fixup! ♻️ decouple PiP behavior from shared primitives

Unify main and PiP emoji UI via context; remove PiP-only duplicates.

.github/workflows/meet.yml

@@ -150,14 +150,13 @@ jobs:
         uses: actions/setup-python@v6
         with:
           python-version: "3.13"
-      - name: Install uv
-        uses: astral-sh/setup-uv@v7
-      - name: Install the project
-        run: uv sync --locked --all-extras
+          cache: "pip"
+      - name: Install development dependencies
+        run: pip install --user .[dev]
       - name: Check code formatting with ruff
-        run: uv run ruff format . --diff
+        run: ~/.local/bin/ruff format . --diff
       - name: Lint code with ruff
-        run: uv run ruff check .
+        run: ~/.local/bin/ruff check .
 
   lint-summary:
     runs-on: ubuntu-latest

.gitignore

@@ -83,6 +83,3 @@ docker/livekit/out
 
 # LiveKit CA configuration
 docker/livekit/rootCA.pem
-
-# Frontend rollup-plugin-visualizer
-/src/frontend/rollup-plugin-visualizer/*

CHANGELOG.md

@@ -8,46 +8,17 @@ and this project adheres to
 
 ## [Unreleased]
 
-## [1.17.0] - 2026-05-31
-
-### Added
-
-- ✨(fullstack) allow participants to mute others based on room configuration
-- ✨(frontend) add synchronizer for room metadata updates
-- ✨(frontend) make reaction toolbar responsive on small viewports
-- ✨(frontend) enable reactions on mobile devices
-- ✨(frontend) introduce picture-in-picture meeting
-- ✨(backend) add core.recording.event.parsers.S3Parser
-- ✨(summary) extended support for all video / audio files #1358
-
-### Changed 
-
-- ♻️(fullstack) simplify source serialization
-- ✨(backend) expose room configuration to all API consumers
-- 🩹(frontend) improve reaction toolbar centering with dynamic positioning
-- 🚀 (paas) remove buildpack requirements.txt to use the new uv.lock #1349
-- ✨(backend) allow room configuration and access level via external api #1260
-- ♻️(backend) prefix Swagger routes with /api
-
-### Fixed
-
-- 🩹(backend) fix swagger and redoc documentation URLs
-
-## [1.16.0] - 2026-05-13
-
 ### Added
 
 - 🔒️(backend) add validation of Room.configuration
 - ✨(helm) add support multiple transcribe worker / endpoint #1247
 - ✨(backend) make LiveKit Egress recording encoding configurable #1288
 - ✨(summary) add speaker-to-participant assignment
+- ✨(feat) Introduce Picture-in-Picture (PiP) #890
 
 ### Changed
 
 - ♻️(summary) change tasks endpoint signature
-- ⬆️(dependencies) update urllib3 to v2.7.0 [SECURITY]
-- 🧑‍💻(agents) use `uv` for package management
-- ✨(summary) improve speaker-to-participant assignment
 
 ### Fixed
 
@@ -57,7 +28,6 @@ and this project adheres to
 - ⬆️(mail) fix dependencies not having resolved or integrity field #1321
 - 🐛(summary) complete webm support #1328
 - 🐛(backend) add link to "Open" text in recording email
-- 🩹(frontend) fix spacing regression in mobile control bar
 
 ## [1.15.0] - 2026-04-30
 

Makefile

@@ -109,7 +109,7 @@ build-frontend: ## build the frontend container
 .PHONY: build-frontend
 
 build-agents: ## build the multi-user-transcriber agent container
-	@$(COMPOSE) build multi-user-transcriber-dev
+	@$(COMPOSE) build multi-user-transcriber
 .PHONY: build-agents
 
 down: ## stop and remove containers, networks, images, and volumes
@@ -138,7 +138,7 @@ run-agents: ## start the multi-user-transcriber agent
 .PHONY: run-agents
 
 run-agent-multi-user-transcriber: ## start the LiveKit agents (multi users transcriber)
-	@$(COMPOSE) up --force-recreate -d multi-user-transcriber-dev
+	@$(COMPOSE) up --force-recreate -d multi-user-transcriber
 .PHONY: run-agent-multi-user-transcriber
 
 run-agent-metadata-collector: ## start the LiveKit agents (metadata collector)

bin/Tiltfile

@@ -23,8 +23,8 @@ docker_build(
     live_update=[
         sync('../src/backend', '/app'),
         run(
-            'uv sync --locked --no-dev',
-            trigger=['../src/backend/uv.lock', '../src/backend/pyproject.toml']
+            'pip install -r /app/requirements.txt',
+            trigger=['./api/requirements.txt']
         )
     ]
 )
@@ -110,20 +110,11 @@ k8s_resource('meet-celery-backend', resource_deps=['redis'])
 k8s_resource('meet-celery-summarize', resource_deps=['redis'])
 k8s_resource('meet-celery-summary-backend', resource_deps=['redis'])
 k8s_resource('meet-celery-transcribe-default', resource_deps=['redis'])
+k8s_resource('meet-backend-migrate', resource_deps=['meet-backend'])
 k8s_resource('livekit-livekit-server', resource_deps=['redis'])
 k8s_resource('livekit-livekit-server-test-connection', resource_deps=['livekit-livekit-server'])
 k8s_resource('keycloak', resource_deps=['kc-postgresql'])
-# Trigger once on launch
-k8s_resource(
-    'meet-backend-createsuperuser',
-    resource_deps=['meet-backend-migrate'],
-    trigger_mode=TRIGGER_MODE_MANUAL,
-)
-k8s_resource(
-    'meet-backend-migrate',
-    resource_deps=['meet-backend'],
-    trigger_mode=TRIGGER_MODE_MANUAL,
-)
+k8s_resource('meet-backend-createsuperuser', resource_deps=['meet-backend-migrate'])
 
 migration = '''
 set -eu

bin/buildpack_postfrontend.sh

@@ -47,3 +47,4 @@ mv src/backend/* ./
 mv deploy/paas/* ./
 
 echo "3.13" > .python-version
+echo "." > requirements.txt

compose.yml

@@ -249,7 +249,6 @@ services:
   metadata-collector-dev:
     build:
       context: ./src/agents
-      target: development
     command: ["python", "metadata_collector.py", "dev"]
     environment:
       - LIVEKIT_URL=ws://livekit:7880
@@ -262,7 +261,6 @@ services:
       - AWS_S3_SECURE_ACCESS=False
     volumes:
       - ./src/agents:/app
-      - /app/.venv
     depends_on:
       - livekit
       - minio
@@ -271,16 +269,6 @@ services:
         - action: rebuild
           path: ./src/agents
 
-  multi-user-transcriber-dev:
-    build:
-      context: ./src/agents
-      target: development
-    env_file:
-      - env.d/development/multi_user_transcriber
-    volumes:
-      - ./src/agents:/app
-      - /app/.venv
-
   redis-summary:
     image: redis
     ports:
@@ -342,6 +330,14 @@ services:
         - action: rebuild
           path: ./src/summary
 
+  multi-user-transcriber:
+    build:
+      context: ./src/agents
+    env_file:
+      - env.d/development/multi_user_transcriber
+    volumes:
+      - ./src/agents:/app
+
 networks:
   default:
   resource-server:

docs/openapi.yaml

@@ -185,7 +185,6 @@ paths:
                           pin_code: "123456"
                           phone_number: "+1-555-0100"
                           default_country: "US"
-                        configuration: {}
         '401':
           $ref: '#/components/responses/UnauthorizedError'
         '403':
@@ -199,6 +198,10 @@ paths:
       description: |
         Creates a new room with secure defaults for external API usage.
         
+        **Restrictions:**
+        - Rooms are always created with `trusted` access (no public rooms via API)
+        - Room access_level can be updated from the webapp interface.
+        
         **Defaults:**
         - Delegated user is set as owner
         - Room slug auto-generated for uniqueness
@@ -215,17 +218,8 @@ paths:
               $ref: '#/components/schemas/RoomCreate'
             examples:
               emptyBody:
-                summary: No parameters (use all defaults)
-                value: { }
-              withAccessLevel:
-                summary: Specify access level
-                value:
-                  access_level: "trusted"
-              withConfiguration:
-                summary: Provide room configuration
-                value:
-                  configuration:
-                    everyone_can_mute: true
+                summary: No parameters (default)
+                value: {}
       responses:
         '201':
           description: Room created successfully
@@ -275,7 +269,6 @@ paths:
                       pin_code: "123456"
                       phone_number: "+1-555-0100"
                       default_country: "US"
-                    configuration: {}
         '401':
           $ref: '#/components/responses/UnauthorizedError'
         '403':
@@ -351,56 +344,8 @@ components:
 
     RoomCreate:
       type: object
-      description: |
-        Optional fields for room creation. All fields have secure defaults if omitted.
-      properties:
-        access_level:
-          $ref: '#/components/schemas/RoomAccessLevel'
-        configuration:
-          $ref: '#/components/schemas/RoomConfiguration'
-
-    RoomConfiguration:
-      type: object
-      description: |
-        Optional room behaviour settings. Unknown fields are rejected.
-        All fields are optional and default to `null` (server-side defaults apply).
-      properties:
-        can_publish_sources:
-          type: array
-          nullable: true
-          description: |
-            Restricts which media tracks participants are allowed to publish.
-            If `null`, all sources are permitted.
-          items:
-            type: string
-            enum:
-              - camera
-              - microphone
-              - screen_share
-              - screen_share_audio
-          example: [ "camera", "microphone" ]
-        everyone_can_mute:
-          type: boolean
-          nullable: true
-          description: |
-            Whether any participant can mute others, or only the room owner/moderator.
-            If `null`, the server default applies.
-          example: true
-      additionalProperties: false
-
-    RoomAccessLevel:
-      type: string
-      enum:
-        - public
-        - trusted
-        - restricted
-      description: |
-        Controls who can join the room without going through the lobby.
-
-        - `public`: Anyone with the room link can join directly, no authentication required.
-        - `trusted`: Authenticated users join directly. Unauthenticated users wait in the lobby for approval.
-        - `restricted`: Only participants explicitly trusted by the owner bypass the lobby. Everyone else waits for approval regardless of authentication.
-      example: "trusted"
+      description: Empty object - all room properties are auto-generated
+      properties: {}
 
     Room:
       type: object
@@ -417,7 +362,10 @@ components:
           description: URL-friendly room identifier (auto-generated)
           example: "aze-eere-zer"
         access_level:
-          $ref: '#/components/schemas/RoomAccessLevel'
+          type: string
+          readOnly: true
+          description: Room access level (always 'trusted' for API-created rooms)
+          example: "trusted"
         url:
           type: string
           format: uri
@@ -445,8 +393,6 @@ components:
               type: string
               description: Default country code
               example: "US"
-        configuration:
-          $ref: '#/components/schemas/RoomConfiguration'
 
     OAuthError:
       type: object

docs/resource_server.yaml

@@ -48,7 +48,7 @@ paths:
       summary: List rooms
       description: |
         Returns a list of rooms accessible to the authenticated user.
-        Only rooms where the user has access will be returned.
+        Only rooms where the delegated user has access will be returned.
       operationId: listRooms
       security:
         - BearerAuth: [rooms:list]
@@ -108,7 +108,6 @@ paths:
                           pin_code: "123456"
                           phone_number: "+1-555-0100"
                           default_country: "US"
-                        configuration: { }
         '401':
           $ref: '#/components/responses/UnauthorizedError'
         '403':
@@ -121,9 +120,13 @@ paths:
       summary: Create a room
       description: |
         Creates a new room with secure defaults for external API usage.
-
+        
+        **Restrictions:**
+        - Rooms are always created with `trusted` access (no public rooms via API)
+        - Room access_level can be updated from the webapp interface.
+        
         **Defaults:**
-        - user is set as owner
+        - Delegated user is set as owner
         - Room slug auto-generated for uniqueness
         - Telephony PIN auto-generated when enabled
         - Creation tracked with application client_id for auditing
@@ -138,17 +141,8 @@ paths:
               $ref: '#/components/schemas/RoomCreate'
             examples:
               emptyBody:
-                summary: No parameters (use all defaults)
-                value: { }
-              withAccessLevel:
-                summary: Specify access level
-                value:
-                  access_level: "trusted"
-              withConfiguration:
-                summary: Provide room configuration
-                value:
-                  configuration:
-                    everyone_can_mute: true
+                summary: No parameters (default)
+                value: {}
       responses:
         '201':
           description: Room created successfully
@@ -198,7 +192,6 @@ paths:
                       pin_code: "123456"
                       phone_number: "+1-555-0100"
                       default_country: "US"
-                    configuration: { }
         '401':
           $ref: '#/components/responses/UnauthorizedError'
         '403':
@@ -217,58 +210,65 @@ components:
         Include in requests as: `Authorization: Bearer <token>`
 
   schemas:
+    TokenRequest:
+      type: object
+      required:
+        - client_id
+        - client_secret
+        - grant_type
+        - scope
+      properties:
+        client_id:
+          type: string
+          description: Application client identifier
+          example: "550e8400-e29b-41d4-a716-446655440000"
+        client_secret:
+          type: string
+          format: password
+          writeOnly: true
+          description: Application secret key
+          example: "1234567890abcdefghijklmnopqrstuvwxyz"
+        grant_type:
+          type: string
+          enum:
+            - client_credentials
+          description: OAuth2 grant type (must be 'client_credentials')
+          example: "client_credentials"
+        scope:
+          type: string
+          format: email
+          description: |
+            Email address of the user to delegate.
+            The application will act on behalf of this user.
+            Note: This parameter is named 'scope' to align with OAuth2 conventions,
+            but accepts an email address to identify the user. This design allows
+            for future extensibility.
+          example: "user@example.com"
+
+    TokenResponse:
+      type: object
+      properties:
+        access_token:
+          type: string
+          description: JWT access token
+          example: "eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJpc3MiOiJtZWV0LWFwaSIsImF1ZCI6Im1lZXQtY2xpZW50cyIsImlhdCI6MTcwOTQ5MTIwMCwiZXhwIjoxNzA5NDk0ODAwLCJjbGllbnRfaWQiOiI1NTBlODQwMC1lMjliLTQxZDQtYTcxNi00NDY2NTU0NDAwMDAiLCJzY29wZSI6InJvb21zOmxpc3Qgcm9vbXM6cmV0cmlldmUgcm9vbXM6Y3JlYXRlIiwidXNlcl9pZCI6IjdiOGQ5YzQwLTNhMmItNGVkZi04NzFjLTJmM2Q0ZTVmNmE3YiIsImRlbGVnYXRlZCI6dHJ1ZX0.signature"
+        token_type:
+          type: string
+          description: Token type (always 'Bearer')
+          example: "Bearer"
+        expires_in:
+          type: integer
+          description: Token lifetime in seconds
+          example: 3600
+        scope:
+          type: string
+          description: Space-separated list of granted permission scopes
+          example: "rooms:list rooms:retrieve rooms:create"
+
     RoomCreate:
       type: object
-      description: |
-        Optional fields for room creation. All fields have secure defaults if omitted.
-      properties:
-        access_level:
-          $ref: '#/components/schemas/RoomAccessLevel'
-        configuration:
-          $ref: '#/components/schemas/RoomConfiguration'
-
-    RoomConfiguration:
-      type: object
-      description: |
-        Optional room behaviour settings. Unknown fields are rejected.
-        All fields are optional and default to `null` (server-side defaults apply).
-      properties:
-        can_publish_sources:
-          type: array
-          nullable: true
-          description: |
-            Restricts which media tracks participants are allowed to publish.
-            If `null`, all sources are permitted.
-          items:
-            type: string
-            enum:
-              - camera
-              - microphone
-              - screen_share
-              - screen_share_audio
-          example: [ "camera", "microphone" ]
-        everyone_can_mute:
-          type: boolean
-          nullable: true
-          description: |
-            Whether any participant can mute others, or only the room owner/moderator.
-            If `null`, the server default applies.
-          example: true
-      additionalProperties: false
-
-    RoomAccessLevel:
-      type: string
-      enum:
-        - public
-        - trusted
-        - restricted
-      description: |
-        Controls who can join the room without going through the lobby.
-
-        - `public`: Anyone with the room link can join directly, no authentication required.
-        - `trusted`: Authenticated users join directly. Unauthenticated users wait in the lobby for approval.
-        - `restricted`: Only participants explicitly trusted by the owner bypass the lobby. Everyone else waits for approval regardless of authentication.
-      example: "trusted"
+      description: Empty object - all room properties are auto-generated
+      properties: {}
 
     Room:
       type: object
@@ -285,7 +285,10 @@ components:
           description: URL-friendly room identifier (auto-generated)
           example: "aze-eere-zer"
         access_level:
-          $ref: '#/components/schemas/RoomAccessLevel'
+          type: string
+          readOnly: true
+          description: Room access level (always 'trusted' for API-created rooms)
+          example: "trusted"
         url:
           type: string
           format: uri
@@ -313,8 +316,6 @@ components:
               type: string
               description: Default country code
               example: "US"
-        configuration:
-          $ref: '#/components/schemas/RoomConfiguration'
 
