the MetadataCollectorService")
-        if event is None:
+        if (
-            return
+            data.egress_info.status == api.EgressStatus.EGRESS_LIMIT_REACHED
            and recording.status == models.RecordingStatusChoices.ACTIVE
        ):
            try:
                self.recording_events.handle_limit_reached(recording)
            except RecordingEventsError as e:
                raise ActionFailedError(
                    f"Failed to process limit reached event for recording {recording}"
                ) from e
-        self.recording_events.handle_terminal_event(recording, event)
+        # Finalize the recording, the egress has uploaded the file to the storage
        if data.egress_info.status in [
            api.EgressStatus.EGRESS_COMPLETE,
            api.EgressStatus.EGRESS_LIMIT_REACHED,
        ]:
            try:
                self.recording_events.handle_complete(recording)
            except RecordingNotSavableError:
                logger.warning(
                    "Recording %s is not savable on egress complete "
                    "(already saved or in an error state); ignoring.",
                    recording.id,
                )
        # Silently ignoring EGRESS_ABORTED, EGRESS_FAILED
    @staticmethod
    def _is_connection_test_room(room_name: str) -> bool:
@@ -271,20 +253,12 @@ class LiveKitEventsService:
            )
            raise ActionFailedError("Failed to process room started event") from e
-        room_updated_count = models.Room.objects.filter(pk=room_id).update(
+        try:
-            last_started_at=timezone.now()
+            room = models.Room.objects.get(id=room_id)
-        )
+        except models.Room.DoesNotExist as err:
-        if not room_updated_count:
+            raise ActionFailedError(f"Room with ID {room_id} does not exist") from err
            raise ActionFailedError(f"Room with ID {room_id} does not exist")
        if settings.ROOM_TELEPHONY_ENABLED or settings.ROOMKIT_ENABLED:
            try:
                room = models.Room.objects.get(pk=room_id)
            except models.Room.DoesNotExist as err:
                raise ActionFailedError(
                    f"Room with ID {room_id} does not exist"
                ) from err
            try:
                self.sip_management.ensure_dispatch_rule(room)
            except SIPException as e:
@@ -4,12 +4,11 @@ import logging
 import uuid
 from dataclasses import dataclass
 from enum import Enum
-from typing import Dict, FrozenSet, Optional, Sequence, Tuple
+from typing import Dict, List, Optional, Tuple
 from uuid import UUID
 from django.conf import settings
 from django.core.cache import cache
 from django.utils import timezone
 from core import models, utils
@@ -47,7 +46,6 @@ class LobbyParticipant:
    username: str
    color: str
    id: str
    entered_at: str
    def to_dict(self) -> Dict[str, str]:
        """Serialize the participant object to a dict representation."""
@@ -56,7 +54,6 @@ class LobbyParticipant:
            "username": self.username,
            "id": self.id,
            "color": self.color,
            "entered_at": self.entered_at,
        }
    @classmethod
@@ -71,7 +68,6 @@ class LobbyParticipant:
                username=data["username"],
                id=data["id"],
                color=data["color"],
                entered_at=data["entered_at"],
            )
        except (KeyError, ValueError) as e:
            logger.exception("Error creating Participant from dict:")
@@ -90,47 +86,6 @@ class LobbyService:
        """Generate cache key for participant(s) data."""
        return f"{settings.LOBBY_KEY_PREFIX}_{room_id!s}_{participant_id}"
    @staticmethod
    def _get_index_key(room_id: UUID) -> str:
        """Raw Redis key of the per-room participant index (a native SET)."""
        return cache.client.make_key(f"{settings.LOBBY_KEY_PREFIX}-index_{room_id!s}")
    @staticmethod
    def _redis(write: bool = True):
        """Raw redis-py client.
        SADD/SREM/SMEMBERS are not exposed by the Django cache API; this is
        the documented django-redis escape hatch.
        """
        return cache.client.get_client(write=write)
    def _index_add(self, room_id: UUID, participant_id: str) -> None:
        """Record a participant id in the room index."""
        index_key = self._get_index_key(room_id)
        pipe = self._redis().pipeline(transaction=False)
        pipe.sadd(index_key, participant_id)
        pipe.expire(index_key, settings.LOBBY_ACCEPTED_TIMEOUT)
        pipe.execute()
    def _index_members(self, room_id: UUID) -> FrozenSet[str]:
        """All participant ids currently indexed for the room."""
        members = self._redis(write=False).smembers(self._get_index_key(room_id))
        return frozenset(
            member.decode() if isinstance(member, bytes) else member
            for member in members
        )
    def _index_touch(self, room_id: UUID) -> None:
        """Re-arm the room index backstop TTL."""
        self._redis().expire(
            self._get_index_key(room_id), settings.LOBBY_ACCEPTED_TIMEOUT
        )
    def _index_remove(self, room_id: UUID, *participant_ids: str) -> None:
        """Drop participant ids from the room index."""
        if participant_ids:
            self._redis().srem(self._get_index_key(room_id), *participant_ids)
    @staticmethod
    def _get_or_create_participant_id(request) -> str:
        """Extract unique participant identifier from the request."""
@@ -207,7 +162,6 @@ class LobbyService:
                    username=username,
                    id=participant_id,
                    color=utils.generate_color(participant_id),
                    entered_at=timezone.now().isoformat(),
                )
            else:
                participant.status = LobbyParticipantStatus.ACCEPTED
@@ -255,12 +209,15 @@ class LobbyService:
        cache.touch(
            self._get_cache_key(room_id, participant_id), settings.LOBBY_WAITING_TIMEOUT
        )
        self._index_touch(room_id)
    def enter(
        self, room_id: UUID, participant_id: str, username: str
    ) -> LobbyParticipant:
-        """Add participant to waiting lobby."""
+        """Add participant to waiting lobby.
        Create a new participant entry in waiting status and notify room
        participants of the new entry request.
        """
        color = utils.generate_color(participant_id)
@@ -269,7 +226,6 @@ class LobbyService:
            username=username,
            id=participant_id,
            color=color,
            entered_at=timezone.now().isoformat(),
        )
        try:
@@ -289,7 +245,6 @@ class LobbyService:
            participant.to_dict(),
            timeout=settings.LOBBY_WAITING_TIMEOUT,
        )
        self._index_add(room_id, participant_id)
        return participant
@@ -311,42 +266,28 @@ class LobbyService:
            cache.delete(cache_key)
            return None
-    def list_waiting_participants(self, room_id: UUID) -> Sequence[dict]:
+    def list_waiting_participants(self, room_id: UUID) -> List[dict]:
        """List all waiting participants for a room."""