     OAuthError:
       type: object

src/addons/outlook/package-lock.json

@@ -9,7 +9,7 @@
       "version": "0.0.1",
       "license": "MIT",
       "dependencies": {
-        "core-js": "^3.49.0",
+        "core-js": "^3.36.0",
         "regenerator-runtime": "^0.14.1"
       },
       "devDependencies": {
@@ -19,7 +19,7 @@
         "@types/office-runtime": "^1.0.35",
         "acorn": "^8.11.3",
         "babel-loader": "^9.1.3",
-        "copy-webpack-plugin": "^14.0.0",
+        "copy-webpack-plugin": "^12.0.2",
         "eslint-plugin-office-addins": "^4.0.3",
         "file-loader": "^6.2.0",
         "html-loader": "^5.0.0",
@@ -36,7 +36,7 @@
         "source-map-loader": "^5.0.0",
         "webpack": "^5.95.0",
         "webpack-cli": "^5.1.4",
-        "webpack-dev-server": "5.2.4"
+        "webpack-dev-server": "5.2.1"
       }
     },
     "node_modules/@apidevtools/json-schema-ref-parser": {
@@ -4319,195 +4319,44 @@
         "node": ">= 4.0.0"
       }
     },
-    "node_modules/@noble/hashes": {
-      "version": "1.4.0",
-      "resolved": "https://registry.npmjs.org/@noble/hashes/-/hashes-1.4.0.tgz",
-      "integrity": "sha512-V1JJ1WTRUqHHrOSh597hURcMqVKVGL/ea3kv0gSnEdsEZ0/+VyPghM1lMNGc00z7CIQorSvbKpuJkxvuHbvdbg==",
+    "node_modules/@nodelib/fs.scandir": {
+      "version": "2.1.5",
+      "resolved": "https://registry.npmjs.org/@nodelib/fs.scandir/-/fs.scandir-2.1.5.tgz",
+      "integrity": "sha512-vq24Bq3ym5HEQm2NKCr3yXDwjc7vTsEThRDnkp2DK9p1uqLR+DHurm/NOTo0KG7HYHU7eppKZj3MyqYuMBf62g==",
+      "dev": true,
+      "license": "MIT",
+      "dependencies": {
+        "@nodelib/fs.stat": "2.0.5",
+        "run-parallel": "^1.1.9"
+      },
+      "engines": {
+        "node": ">= 8"
+      }
+    },
+    "node_modules/@nodelib/fs.stat": {
+      "version": "2.0.5",
+      "resolved": "https://registry.npmjs.org/@nodelib/fs.stat/-/fs.stat-2.0.5.tgz",
+      "integrity": "sha512-RkhPPp2zrqDAQA/2jNhnztcPAlv64XdhIp7a7454A5ovI7Bukxgt7MX7udwAu3zg1DcpPU0rz3VV1SeaqvY4+A==",
       "dev": true,
       "license": "MIT",
       "engines": {
-        "node": ">= 16"
-      },
-      "funding": {
-        "url": "https://paulmillr.com/funding/"
+        "node": ">= 8"
       }
     },
-    "node_modules/@peculiar/asn1-cms": {
-      "version": "2.7.0",
-      "resolved": "https://registry.npmjs.org/@peculiar/asn1-cms/-/asn1-cms-2.7.0.tgz",
-      "integrity": "sha512-hew63shtzzvBcSHbhm+cyAmKe6AIfinT9hzEqSPjDC6opTTMKmTkQ0gHuN2KsWlvqiKw1S/fS94fhag/FJkioQ==",
+    "node_modules/@nodelib/fs.walk": {
+      "version": "1.2.8",
+      "resolved": "https://registry.npmjs.org/@nodelib/fs.walk/-/fs.walk-1.2.8.tgz",
+      "integrity": "sha512-oGB+UxlgWcgQkgwo8GcEGwemoTFt3FIO9ababBmaGwXIoBKZ+GTy0pP185beGg7Llih/NSHSV2XAs1lnznocSg==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
-        "@peculiar/asn1-schema": "^2.7.0",
-        "@peculiar/asn1-x509": "^2.7.0",
-        "@peculiar/asn1-x509-attr": "^2.7.0",
-        "asn1js": "^3.0.6",
-        "tslib": "^2.8.1"
-      }
-    },
-    "node_modules/@peculiar/asn1-csr": {
-      "version": "2.7.0",
-      "resolved": "https://registry.npmjs.org/@peculiar/asn1-csr/-/asn1-csr-2.7.0.tgz",
-      "integrity": "sha512-VVsAyGqErT9D1SY4aEqozThXMVI+ssVRiv2DDeYuvpBKLIgZ3hYs3Ay3u/VSoKq6ESFi9cf6rf3IOOzfwh7oMA==",
-      "dev": true,
-      "license": "MIT",
-      "dependencies": {
-        "@peculiar/asn1-schema": "^2.7.0",
-        "@peculiar/asn1-x509": "^2.7.0",
-        "asn1js": "^3.0.6",
-        "tslib": "^2.8.1"
-      }
-    },
-    "node_modules/@peculiar/asn1-ecc": {
-      "version": "2.7.0",
-      "resolved": "https://registry.npmjs.org/@peculiar/asn1-ecc/-/asn1-ecc-2.7.0.tgz",
-      "integrity": "sha512-n7KEs/Q/wrB415cxy4fHOBhegp4NdJ15fkJPwcB/3/8iNBQC2L/N7SChJPKDJPZGYH0jD4Tg4/0vnHmwghnbKw==",
-      "dev": true,
-      "license": "MIT",
-      "dependencies": {
-        "@peculiar/asn1-schema": "^2.7.0",
-        "@peculiar/asn1-x509": "^2.7.0",
-        "asn1js": "^3.0.6",
-        "tslib": "^2.8.1"
-      }
-    },
-    "node_modules/@peculiar/asn1-pfx": {
-      "version": "2.7.0",
-      "resolved": "https://registry.npmjs.org/@peculiar/asn1-pfx/-/asn1-pfx-2.7.0.tgz",
-      "integrity": "sha512-V/nrlQVmhg7lYAsM7E13UDL5erAwFv6kCIVFqNaMIHSVi7dngcT839JkRTkQBqznMG98l2XjxYk74ZztAohZzA==",
-      "dev": true,
-      "license": "MIT",
-      "dependencies": {
-        "@peculiar/asn1-cms": "^2.7.0",
-        "@peculiar/asn1-pkcs8": "^2.7.0",
-        "@peculiar/asn1-rsa": "^2.7.0",
-        "@peculiar/asn1-schema": "^2.7.0",
-        "asn1js": "^3.0.6",
-        "tslib": "^2.8.1"
-      }
-    },
-    "node_modules/@peculiar/asn1-pkcs8": {
-      "version": "2.7.0",
-      "resolved": "https://registry.npmjs.org/@peculiar/asn1-pkcs8/-/asn1-pkcs8-2.7.0.tgz",
-      "integrity": "sha512-9GTl1nE8Mx1kTZ+7QyYatDyKsm34QcWRBFkY1iPvWC3X4Dona5s/tlLiQsx5WzVdZqiMBZNYT0buyw4/vbhnjw==",
-      "dev": true,
-      "license": "MIT",
-      "dependencies": {
-        "@peculiar/asn1-schema": "^2.7.0",
-        "@peculiar/asn1-x509": "^2.7.0",
-        "asn1js": "^3.0.6",
-        "tslib": "^2.8.1"
-      }
-    },
-    "node_modules/@peculiar/asn1-pkcs9": {
-      "version": "2.7.0",
-      "resolved": "https://registry.npmjs.org/@peculiar/asn1-pkcs9/-/asn1-pkcs9-2.7.0.tgz",
-      "integrity": "sha512-Bh7m+OuIaSEllPQcSd9OSp93F4ROWH7sbITWV8MI+8dwsjE5111/87VxiWVvYFKyww3vp39geLv9ENqhwWHcew==",
-      "dev": true,
-      "license": "MIT",
-      "dependencies": {
-        "@peculiar/asn1-cms": "^2.7.0",
-        "@peculiar/asn1-pfx": "^2.7.0",
-        "@peculiar/asn1-pkcs8": "^2.7.0",
-        "@peculiar/asn1-schema": "^2.7.0",
-        "@peculiar/asn1-x509": "^2.7.0",
-        "@peculiar/asn1-x509-attr": "^2.7.0",
-        "asn1js": "^3.0.6",
-        "tslib": "^2.8.1"
-      }
-    },
-    "node_modules/@peculiar/asn1-rsa": {
-      "version": "2.7.0",
-      "resolved": "https://registry.npmjs.org/@peculiar/asn1-rsa/-/asn1-rsa-2.7.0.tgz",
-      "integrity": "sha512-/qvENQrXyTZURjMqSeofHul0JJt2sNSzSwk36pl2olkHbaioMQgrASDZAlHXl0xUlnVbHj0uGgOrBMTb5x2aJQ==",
-      "dev": true,
-      "license": "MIT",
-      "dependencies": {
-        "@peculiar/asn1-schema": "^2.7.0",
-        "@peculiar/asn1-x509": "^2.7.0",
-        "asn1js": "^3.0.6",
-        "tslib": "^2.8.1"
-      }
-    },
-    "node_modules/@peculiar/asn1-schema": {
-      "version": "2.7.0",
-      "resolved": "https://registry.npmjs.org/@peculiar/asn1-schema/-/asn1-schema-2.7.0.tgz",
-      "integrity": "sha512-W8ZfWzLmQnrcky+eh3tni4IozMdqBDiHWU0N+vve/UGjMaUs8c0L7A2oEdkBXS8rTpWDpK/aoI3DG/L/hxmxPg==",
-      "dev": true,
-      "license": "MIT",
-      "dependencies": {
-        "@peculiar/utils": "^2.0.2",
-        "asn1js": "^3.0.6",
-        "tslib": "^2.8.1"
-      }
-    },
-    "node_modules/@peculiar/asn1-x509": {
-      "version": "2.7.0",
-      "resolved": "https://registry.npmjs.org/@peculiar/asn1-x509/-/asn1-x509-2.7.0.tgz",
-      "integrity": "sha512-mUn9RRrkGDnG4ALfunDmzyRW5dg+sWCj/pfnCCqEHYbkGxEpvUt6iVJv8Yw1cyp6SWZ26ZE5oSmI5SqEaen15g==",
-      "dev": true,
-      "license": "MIT",
-      "dependencies": {
-        "@peculiar/asn1-schema": "^2.7.0",
-        "@peculiar/utils": "^2.0.2",
-        "asn1js": "^3.0.6",
-        "tslib": "^2.8.1"
-      }
-    },
-    "node_modules/@peculiar/asn1-x509-attr": {
-      "version": "2.7.0",
-      "resolved": "https://registry.npmjs.org/@peculiar/asn1-x509-attr/-/asn1-x509-attr-2.7.0.tgz",
-      "integrity": "sha512-NS8e7SOgXipkzUPLF/sce7ukpMpWjhxYsH0n6Y+bHYo4TTxOb95Zv7hqwSuL212mj5YxovjdOKQOgH1As3E94w==",
-      "dev": true,
-      "license": "MIT",
-      "dependencies": {
-        "@peculiar/asn1-schema": "^2.7.0",
-        "@peculiar/asn1-x509": "^2.7.0",
-        "asn1js": "^3.0.6",
-        "tslib": "^2.8.1"
-      }
-    },
-    "node_modules/@peculiar/utils": {
-      "version": "2.0.3",
-      "resolved": "https://registry.npmjs.org/@peculiar/utils/-/utils-2.0.3.tgz",
-      "integrity": "sha512-+oL3HPFRIZ1St2K50lWCXiioIgSoxzz7R1J3uF6neO2yl1sgmpgY6XXJH4BdpoDkMWznQTeYF6oWNDZLCdQ4eQ==",
-      "dev": true,
-      "license": "MIT",
-      "dependencies": {
-        "tslib": "^2.8.1"
-      }
-    },
-    "node_modules/@peculiar/x509": {
-      "version": "1.14.3",
-      "resolved": "https://registry.npmjs.org/@peculiar/x509/-/x509-1.14.3.tgz",
-      "integrity": "sha512-C2Xj8FZ0uHWeCXXqX5B4/gVFQmtSkiuOolzAgutjTfseNOHT3pUjljDZsTSxXFGgio54bCzVFqmEOUrIVk8RDA==",
-      "dev": true,
-      "license": "MIT",
-      "dependencies": {
-        "@peculiar/asn1-cms": "^2.6.0",
-        "@peculiar/asn1-csr": "^2.6.0",
-        "@peculiar/asn1-ecc": "^2.6.0",
-        "@peculiar/asn1-pkcs9": "^2.6.0",
-        "@peculiar/asn1-rsa": "^2.6.0",
-        "@peculiar/asn1-schema": "^2.6.0",
-        "@peculiar/asn1-x509": "^2.6.0",
-        "pvtsutils": "^1.3.6",
-        "reflect-metadata": "^0.2.2",
-        "tslib": "^2.8.1",
-        "tsyringe": "^4.10.0"
+        "@nodelib/fs.scandir": "2.1.5",
+        "fastq": "^1.6.0"
       },
       "engines": {
-        "node": ">=20.0.0"
+        "node": ">= 8"
       }
     },
-    "node_modules/@peculiar/x509/node_modules/reflect-metadata": {
-      "version": "0.2.2",
-      "resolved": "https://registry.npmjs.org/reflect-metadata/-/reflect-metadata-0.2.2.tgz",
-      "integrity": "sha512-urBwgfrvVP/eAyXx4hluJivBKzuEbSQs9rKWCrCkbSxNv8mxPcUZKeuoF3Uy4mJl3Lwprp6yy5/39VWigZ4K6Q==",
-      "dev": true,
-      "license": "Apache-2.0"
-    },
     "node_modules/@pkgr/core": {
       "version": "0.2.9",
       "resolved": "https://registry.npmjs.org/@pkgr/core/-/core-0.2.9.tgz",
@@ -4521,6 +4370,19 @@
         "url": "https://opencollective.com/pkgr"
       }
     },
+    "node_modules/@sindresorhus/merge-streams": {
+      "version": "2.3.0",
+      "resolved": "https://registry.npmjs.org/@sindresorhus/merge-streams/-/merge-streams-2.3.0.tgz",
+      "integrity": "sha512-LtoMMhxAlorcGhmFYI+LhPgbPZCkgP6ra1YL604EeF6U98pLlQ3iWIGMdWSC+vWmPBWBNgmDBAhnAobLROJmwg==",
+      "dev": true,
+      "license": "MIT",
+      "engines": {
+        "node": ">=18"
+      },
+      "funding": {
+        "url": "https://github.com/sponsors/sindresorhus"
+      }
+    },
     "node_modules/@types/body-parser": {
       "version": "1.19.6",
       "resolved": "https://registry.npmjs.org/@types/body-parser/-/body-parser-1.19.6.tgz",
@@ -4722,6 +4584,16 @@
         "form-data": "^4.0.4"
       }
     },
+    "node_modules/@types/node-forge": {
+      "version": "1.3.14",
+      "resolved": "https://registry.npmjs.org/@types/node-forge/-/node-forge-1.3.14.tgz",
+      "integrity": "sha512-mhVF2BnD4BO+jtOp7z1CdzaK4mbuK0LLQYAvdOLqHTavxFNq4zA1EmYkpnFjP8HOUzedfQkRnp0E2ulSAYSzAw==",
+      "dev": true,
+      "license": "MIT",
+      "dependencies": {
+        "@types/node": "*"
+      }
+    },
     "node_modules/@types/office-js": {
       "version": "1.0.582",
       "resolved": "https://registry.npmjs.org/@types/office-js/-/office-js-1.0.582.tgz",
@@ -5778,21 +5650,6 @@
         "url": "https://github.com/sponsors/ljharb"
       }
     },
-    "node_modules/asn1js": {
-      "version": "3.0.10",
-      "resolved": "https://registry.npmjs.org/asn1js/-/asn1js-3.0.10.tgz",
-      "integrity": "sha512-S2s3aOytiKdFRdulw2qPE51MzjzVOisppcVv7jVFR+Kw0kxwvFrDcYA0h7Ndqbmj0HkMIXYWaoj7fli8kgx1eg==",
-      "dev": true,
-      "license": "BSD-3-Clause",
-      "dependencies": {
-        "pvtsutils": "^1.3.6",
-        "pvutils": "^1.1.5",
-        "tslib": "^2.8.1"
-      },
-      "engines": {
-        "node": ">=12.0.0"
-      }
-    },
     "node_modules/assertion-error": {
       "version": "1.1.0",
       "resolved": "https://registry.npmjs.org/assertion-error/-/assertion-error-1.1.0.tgz",
@@ -6264,16 +6121,6 @@
         "node": ">= 0.8"
       }
     },
-    "node_modules/bytestreamjs": {
-      "version": "2.0.1",
-      "resolved": "https://registry.npmjs.org/bytestreamjs/-/bytestreamjs-2.0.1.tgz",
-      "integrity": "sha512-U1Z/ob71V/bXfVABvNr/Kumf5VyeQRBEm6Txb0PQ6S7V5GpBM3w4Cbqz/xPDicR5tN0uvDifng8C+5qECeGwyQ==",
-      "dev": true,
-      "license": "BSD-3-Clause",
-      "engines": {
-        "node": ">=6.0.0"
-      }
-    },
     "node_modules/call-bind": {
       "version": "1.0.8",
       "resolved": "https://registry.npmjs.org/call-bind/-/call-bind-1.0.8.tgz",
@@ -6839,20 +6686,21 @@
       "license": "MIT"
     },
     "node_modules/copy-webpack-plugin": {
-      "version": "14.0.0",
-      "resolved": "https://registry.npmjs.org/copy-webpack-plugin/-/copy-webpack-plugin-14.0.0.tgz",
-      "integrity": "sha512-3JLW90aBGeaTLpM7mYQKpnVdgsUZRExY55giiZgLuX/xTQRUs1dOCwbBnWnvY6Q6rfZoXMNwzOQJCSZPppfqXA==",
+      "version": "12.0.2",
+      "resolved": "https://registry.npmjs.org/copy-webpack-plugin/-/copy-webpack-plugin-12.0.2.tgz",
+      "integrity": "sha512-SNwdBeHyII+rWvee/bTnAYyO8vfVdcSTud4EIb6jcZ8inLeWucJE0DnxXQBjlQ5zlteuuvooGQy3LIyGxhvlOA==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
+        "fast-glob": "^3.3.2",
         "glob-parent": "^6.0.1",
+        "globby": "^14.0.0",
         "normalize-path": "^3.0.0",
         "schema-utils": "^4.2.0",
-        "serialize-javascript": "^7.0.3",
-        "tinyglobby": "^0.2.12"
+        "serialize-javascript": "^6.0.2"
       },
       "engines": {
-        "node": ">= 20.9.0"
+        "node": ">= 18.12.0"
       },
       "funding": {
         "type": "opencollective",
@@ -6863,9 +6711,9 @@
       }
     },
     "node_modules/core-js": {
-      "version": "3.49.0",
-      "resolved": "https://registry.npmjs.org/core-js/-/core-js-3.49.0.tgz",
-      "integrity": "sha512-es1U2+YTtzpwkxVLwAFdSpaIMyQaq0PBgm3YD1W3Qpsn1NAmO3KSgZfu+oGSWVu6NvLHoHCV/aYcsE5wiB7ALg==",
+      "version": "3.48.0",
+      "resolved": "https://registry.npmjs.org/core-js/-/core-js-3.48.0.tgz",
+      "integrity": "sha512-zpEHTy1fjTMZCKLHUZoVeylt9XrzaIN2rbPXEt0k+q7JE5CkCZdo6bNq55bn24a69CH7ErAVLKijxJja4fw+UQ==",
       "hasInstallScript": true,
       "license": "MIT",
       "funding": {
@@ -8214,6 +8062,36 @@
       "dev": true,
       "license": "Apache-2.0"
     },
+    "node_modules/fast-glob": {
+      "version": "3.3.3",
+      "resolved": "https://registry.npmjs.org/fast-glob/-/fast-glob-3.3.3.tgz",
+      "integrity": "sha512-7MptL8U0cqcFdzIzwOTHoilX9x5BrNqye7Z/LuC7kCMRio1EMSyqRK3BEAUD7sXRq4iT4AzTVuZdhgQ2TCvYLg==",
+      "dev": true,
+      "license": "MIT",
+      "dependencies": {
+        "@nodelib/fs.stat": "^2.0.2",
+        "@nodelib/fs.walk": "^1.2.3",
+        "glob-parent": "^5.1.2",
+        "merge2": "^1.3.0",
+        "micromatch": "^4.0.8"
+      },
+      "engines": {
+        "node": ">=8.6.0"
+      }
+    },
+    "node_modules/fast-glob/node_modules/glob-parent": {
+      "version": "5.1.2",
+      "resolved": "https://registry.npmjs.org/glob-parent/-/glob-parent-5.1.2.tgz",
+      "integrity": "sha512-AOIgSQCepiJYwP3ARnGx+5VnTu2HBYdzbGP45eLw1vr3zB3vZLeyed1sC9hnbcOc9/SrMyM5RPQrkGz4aS9Zow==",
+      "dev": true,
+      "license": "ISC",
+      "dependencies": {
+        "is-glob": "^4.0.1"
+      },
+      "engines": {
+        "node": ">= 6"
+      }
+    },
     "node_modules/fast-json-stable-stringify": {
       "version": "2.1.0",
       "resolved": "https://registry.npmjs.org/fast-json-stable-stringify/-/fast-json-stable-stringify-2.1.0.tgz",
@@ -8302,6 +8180,16 @@
         "node": ">= 4.9.1"
       }
     },
+    "node_modules/fastq": {
+      "version": "1.20.1",
+      "resolved": "https://registry.npmjs.org/fastq/-/fastq-1.20.1.tgz",
+      "integrity": "sha512-GGToxJ/w1x32s/D2EKND7kTil4n8OVk/9mycTc4VDza13lOvpUZTGX3mFSCtV9ksdGBVzvsyAVLM6mHFThxXxw==",
+      "dev": true,
+      "license": "ISC",
+      "dependencies": {
+        "reusify": "^1.0.4"
+      }
+    },
     "node_modules/faye-websocket": {
       "version": "0.11.4",
       "resolved": "https://registry.npmjs.org/faye-websocket/-/faye-websocket-0.11.4.tgz",
@@ -8870,6 +8758,37 @@
         "url": "https://github.com/sponsors/ljharb"
       }
     },
+    "node_modules/globby": {
+      "version": "14.1.0",
+      "resolved": "https://registry.npmjs.org/globby/-/globby-14.1.0.tgz",
+      "integrity": "sha512-0Ia46fDOaT7k4og1PDW4YbodWWr3scS2vAr2lTbsplOt2WkKp0vQbkI9wKis/T5LV/dqPjO3bpS/z6GTJB82LA==",
+      "dev": true,
+      "license": "MIT",
+      "dependencies": {
+        "@sindresorhus/merge-streams": "^2.1.0",
+        "fast-glob": "^3.3.3",
+        "ignore": "^7.0.3",
+        "path-type": "^6.0.0",
+        "slash": "^5.1.0",
+        "unicorn-magic": "^0.3.0"
+      },
+      "engines": {
+        "node": ">=18"
+      },
+      "funding": {
+        "url": "https://github.com/sponsors/sindresorhus"
+      }
+    },
+    "node_modules/globby/node_modules/ignore": {
+      "version": "7.0.5",
+      "resolved": "https://registry.npmjs.org/ignore/-/ignore-7.0.5.tgz",
+      "integrity": "sha512-Hs59xBNfUIunMFgWAbGX5cq6893IbWg4KnrjbYwX3tx0ztorVgTDA6B2sxf8ejHJ4wz8BqGUMYlnzNBer5NvGg==",
+      "dev": true,
+      "license": "MIT",
+      "engines": {
+        "node": ">= 4"
+      }
+    },
     "node_modules/gopd": {
       "version": "1.2.0",
       "resolved": "https://registry.npmjs.org/gopd/-/gopd-1.2.0.tgz",
@@ -11125,6 +11044,16 @@
       "dev": true,
       "license": "MIT"
     },
+    "node_modules/merge2": {
+      "version": "1.4.1",
+      "resolved": "https://registry.npmjs.org/merge2/-/merge2-1.4.1.tgz",
+      "integrity": "sha512-8q7VEgMJW4J8tcfVPy8g09NcQwZdbwFEqhe/WZkoIzjn/3TGDwtOCYtXGxA3O8tPzpczCCDgv+P2P5y00ZJOOg==",
+      "dev": true,
+      "license": "MIT",
+      "engines": {
+        "node": ">= 8"
+      }
+    },
     "node_modules/methods": {
       "version": "1.1.2",
       "resolved": "https://registry.npmjs.org/methods/-/methods-1.1.2.tgz",
@@ -12709,6 +12638,19 @@
       "dev": true,
       "license": "MIT"
     },
+    "node_modules/path-type": {
+      "version": "6.0.0",
+      "resolved": "https://registry.npmjs.org/path-type/-/path-type-6.0.0.tgz",
+      "integrity": "sha512-Vj7sf++t5pBD637NSfkxpHSMfWaeig5+DKWLhcqIYx6mWQz5hdJTGDVMQiJcw1ZYkhs7AazKDGpRVji1LJCZUQ==",
+      "dev": true,
+      "license": "MIT",
+      "engines": {
+        "node": ">=18"
+      },
+      "funding": {
+        "url": "https://github.com/sponsors/sindresorhus"
+      }
+    },
     "node_modules/pathval": {
       "version": "1.1.1",
       "resolved": "https://registry.npmjs.org/pathval/-/pathval-1.1.1.tgz",
@@ -12844,24 +12786,6 @@
         "url": "https://github.com/sponsors/sindresorhus"
       }
     },
-    "node_modules/pkijs": {
-      "version": "3.4.0",
-      "resolved": "https://registry.npmjs.org/pkijs/-/pkijs-3.4.0.tgz",
-      "integrity": "sha512-emEcLuomt2j03vxD54giVB4SxTjnsqkU692xZOZXHDVoYyypEm+b3jpiTcc+Cf+myooc+/Ly0z01jqeNHVgJGw==",
-      "dev": true,
-      "license": "BSD-3-Clause",
-      "dependencies": {
-        "@noble/hashes": "1.4.0",
-        "asn1js": "^3.0.6",
-        "bytestreamjs": "^2.0.1",
-        "pvtsutils": "^1.3.6",
-        "pvutils": "^1.1.3",
-        "tslib": "^2.8.1"
-      },
-      "engines": {
-        "node": ">=16.0.0"
-      }
-    },
     "node_modules/possible-typed-array-names": {
       "version": "1.1.0",
       "resolved": "https://registry.npmjs.org/possible-typed-array-names/-/possible-typed-array-names-1.1.0.tgz",
@@ -13045,26 +12969,6 @@
         "node": ">=6"
       }
     },
-    "node_modules/pvtsutils": {
-      "version": "1.3.6",
-      "resolved": "https://registry.npmjs.org/pvtsutils/-/pvtsutils-1.3.6.tgz",
-      "integrity": "sha512-PLgQXQ6H2FWCaeRak8vvk1GW462lMxB5s3Jm673N82zI4vqtVUPuZdffdZbPDFRoU8kAhItWFtPCWiPpp4/EDg==",
-      "dev": true,
-      "license": "MIT",
-      "dependencies": {
-        "tslib": "^2.8.1"
-      }
-    },
-    "node_modules/pvutils": {
-      "version": "1.1.5",
-      "resolved": "https://registry.npmjs.org/pvutils/-/pvutils-1.1.5.tgz",
-      "integrity": "sha512-KTqnxsgGiQ6ZAzZCVlJH5eOjSnvlyEgx1m8bkRJfOhmGRqfo5KLvmAlACQkrjEtOQ4B7wF9TdSLIs9O90MX9xA==",
-      "dev": true,
-      "license": "MIT",
-      "engines": {
-        "node": ">=16.0.0"
-      }
-    },
     "node_modules/qs": {
       "version": "6.14.2",
       "resolved": "https://registry.npmjs.org/qs/-/qs-6.14.2.tgz",
@@ -13081,6 +12985,37 @@
         "url": "https://github.com/sponsors/ljharb"
       }
     },
+    "node_modules/queue-microtask": {
+      "version": "1.2.3",
+      "resolved": "https://registry.npmjs.org/queue-microtask/-/queue-microtask-1.2.3.tgz",
+      "integrity": "sha512-NuaNSa6flKT5JaSYQzJok04JzTL1CA6aGhv5rfLW3PgqA+M2ChpZQnAC8h8i4ZFkBS8X5RqkDBHA7r4hej3K9A==",
+      "dev": true,
+      "funding": [
+        {
+          "type": "github",
+          "url": "https://github.com/sponsors/feross"
+        },
+        {
+          "type": "patreon",
+          "url": "https://www.patreon.com/feross"
+        },
+        {
+          "type": "consulting",
+          "url": "https://feross.org/support"
+        }
+      ],
+      "license": "MIT"
+    },
+    "node_modules/randombytes": {
+      "version": "2.1.0",
+      "resolved": "https://registry.npmjs.org/randombytes/-/randombytes-2.1.0.tgz",
+      "integrity": "sha512-vYl3iOX+4CKUWuxGi9Ukhie6fsqXqS9FE2Zaic4tNFD2N2QQaXOMFbuKK4QmDHC0JO6B1Zp41J0LpT0oR68amQ==",
+      "dev": true,
+      "license": "MIT",
+      "dependencies": {
+        "safe-buffer": "^5.1.0"
+      }
+    },
     "node_modules/range-parser": {
       "version": "1.2.1",
       "resolved": "https://registry.npmjs.org/range-parser/-/range-parser-1.2.1.tgz",
@@ -13567,6 +13502,17 @@
         "node": ">= 4"
       }
     },
+    "node_modules/reusify": {
+      "version": "1.1.0",
+      "resolved": "https://registry.npmjs.org/reusify/-/reusify-1.1.0.tgz",
+      "integrity": "sha512-g6QUff04oZpHs0eG5p83rFLhHeV00ug/Yf9nZM6fLeUrPguBTkTQOdpAWWspMh55TZfVQDPaN3NQJfbVRAxdIw==",
+      "dev": true,
+      "license": "MIT",
+      "engines": {
+        "iojs": ">=1.0.0",
+        "node": ">=0.10.0"
+      }
+    },
     "node_modules/rfdc": {
       "version": "1.4.1",
       "resolved": "https://registry.npmjs.org/rfdc/-/rfdc-1.4.1.tgz",
@@ -13599,6 +13545,30 @@
         "node": ">=0.12.0"
       }
     },
+    "node_modules/run-parallel": {
+      "version": "1.2.0",
+      "resolved": "https://registry.npmjs.org/run-parallel/-/run-parallel-1.2.0.tgz",
+      "integrity": "sha512-5l4VyZR86LZ/lDxZTR6jqL8AFE2S0IFLMP26AbjsLVADxHdhB/c0GUsH+y39UfCi3dzz8OlQuPmnaJOMoDHQBA==",
+      "dev": true,
+      "funding": [
+        {
+          "type": "github",
+          "url": "https://github.com/sponsors/feross"
+        },
+        {
+          "type": "patreon",
+          "url": "https://www.patreon.com/feross"
+        },
+        {
+          "type": "consulting",
+          "url": "https://feross.org/support"
+        }
+      ],
+      "license": "MIT",
+      "dependencies": {
+        "queue-microtask": "^1.2.2"
+      }
+    },
     "node_modules/rxjs": {
       "version": "7.8.2",
       "resolved": "https://registry.npmjs.org/rxjs/-/rxjs-7.8.2.tgz",
@@ -13793,17 +13763,17 @@
       "license": "MIT"
     },
     "node_modules/selfsigned": {
-      "version": "5.5.0",
-      "resolved": "https://registry.npmjs.org/selfsigned/-/selfsigned-5.5.0.tgz",
-      "integrity": "sha512-ftnu3TW4+3eBfLRFnDEkzGxSF/10BJBkaLJuBHZX0kiPS7bRdlpZGu6YGt4KngMkdTwJE6MbjavFpqHvqVt+Ew==",
+      "version": "2.4.1",
+      "resolved": "https://registry.npmjs.org/selfsigned/-/selfsigned-2.4.1.tgz",
+      "integrity": "sha512-th5B4L2U+eGLq1TVh7zNRGBapioSORUeymIydxgFpwww9d2qyKvtuPU2jJuHvYAwwqi2Y596QBL3eEqcPEYL8Q==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
-        "@peculiar/x509": "^1.14.2",
-        "pkijs": "^3.3.3"
+        "@types/node-forge": "^1.3.0",
+        "node-forge": "^1"
       },
       "engines": {
-        "node": ">=18"
+        "node": ">=10"
       }
     },
     "node_modules/semver": {
@@ -13872,13 +13842,13 @@
       }
     },
     "node_modules/serialize-javascript": {
-      "version": "7.0.5",
-      "resolved": "https://registry.npmjs.org/serialize-javascript/-/serialize-javascript-7.0.5.tgz",
-      "integrity": "sha512-F4LcB0UqUl1zErq+1nYEEzSHJnIwb3AF2XWB94b+afhrekOUijwooAYqFyRbjYkm2PAKBabx6oYv/xDxNi8IBw==",
+      "version": "6.0.2",
+      "resolved": "https://registry.npmjs.org/serialize-javascript/-/serialize-javascript-6.0.2.tgz",
+      "integrity": "sha512-Saa1xPByTTq2gdeFZYLLo+RFE35NHZkAbqZeWNd3BpzppeVisAqpDjcp8dyf6uIvEqJRd46jemmyA4iFIeVk8g==",
       "dev": true,
       "license": "BSD-3-Clause",
-      "engines": {
-        "node": ">=20.0.0"
+      "dependencies": {
+        "randombytes": "^2.1.0"
       }
     },
     "node_modules/serve-index": {
@@ -14290,6 +14260,19 @@
         "simple-concat": "^1.0.0"
       }
     },
+    "node_modules/slash": {
+      "version": "5.1.0",
+      "resolved": "https://registry.npmjs.org/slash/-/slash-5.1.0.tgz",
+      "integrity": "sha512-ZA6oR3T/pEyuqwMgAKT0/hAv8oAXckzbkmR0UkUosQ+Mc4RxGoJkRmwHgHufaenlyAgE1Mxgpdcrf75y6XcnDg==",
+      "dev": true,
+      "license": "MIT",
+      "engines": {
+        "node": ">=14.16"
+      },
+      "funding": {
+        "url": "https://github.com/sponsors/sindresorhus"
+      }
+    },
     "node_modules/sockjs": {
       "version": "0.3.24",
       "resolved": "https://registry.npmjs.org/sockjs/-/sockjs-0.3.24.tgz",
@@ -15037,26 +15020,6 @@
       "dev": true,
       "license": "0BSD"
     },
-    "node_modules/tsyringe": {
-      "version": "4.10.0",
-      "resolved": "https://registry.npmjs.org/tsyringe/-/tsyringe-4.10.0.tgz",
-      "integrity": "sha512-axr3IdNuVIxnaK5XGEUFTu3YmAQ6lllgrvqfEoR16g/HGnYY/6We4oWENtAnzK6/LpJ2ur9PAb80RBt7/U4ugw==",
-      "dev": true,
-      "license": "MIT",
-      "dependencies": {
-        "tslib": "^1.9.3"
-      },
-      "engines": {
-        "node": ">= 6.0.0"
-      }
-    },
-    "node_modules/tsyringe/node_modules/tslib": {
-      "version": "1.14.1",
-      "resolved": "https://registry.npmjs.org/tslib/-/tslib-1.14.1.tgz",
-      "integrity": "sha512-Xni35NKzjgMrwevysHTCArtLDpPvye8zV/0E4EyYn43P7/7qvQwPh9BGkHewbMulVntbigmcT7rdX3BNo9wRJg==",
-      "dev": true,
-      "license": "0BSD"
-    },
     "node_modules/tunnel-agent": {
       "version": "0.6.0",
       "resolved": "https://registry.npmjs.org/tunnel-agent/-/tunnel-agent-0.6.0.tgz",
@@ -15348,6 +15311,19 @@
         "node": ">=4"
       }
     },
+    "node_modules/unicorn-magic": {
+      "version": "0.3.0",
+      "resolved": "https://registry.npmjs.org/unicorn-magic/-/unicorn-magic-0.3.0.tgz",
+      "integrity": "sha512-+QBBXBCvifc56fsbuxZQ6Sic3wqqc3WWaqxs58gvJrcOuN83HGTCwz3oS5phzU9LthRNE9VrJCFCLUgHeeFnfA==",
+      "dev": true,
+      "license": "MIT",
+      "engines": {
+        "node": ">=18"
+      },
+      "funding": {
+        "url": "https://github.com/sponsors/sindresorhus"
+      }
+    },
     "node_modules/universalify": {
       "version": "2.0.1",
       "resolved": "https://registry.npmjs.org/universalify/-/universalify-2.0.1.tgz",
@@ -15678,15 +15654,15 @@
       }
     },
     "node_modules/webpack-dev-server": {
-      "version": "5.2.4",
-      "resolved": "https://registry.npmjs.org/webpack-dev-server/-/webpack-dev-server-5.2.4.tgz",
-      "integrity": "sha512-GqDPGZN9bRqKBTkp4aWkobDDHMsrXKoGSdOH56smIri8qR0JG8gfL8/v/f/OZR3/OKXjG8uwJbFVhKm/FNU/UA==",
+      "version": "5.2.1",
+      "resolved": "https://registry.npmjs.org/webpack-dev-server/-/webpack-dev-server-5.2.1.tgz",
+      "integrity": "sha512-ml/0HIj9NLpVKOMq+SuBPLHcmbG+TGIjXRHsYfZwocUBIqEvws8NnS/V9AFQ5FKP+tgn5adwVwRrTEpGL33QFQ==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
         "@types/bonjour": "^3.5.13",
         "@types/connect-history-api-fallback": "^1.5.4",
-        "@types/express": "^4.17.25",
+        "@types/express": "^4.17.21",
         "@types/express-serve-static-core": "^4.17.21",
         "@types/serve-index": "^1.9.4",
         "@types/serve-static": "^1.15.5",
@@ -15696,17 +15672,17 @@
         "bonjour-service": "^1.2.1",
         "chokidar": "^3.6.0",
         "colorette": "^2.0.10",
-        "compression": "^1.8.1",
+        "compression": "^1.7.4",
         "connect-history-api-fallback": "^2.0.0",
-        "express": "^4.22.1",
+        "express": "^4.21.2",
         "graceful-fs": "^4.2.6",
-        "http-proxy-middleware": "^2.0.9",
+        "http-proxy-middleware": "^2.0.7",
         "ipaddr.js": "^2.1.0",
         "launch-editor": "^2.6.1",
         "open": "^10.0.3",
         "p-retry": "^6.2.0",
         "schema-utils": "^4.2.0",
-        "selfsigned": "^5.5.0",
+        "selfsigned": "^2.4.1",
         "serve-index": "^1.9.1",
         "sockjs": "^0.3.24",
         "spdy": "^4.0.2",
@@ -15762,9 +15738,9 @@
       }
     },
     "node_modules/webpack-dev-server/node_modules/ipaddr.js": {
-      "version": "2.4.0",
-      "resolved": "https://registry.npmjs.org/ipaddr.js/-/ipaddr.js-2.4.0.tgz",
-      "integrity": "sha512-9VGk3HGanVE6JoZXHiCpnGy5X0jYDnN4EA4lntFPj+1vIWlFhIylq2CrrCOJH9EAhc5CYhq18F2Av2tgoAPsYQ==",
+      "version": "2.3.0",
+      "resolved": "https://registry.npmjs.org/ipaddr.js/-/ipaddr.js-2.3.0.tgz",
+      "integrity": "sha512-Zv/pA+ciVFbCSBBjGfaKUya/CcGmUHzTydLMaTwrUUEM2DIEO3iZvueGxmacvmN50fGpGVKeTXpb2LcYQxeVdg==",
       "dev": true,
       "license": "MIT",
       "engines": {
@@ -15791,9 +15767,9 @@
       }
     },
     "node_modules/webpack-dev-server/node_modules/ws": {
-      "version": "8.20.1",
-      "resolved": "https://registry.npmjs.org/ws/-/ws-8.20.1.tgz",
-      "integrity": "sha512-It4dO0K5v//JtTXuPkfEOaI3uUN87iYPnqo/ZzqCoG3g8uhA66QUMs/SrM0YK7/NAu+r4LMh/9dq2A7k+rHs+w==",
+      "version": "8.20.0",
+      "resolved": "https://registry.npmjs.org/ws/-/ws-8.20.0.tgz",
+      "integrity": "sha512-sAt8BhgNbzCtgGbt2OxmpuryO63ZoDk/sqaB/znQm94T4fCEsy/yV+7CdC1kJhOU9lboAEU7R3kquuycDoibVA==",
       "dev": true,
       "license": "MIT",
       "engines": {

src/addons/outlook/package.json

@@ -26,7 +26,7 @@
     "watch": "webpack --mode development --watch"
   },
   "dependencies": {
-    "core-js": "^3.49.0",
+    "core-js": "^3.36.0",
     "regenerator-runtime": "^0.14.1"
   },
   "devDependencies": {
@@ -36,7 +36,7 @@
     "@types/office-runtime": "^1.0.35",
     "acorn": "^8.11.3",
     "babel-loader": "^9.1.3",
-    "copy-webpack-plugin": "^14.0.0",
+    "copy-webpack-plugin": "^12.0.2",
     "eslint-plugin-office-addins": "^4.0.3",
     "file-loader": "^6.2.0",
     "html-loader": "^5.0.0",
@@ -53,7 +53,7 @@
     "source-map-loader": "^5.0.0",
     "webpack": "^5.95.0",
     "webpack-cli": "^5.1.4",
-    "webpack-dev-server": "5.2.4"
+    "webpack-dev-server": "5.2.1"
   },
   "prettier": "office-addin-prettier-config",
   "browserslist": [

src/agents/.dockerignore

@@ -1,38 +0,0 @@
-# Python
-__pycache__
-*.pyc
-**/__pycache__
-**/*.pyc
-venv
-**/.venv
-
-# System-specific files
-.DS_Store
-**/.DS_Store
-
-# Docker
-compose.*
-env.d
-
-# Docs
-docs
-*.md
-*.log
-
-# Development/test cache & configurations
-data
-.cache
-.circleci
-.git
-.iml
-db.sqlite3
-.pylint.d
-
-**/.idea
-**/.vscode
-**/.pytest_cache
-**/.mypy_cache
-**/.ruff_cache
-
-# Env
-.env

src/agents/Dockerfile

@@ -6,61 +6,31 @@ RUN apt-get update && apt-get install -y \
     libgobject-2.0-0 \
     && rm -rf /var/lib/apt/lists/*
 
-
-# ---- Builder image ----
 FROM base AS builder
 
-ENV UV_COMPILE_BYTECODE=1 \
-    UV_LINK_MODE=copy \
-    UV_PYTHON_DOWNLOADS=0
+WORKDIR /builder
 
-# Install uv
-COPY --from=ghcr.io/astral-sh/uv:0.10.9 /uv /uvx /bin/
+COPY pyproject.toml .
 
-WORKDIR /app
+RUN mkdir /install && \
+  pip install --prefix=/install .
 
-# Install production dependencies without the project itself (cacheable layer)
-RUN --mount=type=cache,target=/root/.cache/uv \
-    --mount=type=bind,source=uv.lock,target=uv.lock \
-    --mount=type=bind,source=pyproject.toml,target=pyproject.toml \
-    uv sync --locked --no-install-project --no-dev
-
-# Install the project
-COPY . /app
-RUN --mount=type=cache,target=/root/.cache/uv \
-    uv sync --locked --no-dev
-
-
-# ---- Development image ----
 FROM base AS development
 
-ENV UV_COMPILE_BYTECODE=1 \
-    UV_LINK_MODE=copy \
-    UV_PYTHON_DOWNLOADS=0
-
-COPY --from=ghcr.io/astral-sh/uv:0.10.9 /uv /uvx /bin/
-
 WORKDIR /app
 
-COPY . /app
+COPY pyproject.toml .
+RUN pip install --no-cache-dir ".[dev]"
 
-RUN --mount=type=cache,target=/root/.cache/uv \
-    uv sync --locked --all-extras
+COPY . .
 
-ENV PATH="/app/.venv/bin:$PATH"
+CMD ["python", "metadata_collector.py", "dev"]
 
-CMD ["python", "multi_user_transcriber.py", "dev"]
-
-
-# ---- Production image ----
 FROM base AS production
 
 WORKDIR /app
 
-# Copy the pre-built virtualenv and application source
-COPY --from=builder /app /app
-
-ENV PATH="/app/.venv/bin:$PATH"
+COPY --from=builder /install /usr/local
 
 # Remove pip to reduce attack surface in production
 RUN pip uninstall -y pip
@@ -69,4 +39,6 @@ RUN pip uninstall -y pip
 ARG DOCKER_USER
 USER ${DOCKER_USER}
 
+COPY ./*.py /app/
+
 CMD ["python", "multi_user_transcriber.py", "start"]

src/agents/pyproject.toml

@@ -1,7 +1,7 @@
 
 [project]
 name = "agents"
-version = "1.17.0"
+version = "1.15.0"
 requires-python = ">=3.12"
 dependencies = [
     "livekit-agents==1.4.5",
@@ -18,8 +18,12 @@ dev = [
     "ruff==0.15.6",
 ]
 
-[tool.uv]
-package = false
+[tool.setuptools]
+py-modules = ["multi_user_transcriber", "metadata_collector", "exceptions"]
+
+[build-system]
+requires = ["setuptools>=61.0"]
+build-backend = "setuptools.build_meta"
 
 [tool.ruff]
 target-version = "py313"

src/backend/core/api/__init__.py

@@ -8,8 +8,6 @@ from rest_framework import views as drf_views
 from rest_framework.decorators import api_view
 from rest_framework.response import Response
 
-from core.utils import build_telephony_config
-
 
 def exception_handler(exc, context):
     """Handle Django ValidationError as an accepted exception.
@@ -60,7 +58,13 @@ def get_frontend_configuration(request):
                 "allowed_mimetypes"
             ],
         },
-        "telephony": build_telephony_config(),
+        "telephony": {
+            "enabled": settings.ROOM_TELEPHONY_ENABLED,
+            "phone_number": settings.ROOM_TELEPHONY_PHONE_NUMBER
+            if settings.ROOM_TELEPHONY_ENABLED
+            else None,
+            "default_country": settings.ROOM_TELEPHONY_DEFAULT_COUNTRY,
+        },
         "subtitle": {"enabled": settings.ROOM_SUBTITLE_ENABLED},
         "livekit": {
             "url": settings.LIVEKIT_CONFIGURATION["url"],

src/backend/core/api/permissions.py

@@ -136,33 +136,3 @@ class FilePermission(IsAuthenticated):
             raise Http404
 
         return obj.get_abilities(request.user).get(view.action, False)
-
-
-class CanMuteParticipant(permissions.BasePermission):
-    """
-    Grant muting rights based on role or room configuration.
-
-    - Admins and owners can always mute.
-    - When `everyone_can_mute` is enabled on the room, any participant
-      currently in the room (proven by a valid LiveKit token for that room)
-      can mute.
-    """
-
-    def has_object_permission(self, request, view, obj):
-        """Check if the requesting user is allowed to mute a participant in the given room."""
-
-        is_livekit_token_auth = request.auth and hasattr(request.auth, "video")
-
-        # Always allow admins/owners when authenticated with session cookie
-        if not is_livekit_token_auth and obj.is_administrator_or_owner(request.user):
-            return True
-
-        everyone_can_mute = obj.configuration.get("everyone_can_mute", True)
-        if not everyone_can_mute:
-            return False
-
-        if not is_livekit_token_auth:
-            return False
-
-        # LiveKit token scoped to this room
-        return request.auth.video.room == str(obj.id)

src/backend/core/api/serializers.py

@@ -13,7 +13,7 @@ from django.core.exceptions import SuspiciousOperation
 from django.utils.translation import gettext_lazy as _
 
 from django_pydantic_field.rest_framework import SchemaField
-from pydantic import BaseModel, Field, field_serializer
+from pydantic import BaseModel, Field
 from pydantic import ValidationError as PydanticValidationError
 from rest_framework import serializers
 from rest_framework.exceptions import PermissionDenied
@@ -166,6 +166,11 @@ class RoomSerializer(serializers.ModelSerializer):
             )
             output["accesses"] = access_serializer.data
 
+        configuration = output["configuration"]
+
+        if not is_admin_or_owner:
+            del output["configuration"]
+
         should_access_room = (
             (
                 instance.access_level == models.RoomAccessLevel.TRUSTED
@@ -182,7 +187,7 @@ class RoomSerializer(serializers.ModelSerializer):
                 room_id=room_id,
                 user=request.user,
                 username=username,
-                configuration=output["configuration"],
+                configuration=configuration,
                 is_admin_or_owner=is_admin_or_owner,
             )
         else:
@@ -312,7 +317,9 @@ class MuteParticipantSerializer(BaseParticipantsManagementSerializer):
     )
 
 
-TrackSource = Literal["camera", "microphone", "screen_share", "screen_share_audio"]
+RoomConfigurationTrackSource = Literal[
+    "camera", "microphone", "screen_share", "screen_share_audio"
+]
 
 
 class RoomConfiguration(BaseModel):
@@ -321,12 +328,14 @@ class RoomConfiguration(BaseModel):
     Unknown fields are rejected.
     """
 
-    can_publish_sources: list[TrackSource] | None = None
-    everyone_can_mute: bool | None = None
+    can_publish_sources: list[RoomConfigurationTrackSource] | None = None
 
     model_config = {"extra": "forbid"}
 
 
+TrackSource = Literal["SCREEN_SHARE", "SCREEN_SHARE_AUDIO", "CAMERA", "MICROPHONE"]
+
+
 class ParticipantPermission(BaseModel):
     """Mirror the LiveKit ParticipantPermission protobuf.
 
@@ -346,10 +355,6 @@ class ParticipantPermission(BaseModel):
 
     model_config = {"extra": "forbid"}
 
-    @field_serializer("can_publish_sources")
-    def _serialize_sources(self, sources: list[str]) -> list[str]:
-        return [s.upper() for s in sources]
-
 
 class UpdateParticipantSerializer(BaseParticipantsManagementSerializer):
     """Validate participant update data."""

src/backend/core/api/viewsets.py

@@ -33,7 +33,6 @@ from rest_framework import (
 from rest_framework import (
     status as drf_status,
 )
-from rest_framework.settings import api_settings
 
 from core import enums, models, utils
 from core.api.filters import ListFileFilter
@@ -71,22 +70,12 @@ from core.services.lobby import (
     LobbyParticipantNotFound,
     LobbyService,
 )
-from core.services.participant_promotion import (
-    AlreadyAdminException,
-    OwnerPromotionException,
-    ParticipantPromotionService,
-)
 from core.services.participants_management import (
     ParticipantNotFoundException,
     ParticipantsManagement,
     ParticipantsManagementException,
 )
 from core.services.room_creation import RoomCreation
-from core.services.room_management import (
-    RoomManagement,
-    RoomManagementException,
-    RoomNotFoundException,
-)
 from core.services.subtitle import SubtitleException, SubtitleService
 from core.tasks.file import process_file_deletion
 
@@ -310,41 +299,6 @@ class RoomViewSet(
         if callback_id := self.request.data.get("callback_id"):
             RoomCreation().persist_callback_state(callback_id, room)
 
-    def perform_update(self, serializer):
-        """Persist the room update, then sync metadata to LiveKit."""
-
-        old_configuration = serializer.instance.configuration
-        old_access_level = serializer.instance.access_level
-
-        room = serializer.save()
-
-        if (
-            room.configuration == old_configuration
-            and room.access_level == old_access_level
-        ):
-            return
-
-        metadata = {
-            "configuration": room.configuration,
-            "access_level": room.access_level,
-        }
-
-        try:
-            RoomManagement().update_metadata(
-                room_name=str(room.id),
-                metadata=metadata,
-            )
-        except RoomNotFoundException:
-            logger.info(
-                "LiveKit room %s does not exist yet, skipping metadata sync",
-                room.id,
-            )
-        except RoomManagementException:
-            logger.warning(
-                "Failed to sync metadata to LiveKit for room %s",
-                room.id,
-            )
-
     @decorators.action(
         detail=True,
         methods=["post"],
@@ -660,11 +614,7 @@ class RoomViewSet(
         methods=["post"],
         url_path="mute-participant",
         url_name="mute-participant",
-        permission_classes=[permissions.CanMuteParticipant],
-        authentication_classes=[
-            LiveKitTokenAuthentication,
-            *api_settings.DEFAULT_AUTHENTICATION_CLASSES,
-        ],
+        permission_classes=[permissions.HasPrivilegesOnRoom],
     )
     def mute_participant(self, request, pk=None):  # pylint: disable=unused-argument
         """Mute a specific track for a participant in the room."""
@@ -673,26 +623,6 @@ class RoomViewSet(
         serializer = serializers.MuteParticipantSerializer(data=request.data)
         serializer.is_valid(raise_exception=True)
 
-        # TEMPORARY: a LiveKit token proves access was granted, not that the caller
-        # joined. Cross-check identity against the live participant list until auth
-        # is hardened. Skipped for non-LiveKit auth backends.
-        caller_identity = getattr(request.auth, "identity", None)
-        if caller_identity is not None:
-            try:
-                ParticipantsManagement().check_if_in_meeting(
-                    room_name=str(room.pk),
-                    identity=caller_identity,
-                )
-            except (ParticipantNotFoundException, ParticipantsManagementException):
-                logger.warning(
-                    "Failed to verify caller presence for mute in room %s; denying",
-                    room.pk,
-                )
-                return drf_response.Response(
-                    {"error": "Could not verify caller presence"},
-                    status=drf_status.HTTP_403_FORBIDDEN,
-                )
-
         try:
             ParticipantsManagement().mute(
                 room_name=str(room.pk),
@@ -880,123 +810,6 @@ class RoomViewSet(
             status=drf_status.HTTP_200_OK,
         )
 
-    @decorators.action(
-        detail=True,
-        methods=["post"],
-        url_path="promote-participant",
-        url_name="promote-participant",
-        permission_classes=[permissions.HasPrivilegesOnRoom],
-    )
-    # pylint: disable=unused-argument,too-many-return-statements
-    def promote_participant(self, request, pk=None):  # noqa: PLR0911
-        """Promote a live participant to room admin.
-
-        This endpoint is intentionally non-transactional: the DB transaction and the
-        LiveKit attribute update are two separate operations. If the participant
-        leaves the meeting between the presence check and the LiveKit update, the
-        resource access is kept — their role will be effective the next time they join.
-        """
-        room = self.get_object()
-
-        serializer = serializers.BaseParticipantsManagementSerializer(data=request.data)
-        serializer.is_valid(raise_exception=True)
-
-        identity = serializer.validated_data["participant_identity"]
-        participant_management = ParticipantsManagement()
-
-        if str(identity) == str(request.user.sub):
-            return drf_response.Response(
-                {"error": "You cannot promote yourself"},
-                status=drf_status.HTTP_403_FORBIDDEN,
-            )
-
-        try:
-            is_in_meeting = participant_management.check_if_in_meeting(
-                room.pk, identity=str(identity)
-            )
-        except (ParticipantNotFoundException, ParticipantsManagementException):
-            logger.warning(
-                "Could not verify presence of participant %s in room %s before promotion; denying",
-                identity,
-                room.pk,
-            )
-            return drf_response.Response(
-                {"error": "Could not verify participant presence"},
-                status=drf_status.HTTP_403_FORBIDDEN,
-            )
-
-        if not is_in_meeting:
-            logger.warning(
-                "Participant %s is not currently in room %s; denying promotion",
-                identity,
-                room.pk,
-            )
-            return drf_response.Response(
-                {"error": "Could not verify participant presence"},
-                status=drf_status.HTTP_403_FORBIDDEN,
-            )
-
-        try:
-            user = models.User.objects.get(sub=identity)
-        except models.User.DoesNotExist:
-            return drf_response.Response(
-                {"error": "Participant not found"},
-                status=drf_status.HTTP_404_NOT_FOUND,
-            )
-
-        if not user.is_active:
-            logger.warning(
-                "Attempted to promote inactive user %s in room %s; denying",
-                identity,
-                room.pk,
-            )
-            return drf_response.Response(
-                {
-                    "error": "This participant account is inactive and cannot be promoted"
-                },
-                status=drf_status.HTTP_403_FORBIDDEN,
-            )
-
-        try:
-            ParticipantPromotionService().promote_to_admin(room=room, user=user)
-        except AlreadyAdminException:
-            return drf_response.Response(
-                {"status": "success"}, status=drf_status.HTTP_200_OK
-            )
-        except OwnerPromotionException:
-            return drf_response.Response(
-                {
-                    "error": "Owners already have the highest privileges and cannot be promoted"
-                },
-                status=drf_status.HTTP_403_FORBIDDEN,
-            )
-
-        # DB transaction is intentionally persisted before the LiveKit update.
-        # If the participant disconnects meanwhile, the role still applies on rejoin.
-        try:
-            participant_management.update(
-                room_name=str(room.pk),
-                identity=str(identity),
-                attributes={"room_admin": "true"},
-            )
-        except (ParticipantNotFoundException, ParticipantsManagementException):
-            logger.exception(
-                "LiveKit update failed for participant %s in room %s; ADMIN role persisted",
-                identity,
-                room.pk,
-            )
-            return drf_response.Response(
-                {
-                    "status": "success",
-                    "warning": "LiveKit update failed; role update persisted",
-                },
-                status=drf_status.HTTP_200_OK,
-            )
-
-        return drf_response.Response(
-            {"status": "success"}, status=drf_status.HTTP_200_OK
-        )
-
 
 class ResourceAccessViewSet(
     mixins.CreateModelMixin,

src/backend/core/external_api/serializers.py

@@ -4,11 +4,10 @@
 
 from django.conf import settings
 
-from pydantic import ValidationError
 from rest_framework import serializers
 
 from core import models, utils
-from core.api.serializers import BaseValidationOnlySerializer, RoomConfiguration
+from core.api.serializers import BaseValidationOnlySerializer
 