-        member_ids = self._index_members(room_id)
+        pattern = self._get_cache_key(room_id, "*")
        keys = list(cache.iter_keys(pattern, itersize=utils.CACHE_SCAN_ITERSIZE))
-        if not member_ids:
+        if not keys:
-            return ()
+            return []
-        keys_by_id = {
+        data = cache.get_many(keys)
            participant_id: self._get_cache_key(room_id, participant_id)
            for participant_id in member_ids
        }
        data = cache.get_many(list(keys_by_id.values()))
        dead_ids = []
        waiting_participants = []
-
+        for cache_key, raw_participant in data.items():
        for participant_id, cache_key in keys_by_id.items():
            raw_participant = data.get(cache_key)
            if raw_participant is None:
                dead_ids.append(participant_id)
                continue
            try:
                participant = LobbyParticipant.from_dict(raw_participant)
            except LobbyParticipantParsingError:
                cache.delete(cache_key)
                dead_ids.append(participant_id)
                continue
            if participant.status == LobbyParticipantStatus.WAITING:
                waiting_participants.append(participant.to_dict())
-        self._index_remove(room_id, *dead_ids)
+        return waiting_participants
        waiting_participants.sort(key=lambda p: p["entered_at"], reverse=True)
        return tuple(waiting_participants)
    def handle_participant_entry(
        self,
@@ -400,24 +341,16 @@ class LobbyService:
        participant.status = status
        cache.set(cache_key, participant.to_dict(), timeout=timeout)
        self._index_touch(room_id)
    def clear_room_cache(self, room_id: UUID) -> None:
        """Clear all participant entries from the cache for a specific room."""
-        member_ids = self._index_members(room_id)
+        cache.delete_pattern(
-        if member_ids:
+            self._get_cache_key(room_id, "*"), itersize=utils.CACHE_SCAN_ITERSIZE
-            cache.delete_many(
+        )
                [
                    self._get_cache_key(room_id, participant_id)
                    for participant_id in member_ids
                ]
            )
        self._redis().delete(self._get_index_key(room_id))
    def clear_participant_cache(self, room_id: UUID, participant_id: str) -> None:
        """Clear a given participant entry from the cache for a specific room."""
        cache_key = self._get_cache_key(room_id, participant_id)
        cache.delete(cache_key)
        self._index_remove(room_id, participant_id)
@@ -1,11 +1,25 @@
-"""Presence cache."""
+"""Presence cache.
 Redis-backed memo of "this identity is currently connected to this room".
 This module is intentionally a *pure cache store* with no dependency on other
 services, so that `participants_management` (which talks to LiveKit) can
 import it without creating an import cycle. The composition of "check cache,
 fall back to LiveKit" lives in
 `ParticipantsManagement.check_if_in_meeting_cached`.
 Only positive answers are stored: a sticky negative would lock out someone
 who joins right after a miss for the whole TTL. The TTL is a safety net in
 case an invalidation webhook is lost.
 """
 from typing import FrozenSet
 from uuid import UUID
 from django.conf import settings
 from django.core.cache import cache
 from core.utils import CACHE_SCAN_ITERSIZE
 class PresenceCache:
    """Store and invalidate (room, identity) presence entries."""
@@ -15,65 +29,24 @@ class PresenceCache:
        """Cache key for a (room, identity) presence entry."""
        return f"{settings.PRESENCE_KEY_PREFIX}_{room_id!s}_{identity}"
    @staticmethod
    def _get_index_key(room_id: UUID | str) -> str:
        """Raw Redis key of the per-room identity index (a native SET).
        Built through django-redis' make_key so it lives under the same
        KEY_PREFIX/version namespace as the presence entries.
        """
        return cache.client.make_key(
            f"{settings.PRESENCE_KEY_PREFIX}-index_{room_id!s}"
        )
    @staticmethod
    def _redis(write: bool = True):
        """Raw redis-py client.
        SADD/SREM/SMEMBERS are not exposed by the Django cache API; this is
        the documented django-redis escape hatch.
        """
        return cache.client.get_client(write=write)
    def _index_members(self, room_id: UUID | str) -> FrozenSet[str]:
        """All identities currently indexed for the room."""
        members = self._redis(write=False).smembers(self._get_index_key(room_id))
        return frozenset(
            member.decode() if isinstance(member, bytes) else member
            for member in members
        )
    def is_marked_present(self, room_id: UUID | str, identity: str) -> bool:
        """Return True if a positive presence entry exists in cache."""
        return bool(cache.get(self._get_cache_key(room_id, identity)))
    def mark_present(self, room_id: UUID | str, identity: str) -> None:
-        """Record that `identity` is in `room_id` and index it for the room."""
+        """Record that `identity` is in `room_id`."""
        cache.set(
            self._get_cache_key(room_id, identity),
            True,
            timeout=settings.PRESENCE_CACHE_TIMEOUT,
        )
        index_key = self._get_index_key(room_id)
        pipe = self._redis().pipeline(transaction=False)
        pipe.sadd(index_key, identity)
        pipe.expire(index_key, settings.PRESENCE_CACHE_TIMEOUT)
        pipe.execute()
    def clear(self, room_id: UUID | str, identity: str) -> None:
        """Forget presence for one participant (e.g. on participant_left)."""
        cache.delete(self._get_cache_key(room_id, identity))
        self._redis().srem(self._get_index_key(room_id), identity)
    def clear_room(self, room_id: UUID | str) -> None:
-        """Forget presence for every participant of a room (on room_finished).
+        """Forget presence for every participant of a room (on room_finished)."""
-
+        cache.delete_pattern(
-        Deletes the indexed entries and the index itself with targeted
+            self._get_cache_key(room_id, "*"), itersize=CACHE_SCAN_ITERSIZE
-        commands instead of a full-keyspace pattern scan.
+        )
        """
        identities = self._index_members(room_id)
        if identities:
            cache.delete_many(
                [self._get_cache_key(room_id, identity) for identity in identities]
            )
        self._redis().delete(self._get_index_key(room_id))
@@ -30,10 +30,9 @@ class RoomNotFoundException(RoomManagementException):
 class RoomManagement:
    """Service for managing LiveKit rooms."""
    @classmethod
    @async_to_sync
    async def update_metadata(
-        cls,
+        self,
        room_name: str,
        metadata: Optional[Dict] = None,
        remove_keys: Optional[list[str]] = None,
@@ -76,6 +75,10 @@ class RoomManagement:
        except TwirpError as e:
            if e.code == "not_found":
                logger.warning(
                    "Room %s not found in LiveKit, skipping metadata update",
                    room_name,
                )
                raise RoomNotFoundException("Room does not exist") from e
            logger.exception(
@@ -87,9 +90,8 @@ class RoomManagement:
        finally:
            await lkapi.aclose()
    @classmethod
    @async_to_sync
-    async def delete_room(cls, room_name: str):
+    async def delete_room(self, room_name: str):
        """Delete a LiveKit room and disconnect all participants.
        Raises:
@@ -114,32 +116,3 @@ class RoomManagement:
            raise RoomManagementException("Could not delete room") from e
        finally:
            await lkapi.aclose()
    @classmethod
    def sync_room_metadata(cls, room):
        """Push a room's configuration and access level to its LiveKit room metadata.
        Failures are swallowed: a room that is not live yet, or a LiveKit hiccup,
        should never fail the request that triggered the update.