 OAUTH2_GRANT_TYPE_CLIENT_CREDENTIALS = "client_credentials"
 
@@ -35,37 +34,10 @@ class RoomSerializer(serializers.ModelSerializer):
     following the principle of least privilege.
     """
 
-    configuration = serializers.JSONField(required=False)
-
     class Meta:
         model = models.Room
-        fields = ["id", "name", "slug", "pin_code", "access_level", "configuration"]
-        read_only_fields = ["id", "name", "slug", "pin_code"]
-
-    def validate_configuration(self, value):
-        """Validate room configuration against the RoomConfiguration schema."""
-        if value is None or value == {}:
-            return value
-        try:
-            RoomConfiguration.model_validate(value)
-        except ValidationError as e:
-            raise serializers.ValidationError(e.errors()) from e
-        return value
-
-    def validate_access_level(self, access_level):
-        """Reject public access_level unless explicitly allowed or the default is already public."""
-
-        if settings.EXTERNAL_API_DEFAULT_ACCESS_LEVEL == models.RoomAccessLevel.PUBLIC:
-            return access_level
-
-        if (
-            access_level == models.RoomAccessLevel.PUBLIC
-            and not settings.EXTERNAL_API_ALLOW_PUBLIC_ACCESS
-        ):
-            raise serializers.ValidationError(
-                "Public rooms are disabled for the external API."
-            )
-        return access_level
+        fields = ["id", "name", "slug", "pin_code", "access_level"]
+        read_only_fields = ["id", "name", "slug", "pin_code", "access_level"]
 
     def to_representation(self, instance):
         """Enrich response with application-specific computed fields."""
@@ -96,9 +68,6 @@ class RoomSerializer(serializers.ModelSerializer):
 
         # Set secure defaults
         validated_data["name"] = utils.generate_room_slug()
-        validated_data.setdefault(
-            "access_level", settings.EXTERNAL_API_DEFAULT_ACCESS_LEVEL
-        )
-        validated_data.setdefault("configuration", {})
+        validated_data["access_level"] = models.RoomAccessLevel.TRUSTED
 
         return super().create(validated_data)

src/backend/core/models.py

@@ -388,7 +388,6 @@ class Room(Resource):
         choices=RoomAccessLevel.choices,
         default=settings.RESOURCE_DEFAULT_ACCESS_LEVEL,
     )
-    # Public configuration exposed to any room participant via the API
     configuration = models.JSONField(
         blank=True,
         default=dict,

src/backend/core/recording/event/parsers.py

@@ -1,7 +1,6 @@
 """Meet storage event parser classes."""
 
 import logging
-import mimetypes
 import re
 from dataclasses import dataclass
 from functools import lru_cache
@@ -19,9 +18,6 @@ from .exceptions import (
     ParsingEventDataError,
 )
 
-# Additional MIME type mapping
-mimetypes.add_type("audio/ogg", ".ogg")
-
 logger = logging.getLogger(__name__)
 
 
@@ -78,8 +74,8 @@ def get_parser() -> EventParser:
     return event_parser_cls(bucket_name=settings.AWS_STORAGE_BUCKET_NAME)
 
 
-class BaseS3Parser:
-    """Base class for handling parsing and validation of S3-compatible storage events."""
+class MinioParser:
+    """Handle parsing and validation of Minio storage events."""
 
     def __init__(self, bucket_name: str, allowed_filetypes=None):
         """Initialize parser with target bucket name and accepted filetypes."""
@@ -95,6 +91,32 @@ class BaseS3Parser:
             rf"(?P<url_encoded_folder_path>(?:[^%]+%2F)+)?{settings.RECORDING_OUTPUT_FOLDER}%2F(?P<recording_id>{UUID_REGEX})\.(?P<extension>{FILE_EXT_REGEX})"
         )
 
+    @staticmethod
+    def parse(data):
+        """Convert raw Minio event dictionary to StorageEvent object."""
+
+        if not data:
+            raise ParsingEventDataError("Received empty data.")
+
+        try:
+            record = data["Records"][0]
+            s3 = record["s3"]
+            bucket_name = s3["bucket"]["name"]
+            file_object = s3["object"]
+            filepath = file_object["key"]
+            filetype = file_object["contentType"]
+        except (KeyError, IndexError) as e:
+            raise ParsingEventDataError(f"Missing or malformed key: {e}.") from e
+        try:
+            return StorageEvent(
+                filepath=filepath,
+                filetype=filetype,
+                bucket_name=bucket_name,
+                metadata=None,
+            )
+        except TypeError as e:
+            raise ParsingEventDataError(f"Missing essential data fields: {e}") from e
+
     def validate(self, event_data: StorageEvent) -> str:
         """Verify StorageEvent matches bucket, filetype and filepath requirements."""
 
@@ -119,56 +141,9 @@ class BaseS3Parser:
         return recording_id
 
     def get_recording_id(self, data):
-        """Extract recording ID from S3 event through parsing and validation."""
+        """Extract recording ID from Minio event through parsing and validation."""
 
         event_data = self.parse(data)
-        return self.validate(event_data)
+        recording_id = self.validate(event_data)
 
-    def parse(self, data: Dict) -> StorageEvent:
-        """To be implemented by subclasses."""
-        raise NotImplementedError("Subclasses must implement parse()")
-
-
-class MinioParser(BaseS3Parser):
-    """Minio specific event parsing."""
-
-    def parse(self, data: Dict) -> StorageEvent:
-        if not data:
-            raise ParsingEventDataError("Received empty data.")
-        try:
-            record = data["Records"][0]
-            s3 = record["s3"]
-            return StorageEvent(
-                filepath=s3["object"]["key"],
-                filetype=s3["object"]["contentType"],  # Minio-specific field
-                bucket_name=s3["bucket"]["name"],
-                metadata=None,
-            )
-        except (KeyError, IndexError) as e:
-            raise ParsingEventDataError(f"Malformed Minio event: {e}") from e
-        except TypeError as e:
-            raise ParsingEventDataError(f"Missing essential data fields: {e}") from e
-
-
-class S3Parser(BaseS3Parser):
-    """AWS S3 specific event parsing."""
-
-    def parse(self, data: Dict) -> StorageEvent:
-        if not data:
-            raise ParsingEventDataError("Received empty data.")
-        try:
-            # AWS S3 structure can slightly differ from Minio implementation
-            record = data["Records"][0]
-            s3 = record["s3"]
-            filepath = s3["object"]["key"]
-            if not filepath:
-                raise ParsingEventDataError("Missing object key name")
-            filetype, _ = mimetypes.guess_type(filepath)
-            return StorageEvent(
-                filepath=filepath,
-                filetype=filetype,
-                bucket_name=s3["bucket"]["name"],
-                metadata=None,
-            )
-        except (KeyError, IndexError) as e:
-            raise ParsingEventDataError(f"Malformed S3 event: {e}") from e
+        return recording_id

src/backend/core/services/participant_promotion.py

@@ -1,44 +0,0 @@
-"""Participant promotion service."""
-
-from logging import getLogger
-
-from core import models
-
-logger = getLogger(__name__)
-
-
-class PromotionException(Exception):
-    """Base exception for promotion errors."""
-
-
-class OwnerPromotionException(PromotionException):
-    """Raised when attempting to promote an owner."""
-
-
-class AlreadyAdminException(PromotionException):
-    """Raised when attempting to promote a user who is already an admin."""
-
-
-class ParticipantPromotionService:
-    """Handles the DB side of promoting a participant to room admin."""
-
-    def promote_to_admin(self, room, user) -> None:
-        """Promote a user to ADMIN role for the given room."""
-
-        access = models.ResourceAccess.objects.filter(resource=room, user=user).first()
-
-        if access and access.role == models.RoleChoices.ADMIN:
-            raise AlreadyAdminException(
-                f"User {user.pk} is already an admin of room {room.pk}"
-            )
-
-        if access and access.role == models.RoleChoices.OWNER:
-            raise OwnerPromotionException(
-                f"User {user.pk} is an owner of room {room.pk} and cannot be promoted"
-            )
-
-        models.ResourceAccess.objects.update_or_create(
-            resource=room,
-            user=user,
-            defaults={"role": models.RoleChoices.ADMIN},
-        )

src/backend/core/services/participants_management.py

@@ -15,7 +15,6 @@ from livekit.api import (
     TwirpError,
     UpdateParticipantRequest,
 )
-from livekit.protocol.models import ParticipantInfo
 
 from core import utils
 
@@ -155,44 +154,3 @@ class ParticipantsManagement:
 
         finally:
             await lkapi.aclose()
-
-    @async_to_sync
-    async def check_if_in_meeting(self, room_name: str, identity: str) -> bool:
-        """Check whether `identity` is currently a participant in `room_name`.
-
-        Raises ParticipantsManagementException for unexpected LiveKit errors
-        so callers can fail closed rather than silently allowing the action.
-        """
-
-        if not room_name or not identity:
-            return False
-
-        lkapi = utils.create_livekit_client()
-
-        try:
-            participant = await lkapi.room.get_participant(
-                RoomParticipantIdentity(
-                    room=room_name,
-                    identity=identity,
-                )
-            )
-        except TwirpError as e:
-            if e.code == "not_found":
-                raise ParticipantNotFoundException("Participant does not exist") from e
-
-            logger.exception(
-                "Unexpected error checking participant %s in room %s",
-                identity,
-                room_name,
-            )
-            raise ParticipantsManagementException(
-                "Could not verify participant presence"
-            ) from e
-
-        finally:
-            await lkapi.aclose()
-
-        return (
-            participant is not None
-            and participant.state != ParticipantInfo.State.DISCONNECTED
-        )

src/backend/core/services/room_management.py

@@ -1,64 +0,0 @@
-"""Room management service for LiveKit rooms."""
-
-# pylint: disable=no-name-in-module
-
-import json
-from logging import getLogger
-from typing import Dict, Optional
-
-from asgiref.sync import async_to_sync
-from livekit.api import (
-    TwirpError,
-    UpdateRoomMetadataRequest,
-)
-
-from core import utils
-
-logger = getLogger(__name__)
-
-
-class RoomManagementException(Exception):
-    """Exception raised when a room management operation fails."""
-
-
-class RoomNotFoundException(RoomManagementException):
-    """Raised when the target room does not exist in LiveKit."""
-
-
-class RoomManagement:
-    """Service for managing LiveKit rooms."""
-
-    @async_to_sync
-    async def update_metadata(self, room_name: str, metadata: Optional[Dict] = None):
-        """Update a LiveKit room's metadata.
-
-        The `room_name` corresponds to the LiveKit room identifier
-        (i.e. the Room model's UUID as a string).
-        """
-
-        lkapi = utils.create_livekit_client()
-
-        try:
-            await lkapi.room.update_room_metadata(
-                UpdateRoomMetadataRequest(
-                    room=room_name,
-                    metadata=json.dumps(metadata) if metadata is not None else "",
-                )
-            )
-
-        except TwirpError as e:
-            if e.code == "not_found":
-                logger.warning(
-                    "Room %s not found in LiveKit, skipping metadata update",
-                    room_name,
-                )
-                raise RoomNotFoundException("Room does not exist") from e
-
-            logger.exception(
-                "Unexpected error updating metadata for room %s",
-                room_name,
-            )
-            raise RoomManagementException("Could not update room metadata") from e
-
-        finally:
-            await lkapi.aclose()

src/backend/core/tests/recording/event/test_parsers.py

@@ -18,13 +18,10 @@ from core.recording.event.exceptions import (
 )
 from core.recording.event.parsers import (
     MinioParser,
-    S3Parser,
     StorageEvent,
     get_parser,
 )
 
-# MinioParser
-
 
 @pytest.fixture
 def valid_minio_event():
@@ -50,7 +47,7 @@ def minio_parser():
     return MinioParser(bucket_name="test-bucket")
 
 
-def test_minio_parse_valid_event(minio_parser, valid_minio_event):
+def test_parse_valid_event(minio_parser, valid_minio_event):
     """Test parsing a valid Minio event."""
     event = minio_parser.parse(valid_minio_event)
     assert isinstance(event, StorageEvent)
@@ -60,33 +57,13 @@ def test_minio_parse_valid_event(minio_parser, valid_minio_event):
     assert event.metadata is None
 
 
-def test_minio_parse_with_video_type(minio_parser):
-    """Test parsing event with video file type."""
-    video_event = {
-        "Records": [
-            {
-                "s3": {
-                    "bucket": {"name": "test-bucket"},
-                    "object": {
-                        "key": "46d1a121-2426-484d-8fb3-09b5d886f7a8.mp4",
-                        "contentType": "video/mp4",
-                    },
-                }
-            }
-        ]
-    }
-    event = minio_parser.parse(video_event)
-    assert event.filetype == "video/mp4"
-    assert event.filepath.endswith(".mp4")
-
-
-def test_minio_parse_empty_data(minio_parser):
+def test_parse_empty_data(minio_parser):
     """Test parsing empty event data raises error."""
     with pytest.raises(ParsingEventDataError, match="Received empty data."):
         minio_parser.parse({})
 
 
-def test_minio_parse_missing_keys(minio_parser):
+def test_parse_missing_keys(minio_parser):
     """Test parsing event with missing key."""
 
     invalid_minio_event = {
@@ -100,11 +77,11 @@ def test_minio_parse_missing_keys(minio_parser):
         ]
     }
 
-    with pytest.raises(ParsingEventDataError, match="Malformed Minio event:"):
+    with pytest.raises(ParsingEventDataError, match="Missing or malformed key"):
         minio_parser.parse(invalid_minio_event)
 
 
-def test_minio_parse_none_key(minio_parser):
+def test_parse_none_key(minio_parser):
     """Test parsing event with None field."""
 
     invalid_minio_event = {
@@ -125,7 +102,7 @@ def test_minio_parse_none_key(minio_parser):
         minio_parser.parse(invalid_minio_event)
 
 
-def test_minio_validate_invalid_bucket(minio_parser):
+def test_validate_invalid_bucket(minio_parser):
     """Test validation with wrong bucket name."""
     event = StorageEvent(
         filepath="recording%2F46d1a121-2426-484d-8fb3-09b5d886f7a8.ogg",
@@ -137,7 +114,7 @@ def test_minio_validate_invalid_bucket(minio_parser):
         minio_parser.validate(event)
 
 
-def test_minio_validate_invalid_filetype(minio_parser):
+def test_validate_invalid_filetype(minio_parser):
     """Test validation with unsupported file type."""
     event = StorageEvent(
         filepath="recording%2F46d1a121-2426-484d-8fb3-09b5d886f7a8.txt",
@@ -162,7 +139,7 @@ def test_minio_validate_invalid_filetype(minio_parser):
         "folder%2Fuploads%2F46d1a121-2426-484d-8fb3-09b5d886f7a8.ogg",  # nested but no recordings/
     ],
 )
-def test_minio_validate_invalid_filepath(invalid_filepath, minio_parser):
+def test_validate_invalid_filepath(invalid_filepath, minio_parser):
     """Test validation with malformed filepath."""
     event = StorageEvent(
         filepath=invalid_filepath,
@@ -174,7 +151,7 @@ def test_minio_validate_invalid_filepath(invalid_filepath, minio_parser):
         minio_parser.validate(event)
 
 
-def test_minio_validate_valid_event(minio_parser):
+def test_validate_valid_event(minio_parser):
     """Test validation with valid event data."""
     event = StorageEvent(
         filepath="recordings%2F46d1a121-2426-484d-8fb3-09b5d886f7a8.ogg",
@@ -186,13 +163,13 @@ def test_minio_validate_valid_event(minio_parser):
     assert recording_id == "46d1a121-2426-484d-8fb3-09b5d886f7a8"
 
 
-def test_minio_get_recording_id_success(minio_parser, valid_minio_event):
+def test_get_recording_id_success(minio_parser, valid_minio_event):
     """Test successful extraction of recording ID."""
     recording_id = minio_parser.get_recording_id(valid_minio_event)
     assert recording_id == "46d1a121-2426-484d-8fb3-09b5d886f7a8"
 
 
-def test_minio_validate_filepath_with_folder(minio_parser):
+def test_validate_filepath_with_folder(minio_parser):
     """Test validation of filepath with folder structure."""
     event = StorageEvent(
         filepath="parent_folder%2Frecordings%2F46d1a121-2426-484d-8fb3-09b5d886f7a8.ogg",
@@ -204,21 +181,41 @@ def test_minio_validate_filepath_with_folder(minio_parser):
     assert recording_id == "46d1a121-2426-484d-8fb3-09b5d886f7a8"
 
 
-def test_minio_empty_allowed_filetypes():
+def test_parse_with_video_type(minio_parser):
+    """Test parsing event with video file type."""
+    video_event = {
+        "Records": [
+            {
+                "s3": {
+                    "bucket": {"name": "test-bucket"},
+                    "object": {
+                        "key": "46d1a121-2426-484d-8fb3-09b5d886f7a8.mp4",
+                        "contentType": "video/mp4",
+                    },
+                }
+            }
+        ]
+    }
+    event = minio_parser.parse(video_event)
+    assert event.filetype == "video/mp4"
+    assert event.filepath.endswith(".mp4")
+
+
+def test_empty_allowed_filetypes():
     """Test MinioParser with empty allowed_filetypes."""
     empty_types = set()
     parser = MinioParser(bucket_name="test-bucket", allowed_filetypes=empty_types)
     assert parser._allowed_filetypes == {"audio/ogg", "video/mp4"}
 
 
-def test_minio_custom_allowed_filetypes():
+def test_custom_allowed_filetypes():
     """Test MinioParser with empty allowed_filetypes."""
     custom_types = {"audio/mp3", "video/mov"}
     parser = MinioParser(bucket_name="test-bucket", allowed_filetypes=custom_types)
     assert parser._allowed_filetypes == {"audio/mp3", "video/mov"}
 
 
-def test_minio_validate_custom_filetypes():
+def test_validate_custom_filetypes():
     """Test validation of filepath with folder structure."""
 
     parser = MinioParser(bucket_name="test-bucket", allowed_filetypes={"audio/mp3"})
@@ -232,143 +229,18 @@ def test_minio_validate_custom_filetypes():
     parser.validate(event)
 
 
-def test_minio_constructor_none_bucket():
+def test_constructor_none_bucket():
     """Test MinioParser constructor with None bucket name."""
     with pytest.raises(ValueError, match="Bucket name cannot be None or empty"):
         MinioParser(bucket_name=None)
 
 
-def test_minio_constructor_empty_bucket():
+def test_constructor_empty_bucket():
     """Test MinioParser constructor with empty bucket name."""
     with pytest.raises(ValueError, match="Bucket name cannot be None or empty"):
         MinioParser(bucket_name="")
 
 
-# S3Parser
-
-
-@pytest.fixture
-def valid_s3_event():
-    """Mock a valid S3 event."""
-    return {
-        "Records": [
-            {
-                "s3": {
-                    "bucket": {"name": "test-bucket"},
-                    "object": {
-                        "key": "recordings%2F46d1a121-2426-484d-8fb3-09b5d886f7a8.ogg",
-                    },
-                }
-            }
-        ]
-    }
-
-
-@pytest.fixture
-def s3_parser():
-    """Mock an S3 parser."""
-    return S3Parser(bucket_name="test-bucket")
-
-
-def test_s3_parse_valid_event(s3_parser, valid_s3_event):
-    """Test parsing a valid S3 event."""
-    event = s3_parser.parse(valid_s3_event)
-    assert isinstance(event, StorageEvent)
-    assert event.filepath == "recordings%2F46d1a121-2426-484d-8fb3-09b5d886f7a8.ogg"
-    assert event.filetype == "audio/ogg"
-    assert event.bucket_name == "test-bucket"
-    assert event.metadata is None
-
-
-def test_s3_parse_empty_data(s3_parser):
-    """Test parsing empty S3 event data raises error."""
-    with pytest.raises(ParsingEventDataError, match="Received empty data."):
-        s3_parser.parse({})
-
-
-def test_s3_parse_missing_keys(s3_parser):
-    """Test parsing S3 event with missing key."""
-    invalid_s3_event = {
-        "Records": [
-            {
-                "s3": {
-                    "bucket": {"name": "test-bucket"},
-                    # Missing 'object' key
-                }
-            }
-        ]
-    }
-
-    with pytest.raises(ParsingEventDataError, match="Malformed S3 event:"):
-        s3_parser.parse(invalid_s3_event)
-
-
-def test_s3_parse_none_key(s3_parser):
-    """Test parsing S3 event with None field."""
-    invalid_s3_event = {
-        "Records": [
-            {
-                "s3": {
-                    "bucket": {"name": "test-bucket"},
-                    "object": {
-                        "key": None,
-                    },
-                }
-            }
-        ]
-    }
-
-    with pytest.raises(ParsingEventDataError, match="Missing object key name"):
-        s3_parser.parse(invalid_s3_event)
-
-
-def test_s3_parse_with_video_type(s3_parser):
-    """Test parsing S3 event with mp4 file extension."""
-    video_event = {
-        "Records": [
-            {
-                "s3": {
-                    "bucket": {"name": "test-bucket"},
-                    "object": {
-                        "key": "recordings%2F46d1a121-2426-484d-8fb3-09b5d886f7a8.mp4",
-                    },
-                }
-            }
-        ]
-    }
-    event = s3_parser.parse(video_event)
-    assert event.filetype == "video/mp4"
-    assert event.filepath.endswith(".mp4")
-
-
-def test_s3_parse_unrecognized_extension(s3_parser):
-    """Test parsing S3 event with unrecognized file extension."""
-    event_with_unknown_ext = {
-        "Records": [
-            {
-                "s3": {
-                    "bucket": {"name": "test-bucket"},
-                    "object": {
-                        "key": "recordings%2F46d1a121-2426-484d-8fb3-09b5d886f7a8.zzunknown999",
-                    },
-                }
-            }
-        ]
-    }
-
-    with pytest.raises(TypeError, match="filetype cannot be None"):
-        s3_parser.parse(event_with_unknown_ext)
-
-
-def test_s3_get_recording_id_success(s3_parser, valid_s3_event):
-    """Test successful extraction of recording ID from S3 event."""
-    recording_id = s3_parser.get_recording_id(valid_s3_event)
-    assert recording_id == "46d1a121-2426-484d-8fb3-09b5d886f7a8"
-
-
-# get_parser
-
-
 @pytest.fixture
 def clear_lru_cache():
     """Fixture to clear the LRU cache between tests."""

src/backend/core/tests/rooms/test_api_rooms_participants_management.py

@@ -2,23 +2,20 @@
 Test rooms API endpoints in the Meet core app: participants management.
 """
 
-# pylint: disable=redefined-outer-name,unused-argument,protected-access,no-name-in-module,too-many-lines
+# pylint: disable=redefined-outer-name,unused-argument,protected-access
 
 import random
 from unittest import mock
 from uuid import uuid4
 
-from django.contrib.auth.models import AnonymousUser
 from django.core.exceptions import SuspiciousOperation
 from django.urls import reverse
 
 import pytest
-from livekit.api import TwirpError, UpdateParticipantRequest
-from livekit.protocol.models import ParticipantInfo
+from livekit.api import TwirpError
 from rest_framework import status
 from rest_framework.test import APIClient
 
-from core import utils
 from core.factories import RoomFactory, UserFactory, UserResourceAccessFactory
 from core.services.lobby import LobbyService
 
@@ -34,8 +31,8 @@ def mock_livekit_client():
         yield mock_client
 
 
-def test_mute_participant_success_as_admin(mock_livekit_client):
-    """Admins and owners should be able to mute without a LiveKit token."""
+def test_mute_participant_success(mock_livekit_client):
+    """Test successful participant muting."""
     client = APIClient()
     room = RoomFactory()
     user = UserFactory()
@@ -44,12 +41,10 @@ def test_mute_participant_success_as_admin(mock_livekit_client):
     )
     client.force_authenticate(user=user)
 
+    payload = {"participant_identity": str(uuid4()), "track_sid": "test-track-sid"}
+
     url = reverse("rooms-mute-participant", kwargs={"pk": room.id})
-    response = client.post(
-        url,
-        {"participant_identity": str(uuid4()), "track_sid": "test-track-sid"},
-        format="json",
-    )
+    response = client.post(url, payload, format="json")
 
     assert response.status_code == status.HTTP_200_OK
     assert response.data == {"status": "success"}
@@ -58,131 +53,23 @@ def test_mute_participant_success_as_admin(mock_livekit_client):
     mock_livekit_client.aclose.assert_called_once()
 
 
-def test_mute_participant_anonymous_no_token_forbidden(mock_livekit_client):
-    """Should forbid muting when user is anonymous and no LiveKit token."""
+def test_mute_participant_forbidden_without_access():
+    """Test mute participant returns 403 when user lacks room privileges."""
     client = APIClient()
     room = RoomFactory()
-
-    url = reverse("rooms-mute-participant", kwargs={"pk": room.id})
-    response = client.post(
-        url,
-        {"participant_identity": str(uuid4()), "track_sid": "test-track-sid"},
-        format="json",
-    )
-
-    assert response.status_code == status.HTTP_403_FORBIDDEN
-    mock_livekit_client.room.mute_published_track.assert_not_called()
-
-
-def test_mute_participant_with_livekit_token_for_this_room(mock_livekit_client):
-    """Should allow muting when the LiveKit token is scoped to this room."""
-    client = APIClient()
-    room = RoomFactory()
-
-    user = AnonymousUser()
-    token = utils.generate_token(str(room.id), user, is_admin_or_owner=False)
-
-    url = reverse("rooms-mute-participant", kwargs={"pk": room.id})
-    response = client.post(
-        url,
-        {"participant_identity": str(uuid4()), "track_sid": "test-track-sid"},
-        format="json",
-        HTTP_AUTHORIZATION=f"Bearer {token}",
-    )
-
-    assert response.status_code == status.HTTP_200_OK
-    assert response.data == {"status": "success"}
-
-    mock_livekit_client.room.mute_published_track.assert_called_once()
-
-
-def test_mute_participant_with_livekit_token_for_another_room_forbidden(
-    mock_livekit_client,
-):
-    """Should forbid muting when the LiveKit token is scoped to a different room."""
-
-    client = APIClient()
-    target_room = RoomFactory()
-    other_room = RoomFactory()
-
-    user = AnonymousUser()
-    token = utils.generate_token(str(other_room.id), user, is_admin_or_owner=False)
-
-    url = reverse("rooms-mute-participant", kwargs={"pk": target_room.id})
-    response = client.post(
-        url,
-        {"participant_identity": str(uuid4()), "track_sid": "test-track-sid"},
-        format="json",
-        HTTP_AUTHORIZATION=f"Bearer {token}",
-    )
-
-    assert response.status_code == status.HTTP_403_FORBIDDEN
-    mock_livekit_client.room.mute_published_track.assert_not_called()
-
-
-def test_mute_participant_authenticated_no_role_no_token_forbidden(mock_livekit_client):
-    """Should forbid muting when user has no room role and no LiveKit token."""
-    client = APIClient()
-    room = RoomFactory()  # everyone_can_mute defaults to True
-    user = UserFactory()  # no UserResourceAccess for this room
+    user = UserFactory()  # User without UserResourceAccess
     client.force_authenticate(user=user)
 
+    payload = {"participant_identity": str(uuid4()), "track_sid": "test-track-sid"}
+
     url = reverse("rooms-mute-participant", kwargs={"pk": room.id})
-    response = client.post(
-        url,
-        {"participant_identity": str(uuid4()), "track_sid": "test-track-sid"},
-        format="json",
-    )
+    response = client.post(url, payload, format="json")
 
     assert response.status_code == status.HTTP_403_FORBIDDEN
-    mock_livekit_client.room.mute_published_track.assert_not_called()
-
-
-def test_mute_participant_everyone_can_mute_disabled_blocks_non_admin(
-    mock_livekit_client,
-):
-    """Should forbid muting when everyone_can_mute is False, even with a LiveKit token."""
-    client = APIClient()
-    room = RoomFactory(configuration={"everyone_can_mute": False})
-
-    user = AnonymousUser()
-    token = utils.generate_token(str(room.id), user, is_admin_or_owner=False)
-
-    url = reverse("rooms-mute-participant", kwargs={"pk": room.id})
-    response = client.post(
-        url,
-        {"participant_identity": str(uuid4()), "track_sid": "test-track-sid"},
-        format="json",
-        HTTP_AUTHORIZATION=f"Bearer {token}",
-    )
-
-    assert response.status_code == status.HTTP_403_FORBIDDEN
-    mock_livekit_client.room.mute_published_track.assert_not_called()
-
-
-def test_mute_participant_everyone_can_mute_disabled_allows_admin(mock_livekit_client):
-    """Should allow admins and owners to mute when everyone_can_mute is False."""
-    client = APIClient()
-    room = RoomFactory(configuration={"everyone_can_mute": False})
-    user = UserFactory()
-    UserResourceAccessFactory(
-        resource=room, user=user, role=random.choice(["administrator", "owner"])
-    )
-    client.force_authenticate(user=user)
-
-    url = reverse("rooms-mute-participant", kwargs={"pk": room.id})
-    response = client.post(
-        url,
-        {"participant_identity": str(uuid4()), "track_sid": "test-track-sid"},
-        format="json",
-    )
-
-    assert response.status_code == status.HTTP_200_OK
-    mock_livekit_client.room.mute_published_track.assert_called_once()
 
 
 def test_mute_participant_invalid_payload():
-    """Should reject muting when the payload is invalid."""
+    """Test mute participant with invalid payload."""
     client = APIClient()
     room = RoomFactory()
     user = UserFactory()
@@ -191,16 +78,16 @@ def test_mute_participant_invalid_payload():
     )
     client.force_authenticate(user=user)
 
+    payload = {"participant_identity": "invalid-uuid", "track_sid": ""}
+
     url = reverse("rooms-mute-participant", kwargs={"pk": room.id})
-    response = client.post(
-        url, {"participant_identity": "invalid-uuid", "track_sid": ""}, format="json"
-    )
+    response = client.post(url, payload, format="json")
 
     assert response.status_code == status.HTTP_400_BAD_REQUEST
 
 
 def test_mute_participant_unexpected_twirp_error(mock_livekit_client):
-    """Should return 500 when the LiveKit API raises a TwirpError."""
+    """Test mute participant when LiveKit API raises TwirpError."""
     client = APIClient()
 
     mock_livekit_client.room.mute_published_track.side_effect = TwirpError(
@@ -214,12 +101,10 @@ def test_mute_participant_unexpected_twirp_error(mock_livekit_client):
     )
     client.force_authenticate(user=user)
 
+    payload = {"participant_identity": str(uuid4()), "track_sid": "test-track-sid"}
+
     url = reverse("rooms-mute-participant", kwargs={"pk": room.id})
-    response = client.post(
-        url,
-        {"participant_identity": str(uuid4()), "track_sid": "test-track-sid"},
-        format="json",
-    )
+    response = client.post(url, payload, format="json")
 
     assert response.status_code == status.HTTP_500_INTERNAL_SERVER_ERROR
     assert response.data == {"error": "Failed to mute participant"}
@@ -227,282 +112,6 @@ def test_mute_participant_unexpected_twirp_error(mock_livekit_client):
     mock_livekit_client.aclose.assert_called_once()
 
 
-def test_mute_participant_participant_not_found(mock_livekit_client):
-    """Should return 404 when the participant does not exist in the room."""
-    client = APIClient()
-
-    mock_livekit_client.room.mute_published_track.side_effect = TwirpError(
-        msg="participant does not exist", code="not_found", status=404
-    )
-
-    room = RoomFactory()
-    user = UserFactory()
-    UserResourceAccessFactory(
-        resource=room, user=user, role=random.choice(["administrator", "owner"])
-    )
-    client.force_authenticate(user=user)
-
-    url = reverse("rooms-mute-participant", kwargs={"pk": room.id})
-    response = client.post(
-        url,
-        {"participant_identity": str(uuid4()), "track_sid": "test-track-sid"},
-        format="json",
-    )
-
-    assert response.status_code == status.HTTP_404_NOT_FOUND
-    assert response.data == {"error": "Participant not found"}
-
-    mock_livekit_client.aclose.assert_called_once()
-
-
-def test_mute_participant_management_exception(mock_livekit_client):
-    """Should return 500 when ParticipantsManagement raises an unexpected error."""
-    client = APIClient()
-
-    mock_livekit_client.room.mute_published_track.side_effect = TwirpError(
-        msg="boom", code="internal", status=503
-    )
-
-    room = RoomFactory()
-    user = UserFactory()
-    UserResourceAccessFactory(
-        resource=room, user=user, role=random.choice(["administrator", "owner"])
-    )
-    client.force_authenticate(user=user)
-
-    url = reverse("rooms-mute-participant", kwargs={"pk": room.id})
-    response = client.post(
-        url,
-        {"participant_identity": str(uuid4()), "track_sid": "test-track-sid"},
-        format="json",
-    )
-
-    assert response.status_code == status.HTTP_500_INTERNAL_SERVER_ERROR
-    assert response.data == {"error": "Failed to mute participant"}
-
-    mock_livekit_client.aclose.assert_called_once()
-
-
-def test_mute_participant_admin_with_token_for_this_room(mock_livekit_client):
-    """Should allow muting when user is admin and LiveKit token is scoped to this room."""
-    client = APIClient()
-    room = RoomFactory()
-    user = UserFactory()
-    UserResourceAccessFactory(
-        resource=room, user=user, role=random.choice(["administrator", "owner"])
-    )
-    # Token identity matches the admin user so LiveKitTokenAuthentication
-    # resolves request.user back to the admin.
-    token = utils.generate_token(str(room.id), user, is_admin_or_owner=True)
-
-    url = reverse("rooms-mute-participant", kwargs={"pk": room.id})
-    response = client.post(
-        url,
-        {"participant_identity": str(uuid4()), "track_sid": "test-track-sid"},
-        format="json",
-        HTTP_AUTHORIZATION=f"Bearer {token}",
-    )
-
-    assert response.status_code == status.HTTP_200_OK
-    assert response.data == {"status": "success"}
-
-    mock_livekit_client.room.mute_published_track.assert_called_once()
-
-
-def test_mute_participant_admin_with_token_for_another_room(mock_livekit_client):
-    """Should not allow muting when user is admin and the LiveKit token is for another room."""
-    client = APIClient()
-    target_room = RoomFactory()
-    other_room = RoomFactory()
-    user = UserFactory()
-    UserResourceAccessFactory(
-        resource=target_room,
-        user=user,
-        role=random.choice(["administrator", "owner"]),
-    )
-    # Token is scoped to a DIFFERENT room, and admin status must only be
-    # honored when established via session, never via a LiveKit
-    # token, which can be replayed off-host.
-    token = utils.generate_token(str(other_room.id), user, is_admin_or_owner=True)
-
-    url = reverse("rooms-mute-participant", kwargs={"pk": target_room.id})
-    response = client.post(
-        url,
-        {"participant_identity": str(uuid4()), "track_sid": "test-track-sid"},
-        format="json",
-        HTTP_AUTHORIZATION=f"Bearer {token}",
-    )
-
-    assert response.status_code == status.HTTP_403_FORBIDDEN
-    assert response.data == {
-        "detail": "You do not have permission to perform this action."
-    }
-
-    mock_livekit_client.room.mute_published_track.assert_not_called()
-
-
-def test_mute_participant_admin_token_replayed_does_not_grant_admin(
-    mock_livekit_client,
-):
-    """Should forbid muting when a LiveKit token issued for an admin is passed without a session."""
-    client = APIClient()
-    room = RoomFactory(configuration={"everyone_can_mute": False})
-    admin_user = UserFactory()
-    UserResourceAccessFactory(
-        resource=room,
-        user=admin_user,
-        role=random.choice(["administrator", "owner"]),
-    )
-    # The token is the only credential.
-    token = utils.generate_token(str(room.id), admin_user, is_admin_or_owner=True)
-
-    url = reverse("rooms-mute-participant", kwargs={"pk": room.id})
-    response = client.post(
-        url,
-        {"participant_identity": str(uuid4()), "track_sid": "test-track-sid"},
-        format="json",
-        HTTP_AUTHORIZATION=f"Bearer {token}",
-    )
-
-    assert response.status_code == status.HTTP_403_FORBIDDEN
-    mock_livekit_client.room.mute_published_track.assert_not_called()
-
-
-def test_mute_participant_livekit_token_triggers_presence_check(mock_livekit_client):
-    """Should check participant presence when authenticated via LiveKit token only."""
-    client = APIClient()
-    room = RoomFactory()
-
-    user = AnonymousUser()
-    token = utils.generate_token(str(room.id), user, is_admin_or_owner=False)
-
-    url = reverse("rooms-mute-participant", kwargs={"pk": room.id})
-    response = client.post(
-        url,
-        {"participant_identity": str(uuid4()), "track_sid": "test-track-sid"},
-        format="json",
-        HTTP_AUTHORIZATION=f"Bearer {token}",
-    )
-
-    assert response.status_code == status.HTTP_200_OK
-    # Presence is verified against LiveKit before the mute is issued.
-    mock_livekit_client.room.get_participant.assert_called_once()
-    mock_livekit_client.room.mute_published_track.assert_called_once()
-
-
-def test_mute_participant_livekit_token_presence_check_returns_participant(
-    mock_livekit_client,
-):
-    """Should mute when the authentified participant is currently in the room."""
-    client = APIClient()
-    room = RoomFactory()
-
-    # Simulate LiveKit confirming the caller is currently in the room.
-    # State != DISCONNECTED (3) means present.
-    mock_livekit_client.room.get_participant.return_value = ParticipantInfo(
-        identity="caller-identity",
-        state=ParticipantInfo.State.ACTIVE,
-    )
-
-    user = AnonymousUser()
-    token = utils.generate_token(str(room.id), user, is_admin_or_owner=False)
-
-    url = reverse("rooms-mute-participant", kwargs={"pk": room.id})
-    response = client.post(
-        url,
-        {"participant_identity": str(uuid4()), "track_sid": "test-track-sid"},
-        format="json",
-        HTTP_AUTHORIZATION=f"Bearer {token}",
-    )
-
-    assert response.status_code == status.HTTP_200_OK
-    assert response.data == {"status": "success"}
-    mock_livekit_client.room.get_participant.assert_called_once()
-    mock_livekit_client.room.mute_published_track.assert_called_once()
-
-
-def test_mute_participant_livekit_token_presence_check_participant_not_found(
-    mock_livekit_client,
-):
-    """Should not mute when the authentified participant is not found."""
-    client = APIClient()
-    room = RoomFactory()
-
-    mock_livekit_client.room.get_participant.side_effect = TwirpError(
-        msg="participant does not exist", code="not_found", status=404
-    )
-
-    user = AnonymousUser()
-    token = utils.generate_token(str(room.id), user, is_admin_or_owner=False)
-
-    url = reverse("rooms-mute-participant", kwargs={"pk": room.id})
-    response = client.post(
-        url,
-        {"participant_identity": str(uuid4()), "track_sid": "test-track-sid"},
-        format="json",
-        HTTP_AUTHORIZATION=f"Bearer {token}",
-    )
-
-    assert response.status_code == status.HTTP_403_FORBIDDEN
-    assert response.data == {"error": "Could not verify caller presence"}
-    mock_livekit_client.room.get_participant.assert_called_once()
-    # The presence check failed, so we never reach the mute call.
-    mock_livekit_client.room.mute_published_track.assert_not_called()
-
-
-def test_mute_participant_livekit_token_presence_check_twirp_error_forbidden(
-    mock_livekit_client,
-):
-    """Should not mute when the presence check fail."""
-    client = APIClient()
-    room = RoomFactory()
-
-    mock_livekit_client.room.get_participant.side_effect = TwirpError(
-        msg="an error occured", code="not_found", status=500
-    )
-
-    user = AnonymousUser()
-    token = utils.generate_token(str(room.id), user, is_admin_or_owner=False)
-
-    url = reverse("rooms-mute-participant", kwargs={"pk": room.id})
-    response = client.post(
-        url,
-        {"participant_identity": str(uuid4()), "track_sid": "test-track-sid"},
-        format="json",
-        HTTP_AUTHORIZATION=f"Bearer {token}",
-    )
-
-    assert response.status_code == status.HTTP_403_FORBIDDEN
-    assert response.data == {"error": "Could not verify caller presence"}
-    mock_livekit_client.room.get_participant.assert_called_once()
-    # The presence check failed, so we never reach the mute call.
-    mock_livekit_client.room.mute_published_track.assert_not_called()
-
-
-def test_mute_participant_session_auth_skips_presence_check(mock_livekit_client):
-    """Should not check presence of the participant when authentified with a session cookie."""
-    client = APIClient()
-    room = RoomFactory()
-    user = UserFactory()
-    UserResourceAccessFactory(
-        resource=room, user=user, role=random.choice(["administrator", "owner"])
-    )
-    client.force_authenticate(user=user)
-
-    url = reverse("rooms-mute-participant", kwargs={"pk": room.id})
-    response = client.post(
-        url,
-        {"participant_identity": str(uuid4()), "track_sid": "test-track-sid"},
-        format="json",
-    )
-
-    assert response.status_code == status.HTTP_200_OK
-    # Session auth has no LiveKit identity to verify against, so the
-    # stop-gap presence check is skipped.
-    mock_livekit_client.room.get_participant.assert_not_called()
-    mock_livekit_client.room.mute_published_track.assert_called_once()
-
-
 def test_update_participant_success(mock_livekit_client):
     """Test successful participant update."""
     client = APIClient()
@@ -521,8 +130,8 @@ def test_update_participant_success(mock_livekit_client):
             "can_publish": True,
             "can_publish_data": True,
             "can_publish_sources": [
-                "camera",
-                "microphone",
+                "CAMERA",
+                "MICROPHONE",
             ],
             "can_update_metadata": True,
             "can_subscribe_metrics": True,
@@ -549,8 +158,8 @@ def test_update_participant_success(mock_livekit_client):
         {"can_publish_data": True},
         {
             "can_publish_sources": [
-                "camera",
-                "microphone",
+                "CAMERA",
+                "MICROPHONE",
             ]
         },
         {"can_update_metadata": True},
@@ -581,41 +190,9 @@ def test_update_participant_permission_fields_are_optional(
     assert response.data == {"status": "success"}
 
     mock_livekit_client.room.update_participant.assert_called_once()
-
-    (request_arg,), _ = mock_livekit_client.room.update_participant.call_args
-    assert isinstance(request_arg, UpdateParticipantRequest)
-
     mock_livekit_client.aclose.assert_called_once()
 
 
-def test_update_participant_permission_fields_invalid_case(mock_livekit_client):
-    """Should raise bad request when can_publish_sources is uppercase."""
-    client = APIClient()
-    room = RoomFactory()
-    user = UserFactory()
-    UserResourceAccessFactory(
-        resource=room, user=user, role=random.choice(["administrator", "owner"])
-    )
-    client.force_authenticate(user=user)
-
-    payload = {
-        "participant_identity": str(uuid4()),
-        "permission": {
-            "can_publish_sources": [
-                "CAMERA",
-                "microphone",
-            ]
-        },
-    }
-
-    url = reverse("rooms-update-participant", kwargs={"pk": room.id})
-    response = client.post(url, payload, format="json")
-
-    assert response.status_code == status.HTTP_400_BAD_REQUEST
-    mock_livekit_client.room.update_participant.assert_not_called()
-    mock_livekit_client.aclose.assert_not_called()
-
-
 @pytest.mark.parametrize(
     "value,permission_key",
     [