        """
        metadata = {
            "configuration": room.configuration,
            "access_level": room.access_level,
        }
        try:
            cls.update_metadata(
                room_name=str(room.id),
                metadata=metadata,
            )
        except RoomNotFoundException:
            logger.info(
                "LiveKit room %s does not exist yet, skipping metadata sync",
                room.id,
            )
        except RoomManagementException:
            logger.warning(
                "Failed to sync metadata to LiveKit for room %s",
                room.id,
            )
@@ -31,7 +31,7 @@ def delete_connection_test_room(room_name: str):
        return
    try:
-        RoomManagement.delete_room(room_name)
+        RoomManagement().delete_room(room_name)
    except RoomNotFoundException:
        # Room may already be gone after empty/departure timeout.
        logger.info("Connection test room '%s' already gone.", room_name)
@@ -40,111 +40,6 @@ def test_authentication_getter_existing_user(monkeypatch):
    assert user == db_user
@pytest.mark.parametrize(
    "sub",
    [
        # NUL (U+0000) passes str.isascii() but PostgreSQL text fields
        # cannot store or compare it (DataError)
        "auth0|abc\x00def",
        # lone surrogates cannot be encoded to UTF-8 for the DB lookup
        # (UnicodeEncodeError), which runs before any model validation
        "bad\ud800sub",
        # plainly invalid subs would otherwise escape as ValidationError
        # on user creation, which mozilla-django-oidc does not catch
        "\u00e9milie",
        "a" * 256,
        # ASCII control characters are rejected by policy
        "tab\tsub",
        "del\x7fsub",
    ],
 )
 def test_authentication_getter_invalid_sub_rejected_cleanly(monkeypatch, sub):
    """
    Subs that can never be persisted should be rejected with
    SuspiciousOperation (turned into a clean authentication failure by
    mozilla-django-oidc) instead of leaking DataError, UnicodeEncodeError
    or ValidationError as a server error.
    """
    klass = OIDCAuthenticationBackend()
    def get_userinfo_mocked(*args):
        return {"sub": sub, "email": "john@example.com"}
    monkeypatch.setattr(OIDCAuthenticationBackend, "get_userinfo", get_userinfo_mocked)
    with pytest.raises(
        SuspiciousOperation,
        match="User info contained an invalid sub claim",
    ):
        klass.get_or_create_user(access_token="test-token", id_token=None, payload=None)
    assert models.User.objects.exists() is False
 def test_authentication_getter_numeric_sub(monkeypatch):
    """
    Some providers serialize the sub as a JSON number. It should keep working
    (CharField coerces it to a string on save) and must not crash the early
    sub checks in get_existing_user.
    """
    klass = OIDCAuthenticationBackend()
    def get_userinfo_mocked(*args):
        return {"sub": 12345, "email": "john@example.com"}
    monkeypatch.setattr(OIDCAuthenticationBackend, "get_userinfo", get_userinfo_mocked)
    user = klass.get_or_create_user(
        access_token="test-token", id_token=None, payload=None
    )
    assert user.sub == "12345"
    assert models.User.objects.count() == 1
 def test_authentication_getter_new_user_auth0_pipe_sub(monkeypatch):
    """
    A first login with an Auth0-style sub containing a pipe ("provider|user-id")
    should create the user instead of raising a ValidationError.
    Regression test for https://github.com/suitenumerique/meet/issues/[XXX].
    """
    klass = OIDCAuthenticationBackend()
    def get_userinfo_mocked(*args):
        return {"sub": "auth0|644c0bc8f1874ef6d339fb34", "email": "john@example.com"}
    monkeypatch.setattr(OIDCAuthenticationBackend, "get_userinfo", get_userinfo_mocked)
    user = klass.get_or_create_user(
        access_token="test-token", id_token=None, payload=None
    )
    assert user.sub == "auth0|644c0bc8f1874ef6d339fb34"
    assert user.email == "john@example.com"
    assert models.User.objects.count() == 1
 def test_authentication_getter_existing_user_auth0_pipe_sub(monkeypatch):
    """
    A returning user with an Auth0-style pipe sub should be matched by sub,
    not duplicated or rejected.
    """
    klass = OIDCAuthenticationBackend()
    db_user = UserFactory(sub="auth0|644c0bc8f1874ef6d339fb34")
    def get_userinfo_mocked(*args):
        return {"sub": db_user.sub}
    monkeypatch.setattr(OIDCAuthenticationBackend, "get_userinfo", get_userinfo_mocked)
    user = klass.get_or_create_user(
        access_token="test-token", id_token=None, payload=None
    )
    assert user == db_user
    assert models.User.objects.count() == 1
 def test_authentication_getter_new_user_no_email(monkeypatch):
    """
    If no user matches, a user should be created.
@@ -1,239 +0,0 @@
 """Tests for the purge_inactive_rooms management command."""
 import logging
 from datetime import timedelta
 from io import StringIO
 from unittest import mock
 from django.core.management import call_command
 from django.utils import timezone
 import pytest
 from core import factories, models
 pytestmark = pytest.mark.django_db
 COMMAND_MODULE = "core.management.commands.purge_inactive_rooms"
 BEFORE_PERIOD = timedelta(days=366)
 WITHIN_PERIOD = timedelta(days=364)
@pytest.fixture(name="purge_enabled", autouse=True)
 def fixture_purge_enabled(settings):
    """Enable the purge of the rooms inactive for a year."""
    settings.ROOM_INACTIVITY_DELETION_DAYS = 365
    settings.RECORDING_EXPIRATION_DAYS = 30
 def create_at(date, factory, **kwargs):
    """Build an object with the factory as if it was created at the given date."""
    with mock.patch("django.utils.timezone.now", return_value=date):
        return factory(**kwargs)
 def call_purge(*args):
    """Run the purge command and return what it wrote on stdout."""
    out = StringIO()
    call_command("purge_inactive_rooms", *args, stdout=out)
    return out.getvalue()
 def room_exists(room):
    """Tell whether the room is still in database."""
    return models.Room.objects.filter(pk=room.pk).exists()
 def test_purge_inactive_rooms_disabled(settings):
    """Should delete nothing when no inactivity period is configured."""
    settings.ROOM_INACTIVITY_DELETION_DAYS = None
    room = create_at(timezone.now() - BEFORE_PERIOD, factories.RoomFactory)
    assert "disabled" in call_purge()
    assert room_exists(room)
 def test_purge_inactive_rooms_without_recording_expiration(settings):
    """Should purge when recordings never expire, keeping rooms with a saved one."""
    settings.RECORDING_EXPIRATION_DAYS = None
    long_ago = timezone.now() - BEFORE_PERIOD
    room = create_at(long_ago, factories.RoomFactory)
    room_with_recording = create_at(long_ago, factories.RoomFactory)
    create_at(
        long_ago,
        factories.RecordingFactory,
        room=room_with_recording,
        status=models.RecordingStatusChoices.SAVED,
    )
    assert call_purge() == "Purged 1 inactive room(s).\n"
    assert not room_exists(room)
    assert room_exists(room_with_recording)
 def test_purge_inactive_rooms_without_recording_expiration_not_saved(settings):
    """Should delete a room whose recordings were never saved when none expire."""