src/backend/core/tests/rooms/test_api_rooms_promote_participant.py

@@ -1,612 +0,0 @@
-"""
-Test rooms API endpoints: promote participant.
-"""
-
-# pylint: disable=redefined-outer-name,unused-argument,protected-access
-
-import random
-from unittest import mock
-from uuid import uuid4
-
-import pytest
-from rest_framework import status
-from rest_framework.test import APIClient
-
-from core import models
-from core.factories import RoomFactory, UserFactory, UserResourceAccessFactory
-from core.services.participants_management import (
-    ParticipantNotFoundException,
-    ParticipantsManagementException,
-)
-
-pytestmark = pytest.mark.django_db
-
-
-# ---
-# success cases
-# ---
-
-
-@mock.patch("core.api.viewsets.ParticipantsManagement")
-def test_promote_participant_success_new_access(mock_participants_management_cls):
-    """Should create a new ResourceAccess with ADMIN role and update LiveKit."""
-    mock_instance = mock.MagicMock()
-    mock_participants_management_cls.return_value = mock_instance
-
-    room = RoomFactory()
-    admin_user = UserFactory()
-    UserResourceAccessFactory(
-        resource=room, user=admin_user, role=random.choice(["administrator", "owner"])
-    )
-    participant_user = UserFactory(sub=uuid4())
-
-    client = APIClient()
-    client.force_authenticate(user=admin_user)
-
-    response = client.post(
-        f"/api/v1.0/rooms/{room.id}/promote-participant/",
-        {"participant_identity": str(participant_user.sub)},
-        format="json",
-    )
-
-    assert response.status_code == status.HTTP_200_OK
-    assert response.data == {"status": "success"}
-
-    mock_instance.check_if_in_meeting.assert_called_once_with(
-        room.pk, identity=participant_user.sub
-    )
-
-    assert models.ResourceAccess.objects.filter(
-        resource=room,
-        user=participant_user,
-        role=models.RoleChoices.ADMIN,
-    ).exists()
-
-    mock_instance.update.assert_called_once_with(
-        room_name=str(room.pk),
-        identity=str(participant_user.sub),
-        attributes={"room_admin": "true"},
-    )
-
-
-@mock.patch("core.api.viewsets.ParticipantsManagement")
-def test_promote_participant_success_upgrades_member_to_admin(
-    mock_participants_management_cls,
-):
-    """Should upgrade an existing member to ADMIN role."""
-    mock_instance = mock.MagicMock()
-    mock_participants_management_cls.return_value = mock_instance
-
-    room = RoomFactory()
-    admin_user = UserFactory()
-    UserResourceAccessFactory(
-        resource=room, user=admin_user, role=random.choice(["administrator", "owner"])
-    )
-    participant_user = UserFactory(sub=uuid4())
-    UserResourceAccessFactory(resource=room, user=participant_user, role="member")
-
-    client = APIClient()
-    client.force_authenticate(user=admin_user)
-
-    response = client.post(
-        f"/api/v1.0/rooms/{room.id}/promote-participant/",
-        {"participant_identity": str(participant_user.sub)},
-        format="json",
-    )
-
-    assert response.status_code == status.HTTP_200_OK
-    assert response.data == {"status": "success"}
-
-    mock_instance.check_if_in_meeting.assert_called_once_with(
-        room.pk, identity=str(participant_user.sub)
-    )
-
-    access = models.ResourceAccess.objects.get(resource=room, user=participant_user)
-    assert access.role == models.RoleChoices.ADMIN
-
-
-@mock.patch("core.api.viewsets.ParticipantsManagement")
-def test_promote_participant_success_already_admin(mock_participants_management_cls):
-    """Should succeed idempotently when the participant is already an admin."""
-    mock_instance = mock.MagicMock()
-    mock_participants_management_cls.return_value = mock_instance
-
-    room = RoomFactory()
-    admin_user = UserFactory()
-    UserResourceAccessFactory(
-        resource=room, user=admin_user, role=random.choice(["administrator", "owner"])
-    )
-    participant_user = UserFactory(sub=uuid4())
-    UserResourceAccessFactory(
-        resource=room, user=participant_user, role="administrator"
-    )
-
-    client = APIClient()
-    client.force_authenticate(user=admin_user)
-
-    response = client.post(
-        f"/api/v1.0/rooms/{room.id}/promote-participant/",
-        {"participant_identity": str(participant_user.sub)},
-        format="json",
-    )
-
-    assert response.status_code == status.HTTP_200_OK
-    assert response.data == {"status": "success"}
-
-    mock_instance.check_if_in_meeting.assert_called_once_with(
-        room.pk, identity=str(participant_user.sub)
-    )
-
-    access = models.ResourceAccess.objects.get(resource=room, user=participant_user)
-    assert access.role == models.RoleChoices.ADMIN
-    mock_instance.update.assert_not_called()
-
-
-# ---
-# permission / auth
-# ---
-
-
-def test_promote_participant_forbidden_without_authentication():
-    """Should return 401 when the request is unauthenticated."""
-    room = RoomFactory()
-
-    response = APIClient().post(
-        f"/api/v1.0/rooms/{room.id}/promote-participant/",
-        {"participant_identity": str(uuid4())},
-        format="json",
-    )
-
-    assert response.status_code == status.HTTP_401_UNAUTHORIZED
-
-
-def test_promote_participant_forbidden_for_member():
-    """Should return 403 when the requester only has member-level access."""
-    room = RoomFactory()
-    member = UserFactory()
-    UserResourceAccessFactory(resource=room, user=member, role="member")
-
-    client = APIClient()
-    client.force_authenticate(user=member)
-
-    response = client.post(
-        f"/api/v1.0/rooms/{room.id}/promote-participant/",
-        {"participant_identity": str(uuid4())},
-        format="json",
-    )
-
-    assert response.status_code == status.HTTP_403_FORBIDDEN
-
-
-def test_promote_participant_forbidden_for_unrelated_user():
-    """Should return 403 when the requester has no access to the room."""
-    room = RoomFactory()
-    unrelated_user = UserFactory()
-
-    client = APIClient()
-    client.force_authenticate(user=unrelated_user)
-
-    response = client.post(
-        f"/api/v1.0/rooms/{room.id}/promote-participant/",
-        {"participant_identity": str(uuid4())},
-        format="json",
-    )
-
-    assert response.status_code == status.HTTP_403_FORBIDDEN
-
-
-def test_promote_participant_forbidden_for_admin_on_another_room():
-    """Should return 403 when the requester is admin on a different room, not the target one."""
-    target_room = RoomFactory()
-    other_room = RoomFactory()
-    admin_other_room = UserFactory()
-    UserResourceAccessFactory(
-        resource=other_room,
-        user=admin_other_room,
-        role=random.choice(["administrator", "owner"]),
-    )
-
-    client = APIClient()
-    client.force_authenticate(user=admin_other_room)
-
-    response = client.post(
-        f"/api/v1.0/rooms/{target_room.id}/promote-participant/",
-        {"participant_identity": str(uuid4())},
-        format="json",
-    )
-
-    assert response.status_code == status.HTTP_403_FORBIDDEN
-
-
-# ---
-# self-promotion
-# ---
-
-
-@mock.patch("core.api.viewsets.ParticipantsManagement")
-def test_promote_participant_forbidden_self_promotion(mock_participants_management_cls):
-    """Should return 403 when the requester attempts to promote themselves."""
-    mock_participants_management_cls.return_value = mock.MagicMock()
-
-    room = RoomFactory()
-    admin_user = UserFactory(sub=uuid4())
-    UserResourceAccessFactory(
-        resource=room, user=admin_user, role=random.choice(["administrator", "owner"])
-    )
-
-    client = APIClient()
-    client.force_authenticate(user=admin_user)
-
-    response = client.post(
-        f"/api/v1.0/rooms/{room.id}/promote-participant/",
-        {"participant_identity": str(admin_user.sub)},
-        format="json",
-    )
-
-    assert response.status_code == status.HTTP_403_FORBIDDEN
-    assert response.data == {"error": "You cannot promote yourself"}
-
-    mock_participants_management_cls.check_if_in_meeting.assert_not_called()
-
-
-# ---
-# presence check
-# ---
-
-
-@mock.patch("core.api.viewsets.ParticipantsManagement")
-def test_promote_participant_forbidden_when_participant_not_in_meeting(
-    mock_participants_management_cls,
-):
-    """Should return 403 when check_if_in_meeting returns False."""
-    mock_instance = mock.MagicMock()
-    mock_instance.check_if_in_meeting.return_value = False
-    mock_participants_management_cls.return_value = mock_instance
-
-    room = RoomFactory()
-    admin_user = UserFactory()
-    UserResourceAccessFactory(
-        resource=room, user=admin_user, role=random.choice(["administrator", "owner"])
-    )
-    participant_user = UserFactory(sub=uuid4())
-
-    client = APIClient()
-    client.force_authenticate(user=admin_user)
-
-    response = client.post(
-        f"/api/v1.0/rooms/{room.id}/promote-participant/",
-        {"participant_identity": str(participant_user.sub)},
-        format="json",
-    )
-
-    assert response.status_code == status.HTTP_403_FORBIDDEN
-    assert response.data == {"error": "Could not verify participant presence"}
-    mock_instance.update.assert_not_called()
-    assert not models.ResourceAccess.objects.filter(
-        resource=room, user=participant_user
-    ).exists()
-
-
-@mock.patch("core.api.viewsets.ParticipantsManagement")
-def test_promote_participant_forbidden_when_presence_check_fails(
-    mock_participants_management_cls,
-):
-    """Should return 403 when the participant is not found in the meeting."""
-    mock_instance = mock.MagicMock()
-    mock_instance.check_if_in_meeting.side_effect = ParticipantNotFoundException()
-    mock_participants_management_cls.return_value = mock_instance
-
-    room = RoomFactory()
-    admin_user = UserFactory()
-    UserResourceAccessFactory(
-        resource=room, user=admin_user, role=random.choice(["administrator", "owner"])
-    )
-    participant_user = UserFactory(sub=uuid4())
-
-    client = APIClient()
-    client.force_authenticate(user=admin_user)
-
-    response = client.post(
-        f"/api/v1.0/rooms/{room.id}/promote-participant/",
-        {"participant_identity": str(participant_user.sub)},
-        format="json",
-    )
-
-    assert response.status_code == status.HTTP_403_FORBIDDEN
-    assert response.data == {"error": "Could not verify participant presence"}
-    mock_instance.update.assert_not_called()
-    assert not models.ResourceAccess.objects.filter(
-        resource=room, user=participant_user
-    ).exists()
-
-
-@mock.patch("core.api.viewsets.ParticipantsManagement")
-def test_promote_participant_forbidden_when_presence_management_exception(
-    mock_participants_management_cls,
-):
-    """Should return 403 when the presence check raises a management exception."""
-    mock_instance = mock.MagicMock()
-    mock_instance.check_if_in_meeting.side_effect = ParticipantsManagementException()
-    mock_participants_management_cls.return_value = mock_instance
-
-    room = RoomFactory()
-    admin_user = UserFactory()
-    UserResourceAccessFactory(
-        resource=room, user=admin_user, role=random.choice(["administrator", "owner"])
-    )
-    participant_user = UserFactory(sub=uuid4())
-
-    client = APIClient()
-    client.force_authenticate(user=admin_user)
-
-    response = client.post(
-        f"/api/v1.0/rooms/{room.id}/promote-participant/",
-        {"participant_identity": str(participant_user.sub)},
-        format="json",
-    )
-
-    assert response.status_code == status.HTTP_403_FORBIDDEN
-    assert response.data == {"error": "Could not verify participant presence"}
-    mock_instance.update.assert_not_called()
-    assert not models.ResourceAccess.objects.filter(
-        resource=room, user=participant_user
-    ).exists()
-
-
-# ---
-# user resolution
-# ---
-
-
-@mock.patch("core.api.viewsets.ParticipantsManagement")
-def test_promote_participant_not_found_when_user_never_logged_in(
-    mock_participants_management_cls,
-):
-    """Should return 404 when the identity has no matching db user."""
-    mock_instance = mock.MagicMock()
-    mock_participants_management_cls.return_value = mock_instance
-
-    room = RoomFactory()
-    admin_user = UserFactory()
-    UserResourceAccessFactory(
-        resource=room, user=admin_user, role=random.choice(["administrator", "owner"])
-    )
-    unknown_sub = uuid4()
-
-    client = APIClient()
-    client.force_authenticate(user=admin_user)
-
-    response = client.post(
-        f"/api/v1.0/rooms/{room.id}/promote-participant/",
-        {"participant_identity": str(unknown_sub)},
-        format="json",
-    )
-
-    assert response.status_code == status.HTTP_404_NOT_FOUND
-    assert response.data == {"error": "Participant not found"}
-    mock_instance.update.assert_not_called()
-
-    assert models.ResourceAccess.objects.filter(resource=room).count() == 1
-    assert models.ResourceAccess.objects.filter(resource=room, user=admin_user).exists()
-
-
-# ---
-# inactive user
-# ---
-
-
-@mock.patch("core.api.viewsets.ParticipantsManagement")
-def test_promote_participant_forbidden_when_user_is_inactive(
-    mock_participants_management_cls,
-):
-    """Should return 403 when the target participant account is inactive."""
-    mock_instance = mock.MagicMock()
-    mock_participants_management_cls.return_value = mock_instance
-
-    room = RoomFactory()
-    admin_user = UserFactory()
-    UserResourceAccessFactory(
-        resource=room, user=admin_user, role=random.choice(["administrator", "owner"])
-    )
-    participant_user = UserFactory(sub=uuid4(), is_active=False)
-
-    client = APIClient()
-    client.force_authenticate(user=admin_user)
-
-    response = client.post(
-        f"/api/v1.0/rooms/{room.id}/promote-participant/",
-        {"participant_identity": str(participant_user.sub)},
-        format="json",
-    )
-
-    assert response.status_code == status.HTTP_403_FORBIDDEN
-    assert response.data == {
-        "error": "This participant account is inactive and cannot be promoted"
-    }
-    mock_instance.update.assert_not_called()
-    assert not models.ResourceAccess.objects.filter(
-        resource=room, user=participant_user
-    ).exists()
-
-
-# ---
-# owner protection
-# ---
-
-
-@mock.patch("core.api.viewsets.ParticipantsManagement")
-def test_promote_participant_forbidden_when_target_is_owner(
-    mock_participants_management_cls,
-):
-    """Should return 403 when trying to promote a participant who is already an owner."""
-    mock_instance = mock.MagicMock()
-    mock_participants_management_cls.return_value = mock_instance
-
-    room = RoomFactory()
-    admin_user = UserFactory()
-    UserResourceAccessFactory(
-        resource=room, user=admin_user, role=random.choice(["administrator", "owner"])
-    )
-    participant_user = UserFactory(sub=uuid4())
-    UserResourceAccessFactory(resource=room, user=participant_user, role="owner")
-
-    client = APIClient()
-    client.force_authenticate(user=admin_user)
-
-    response = client.post(
-        f"/api/v1.0/rooms/{room.id}/promote-participant/",
-        {"participant_identity": str(participant_user.sub)},
-        format="json",
-    )
-
-    assert response.status_code == status.HTTP_403_FORBIDDEN
-    assert response.data == {
-        "error": "Owners already have the highest privileges and cannot be promoted"
-    }
-    mock_instance.update.assert_not_called()
-
-    assert models.ResourceAccess.objects.filter(
-        resource=room,
-        user=participant_user,
-        role=models.RoleChoices.OWNER,
-    ).exists()
-
-
-# ---
-# LiveKit update failures
-# ---
-
-
-@mock.patch("core.api.viewsets.ParticipantsManagement")
-def test_promote_participant_partial_success_when_livekit_participant_missing(
-    mock_participants_management_cls,
-):
-    """Should return 200 with warning when participant left during the promotion.
-
-    The DB resource access is kept — they will have admin privileges on rejoin.
-    """
-    mock_instance = mock.MagicMock()
-    mock_instance.update.side_effect = ParticipantNotFoundException()
-    mock_participants_management_cls.return_value = mock_instance
-
-    room = RoomFactory()
-    admin_user = UserFactory()
-    UserResourceAccessFactory(
-        resource=room, user=admin_user, role=random.choice(["administrator", "owner"])
-    )
-    participant_user = UserFactory(sub=uuid4())
-
-    client = APIClient()
-    client.force_authenticate(user=admin_user)
-
-    response = client.post(
-        f"/api/v1.0/rooms/{room.id}/promote-participant/",
-        {"participant_identity": str(participant_user.sub)},
-        format="json",
-    )
-
-    assert response.status_code == status.HTTP_200_OK
-    assert response.data == {
-        "status": "success",
-        "warning": "LiveKit update failed; role update persisted",
-    }
-
-    assert models.ResourceAccess.objects.filter(
-        resource=room,
-        user=participant_user,
-        role=models.RoleChoices.ADMIN,
-    ).exists()
-
-
-@mock.patch("core.api.viewsets.ParticipantsManagement")
-def test_promote_participant_partial_success_on_livekit_management_exception(
-    mock_participants_management_cls,
-):
-    """Should return 200 with warning when LiveKit update fails but DB transaction succeeded."""
-    mock_instance = mock.MagicMock()
-    mock_instance.update.side_effect = ParticipantsManagementException()
-    mock_participants_management_cls.return_value = mock_instance
-
-    room = RoomFactory()
-    admin_user = UserFactory()
-    UserResourceAccessFactory(
-        resource=room, user=admin_user, role=random.choice(["administrator", "owner"])
-    )
-    participant_user = UserFactory(sub=uuid4())
-
-    client = APIClient()
-    client.force_authenticate(user=admin_user)
-
-    response = client.post(
-        f"/api/v1.0/rooms/{room.id}/promote-participant/",
-        {"participant_identity": str(participant_user.sub)},
-        format="json",
-    )
-
-    assert response.status_code == status.HTTP_200_OK
-    assert response.data == {
-        "status": "success",
-        "warning": "LiveKit update failed; role update persisted",
-    }
-
-    assert models.ResourceAccess.objects.filter(
-        resource=room,
-        user=participant_user,
-        role=models.RoleChoices.ADMIN,
-    ).exists()
-
-
-# ---
-# payload validation
-# ---
-
-
-@pytest.mark.parametrize(
-    "payload",
-    [
-        {"participant_identity": "not-a-uuid"},
-        {"participant_identity": ""},
-        {"participant_identity": "   "},
-        {"participant_identity": None},
-        {},
-    ],
-)
-def test_promote_participant_invalid_payload(payload):
-    """Should return 400 for invalid, empty, whitespace, null, or missing participant_identity."""
-    room = RoomFactory()
-    admin_user = UserFactory()
-    UserResourceAccessFactory(
-        resource=room, user=admin_user, role=random.choice(["administrator", "owner"])
-    )
-
-    client = APIClient()
-    client.force_authenticate(user=admin_user)
-
-    response = client.post(
-        f"/api/v1.0/rooms/{room.id}/promote-participant/",
-        payload,
-        format="json",
-    )
-
-    assert response.status_code == status.HTTP_400_BAD_REQUEST
-
-
-# ---
-# room not found
-# ---
-
-
-def test_promote_participant_room_not_found():
-    """Should return 404 when the room does not exist."""
-    user = UserFactory()
-
-    client = APIClient()
-    client.force_authenticate(user=user)
-
-    response = client.post(
-        f"/api/v1.0/rooms/{uuid4()}/promote-participant/",
-        {"participant_identity": str(uuid4())},
-        format="json",
-    )
-
-    assert response.status_code == status.HTTP_404_NOT_FOUND

src/backend/core/tests/rooms/test_api_rooms_retrieve.py

@@ -28,7 +28,6 @@ def test_api_rooms_retrieve_anonymous_private_pk():
 
     assert response.status_code == 200
     assert response.json() == {
-        "configuration": {},
         "access_level": "restricted",
         "id": str(room.id),
         "is_administrable": False,
@@ -48,7 +47,6 @@ def test_api_rooms_retrieve_anonymous_trusted_pk():
 
     assert response.status_code == 200
     assert response.json() == {
-        "configuration": {},
         "access_level": "trusted",
         "id": str(room.id),
         "is_administrable": False,
@@ -67,7 +65,6 @@ def test_api_rooms_retrieve_anonymous_private_pk_no_dashes():
 
     assert response.status_code == 200
     assert response.json() == {
-        "configuration": {},
         "access_level": "restricted",
         "id": str(room.id),
         "is_administrable": False,
@@ -84,7 +81,6 @@ def test_api_rooms_retrieve_anonymous_private_slug():
 
     assert response.status_code == 200
     assert response.json() == {
-        "configuration": {},
         "access_level": "restricted",
         "id": str(room.id),
         "is_administrable": False,
@@ -101,7 +97,6 @@ def test_api_rooms_retrieve_anonymous_private_slug_not_normalized():
 
     assert response.status_code == 200
     assert response.json() == {
-        "configuration": {},
         "access_level": "restricted",
         "id": str(room.id),
         "is_administrable": False,
@@ -205,7 +200,6 @@ def test_api_rooms_retrieve_anonymous_public(mock_token):
     assert response.status_code == 200
     expected_name = f"{room.id!s}"
     assert response.json() == {
-        "configuration": {},
         "access_level": str(room.access_level),
         "id": str(room.id),
         "is_administrable": False,
@@ -252,7 +246,6 @@ def test_api_rooms_retrieve_authenticated_public(mock_token):
 
     expected_name = f"{room.id!s}"
     assert response.json() == {
-        "configuration": {"can_publish_sources": ["camera"]},
         "access_level": str(room.access_level),
         "id": str(room.id),
         "is_administrable": False,
@@ -304,7 +297,6 @@ def test_api_rooms_retrieve_authenticated_trusted(mock_token):
 
     expected_name = f"{room.id!s}"
     assert response.json() == {
-        "configuration": {},
         "access_level": str(room.access_level),
         "id": str(room.id),
         "is_administrable": False,
@@ -346,7 +338,6 @@ def test_api_rooms_retrieve_authenticated():
     assert response.status_code == 200
 
     assert response.json() == {
-        "configuration": {},
         "access_level": "restricted",
         "id": str(room.id),
         "is_administrable": False,
@@ -392,7 +383,6 @@ def test_api_rooms_retrieve_members(mock_token, django_assert_num_queries, setti
 
     expected_name = str(room.id)
     assert content_dict == {
-        "configuration": {"can_publish_sources": ["camera"]},
         "access_level": str(room.access_level),
         "id": str(room.id),
         "is_administrable": False,

src/backend/core/tests/rooms/test_api_rooms_update.py

@@ -3,18 +3,12 @@ Test rooms API endpoints in the Meet core app: update.
 """
 
 import random
-from unittest.mock import patch
 
 import pytest
 from rest_framework.test import APIClient
 
 from ...factories import RoomFactory, UserFactory
 from ...models import RoomAccessLevel
-from ...services.room_management import (
-    RoomManagement,
-    RoomManagementException,
-    RoomNotFoundException,
-)
 
 pytestmark = pytest.mark.django_db
 
@@ -85,14 +79,12 @@ def test_api_rooms_update_members():
     assert room.configuration == {}
 
 
-@patch.object(RoomManagement, "update_metadata")
-def test_api_rooms_update_administrators(mock_update_metadata):
-    """Should sync LiveKit metadata when both configuration and access level change."""
+def test_api_rooms_update_administrators():
+    """Administrators or owners of a room should be allowed to update it."""
     user = UserFactory()
     room = RoomFactory(
         access_level=RoomAccessLevel.RESTRICTED,
         users=[(user, random.choice(["administrator", "owner"]))],
-        configuration={"can_publish_sources": ["camera"]},
     )
     client = APIClient()
     client.force_login(user)
@@ -114,120 +106,11 @@ def test_api_rooms_update_administrators(mock_update_metadata):
     assert room.access_level == RoomAccessLevel.PUBLIC
     assert room.configuration == {"can_publish_sources": ["camera", "microphone"]}
 
-    mock_update_metadata.assert_called_once_with(
-        room_name=str(room.id),
-        metadata={
-            "access_level": "public",
-            "configuration": {"can_publish_sources": ["camera", "microphone"]},
-        },
-    )
-
-
-@patch.object(RoomManagement, "update_metadata")
-def test_api_rooms_update_administrators_configuration_only(mock_update_metadata):
-    """Should sync LiveKit metadata when only configuration changes."""
-    user = UserFactory()
-    room = RoomFactory(
-        access_level=RoomAccessLevel.RESTRICTED,
-        users=[(user, random.choice(["administrator", "owner"]))],
-        configuration={},
-    )
-    client = APIClient()
-    client.force_login(user)
-
-    response = client.put(
-        f"/api/v1.0/rooms/{room.id!s}/",
-        {
-            "name": "New name",
-            "slug": "should-be-ignored",
-            "configuration": {"can_publish_sources": ["camera", "microphone"]},
-        },
-        format="json",
-    )
-    assert response.status_code == 200
-    room.refresh_from_db()
-    assert room.name == "New name"
-    assert room.slug == "new-name"
-    assert room.access_level == RoomAccessLevel.RESTRICTED
-    assert room.configuration == {"can_publish_sources": ["camera", "microphone"]}
-
-    mock_update_metadata.assert_called_once_with(
-        room_name=str(room.id),
-        metadata={
-            "access_level": "restricted",
-            "configuration": {"can_publish_sources": ["camera", "microphone"]},
-        },
-    )
-
-
-@patch.object(RoomManagement, "update_metadata")
-def test_api_rooms_update_administrators_access_level_only(mock_update_metadata):
-    """Should sync LiveKit metadata when only access level changes."""
-    user = UserFactory()
-    room = RoomFactory(
-        access_level=RoomAccessLevel.RESTRICTED,
-        users=[(user, random.choice(["administrator", "owner"]))],
-        configuration={"can_publish_sources": ["camera"]},
-    )
-    client = APIClient()
-    client.force_login(user)
-
-    response = client.put(
-        f"/api/v1.0/rooms/{room.id!s}/",
-        {
-            "name": "New name",
-            "access_level": RoomAccessLevel.PUBLIC,
-        },
-        format="json",
-    )
-    assert response.status_code == 200
-    room.refresh_from_db()
-    assert room.name == "New name"
-    assert room.slug == "new-name"
-    assert room.access_level == RoomAccessLevel.PUBLIC
-    assert room.configuration == {"can_publish_sources": ["camera"]}
-
-    mock_update_metadata.assert_called_once_with(
-        room_name=str(room.id),
-        metadata={
-            "access_level": "public",
-            "configuration": {"can_publish_sources": ["camera"]},
-        },
-    )
-
-
-@patch.object(RoomManagement, "update_metadata")
-def test_api_rooms_update_administrators_name_only(mock_update_metadata):
-    """Should not sync LiveKit metadata when neither configuration nor access level changes."""
-    user = UserFactory()
-    room = RoomFactory(
-        name="Old name",
-        access_level=RoomAccessLevel.PUBLIC,
-        configuration={"can_publish_sources": ["camera"]},
-        users=[(user, random.choice(["administrator", "owner"]))],
-    )
-    client = APIClient()
-    client.force_login(user)
-
-    response = client.patch(
-        f"/api/v1.0/rooms/{room.id!s}/",
-        {"name": "New name"},
-        format="json",
-    )
-    assert response.status_code == 200
-    room.refresh_from_db()
-    assert room.name == "New name"
-    assert room.slug == "new-name"
-    # Unrelated fields untouched
-    assert room.access_level == RoomAccessLevel.PUBLIC
-    assert room.configuration == {"can_publish_sources": ["camera"]}
-
-    mock_update_metadata.assert_not_called()
-
 
 @pytest.mark.parametrize(
     "configuration",
     [
+        {},
         {"can_publish_sources": ["camera", "microphone"]},
         {
             "can_publish_sources": [
@@ -239,17 +122,12 @@ def test_api_rooms_update_administrators_name_only(mock_update_metadata):
         },
         {"can_publish_sources": []},
         {"can_publish_sources": None},
-        {"can_publish_sources": None, "everyone_can_mute": True},
-        {"can_publish_sources": None, "everyone_can_mute": False},
-        {"can_publish_sources": None, "everyone_can_mute": "yes"},
-        {"can_publish_sources": None, "everyone_can_mute": "1"},
     ],
 )
-@patch.object(RoomManagement, "update_metadata")
-def test_api_rooms_update_configuration_valid(mock_update_metadata, configuration):
+def test_api_rooms_update_configuration_valid(configuration):
     """Administrators should be allowed to set valid configurations."""
     user = UserFactory()
-    room = RoomFactory(users=[(user, "owner")], configuration={})
+    room = RoomFactory(users=[(user, "owner")])
     client = APIClient()
     client.force_login(user)
 
@@ -262,28 +140,6 @@ def test_api_rooms_update_configuration_valid(mock_update_metadata, configuratio
     room.refresh_from_db()
     assert room.configuration == configuration
 
-    mock_update_metadata.assert_called_once()
-
-
-@patch.object(RoomManagement, "update_metadata")
-def test_api_rooms_update_configuration_unchanged_empty(mock_update_metadata):
-    """Should not sync LiveKit metadata when patching an already empty configuration."""
-    user = UserFactory()
-    room = RoomFactory(users=[(user, "owner")], configuration={})
-    client = APIClient()
-    client.force_login(user)
-
-    response = client.patch(
-        f"/api/v1.0/rooms/{room.id!s}/",
-        {"configuration": {}},
-        format="json",
-    )
-    assert response.status_code == 200
-    room.refresh_from_db()
-    assert room.configuration == {}
-
-    mock_update_metadata.assert_not_called()
-
 
 def test_api_rooms_update_configuration_extra_keys_rejected():
     """Extra keys in configuration should be rejected."""
@@ -342,24 +198,6 @@ def test_api_rooms_update_configuration_wrong_type():
     assert room.configuration == {}
 
 
-@pytest.mark.parametrize("invalid_value", ["test", [], {}])
-def test_api_rooms_update_configuration_everyone_can_mute_wrong_type(invalid_value):
-    """everyone_can_mute values with wrong types should be rejected."""
-    user = UserFactory()
-    room = RoomFactory(users=[(user, "owner")])
-    client = APIClient()
-    client.force_login(user)
-
-    response = client.patch(
-        f"/api/v1.0/rooms/{room.id!s}/",
-        {"configuration": {"everyone_can_mute": invalid_value}},
-        format="json",
-    )
-    assert response.status_code == 400
-    room.refresh_from_db()
-    assert room.configuration == {}
-
-
 def test_api_rooms_update_administrators_of_another():
     """
     Being administrator or owner of a room should not grant authorization to update
@@ -379,61 +217,3 @@ def test_api_rooms_update_administrators_of_another():
     other_room.refresh_from_db()
     assert other_room.name == "Old name"
     assert other_room.slug == "old-name"
-
-
-@patch.object(RoomManagement, "update_metadata", side_effect=RoomNotFoundException)
-def test_api_rooms_update_livekit_room_not_found(mock_update_metadata):
-    """Should not fail the API request when the LiveKit room does not exist yet."""
-    user = UserFactory()
-    room = RoomFactory(
-        users=[(user, random.choice(["administrator", "owner"]))],
-        configuration={},
-    )
-    client = APIClient()
-    client.force_login(user)
-
-    response = client.patch(
-        f"/api/v1.0/rooms/{room.id!s}/",
-        {"configuration": {"can_publish_sources": ["camera"]}},
-        format="json",
-    )
-    assert response.status_code == 200
-    room.refresh_from_db()
-    assert room.configuration == {"can_publish_sources": ["camera"]}
-
-    mock_update_metadata.assert_called_once_with(
-        room_name=str(room.id),
-        metadata={
-            "access_level": room.access_level,
-            "configuration": {"can_publish_sources": ["camera"]},
-        },
-    )
-
-
-@patch.object(RoomManagement, "update_metadata", side_effect=RoomManagementException)
-def test_api_rooms_update_livekit_sync_failure(mock_update_metadata):
-    """Should not fail the API request when the LiveKit metadata sync fails."""
-    user = UserFactory()
-    room = RoomFactory(
-        users=[(user, random.choice(["administrator", "owner"]))],
-        configuration={},
-    )
-    client = APIClient()
-    client.force_login(user)
-
-    response = client.patch(
-        f"/api/v1.0/rooms/{room.id!s}/",
-        {"configuration": {"can_publish_sources": ["camera"]}},
-        format="json",
-    )
-    assert response.status_code == 200
-    room.refresh_from_db()
-    assert room.configuration == {"can_publish_sources": ["camera"]}
-
-    mock_update_metadata.assert_called_once_with(
-        room_name=str(room.id),
-        metadata={
-            "access_level": room.access_level,
-            "configuration": {"can_publish_sources": ["camera"]},
-        },
-    )

src/backend/core/tests/swagger/test_openapi_schema.py

@@ -4,7 +4,6 @@ Test suite for generated openapi schema.
 
 import json
 from io import StringIO
-from unittest.mock import patch
 
 from django.core.management import call_command
 from django.test import Client
@@ -34,26 +33,10 @@ def test_openapi_client_schema():
     )
     assert output.getvalue() == ""
 
-    response = Client().get("/api/v1.0/swagger.json")
+    response = Client().get("/v1.0/swagger.json")
 
     assert response.status_code == 200
     with open(
         "core/tests/swagger/swagger.json", "r", encoding="utf-8"
     ) as expected_schema:
         assert response.json() == json.load(expected_schema)
-
-
-@patch(
-    "django.contrib.staticfiles.storage.staticfiles_storage.url",
-    side_effect=lambda name: f"/static/{name}",
-)
-# pylint: disable=unused-argument
-def test_openapi_documentation_routes(mock_staticfiles):
-    """Swagger and ReDoc documentation should be served on canonical URLs."""
-    client = Client()
-
-    swagger_response = client.get("/api/v1.0/swagger/")
-    redoc_response = client.get("/api/v1.0/redoc/")
-
-    assert swagger_response.status_code == 200
-    assert redoc_response.status_code == 200

src/backend/core/tests/test_external_api_rooms.py

@@ -250,112 +250,6 @@ def test_api_rooms_list_filters_by_user():
     assert str(room2.id) not in returned_ids
 
 
-def test_api_rooms_list_access_level_in_results():
-    """Rooms should include the correct access_level for each room."""
-    user = UserFactory()
-    room_trusted = RoomFactory(
-        users=[(user, RoleChoices.OWNER)], access_level=RoomAccessLevel.TRUSTED
-    )
-    room_restricted = RoomFactory(
-        users=[(user, RoleChoices.OWNER)], access_level=RoomAccessLevel.RESTRICTED
-    )
-
-    token = generate_test_token(user, [ApplicationScope.ROOMS_LIST])
-
-    client = APIClient()
-    client.credentials(HTTP_AUTHORIZATION=f"Bearer {token}")
-    response = client.get("/external-api/v1.0/rooms/")
-
-    assert response.status_code == 200
-    results = {r["id"]: r for r in response.data["results"]}
-    assert results[str(room_trusted.id)]["access_level"] == RoomAccessLevel.TRUSTED
-    assert (
-        results[str(room_restricted.id)]["access_level"] == RoomAccessLevel.RESTRICTED
-    )
-
-
-def test_api_rooms_list_does_not_expose_sensitive_fields():
-    """Rooms should not expose pin_code or accesses."""
-    user = UserFactory()
-    RoomFactory(users=[(user, RoleChoices.OWNER)])
-
-    token = generate_test_token(user, [ApplicationScope.ROOMS_LIST])
-
-    client = APIClient()
-    client.credentials(HTTP_AUTHORIZATION=f"Bearer {token}")
-    response = client.get("/external-api/v1.0/rooms/")
-
-    assert response.status_code == 200
-    result = response.data["results"][0]
-    assert "pin_code" not in result
-    assert "accesses" not in result
-    assert "livekit" not in result
-
-
-def test_api_rooms_list_expected_fields(settings):
-    """Rooms should expose exactly the expected fields."""
-
-    settings.APPLICATION_BASE_URL = "https://example.com"
-    settings.ROOM_TELEPHONY_ENABLED = True
-
-    user = UserFactory()
-    RoomFactory(users=[(user, RoleChoices.OWNER)])
-
-    token = generate_test_token(user, [ApplicationScope.ROOMS_LIST])
-
-    client = APIClient()
-    client.credentials(HTTP_AUTHORIZATION=f"Bearer {token}")
-    response = client.get("/external-api/v1.0/rooms/")
-
-    assert response.status_code == 200
-    assert set(response.data["results"][0].keys()) == {
-        "id",
-        "name",
-        "slug",
-        "access_level",
-        "configuration",
-        "telephony",
-        "url",
-    }
-
-
-def test_api_rooms_list_expected_fields_without_telephony(settings):
-    """Rooms shouldn't expose telephony related fields when disabled."""
-
-    settings.APPLICATION_BASE_URL = "https://example.com"
-    settings.ROOM_TELEPHONY_ENABLED = False
-
-    user = UserFactory()
-    RoomFactory(users=[(user, RoleChoices.OWNER)])
-
-    token = generate_test_token(user, [ApplicationScope.ROOMS_LIST])
-
-    client = APIClient()
-    client.credentials(HTTP_AUTHORIZATION=f"Bearer {token}")
-    response = client.get("/external-api/v1.0/rooms/")
-
-    assert response.status_code == 200
-    assert "telephony" not in set(response.data["results"][0].keys())
-
-
-def test_api_rooms_list_expected_fields_missing_base_url(settings):
-    """Rooms shouldn't expose URL field when the application base url is missing."""
-
-    settings.APPLICATION_BASE_URL = None
-
-    user = UserFactory()
-    RoomFactory(users=[(user, RoleChoices.OWNER)])
-
-    token = generate_test_token(user, [ApplicationScope.ROOMS_LIST])
-
-    client = APIClient()
-    client.credentials(HTTP_AUTHORIZATION=f"Bearer {token}")
-    response = client.get("/external-api/v1.0/rooms/")
-
-    assert response.status_code == 200
-    assert "url" not in set(response.data["results"][0].keys())
-
-
 def test_api_rooms_retrieve_requires_authentication():
     """Retrieving rooms without authentication should return 401."""
 
@@ -489,7 +383,6 @@ def test_api_rooms_retrieve_success(settings):
         "name": room.name,
         "slug": room.slug,
         "access_level": str(room.access_level),
-        "configuration": room.configuration,
         "url": f"http://your-application.com/{room.slug}",
         "telephony": {
             "enabled": True,
@@ -672,40 +565,11 @@ def test_api_rooms_create_success():
     assert "slug" in response.data
     assert "name" in response.data
     assert response.data["name"] == response.data["slug"]
-    assert response.data["configuration"] == {}
 
     # Verify room was created with user as owner
     room = Room.objects.get(id=response.data["id"])
     assert room.get_role(user) == RoleChoices.OWNER
     assert room.access_level == "trusted"
-    assert room.configuration == {}
-
-
-def test_api_rooms_create_with_configuration_success():
-    """Creating a room with a validated configuration should succeed."""
-
-    user = UserFactory()
-
-    token = generate_test_token(
-        user, [ApplicationScope.ROOMS_CREATE, ApplicationScope.ROOMS_LIST]
-    )
-
-    client = APIClient()
-    client.credentials(HTTP_AUTHORIZATION=f"Bearer {token}")
-    response = client.post(
-        "/external-api/v1.0/rooms/",
-        {
-            "access_level": RoomAccessLevel.RESTRICTED,
-            "configuration": {"can_publish_sources": ["camera"]},
-        },
-        format="json",
-    )
-
-    assert response.status_code == 201
-    room = Room.objects.get(id=response.data["id"])
-    assert room.access_level == RoomAccessLevel.RESTRICTED
-    assert room.configuration == {"can_publish_sources": ["camera"]}
-    assert response.data["configuration"] == {"can_publish_sources": ["camera"]}
 
 
 def test_api_rooms_create_readonly_enforcement():
@@ -723,6 +587,7 @@ def test_api_rooms_create_readonly_enforcement():
             "id": "fake-id",
             "slug": "fake-slug",
             "name": "fake-name",
+            "access_level": "public",
         },
         format="json",
     )
@@ -734,150 +599,41 @@ def test_api_rooms_create_readonly_enforcement():
     assert response.data["slug"] != "fake-slug"
     assert "id" in response.data
     assert response.data["name"] != "fake-name"
-    assert response.data["configuration"] == {}
 
     # Verify room was created with user as owner
     room = Room.objects.get(id=response.data["id"])
     assert room.get_role(user) == RoleChoices.OWNER
     assert room.access_level == "trusted"
-    assert room.configuration == {}
 
 
-def test_api_rooms_create_rejects_invalid_configuration():
-    """Creating a room with unsupported configuration keys should fail."""
+def test_api_rooms_unknown_actions():
+    """Updating or deleting a room are not supported yet."""
 
     user = UserFactory()
-    token = generate_test_token(user, [ApplicationScope.ROOMS_CREATE])
+    room = RoomFactory(users=[(user, RoleChoices.OWNER)])
+
+    token = generate_test_token(
+        user,
+        [
+            ApplicationScope.ROOMS_RETRIEVE,
+            ApplicationScope.ROOMS_DELETE,
+            ApplicationScope.ROOMS_UPDATE,
+        ],
+    )
 
     client = APIClient()
     client.credentials(HTTP_AUTHORIZATION=f"Bearer {token}")
-    response = client.post(
-        "/external-api/v1.0/rooms/",
-        {
-            "configuration": {
-                "unsupported_flag": True,
-            }
-        },
-        format="json",
-    )
+    response = client.delete(f"/external-api/v1.0/rooms/{room.id}/")
 
-    assert response.status_code == 400
-    assert "extra inputs are not permitted" in str(response.data).lower()
-
-
-@pytest.mark.parametrize(
-    "invalid_configuration",
-    [
-        {"can_publish_sources": ["invalid-source"]},
-        {"everyone_can_mute": "invalid-value"},
-    ],
-)
-def test_api_rooms_create_rejects_invalid_configuration_values(invalid_configuration):
-    """Creating a room with invalid configuration values should fail."""
-
-    user = UserFactory()
-    token = generate_test_token(user, [ApplicationScope.ROOMS_CREATE])
+    assert response.status_code == 405
+    assert 'method "delete" not allowed.' in str(response.data).lower()
 
     client = APIClient()
     client.credentials(HTTP_AUTHORIZATION=f"Bearer {token}")
-    response = client.post(
-        "/external-api/v1.0/rooms/",
-        {"configuration": invalid_configuration},
-        format="json",
-    )
+    response = client.patch(f"/external-api/v1.0/rooms/{room.id}/")
 
-    assert response.status_code == 400
-
-
-def test_api_rooms_create_public_access_disabled_by_default():
-    """Public rooms should be disabled for the external API by default."""
-
-    user = UserFactory()
-    token = generate_test_token(user, [ApplicationScope.ROOMS_CREATE])
-
-    client = APIClient()
-    client.credentials(HTTP_AUTHORIZATION=f"Bearer {token}")
-    response = client.post(
-        "/external-api/v1.0/rooms/",
-        {"access_level": RoomAccessLevel.PUBLIC},
-        format="json",
-    )
-
-    assert response.status_code == 400
-    assert "public rooms are disabled" in str(response.data).lower()
-
-
-def test_api_rooms_create_public_access_enabled_with_settings(settings):
-    """Public rooms should be creatable when explicitly enabled."""
-
-    settings.EXTERNAL_API_ALLOW_PUBLIC_ACCESS = True
-
-    user = UserFactory()
-    token = generate_test_token(user, [ApplicationScope.ROOMS_CREATE])
-
-    client = APIClient()
-    client.credentials(HTTP_AUTHORIZATION=f"Bearer {token}")
-    response = client.post(
-        "/external-api/v1.0/rooms/",
-        {"access_level": RoomAccessLevel.PUBLIC},
-        format="json",
-    )
-
-    assert response.status_code == 201
-    room = Room.objects.get(id=response.data["id"])
-    assert room.access_level == RoomAccessLevel.PUBLIC
-    assert response.data["access_level"] == RoomAccessLevel.PUBLIC
-
-
-def test_api_rooms_create_default_access_level_respects_settings(settings):
-    """Room creation should reflect the EXTERNAL_API_DEFAULT_ACCESS_LEVEL setting."""
-
-    user = UserFactory()
-    token = generate_test_token(user, [ApplicationScope.ROOMS_CREATE])
-
-    client = APIClient()
-    client.credentials(HTTP_AUTHORIZATION=f"Bearer {token}")
-    response = client.post(
-        "/external-api/v1.0/rooms/",
-        format="json",
-    )
-    assert response.status_code == 201
-    assert response.data["access_level"] == RoomAccessLevel.TRUSTED
-
-    settings.EXTERNAL_API_DEFAULT_ACCESS_LEVEL = "public"
-
-    response = client.post(
-        "/external-api/v1.0/rooms/",
-        format="json",
-    )
-    assert response.status_code == 201
-    assert response.data["access_level"] == RoomAccessLevel.PUBLIC
-
-
-def test_api_rooms_create_public_access_level_when_default_is_public(settings):
-    """Explicit public access_level is accepted when the default is already public."""
-    settings.EXTERNAL_API_ALLOW_PUBLIC_ACCESS = False
-    settings.EXTERNAL_API_DEFAULT_ACCESS_LEVEL = "public"
-
-    user = UserFactory()
-    token = generate_test_token(user, [ApplicationScope.ROOMS_CREATE])
-
-    client = APIClient()
-    client.credentials(HTTP_AUTHORIZATION=f"Bearer {token}")
-
-    # No access_level in body — default kicks in, public room is created.
-    response = client.post("/external-api/v1.0/rooms/", {}, format="json")
-    assert response.status_code == 201
-    assert response.data["access_level"] == RoomAccessLevel.PUBLIC
-
-    # Explicit access_level=public in body — still rejected.
-    response = client.post(
-        "/external-api/v1.0/rooms/",
-        {"access_level": RoomAccessLevel.PUBLIC},
-        format="json",
-    )
-    assert response.status_code == 201
-    assert response.data["access_level"] == RoomAccessLevel.PUBLIC
+    assert response.status_code == 405
+    assert 'method "patch" not allowed.' in str(response.data).lower()
 
 
 def test_api_rooms_response_no_url(settings):

src/backend/core/tests/test_utils_build_telephony_config.py

@@ -1,58 +0,0 @@
-"""
-Test utils.build_telephony_config
-"""
-
-import logging
-
-from core.utils import build_telephony_config
-
-
-def test_build_telephony_config_disabled(settings):
-    """Returns {"enabled": False} when telephony is disabled."""
-    settings.ROOM_TELEPHONY_ENABLED = False
-    config = build_telephony_config()
-    assert config == {"enabled": False}
-
-
-def test_build_telephony_config_enabled_with_valid_number(settings):
-    """Returns full config with country and international number when telephony is enabled."""
-    settings.ROOM_TELEPHONY_ENABLED = True
-    settings.ROOM_TELEPHONY_PHONE_NUMBER = "0123456789"
-    settings.ROOM_TELEPHONY_DEFAULT_COUNTRY = "FR"
-    config = build_telephony_config()
-    assert config == {
-        "enabled": True,
-        "default_country": "FR",
-        "international_phone_number": "+33 1 23 45 67 89",
-    }
-
-
-def test_build_telephony_config_enabled_with_invalid_number(settings):
-    """Returns {"enabled": False} when phone number cannot be parsed."""
-    settings.ROOM_TELEPHONY_ENABLED = True
-    settings.ROOM_TELEPHONY_PHONE_NUMBER = "not-a-number"
-    settings.ROOM_TELEPHONY_DEFAULT_COUNTRY = "FR"
-    config = build_telephony_config()
-    assert config == {"enabled": False}
-
-
-def test_build_telephony_config_enabled_with_missing_number(settings):
-    """Returns {"enabled": False} when phone number is not configured."""
-    settings.ROOM_TELEPHONY_ENABLED = True
-    settings.ROOM_TELEPHONY_PHONE_NUMBER = ""
-    settings.ROOM_TELEPHONY_DEFAULT_COUNTRY = "FR"
-    config = build_telephony_config()
-    assert config == {"enabled": False}
-
-
-def test_build_telephony_config_enabled_with_missing_number_warns(settings, caplog):
-    """Logs a warning when telephony is enabled but phone number is not configured."""
-
-    settings.ROOM_TELEPHONY_ENABLED = True
-    settings.ROOM_TELEPHONY_PHONE_NUMBER = ""
-    settings.ROOM_TELEPHONY_DEFAULT_COUNTRY = "FR"
-
-    with caplog.at_level(logging.WARNING):
-        build_telephony_config()
-
-    assert "ROOM_TELEPHONY_PHONE_NUMBER" in caplog.text

src/backend/core/tests/test_utils_format_telephony_phone_number.py

@@ -1,102 +0,0 @@
-"""
-Test utils._format_telephony_phone_number
-"""
-
-import logging
-
-import pytest
-
-from core.utils import _format_telephony_phone_number
-
-
-@pytest.fixture(autouse=True)
-def clear_lru_cache():
-    """Clear the lru_cache before each test to ensure isolation."""
-    _format_telephony_phone_number.cache_clear()
-    yield
-    _format_telephony_phone_number.cache_clear()
-
-
-def test_format_telephony_phone_number_missing_raw_number():
-    """Returns (None, None) when raw_number is empty."""
-    country, international = _format_telephony_phone_number("", "FR")
-    assert country is None
-    assert international is None
-
-
-def test_format_telephony_phone_number_none_raw_number():
-    """Returns (None, None) when raw_number is None."""
-    country, international = _format_telephony_phone_number(None, "FR")
-    assert country is None
-    assert international is None
-
-
-def test_format_telephony_phone_number_missing_default_country():
-    """Returns (None, None) when default_country is empty."""
-    country, international = _format_telephony_phone_number("+33123456789", "")
-    assert country is None
-    assert international is None
-
-
-def test_format_telephony_phone_number_none_default_country():
-    """Returns (None, None) when default_country is None."""
-    country, international = _format_telephony_phone_number("+33123456789", None)
-    assert country is None
-    assert international is None
-
-
-def test_format_telephony_phone_number_both_missing():
-    """Returns (None, None) when both inputs are missing."""
-    country, international = _format_telephony_phone_number(None, None)
-    assert country is None
-    assert international is None
-
-
-def test_format_telephony_phone_number_invalid_number(caplog):
-    """Returns (None, None) and logs a warning when the number cannot be parsed."""
-
-    with caplog.at_level(logging.WARNING):
-        country, international = _format_telephony_phone_number("not-a-number", "FR")
-
-    assert country is None
-    assert international is None
-    assert "not-a-number" in caplog.text
-    assert "FR" in caplog.text
-
-
-def test_format_telephony_phone_number_valid_french_number():
-    """Returns correct country and international format for a valid French number."""
-    country, international = _format_telephony_phone_number("0123456789", "FR")
-    assert country == "FR"
-    assert international == "+33 1 23 45 67 89"
-
-
-def test_format_telephony_phone_number_valid_e164_number():
-    """Returns correct result for an E.164-formatted number (no default country needed)."""
-    country, international = _format_telephony_phone_number("+33123456789", "US")
-    assert country == "FR"
-    assert international == "+33 1 23 45 67 89"
-
-
-def test_format_telephony_phone_number_valid_us_number():
-    """Returns correct country and international format for a valid US number."""
-    country, international = _format_telephony_phone_number("2025550123", "US")
-    assert country == "US"
-    assert international == "+1 202-555-0123"
-
-
-def test_format_telephony_phone_number_valid_german_number():
-    """Returns correct country and international format for a valid German number."""
-    country, international = _format_telephony_phone_number("03012345678", "DE")
-    assert country == "DE"
-    assert international == "+49 30 12345678"
-
-
-def test_format_telephony_phone_number_lru_cache():
-    """Results are cached: the same inputs return the same object."""
-    result1 = _format_telephony_phone_number("0123456789", "FR")
-    result2 = _format_telephony_phone_number("0123456789", "FR")
-    assert result1 is result2
-    # pylint: disable=no-value-for-parameter
-    cache_info = _format_telephony_phone_number.cache_info()
-    assert cache_info.hits >= 1

src/backend/core/utils.py

@@ -12,7 +12,6 @@ import mimetypes
 import random
 import secrets
 import string
-from functools import lru_cache
 from typing import List, Optional
 from uuid import uuid4
 
@@ -23,7 +22,6 @@ import aiohttp
 import boto3
 import botocore
 import magic
-import phonenumbers
 from asgiref.sync import async_to_sync
 from livekit.api import (  # pylint: disable=E0611
     AccessToken,
@@ -457,58 +455,3 @@ def generate_upload_policy(file):
     )
 
     return policy
-
-
-@lru_cache(maxsize=1)
-def _format_telephony_phone_number(raw_number, default_country):
-    """Parse a configured phone number and return (country, international_format).
-
-    Returns (None, None) if the inputs are missing or the number cannot be
-    parsed. Logs a warning on parse failure so operators see the misconfiguration.
-    """
-    if not raw_number or not default_country:
-        return None, None
-
-    try:
-        parsed = phonenumbers.parse(raw_number, default_country)
-    except phonenumbers.NumberParseException:
-        logger.warning(
-            "ROOM_TELEPHONY_PHONE_NUMBER %r is not a valid phone number for "
-            "default country %r; telephony block will be returned without "
-            "formatted number.",
-            raw_number,
-            default_country,
-        )
-        return None, None
-
-    country = phonenumbers.region_code_for_number(parsed)
-    international = phonenumbers.format_number(
-        parsed, phonenumbers.PhoneNumberFormat.INTERNATIONAL
-    )
-    return country, international
-
-
-def build_telephony_config():
-    """Build the telephony block of the frontend configuration."""
-    if not settings.ROOM_TELEPHONY_ENABLED:
-        return {"enabled": False}
-
-    country, international = _format_telephony_phone_number(
-        settings.ROOM_TELEPHONY_PHONE_NUMBER,
-        settings.ROOM_TELEPHONY_DEFAULT_COUNTRY,
-    )
-
-    if international is None:
-        logger.warning(
-            "Telephony is enabled but ROOM_TELEPHONY_PHONE_NUMBER %r with "
-            "default country %r could not be formatted; telephony will be disabled.",
-            settings.ROOM_TELEPHONY_PHONE_NUMBER,
-            settings.ROOM_TELEPHONY_DEFAULT_COUNTRY,
-        )
-        return {"enabled": False}
-
-    return {
-        "enabled": True,
-        "default_country": country,
-        "international_phone_number": international,
-    }

src/backend/meet/settings.py

@@ -908,18 +908,6 @@ class Base(Configuration):
         environ_name="APPLICATION_BASE_URL",
         environ_prefix=None,
     )
-    # Warning: EXTERNAL_API_ALLOW_PUBLIC_ACCESS is ignored when
-    # EXTERNAL_API_DEFAULT_ACCESS_LEVEL=public.
-    EXTERNAL_API_ALLOW_PUBLIC_ACCESS = values.BooleanValue(
-        False,
-        environ_name="EXTERNAL_API_ALLOW_PUBLIC_ACCESS",
-        environ_prefix=None,
-    )
-    EXTERNAL_API_DEFAULT_ACCESS_LEVEL = values.Value(
-        "trusted",
-        environ_name="EXTERNAL_API_DEFAULT_ACCESS_LEVEL",
-        environ_prefix=None,
-    )
     # Allows third-party platforms to create users with email-only identification.
     # Required for external integrations, but fragile due to deferred user reconciliation
     # on sub. Enable it with care /!\

src/backend/meet/urls.py

@@ -4,7 +4,7 @@ from django.conf import settings
 from django.conf.urls.static import static
 from django.contrib import admin
 from django.contrib.staticfiles.urls import staticfiles_urlpatterns
-from django.urls import include, path
+from django.urls import include, path, re_path
 
 from drf_spectacular.views import (
     SpectacularJSONAPIView,
@@ -29,7 +29,7 @@ if settings.DEBUG:
 if settings.USE_SWAGGER or settings.DEBUG:
     urlpatterns += [
         path(
-            f"api/{settings.API_VERSION}/swagger.json",
+            f"{settings.API_VERSION}/swagger.json",
             SpectacularJSONAPIView.as_view(
                 api_version=settings.API_VERSION,
                 urlconf="core.urls",
@@ -37,12 +37,12 @@ if settings.USE_SWAGGER or settings.DEBUG:
             name="client-api-schema",
         ),
         path(
-            f"api/{settings.API_VERSION}/swagger/",
+            f"{settings.API_VERSION}//swagger/",
             SpectacularSwaggerView.as_view(url_name="client-api-schema"),
             name="swagger-ui-schema",
         ),
-        path(
-            f"api/{settings.API_VERSION}/redoc/",
+        re_path(
+            f"{settings.API_VERSION}//redoc/",
             SpectacularRedocView.as_view(url_name="client-api-schema"),
             name="redoc-schema",
         ),

src/backend/pyproject.toml

@@ -7,7 +7,7 @@ build-backend = "uv_build"
 