    settings.RECORDING_EXPIRATION_DAYS = None
    room = create_at(timezone.now() - BEFORE_PERIOD, factories.RoomFactory)
    factories.RecordingFactory(room=room, status=models.RecordingStatusChoices.FAILED)
    call_purge()
    assert not room_exists(room)
 def test_purge_inactive_rooms_started_before_period(caplog):
    """Should delete a room that was last started before the inactivity period."""
    now = timezone.now()
    room = create_at(
        now - timedelta(days=800),
        factories.RoomFactory,
        last_started_at=now - BEFORE_PERIOD,
    )
    with caplog.at_level(logging.INFO, logger=COMMAND_MODULE):
        output = call_purge()
    assert output == "Purged 1 inactive room(s).\n"
    assert not room_exists(room)
    assert f"Purging inactive room {room.pk} ({room.slug})" in caplog.text
 def test_purge_inactive_rooms_never_started_created_before_period():
    """Should delete a room that was never started and created before the period."""
    room = create_at(timezone.now() - BEFORE_PERIOD, factories.RoomFactory)
    call_purge()
    assert not room_exists(room)
 def test_purge_inactive_rooms_started_within_period():
    """Should keep a room created long ago that was started within the period."""
    now = timezone.now()
    room = create_at(
        now - timedelta(days=800),
        factories.RoomFactory,
        last_started_at=now - WITHIN_PERIOD,
    )
    assert call_purge() == "No inactive room to purge.\n"
    assert room_exists(room)
 def test_purge_inactive_rooms_never_started_created_within_period():
    """Should keep a room that was never started but created within the period."""
    room = create_at(timezone.now() - WITHIN_PERIOD, factories.RoomFactory)
    assert call_purge() == "No inactive room to purge.\n"
    assert room_exists(room)
@pytest.mark.parametrize(
    "status", sorted(models.RecordingStatusChoices.saved_statuses())
 )
 def test_purge_inactive_rooms_recording_not_expired(settings, status):
    """Should keep a room holding a saved recording that has not expired yet."""
    settings.RECORDING_EXPIRATION_DAYS = 400
    long_ago = timezone.now() - BEFORE_PERIOD
    room = create_at(long_ago, factories.RoomFactory)
    create_at(long_ago, factories.RecordingFactory, room=room, status=status)
    call_purge()
    assert room_exists(room)
 def test_purge_inactive_rooms_recording_expired(settings):
    """Should delete a room along with its recordings when they all have expired."""
    settings.RECORDING_EXPIRATION_DAYS = 30
    long_ago = timezone.now() - BEFORE_PERIOD
    room = create_at(long_ago, factories.RoomFactory)
    recording = create_at(
        long_ago,
        factories.RecordingFactory,
        room=room,
        status=models.RecordingStatusChoices.SAVED,
    )
    call_purge()
    assert not room_exists(room)
    assert not models.Recording.objects.filter(pk=recording.pk).exists()
@pytest.mark.parametrize(
    "status",
    [
        status
        for status in models.RecordingStatusChoices
        if status not in models.RecordingStatusChoices.saved_statuses()
    ],
 )
 def test_purge_inactive_rooms_recording_not_saved(status):
    """Should delete a room whose recordings were never saved, even unexpired."""
    room = create_at(timezone.now() - BEFORE_PERIOD, factories.RoomFactory)
    factories.RecordingFactory(room=room, status=status)
    call_purge()
    assert not room_exists(room)
 def test_purge_inactive_rooms_recording_saved_among_others():
    """Should keep a room holding a saved recording next to a failed one."""
    room = create_at(timezone.now() - BEFORE_PERIOD, factories.RoomFactory)
    factories.RecordingFactory(room=room, status=models.RecordingStatusChoices.FAILED)
    factories.RecordingFactory(room=room, status=models.RecordingStatusChoices.SAVED)
    call_purge()
    assert room_exists(room)
 def test_purge_inactive_rooms_deletes_accesses_and_resource():
    """Should delete the last owner access and the resource of a purged room."""
    room = create_at(timezone.now() - BEFORE_PERIOD, factories.RoomFactory)
    access = factories.UserResourceAccessFactory(
        resource=room, role=models.RoleChoices.OWNER
    )
    call_purge()
    assert not room_exists(room)
    assert not models.Resource.objects.filter(pk=room.pk).exists()
    assert not models.ResourceAccess.objects.filter(pk=access.pk).exists()
    assert models.User.objects.filter(pk=access.user.pk).exists()
 def test_purge_inactive_rooms_dry_run():
    """Should list the inactive rooms by name without deleting them on a dry run."""
    long_ago = timezone.now() - BEFORE_PERIOD
    rooms = [
        create_at(long_ago, factories.RoomFactory, name=name)
        for name in ("Alpha room", "Beta room")
    ]
    factories.RoomFactory(name="Recent room")
    assert call_purge("--dry-run") == (
        "[dry-run] 2 inactive room(s) would be purged:\n- Alpha room\n- Beta room\n"
    )
    assert all(room_exists(room) for room in rooms)
 def test_purge_inactive_rooms_several_chunks():
    """Should delete every inactive room when they span several chunks."""
    long_ago = timezone.now() - BEFORE_PERIOD
    rooms = [create_at(long_ago, factories.RoomFactory) for _ in range(5)]
    with mock.patch(f"{COMMAND_MODULE}.CHUNK_SIZE", 2):
        output = call_purge()
    assert output == "Purged 5 inactive room(s).\n"
    assert not any(room_exists(room) for room in rooms)
@@ -117,14 +117,14 @@ def test_api_files_create_file_authenticated_success():
    policy_parsed = urlparse(policy)
    assert policy_parsed.scheme == "http"
-    assert policy_parsed.netloc in ["garage:9000", "localhost:9000"]
+    assert policy_parsed.netloc in ["minio:9000", "localhost:9000"]
    assert policy_parsed.path == f"/meet-media-storage/tmp/files/{file.id!s}.png"
    query_params = parse_qs(policy_parsed.query)
    assert query_params.pop("X-Amz-Algorithm") == ["AWS4-HMAC-SHA256"]
    assert query_params.pop("X-Amz-Credential") == [
-        f"meet-access-key/{now.strftime('%Y%m%d')}/local/s3/aws4_request"
+        f"meet/{now.strftime('%Y%m%d')}/us-east-1/s3/aws4_request"
    ]
    assert query_params.pop("X-Amz-Date") == [now.strftime("%Y%m%dT%H%M%SZ")]
    assert query_params.pop("X-Amz-Expires") == ["60"]
@@ -27,7 +27,7 @@ def test_api_files_list_anonymous_not_allowed():
 def test_api_files_list_authentificated_user_allowed():
    """
-    Authenticated users should be allowed to list files
+    Authentificated users should be allowed to list files
    """
    user = factories.UserFactory()
    client = APIClient()
@@ -7,7 +7,6 @@ from urllib.parse import quote, urlparse
 from django.conf import settings
 from django.core.files.storage import default_storage
 from django.test import override_settings
 from django.utils import timezone
 import pytest
@@ -144,59 +143,3 @@ def test_api_files_media_auth_own_file_deleted():
    )
    assert response.status_code == 403
@override_settings(MEDIA_AUTH_ORIGINAL_URL_HEADER="HTTP_X_FORWARDED_URI")
 def test_api_files_media_auth_custom_original_url_header():
    """
    Authorization should honour the configured original-url header.
    Covers the attachment subrequest path, which resolves the header separately
    from the recording one. Reverse proxies other than nginx-ingress use
    different headers: Traefik's ForwardAuth sends X-Forwarded-Uri and cannot
    emit X-Original-URL at all.
    """
    user = factories.UserFactory()
    file = factories.FileFactory(
        type=models.FileTypeChoices.BACKGROUND_IMAGE,
        update_upload_state=models.FileUploadStateChoices.READY,
        creator=user,
    )
    client = APIClient()
    client.force_login(user)
    default_storage.save(file.file_key, BytesIO(b"my prose"))
    original_url = f"http://localhost/media/{file.file_key:s}"
    response = client.get(
        "/api/v1.0/files/media-auth/", HTTP_X_FORWARDED_URI=original_url
    )
    assert response.status_code == 200
    assert "AWS4-HMAC-SHA256 Credential=" in response["Authorization"]
@override_settings(MEDIA_AUTH_ORIGINAL_URL_HEADER="HTTP_X_FORWARDED_URI")
 def test_api_files_media_auth_default_header_ignored_when_reconfigured():
    """
    Only the configured header should be honoured, never a hardcoded fallback.
    """
    user = factories.UserFactory()
    file = factories.FileFactory(
        type=models.FileTypeChoices.BACKGROUND_IMAGE,
        update_upload_state=models.FileUploadStateChoices.READY,
        creator=user,
    )
    client = APIClient()
    client.force_login(user)
    original_url = f"http://localhost/media/{file.file_key:s}"
    response = client.get(
        "/api/v1.0/files/media-auth/", HTTP_X_ORIGINAL_URL=original_url
    )
    assert response.status_code == 403
@@ -2,23 +2,18 @@
 Test RecordingEventsService service.
 """
-# pylint: disable=redefined-outer-name,protected-access
+# pylint: disable=redefined-outer-name
 import logging
 from unittest import mock
 import pytest
 from core.factories import RecordingFactory
 from core.recording.enums import RecordingWorkerEvent
 from core.recording.services.recording_events import (
    RecordingEventsError,
    RecordingEventsService,
    RecordingNotSavableError,
 )
 from core.services.room_management import (
    RoomManagementException,
 )
 from core.utils import NotificationError
 pytestmark = pytest.mark.django_db
@@ -39,10 +34,10 @@ def service():
 )
@mock.patch("core.utils.notify_participants")
 def test_handle_limit_reached_success(mock_notify, mode, notification_type, service):
-    """Test _handle_limit_reached stops recording and notifies participants."""
+    """Test handle_limit_reached stops recording and notifies participants."""
    recording = RecordingFactory(status="active", mode=mode)
-    service._handle_limit_reached(recording)
+    service.handle_limit_reached(recording)
    assert recording.status == "stopped"
    mock_notify.assert_called_once_with(
@@ -53,69 +48,13 @@ def test_handle_limit_reached_success(mock_notify, mode, notification_type, serv
@pytest.mark.parametrize(
    ("mode", "notification_type"),
    (
-        ("screen_recording", "screenRecordingFailed"),
+        ("screen_recording", "screenRecordingLimitReached"),
-        ("transcript", "transcriptionFailed"),
+        ("transcript", "transcriptionLimitReached"),
    ),
 )
@mock.patch("core.utils.notify_participants")
-def test_handle_failed_success(mock_notify, mode, notification_type, service):
+def test_handle_limit_reached_error(mock_notify, mode, notification_type, service):
-    """Test _handle_failed marks recording as failed and notifies participants."""
+    """Test handle_limit_reached raises RecordingEventsError when notification fails."""
    recording = RecordingFactory(status="active", mode=mode)
    service._handle_failed(recording)
    assert recording.status == "failed"
    mock_notify.assert_called_once_with(
        room_name=str(recording.room.id), notification_data={"type": notification_type}
    )
@pytest.mark.parametrize(
    ("mode", "notification_type"),
    (
        ("screen_recording", "screenRecordingAborted"),
        ("transcript", "transcriptionAborted"),
    ),
 )
@mock.patch("core.utils.notify_participants")
 def test_handle_aborted_success(mock_notify, mode, notification_type, service):
    """Test _handle_aborted marks recording as aborted and notifies participants."""
    recording = RecordingFactory(status="active", mode=mode)
    service._handle_aborted(recording)
    assert recording.status == "aborted"
    mock_notify.assert_called_once_with(
        room_name=str(recording.room.id), notification_data={"type": notification_type}
    )
@pytest.mark.parametrize(
    ("mode", "notification_prefix"),
    (("screen_recording", "screenRecording"), ("transcript", "transcription")),
 )
@pytest.mark.parametrize(
    ("handler", "expected_status", "event", "notification_suffix"),
    (
        ("_handle_limit_reached", "stopped", "limit reached", "LimitReached"),
        ("_handle_failed", "failed", "failed", "Failed"),
        ("_handle_aborted", "aborted", "aborted", "Aborted"),
    ),
 )
@mock.patch("core.utils.notify_participants")
 def test_handle_event_notification_error(  # noqa: PLR0913, PLR0917
    mock_notify,
    handler,
    expected_status,
    event,
    notification_suffix,
    mode,
    notification_prefix,
    service,
 ):  # pylint: disable=too-many-arguments,too-many-positional-arguments
    """Test handlers raise RecordingEventsError when notifying participants fails,
    while still applying the recording status of their event.
    """
    mock_notify.side_effect = NotificationError("Error notifying")
@@ -123,15 +62,14 @@ def test_handle_event_notification_error(  # noqa: PLR0913, PLR0917
    with pytest.raises(
        RecordingEventsError,
-        match=rf"Failed to notify participants in room '.+' "
+        match=r"Failed to notify participants in room '.+' "
-        rf"about recording {event} \(recording_id=.+\)",
+        r"about recording limit reached \(recording_id=.+\)",
    ):
-        getattr(service, handler)(recording)
+        service.handle_limit_reached(recording)
-    assert recording.status == expected_status
+    assert recording.status == "stopped"
    mock_notify.assert_called_once_with(
-        room_name=str(recording.room.id),
+        room_name=str(recording.room.id), notification_data={"type": notification_type}
        notification_data={"type": f"{notification_prefix}{notification_suffix}"},
    )
@@ -144,19 +82,19 @@ def test_handle_event_notification_error(  # noqa: PLR0913, PLR0917
    "core.recording.services.recording_events.notification_service."
    "notify_external_services"
 )
-def test_handle_successful_saves_recording(  # pylint: disable=too-many-arguments, too-many-positional-arguments
+def test_handle_complete_saves_recording(  # pylint: disable=too-many-arguments, too-many-positional-arguments
    mock_notify_external_services,
    notify_return_value,
    expected_status,
    status,
    service,
 ):
-    """Test _handle_successful notifies external services and saves a savable recording."""
+    """Test handle_complete notifies external services and saves a savable recording."""
    mock_notify_external_services.return_value = notify_return_value
    recording = RecordingFactory(status=status)
-    service._handle_successful(recording)
+    service.handle_complete(recording)
    mock_notify_external_services.assert_called_once_with(recording)
@@ -166,293 +104,23 @@ def test_handle_successful_saves_recording(  # pylint: disable=too-many-argument
@pytest.mark.parametrize(
    "status",
-    [
+    ["initiated", "saved", "notification_succeeded", "aborted", "failed_to_start"],
        "initiated",
        "saved",
        "notification_succeeded",
        "aborted",
        "failed",
        "failed_to_start",
    ],
 )
@mock.patch(
    "core.recording.services.recording_events.notification_service."
    "notify_external_services"
 )
-def test_handle_successful_non_savable_recording(
+def test_handle_complete_non_savable_recording(
    mock_notify_external_services, status, service
 ):
-    """Test _handle_successful refuses recordings that are already saved or in error."""
+    """Test handle_complete refuses recordings that are already saved or in error."""
    recording = RecordingFactory(status=status)
    with pytest.raises(RecordingNotSavableError):
-        service._handle_successful(recording)
+        service.handle_complete(recording)
    mock_notify_external_services.assert_not_called()
    recording.refresh_from_db()
    assert recording.status == status
@pytest.mark.parametrize(
    ("event", "recording_status"),
    (
        (RecordingWorkerEvent.STARTED, "started"),
        (RecordingWorkerEvent.SAVING, "saving"),
    ),
 )
@mock.patch("core.services.room_management.RoomManagement.update_metadata")
 def test_handle_update_syncs_room_metadata(
    mock_update_metadata, event, recording_status, service
 ):
    """Test handle_update updates the room's metadata."""
    recording = RecordingFactory(status="active")
    service.handle_update(recording, event)
    mock_update_metadata.assert_called_once_with(
        str(recording.room.id), {"recording_status": recording_status}
    )
@pytest.mark.parametrize(
    "event",
    (
        RecordingWorkerEvent.STARTING,
        RecordingWorkerEvent.COMPLETED,
        RecordingWorkerEvent.LIMIT_REACHED,
        RecordingWorkerEvent.ABORTED,
        RecordingWorkerEvent.FAILED,
    ),
 )
@mock.patch("core.services.room_management.RoomManagement.update_metadata")
 def test_handle_update_ignores_events_without_a_metadata_status(
    mock_update_metadata, event, service
 ):
    """Test handle_update doesn't update metadata for events it doesn't match."""
    recording = RecordingFactory(status="active")
    service.handle_update(recording, event)
    mock_update_metadata.assert_not_called()
@pytest.mark.parametrize(
    ("event", "initial_status", "expected_status", "notification_type"),
    (
        (RecordingWorkerEvent.LIMIT_REACHED, "active", "saved", "LimitReached"),
        (RecordingWorkerEvent.LIMIT_REACHED, "stopped", "saved", None),
        (RecordingWorkerEvent.LIMIT_REACHED, "saved", "saved", None),
        (RecordingWorkerEvent.ABORTED, "active", "aborted", "Aborted"),
        (RecordingWorkerEvent.ABORTED, "failed_to_stop", "failed_to_stop", None),
        (RecordingWorkerEvent.FAILED, "active", "failed", "Failed"),
        (RecordingWorkerEvent.FAILED, "stopped", "failed", "Failed"),
        (RecordingWorkerEvent.FAILED, "aborted", "aborted", None),
        (RecordingWorkerEvent.COMPLETED, "active", "saved", None),
        (RecordingWorkerEvent.COMPLETED, "saved", "saved", None),
    ),
 )
@mock.patch(
    "core.recording.services.recording_events.notification_service."
    "notify_external_services"
 )
@mock.patch("core.utils.notify_participants")
 def test_handle_terminal_event_dispatches_on_event_and_status(  # noqa: PLR0913, PLR0917
    mock_notify,
    mock_notify_external_services,
    event,
    initial_status,
    expected_status,
    notification_type,
    service,
 ):  # pylint: disable=too-many-arguments,too-many-positional-arguments
    """Test handle_terminal_event chooses the right handler from the event and status."""
    mock_notify_external_services.return_value = False
    recording = RecordingFactory(status=initial_status, mode="screen_recording")
    service.handle_terminal_event(recording, event)
    recording.refresh_from_db()
    assert recording.status == expected_status
    if notification_type is None:
        mock_notify.assert_not_called()
    else:
        mock_notify.assert_called_once_with(
            room_name=str(recording.room.id),
            notification_data={"type": f"screenRecording{notification_type}"},
        )
@pytest.mark.parametrize(
    "event",
    (
        RecordingWorkerEvent.STARTING,
        RecordingWorkerEvent.STARTED,
        RecordingWorkerEvent.SAVING,
    ),
 )
@mock.patch(
    "core.recording.services.recording_events.notification_service."
    "notify_external_services"
 )
@mock.patch("core.utils.notify_participants")
 def test_handle_terminal_event_ignores_non_terminal_events(
    mock_notify, mock_notify_external_services, event, service, caplog
 ):
    """Test handle_terminal_event refuses non-terminal events."""
    recording = RecordingFactory(status="active")
    with caplog.at_level(logging.WARNING):
        service.handle_terminal_event(recording, event)
    assert f"Ignoring non-terminal event {event.value}" in caplog.text
    mock_notify.assert_not_called()
    mock_notify_external_services.assert_not_called()
    recording.refresh_from_db()
    assert recording.status == "active"
@pytest.mark.parametrize(
    ("event", "expected_status"),
    (
        (RecordingWorkerEvent.LIMIT_REACHED, "saved"),
        (RecordingWorkerEvent.ABORTED, "aborted"),
        (RecordingWorkerEvent.FAILED, "failed"),
    ),
 )
@mock.patch(
    "core.recording.services.recording_events.notification_service."
    "notify_external_services"
 )
@mock.patch("core.utils.notify_participants")
 def test_handle_terminal_event_survives_a_notification_failure(  # noqa: PLR0913, PLR0917
    mock_notify,
    mock_notify_external_services,
    event,
    expected_status,
    service,
    caplog,
 ):  # pylint: disable=too-many-arguments,too-many-positional-arguments
    """Test handle_terminal_event logs a notification failure instead of raising.
    The recording status must still be persisted: participants missing their
    notification should not disturb recording.
    """
    mock_notify_external_services.return_value = False
    mock_notify.side_effect = NotificationError("Error notifying")
    recording = RecordingFactory(status="active")
    with caplog.at_level(logging.ERROR):
        service.handle_terminal_event(recording, event)
    assert f"Failed to notify participants that recording {recording.id}" in caplog.text
    recording.refresh_from_db()
    assert recording.status == expected_status
@pytest.mark.parametrize(
    "status",
    ["failed_to_start", "aborted", "failed", "failed_to_stop", "saved", "initiated"],
 )
@mock.patch(
    "core.recording.services.recording_events.notification_service."
    "notify_external_services"
 )
 def test_handle_terminal_event_ignores_a_non_savable_recording(
    mock_notify_external_services, status, service, caplog
 ):
    """Test handle_terminal_event handles a redelivered event idempotently.
    A terminal event may be redelivered for an already finalized recording;
    this must not raise, otherwise the webhook would 500 and be retried.
    """
    recording = RecordingFactory(status=status)
    with caplog.at_level(logging.WARNING):
        service.handle_terminal_event(recording, RecordingWorkerEvent.COMPLETED)
    assert f"Recording {recording.id} is not savable" in caplog.text
    mock_notify_external_services.assert_not_called()
    recording.refresh_from_db()
    assert recording.status == status
@mock.patch("core.services.room_management.RoomManagement.update_metadata")
 def test_handle_update_survives_a_metadata_failure(
    mock_update_metadata, service, caplog
 ):
    """Test handle_update logs a metadata failure instead of raising."""
    mock_update_metadata.side_effect = RoomManagementException("Error updating")
    recording = RecordingFactory(status="active")
    with caplog.at_level(logging.ERROR):
        service.handle_update(recording, RecordingWorkerEvent.SAVING)
    assert "Failed to update room's metadata" in caplog.text
@pytest.mark.parametrize(
    ("event", "expected_level"),
    (
        (RecordingWorkerEvent.ABORTED, logging.INFO),
        (RecordingWorkerEvent.FAILED, logging.ERROR),
    ),
 )
 def test_log_worker_error_reports_an_unsuccessful_event(
    event, expected_level, service, caplog
 ):
    """Test log_worker_error records the reason the recording did not succeed."""
    recording = RecordingFactory(status="active", mode="screen_recording")
    with caplog.at_level(logging.INFO):
        service.log_worker_error(
            recording, event, error="could not connect to the room", error_code=500
        )
    assert (
        f"Recording worker reported {event.value} for recording {recording.id}"
        in caplog.text
    )
    assert "could not connect to the room" in caplog.text
    assert "error_code=500" in caplog.text
    worker_logs = [
        record
        for record in caplog.records
        if record.name == "core.recording.services.recording_events"
    ]
    assert [record.levelno for record in worker_logs] == [expected_level]
@pytest.mark.parametrize(
    "event",
    (
        RecordingWorkerEvent.STARTING,
        RecordingWorkerEvent.STARTED,
        RecordingWorkerEvent.SAVING,
        RecordingWorkerEvent.COMPLETED,
        RecordingWorkerEvent.LIMIT_REACHED,
        None,
    ),
 )
 def test_log_worker_error_stays_quiet_on_anything_else(event, service, caplog):
    """Test log_worker_error ignores events other than FAILED and ABORTED."""
    recording = RecordingFactory(status="active")
    with caplog.at_level(logging.INFO):
        service.log_worker_error(recording, event, error="some error", error_code=500)
    assert "Recording worker reported" not in caplog.text
@@ -8,7 +8,6 @@ from uuid import uuid4
 from django.conf import settings
 from django.core.files.storage import default_storage
 from django.test import override_settings
 from django.utils import timezone
 import pytest
@@ -283,63 +282,3 @@ def test_api_recordings_media_auth_success_administrator(mode):
        timeout=1,
    )
    assert response.content.decode("utf-8") == "my prose"
 def test_api_recordings_media_auth_missing_header():
    """
    Test that a subrequest without the configured original-url header is rejected.
    """
    user = UserFactory()
    client = APIClient()
    client.force_login(user)
    response = client.get("/api/v1.0/recordings/media-auth/")
    assert response.status_code == 403
@override_settings(MEDIA_AUTH_ORIGINAL_URL_HEADER="HTTP_X_FORWARDED_URI")
 def test_api_recordings_media_auth_custom_original_url_header():
    """
    Test that the header carrying the original URL can be configured.
    Reverse proxies other than nginx-ingress use different headers: Traefik's
    ForwardAuth sends X-Forwarded-Uri and cannot emit X-Original-URL at all.
    """
    user = UserFactory()
    client = APIClient()
    client.force_login(user)
    original_url = f"http://localhost/media/recordings/{uuid4()!s}.mp4"
    response = client.get(
        "/api/v1.0/recordings/media-auth/", HTTP_X_FORWARDED_URI=original_url
    )
    # The header was read and parsed: we get as far as looking the recording up,
    # rather than being rejected for a missing header.
    assert response.status_code == 404
@override_settings(MEDIA_AUTH_ORIGINAL_URL_HEADER="HTTP_X_FORWARDED_URI")
 def test_api_recordings_media_auth_default_header_ignored_when_reconfigured():
    """
    Test that only the configured header is honoured.
    Guards against the header being read from a hardcoded name in parallel with
    the setting.
    """
    user = UserFactory()
    client = APIClient()
    client.force_login(user)
    original_url = f"http://localhost/media/recordings/{uuid4()!s}.mp4"
    response = client.get(
        "/api/v1.0/recordings/media-auth/", HTTP_X_ORIGINAL_URL=original_url
    )
    assert response.status_code == 403
@@ -224,7 +224,6 @@ def test_api_recording_retrieve_expired(settings):
        RecordingStatusChoices.INITIATED,
        RecordingStatusChoices.ACTIVE,
        RecordingStatusChoices.SAVED,
        RecordingStatusChoices.FAILED,
        RecordingStatusChoices.FAILED_TO_START,
        RecordingStatusChoices.FAILED_TO_STOP,
        RecordingStatusChoices.ABORTED,
@@ -4,7 +4,6 @@ Test worker service classes.
 # pylint: disable=protected-access,redefined-outer-name,unused-argument,no-member
 import logging
 from unittest.mock import AsyncMock, Mock, patch
 import pytest
@@ -155,9 +154,9 @@ def test_base_egress_filepath_construction(service, filename, extension, expecte
    "response_status,expected_result",
    [
        (livekit_api.EgressStatus.EGRESS_ABORTED, "ABORTED"),
        (livekit_api.EgressStatus.EGRESS_FAILED, "FAILED"),
        (livekit_api.EgressStatus.EGRESS_COMPLETE, "FAILED_TO_STOP"),
        (livekit_api.EgressStatus.EGRESS_ENDING, "STOPPED"),
        (livekit_api.EgressStatus.EGRESS_FAILED, "FAILED_TO_STOP"),
    ],
 )
 def test_base_egress_stop_with_status(service, response_status, expected_result):
@@ -176,32 +175,6 @@ def test_base_egress_stop_with_status(service, response_status, expected_result)
    assert result == expected_result
@pytest.mark.parametrize(
    "response_status,event",
    [
        (livekit_api.EgressStatus.EGRESS_ABORTED, "aborted"),
        (livekit_api.EgressStatus.EGRESS_FAILED, "failed"),
        (livekit_api.EgressStatus.EGRESS_COMPLETE, "failed to stop"),
    ],
 )
 def test_base_egress_stop_logs_livekit_error(service, response_status, event, caplog):
    """Should log the reason LiveKit reported for an unsuccessful stop."""
    mock_response = Mock(
        status=response_status,
        egress_id="test_worker_id",
        error="could not connect to the room",
        error_code=500,
    )
    service._handle_request = Mock(return_value=mock_response)
    with caplog.at_level(logging.ERROR):
        service.stop("test_worker_id")
    assert f"Egress {event} on stop (egress_id=test_worker_id" in caplog.text
    assert "could not connect to the room" in caplog.text
    assert "error_code=500" in caplog.text
 def test_base_egress_stop_missing_status(service):
    """Test stop method when response is missing status"""
    # Mock _handle_request with missing status
@@ -9,10 +9,6 @@ from django.core.cache import cache
 import pytest
 from rest_framework.test import APIClient
 from ...api.throttling import (
    RoomCreationDailyUserRateThrottle,
    RoomCreationUserRateThrottle,
 )
 from ...factories import RoomFactory, UserFactory
 from ...models import Room, RoomAccessLevel
@@ -316,145 +312,3 @@ def test_api_rooms_create_authenticated_blank_user_default_access_level():
    assert response.status_code == 201
    room = Room.objects.get()
    assert room.access_level == settings.RESOURCE_DEFAULT_ACCESS_LEVEL
@pytest.fixture
 def room_creation_throttle(monkeypatch):
    """Lower the room creation rate for the duration of a test."""
    monkeypatch.setitem(
        settings.REST_FRAMEWORK["DEFAULT_THROTTLE_RATES"], "room_creation", "2/minute"
    )
 def test_api_rooms_create_throttled(room_creation_throttle):
    """Excess requests are rejected and create no room."""
    client = APIClient()
    client.force_login(UserFactory())
    for index in range(2):
        response = client.post("/api/v1.0/rooms/", {"name": f"Room {index}"})
        assert response.status_code == 201
    response = client.post("/api/v1.0/rooms/", {"name": "Blocked room"})
    assert response.status_code == 429
    assert 0 < int(response["Retry-After"]) <= 60
    assert Room.objects.count() == 2
 def test_api_rooms_create_throttle_per_user(room_creation_throttle):
    """Users sharing an IP have independent creation limits."""
    client = APIClient()
    client.force_login(UserFactory())
    for index in range(2):
        response = client.post("/api/v1.0/rooms/", {"name": f"First user room {index}"})
        assert response.status_code == 201
    response = client.post("/api/v1.0/rooms/", {"name": "Blocked room"})
    assert response.status_code == 429
    client.force_login(UserFactory())
    response = client.post("/api/v1.0/rooms/", {"name": "Second user room"})
    assert response.status_code == 201
 def test_api_rooms_create_throttle_does_not_limit_other_actions(room_creation_throttle):
    """Exhausting creation capacity leaves listing and updating available."""
    client = APIClient()
    client.force_login(UserFactory())
    for index in range(2):
        response = client.post("/api/v1.0/rooms/", {"name": f"Room {index}"})
        assert response.status_code == 201
    room_id = response.json()["id"]
    assert client.post("/api/v1.0/rooms/", {"name": "Blocked room"}).status_code == 429
    assert client.get("/api/v1.0/rooms/").status_code == 200
    assert (
        client.patch(
            f"/api/v1.0/rooms/{room_id}/", {"name": "Renamed room"}
        ).status_code
        == 200
    )
@pytest.fixture
 def daily_room_creation_throttle(monkeypatch):
    """Use a tiny daily cap, a loose burst limit and a controllable clock.
    Rates are patched with monkeypatch.setitem so they are restored after the
    test. Returns a one-item list holding the current fake timestamp.
    """
    rates = RoomCreationDailyUserRateThrottle.THROTTLE_RATES
    monkeypatch.setitem(rates, "room_creation", "100/minute")
    monkeypatch.setitem(rates, "room_creation_daily", "3/day")
    now = [1_000_000.0]
    monkeypatch.setattr(RoomCreationUserRateThrottle, "timer", lambda self: now[0])
    return now
 def test_api_rooms_create_daily_throttled(daily_room_creation_throttle):
    """The daily cap still applies once the short-term window has elapsed."""
    now = daily_room_creation_throttle
    client = APIClient()
    client.force_login(UserFactory())
    for index in range(3):
        response = client.post("/api/v1.0/rooms/", {"name": f"Room {index}"})
        assert response.status_code == 201
        now[0] += 120  # Spread creations beyond the short-term window.
    response = client.post("/api/v1.0/rooms/", {"name": "Blocked room"})
    assert response.status_code == 429
    assert int(response["Retry-After"]) > 60
    assert Room.objects.count() == 3
 def test_api_rooms_create_daily_throttle_resets(daily_room_creation_throttle):
    """Room creation is allowed again once a day has passed."""
    now = daily_room_creation_throttle
    client = APIClient()
    client.force_login(UserFactory())
    for index in range(3):
        response = client.post("/api/v1.0/rooms/", {"name": f"Room {index}"})
        assert response.status_code == 201
    response = client.post("/api/v1.0/rooms/", {"name": "Blocked room"})
    assert response.status_code == 429
    now[0] += 24 * 60 * 60 + 1
    response = client.post("/api/v1.0/rooms/", {"name": "Next day room"})
    assert response.status_code == 201
 def test_api_rooms_create_daily_throttle_per_user(daily_room_creation_throttle):
    """Each user has its own daily cap."""
    client = APIClient()
    client.force_login(UserFactory())
    for index in range(3):
        response = client.post("/api/v1.0/rooms/", {"name": f"Room {index}"})
        assert response.status_code == 201
    assert client.post("/api/v1.0/rooms/", {"name": "Blocked"}).status_code == 429
    client.force_login(UserFactory())
    response = client.post("/api/v1.0/rooms/", {"name": "Other user room"})
    assert response.status_code == 201
 def test_api_rooms_create_daily_throttle_does_not_limit_other_actions(
    daily_room_creation_throttle,
 ):
    """Reaching the daily cap leaves listing and updating available."""
    client = APIClient()
    client.force_login(UserFactory())
    for index in range(3):
        response = client.post("/api/v1.0/rooms/", {"name": f"Room {index}"})
        assert response.status_code == 201
    room_id = response.json()["id"]
    assert client.post("/api/v1.0/rooms/", {"name": "Blocked"}).status_code == 429
    assert client.get("/api/v1.0/rooms/").status_code == 200
    response = client.patch(f"/api/v1.0/rooms/{room_id}/", {"name": "Renamed"})
    assert response.status_code == 200
--- a/Show More
+++ b/Show More
		`@@ -1,2 +0,0 @@`
			# Filled with a random value by `make create-env-files`
			`GARAGE_RPC_SECRET=`