 [project]
 name = "meet"
-version = "1.17.0"
+version = "1.15.0"
 authors = [{ "name" = "DINUM", "email" = "dev@mail.numerique.gouv.fr" }]
 classifiers = [
     "Development Status :: 5 - Production/Stable",
@@ -61,8 +61,6 @@ dependencies = [
     "mozilla-django-oidc==5.0.2",
     "livekit-api==1.1.0",
     "aiohttp==3.13.4",
-    "urllib3==2.7.0",
-    "phonenumbers==9.0.30",
 ]
 
 [project.urls]

src/backend/uv.lock

@@ -1173,7 +1173,7 @@ wheels = [
 
 [[package]]
 name = "meet"
-version = "1.17.0"
+version = "1.15.0"
 source = { editable = "." }
 dependencies = [
     { name = "aiohttp" },
@@ -1204,7 +1204,6 @@ dependencies = [
     { name = "markdown" },
     { name = "mozilla-django-oidc" },
     { name = "nested-multipart-parser" },
-    { name = "phonenumbers" },
     { name = "psycopg", extra = ["binary"] },
     { name = "pydantic" },
     { name = "pyjwt" },
@@ -1213,7 +1212,6 @@ dependencies = [
     { name = "redis" },
     { name = "requests" },
     { name = "sentry-sdk" },
-    { name = "urllib3" },
     { name = "whitenoise" },
 ]
 
@@ -1267,7 +1265,6 @@ requires-dist = [
     { name = "markdown", specifier = "==3.10.2" },
     { name = "mozilla-django-oidc", specifier = "==5.0.2" },
     { name = "nested-multipart-parser", specifier = "==1.6.0" },
-    { name = "phonenumbers", specifier = "==9.0.30" },
     { name = "psycopg", extras = ["binary"], specifier = "==3.3.3" },
     { name = "pydantic", specifier = "==2.12.5" },
     { name = "pyjwt", specifier = "==2.12.1" },
@@ -1276,7 +1273,6 @@ requires-dist = [
     { name = "redis", specifier = "==5.2.1" },
     { name = "requests", specifier = "==2.33.0" },
     { name = "sentry-sdk", specifier = "==2.54.0" },
-    { name = "urllib3", specifier = "==2.7.0" },
     { name = "whitenoise", specifier = "==6.12.0" },
 ]
 
@@ -1432,15 +1428,6 @@ wheels = [
     { url = "https://files.pythonhosted.org/packages/9e/c3/059298687310d527a58bb01f3b1965787ee3b40dce76752eda8b44e9a2c5/pexpect-4.9.0-py2.py3-none-any.whl", hash = "sha256:7236d1e080e4936be2dc3e326cec0af72acf9212a7e1d060210e70a47e253523", size = 63772, upload-time = "2023-11-25T06:56:14.81Z" },
 ]
 
-[[package]]
-name = "phonenumbers"
-version = "9.0.30"
-source = { registry = "https://pypi.org/simple" }
-sdist = { url = "https://files.pythonhosted.org/packages/a6/f1/249f843f4107c6a6ed17e5ece17620d75e532c2a355106e26d889a0c72c7/phonenumbers-9.0.30.tar.gz", hash = "sha256:d42d232ccde69c1af1bb5916a7e46f4edbcc72975b02759830f4ea1fba7b00c9", size = 2306521, upload-time = "2026-05-07T10:20:38.884Z" }
-wheels = [
-    { url = "https://files.pythonhosted.org/packages/83/22/e4442aabea04daf16fda50d89bce2ff585e44f204089986b2cc6679cae10/phonenumbers-9.0.30-py2.py3-none-any.whl", hash = "sha256:e0890d4cda206ef6ac18ef07e8f3ab225c31c7edce237ac870b4729d4c1d2520", size = 2595222, upload-time = "2026-05-07T10:20:35.387Z" },
-]
-
 [[package]]
 name = "pillow"
 version = "12.2.0"
@@ -2273,11 +2260,11 @@ wheels = [
 
 [[package]]
 name = "urllib3"
-version = "2.7.0"
+version = "2.6.3"
 source = { registry = "https://pypi.org/simple" }
-sdist = { url = "https://files.pythonhosted.org/packages/53/0c/06f8b233b8fd13b9e5ee11424ef85419ba0d8ba0b3138bf360be2ff56953/urllib3-2.7.0.tar.gz", hash = "sha256:231e0ec3b63ceb14667c67be60f2f2c40a518cb38b03af60abc813da26505f4c", size = 433602, upload-time = "2026-05-07T16:13:18.596Z" }
+sdist = { url = "https://files.pythonhosted.org/packages/c7/24/5f1b3bdffd70275f6661c76461e25f024d5a38a46f04aaca912426a2b1d3/urllib3-2.6.3.tar.gz", hash = "sha256:1b62b6884944a57dbe321509ab94fd4d3b307075e0c2eae991ac71ee15ad38ed", size = 435556, upload-time = "2026-01-07T16:24:43.925Z" }
 wheels = [
-    { url = "https://files.pythonhosted.org/packages/7f/3e/5db95bcf282c52709639744ca2a8b149baccf648e39c8cc87553df9eae0c/urllib3-2.7.0-py3-none-any.whl", hash = "sha256:9fb4c81ebbb1ce9531cce37674bbc6f1360472bc18ca9a553ede278ef7276897", size = 131087, upload-time = "2026-05-07T16:13:17.151Z" },
+    { url = "https://files.pythonhosted.org/packages/39/08/aaaad47bc4e9dc8c725e68f9d04865dbcb2052843ff09c97b08904852d84/urllib3-2.6.3-py3-none-any.whl", hash = "sha256:bf272323e553dfb2e87d9bfd225ca7b0f467b919d7bbd355436d3fd37cb0acd4", size = 131584, upload-time = "2026-01-07T16:24:42.685Z" },
 ]
 
 [[package]]

src/frontend/@types/react-aria-overlays.d.ts

@@ -0,0 +1,18 @@
+import type * as React from 'react';
+
+declare module '@react-aria/overlays' {
+  export type PortalProviderContextValue = {
+    getContainer: () => HTMLElement | null;
+  };
+
+  export type PortalProviderProps = {
+    getContainer: () => HTMLElement | null;
+    children: React.ReactNode;
+  };
+
+  export function useUNSAFE_PortalContext(): PortalProviderContextValue;
+  export function UNSAFE_PortalProvider(
+    props: PortalProviderProps,
+  ): JSX.Element;
+}
+

src/frontend/index.html

@@ -6,6 +6,22 @@
     <link rel="icon" type="image/png" sizes="32x32" href="/favicon-32x32.png">
     <link rel="icon" type="image/png" sizes="16x16" href="/favicon-16x16.png">
     <link rel="manifest" href="/site.webmanifest">
+    <!-- Font URLs are resolved and replaced by Vite during the build process. Font loading failures will not break the application. -->
+    <link
+      rel="preload"
+      as="font"
+      crossorigin="anonymous"
+      href="/node_modules/@fontsource/material-icons-outlined/files/material-icons-outlined-latin-400-normal.woff2"
+      type="font/woff2"
+    />
+    <!-- Font URLs are resolved and replaced by Vite during the build process. Font loading failures will not break the application. -->
+    <link
+      rel="preload"
+      as="font"
+      crossorigin="anonymous"
+      href="/node_modules/@fontsource-variable/material-symbols-outlined/files/material-symbols-outlined-latin-wght-normal.woff2"
+      type="font/woff2"
+    />
     <meta name="viewport" content="width=device-width, initial-scale=1.0" />
     <title>%VITE_APP_TITLE%</title>
   </head>

src/frontend/package.json

@@ -1,12 +1,11 @@
 {
   "name": "meet",
   "private": true,
-  "version": "1.17.0",
+  "version": "1.15.0",
   "type": "module",
   "scripts": {
     "dev": "panda codegen && vite",
     "build": "panda codegen && tsc -b && vite build",
-    "build:debug": "VITE_ANALYZE=true npm run build -- --debug",
     "lint": "eslint . --ext ts,tsx --report-unused-disable-directives --max-warnings 0",
     "preview": "vite preview",
     "i18n:extract": "npx i18next -c i18next-parser.config.json",
@@ -16,6 +15,8 @@
   "dependencies": {
     "@fontsource-variable/atkinson-hyperlegible-next": "5.2.6",
     "@fontsource-variable/lexend": "5.2.11",
+    "@fontsource-variable/material-symbols-outlined": "5.2.34",
+    "@fontsource/material-icons-outlined": "5.2.6",
     "@fontsource/opendyslexic": "5.2.5",
     "@livekit/components-react": "2.9.19",
     "@livekit/components-styles": "1.2.0",
@@ -34,6 +35,7 @@
     "i18next-browser-languagedetector": "8.2.1",
     "i18next-parser": "9.3.0",
     "i18next-resources-to-backend": "1.2.1",
+    "libphonenumber-js": "1.12.10",
     "livekit-client": "2.17.1",
     "posthog-js": "1.342.1",
     "react": "18.3.1",
@@ -45,7 +47,7 @@
     "wouter": "3.9.0"
   },
   "devDependencies": {
-    "@pandacss/dev": "1.11.1",
+    "@pandacss/dev": "1.8.2",
     "@tanstack/eslint-plugin-query": "5.91.4",
     "@tanstack/react-query-devtools": "5.91.3",
     "@types/humanize-duration": "3.27.4",
@@ -60,12 +62,10 @@
     "eslint-plugin-jsx-a11y": "6.10.2",
     "eslint-plugin-react-hooks": "5.2.0",
     "eslint-plugin-react-refresh": "0.4.20",
-    "postcss": "8.5.14",
+    "postcss": "8.5.10",
     "prettier": "3.8.1",
-    "rollup-plugin-visualizer": "7.0.1",
     "typescript": "5.8.3",
     "vite": "7.3.2",
-    "vite-plugin-svgr": "5.2.0",
     "vite-tsconfig-paths": "6.1.1"
   }
 }

src/frontend/panda.config.ts

@@ -279,7 +279,6 @@ const config: Config = {
         'room-side-panel-margin': { value: '1.5rem' },
         'room-control-bar': { value: '80px' },
         'room-reaction-toolbar-height': { value: '42px' },
-        'tooltip-spacing': { value: '8px' },
       },
       spacing,
     }),

src/frontend/src/App.tsx

@@ -1,3 +1,4 @@
+import '@livekit/components-styles'
 import '@/styles/index.css'
 import { Suspense } from 'react'
 import { ReactQueryDevtools } from '@tanstack/react-query-devtools'

src/frontend/src/api/useConfig.ts

@@ -2,8 +2,6 @@ import { fetchApi } from './fetchApi'
 import { keys } from './queryKeys'
 import { useQuery } from '@tanstack/react-query'
 import { RecordingMode } from '@/features/recording'
-import type { Track } from 'livekit-client'
-type Source = Track.Source
 
 export interface ApiConfig {
   analytics?: {
@@ -44,7 +42,7 @@ export interface ApiConfig {
   }
   telephony: {
     enabled: boolean
-    international_phone_number?: string
+    phone_number?: string
     default_country?: string
   }
   manifest_link?: string
@@ -52,7 +50,7 @@ export interface ApiConfig {
     url: string
     force_wss_protocol: boolean
     enable_firefox_proxy_workaround: boolean
-    default_sources: Source[]
+    default_sources: string[]
   }
   transcription_destination?: string
 }

src/frontend/src/assets/icons/article.svg

@@ -1 +0,0 @@
-<svg xmlns="http://www.w3.org/2000/svg" height="24px" viewBox="0 -960 960 960" width="24px" fill="#1f1f1f"><path d="M280-280h280v-80H280v80Zm0-160h400v-80H280v80Zm0-160h400v-80H280v80Zm-80 480q-33 0-56.5-23.5T120-200v-560q0-33 23.5-56.5T200-840h560q33 0 56.5 23.5T840-760v560q0 33-23.5 56.5T760-120H200Zm0-80h560v-560H200v560Zm0-560v560-560Z"/></svg>

src/frontend/src/assets/icons/chevron_forward.svg

@@ -1 +0,0 @@
-<svg xmlns="http://www.w3.org/2000/svg" height="24px" viewBox="0 -960 960 960" width="24px" fill="#1f1f1f"><path d="M504-480 320-664l56-56 240 240-240 240-56-56 184-184Z"/></svg>

src/frontend/src/assets/icons/cloud_download.svg

@@ -1 +0,0 @@
-<svg xmlns="http://www.w3.org/2000/svg" height="24px" viewBox="0 -960 960 960" width="24px" fill="#1f1f1f"><path d="M260-160q-91 0-155.5-63T40-377q0-78 47-139t123-78q17-72 85-137t145-65q33 0 56.5 23.5T520-716v242l64-62 56 56-160 160-160-160 56-56 64 62v-242q-76 14-118 73.5T280-520h-20q-58 0-99 41t-41 99q0 58 41 99t99 41h480q42 0 71-29t29-71q0-42-29-71t-71-29h-60v-80q0-48-22-89.5T600-680v-93q74 35 117 103.5T760-520q69 8 114.5 59.5T920-340q0 75-52.5 127.5T740-160H260Zm220-358Z"/></svg>

src/frontend/src/assets/icons/language.svg

@@ -1 +0,0 @@
-<svg xmlns="http://www.w3.org/2000/svg" height="24px" viewBox="0 -960 960 960" width="24px" fill="#1f1f1f"><path d="M325-111.5q-73-31.5-127.5-86t-86-127.5Q80-398 80-480.5t31.5-155q31.5-72.5 86-127t127.5-86Q398-880 480.5-880t155 31.5q72.5 31.5 127 86t86 127Q880-563 880-480.5T848.5-325q-31.5 73-86 127.5t-127 86Q563-80 480.5-80T325-111.5ZM480-162q26-36 45-75t31-83H404q12 44 31 83t45 75Zm-104-16q-18-33-31.5-68.5T322-320H204q29 50 72.5 87t99.5 55Zm208 0q56-18 99.5-55t72.5-87H638q-9 38-22.5 73.5T584-178ZM170-400h136q-3-20-4.5-39.5T300-480q0-21 1.5-40.5T306-560H170q-5 20-7.5 39.5T160-480q0 21 2.5 40.5T170-400Zm216 0h188q3-20 4.5-39.5T580-480q0-21-1.5-40.5T574-560H386q-3 20-4.5 39.5T380-480q0 21 1.5 40.5T386-400Zm268 0h136q5-20 7.5-39.5T800-480q0-21-2.5-40.5T790-560H654q3 20 4.5 39.5T660-480q0 21-1.5 40.5T654-400Zm-16-240h118q-29-50-72.5-87T584-782q18 33 31.5 68.5T638-640Zm-234 0h152q-12-44-31-83t-45-75q-26 36-45 75t-31 83Zm-200 0h118q9-38 22.5-73.5T376-782q-56 18-99.5 55T204-640Z"/></svg>

src/frontend/src/assets/icons/login.svg

@@ -1 +0,0 @@
-<svg xmlns="http://www.w3.org/2000/svg" height="24px" viewBox="0 -960 960 960" width="24px" fill="#1f1f1f"><path d="M480-120v-80h280v-560H480v-80h280q33 0 56.5 23.5T840-760v560q0 33-23.5 56.5T760-120H480Zm-80-160-55-58 102-102H120v-80h327L345-622l55-58 200 200-200 200Z"/></svg>

src/frontend/src/assets/icons/mail.svg

@@ -1 +0,0 @@
-<svg xmlns="http://www.w3.org/2000/svg" height="24px" viewBox="0 -960 960 960" width="24px" fill="#1f1f1f"><path d="M160-160q-33 0-56.5-23.5T80-240v-480q0-33 23.5-56.5T160-800h640q33 0 56.5 23.5T880-720v480q0 33-23.5 56.5T800-160H160Zm320-280L160-640v400h640v-400L480-440Zm0-80 320-200H160l320 200ZM160-640v-80 480-400Z"/></svg>

src/frontend/src/assets/icons/mode_standby.svg

@@ -1 +0,0 @@
-<svg xmlns="http://www.w3.org/2000/svg" height="24px" viewBox="0 -960 960 960" width="24px" fill="#1f1f1f"><path d="M565-395q35-35 35-85t-35-85q-35-35-85-35t-85 35q-35 35-35 85t35 85q35 35 85 35t85-35ZM480-80q-83 0-156-31.5T197-197q-54-54-85.5-127T80-480q0-83 31.5-156T197-763q54-54 127-85.5T480-880q83 0 156 31.5T763-763q54 54 85.5 127T880-480q0 83-31.5 156T763-197q-54 54-127 85.5T480-80Zm0-80q134 0 227-93t93-227q0-134-93-227t-227-93q-134 0-227 93t-93 227q0 134 93 227t227 93Zm0-320Z"/></svg>

src/frontend/src/assets/icons/person_raised_hand.svg

@@ -1 +0,0 @@
-<svg xmlns="http://www.w3.org/2000/svg" height="24px" viewBox="0 -960 960 960" width="24px" fill="#1f1f1f"><path d="M80-40v-80h800v80H80Zm80-120v-240q-33-54-51-114.5T91-638q0-61 15.5-120T143-874q8-21 26-33.5t40-12.5q31 0 53 21t18 50l-11 91q-6 48 8.5 91t43.5 75.5q29 32.5 70 52t89 19.5q60 0 120.5 12.5T706-472q45 23 69.5 58.5T800-326v166H160Zm80-80h480v-86q0-24-12-42.5T674-398q-41-20-95-31t-99-11q-66 0-122.5-27t-96-72.5Q222-585 202-644.5T190-768q-10 30-14.5 64t-4.5 66q0 58 20.5 111.5T240-422v182Zm127-367q-47-47-47-113t47-113q47-47 113-47t113 47q47 47 47 113t-47 113q-47 47-113 47t-113-47Zm169.5-56.5Q560-687 560-720t-23.5-56.5Q513-800 480-800t-56.5 23.5Q400-753 400-720t23.5 56.5Q447-640 480-640t56.5-23.5ZM320-160v-37q0-67 46.5-115T480-360h160v80H480q-34 0-57 24.5T400-197v37h-80Zm160-80Zm0-480Z"/></svg>

src/frontend/src/assets/icons/screen_record.svg

@@ -1 +0,0 @@
-<svg xmlns="http://www.w3.org/2000/svg" height="24px" viewBox="0 -960 960 960" width="24px" fill="#1f1f1f"><path d="M158-242q-37-50-57.5-110.5T80-480q0-67 20-127t57-110l58 57q-26 38-40.5 83.5T160-480q0 51 14.5 97t40.5 84l-57 57ZM480-80q-67 0-127-20t-110-57l57-58q38 26 83.5 40.5T480-160q51 0 96.5-14.5T660-215l57 58q-50 37-110 57T480-80Zm322-162-57-57q26-38 40.5-84t14.5-97q0-51-14.5-96.5T745-660l58-57q37 50 57 110t20 127q0 67-20.5 127.5T802-242ZM299-745l-57-57q50-37 110.5-57.5T480-880q68 0 128 20.5T718-802l-57 57q-38-26-84-40.5T480-800q-51 0-97 14.5T299-745Zm181 465q-83 0-141.5-58.5T280-480q0-83 58.5-141.5T480-680q83 0 141.5 58.5T680-480q0 83-58.5 141.5T480-280Z"/></svg>

src/frontend/src/assets/icons/speech_to_text.svg

@@ -1 +0,0 @@
-<svg xmlns="http://www.w3.org/2000/svg" height="24px" viewBox="0 -960 960 960" width="24px" fill="#1f1f1f"><path d="M680-560q-33 0-56.5-23T600-640v-160q0-34 23.5-57t56.5-23q34 0 57 23t23 57v160q0 34-23 57t-57 23ZM200-80q-33 0-56.5-23.5T120-160v-640q0-33 23.5-56.5T200-880h320v80H200v640h440v-80h80v80q0 33-23.5 56.5T640-80H200Zm80-160v-80h280v80H280Zm0-120v-80h200v80H280Zm440 40h-80v-104q-77-14-128.5-74.5T460-640h80q0 58 41 99t99 41q59 0 99.5-41t40.5-99h80q0 81-51 141.5T720-424v104Z"/></svg>

src/frontend/src/components/AppInitialization.tsx

@@ -1,14 +1,20 @@
+import { silenceLiveKitLogs } from '@/utils/livekit'
 import { useConfig } from '@/api/useConfig'
 import { useAnalytics } from '@/features/analytics/hooks/useAnalytics'
 import { useSupport } from '@/features/support/hooks/useSupport'
-import { useSyncUserPreferencesWithBackend } from '@/features/auth/api/useSyncUserPreferencesWithBackend'
+import { useSyncUserPreferencesWithBackend } from '@/features/auth'
 import { useEffect } from 'react'
 
 export const AppInitialization = () => {
   const { data } = useConfig()
   useSyncUserPreferencesWithBackend()
 
-  const { analytics = {}, support = {}, custom_css_url = '' } = data ?? {}
+  const {
+    analytics = {},
+    support = {},
+    silence_livekit_debug_logs = false,
+    custom_css_url = '',
+  } = data ?? {}
 
   useAnalytics(analytics)
   useSupport(support)
@@ -23,5 +29,7 @@ export const AppInitialization = () => {
     }
   }, [custom_css_url])
 
+  silenceLiveKitLogs(silence_livekit_debug_logs)
+
   return null
 }

src/frontend/src/components/LoginButton.tsx

@@ -1,8 +1,8 @@
 import { LinkButton } from '@/primitives'
+import { authUrl } from '@/features/auth'
 import { useTranslation } from 'react-i18next'
 import { useConfig } from '@/api/useConfig'
 import { ProConnectButton } from './ProConnectButton'
-import { authUrl } from '@/features/auth/utils/authUrl'
 
 type LoginButtonProps = {
   proConnectHint?: boolean // Hide hint in layouts where space doesn't allow it.

src/frontend/src/features/analytics/hooks/useAnalytics.ts

@@ -1,28 +1,17 @@
 import { useEffect } from 'react'
 import { useLocation } from 'wouter'
-import { type PostHog } from 'posthog-js'
-import { type ApiUser } from '@/features/auth/api/ApiUser'
-import { useUser } from '@/features/auth/api/useUser'
-
-let posthog: PostHog | null = null
-
-const getPosthog = async () => {
-  if (!posthog) posthog = (await import('posthog-js')).default
-  return posthog
-}
+import posthog from 'posthog-js'
+import { ApiUser } from '@/features/auth/api/ApiUser'
 
 export const startAnalyticsSession = (data: ApiUser) => {
-  getPosthog().then((ph) => {
-    if (ph._isIdentified()) return
-    const { id, email } = data
-    ph.identify(id, { email })
-  })
+  if (posthog._isIdentified()) return
+  const { id, email } = data
+  posthog.identify(id, { email })
 }
 
-export const terminateAnalyticsSession = async () => {
-  const ph = await getPosthog()
-  if (!ph._isIdentified()) return
-  ph.reset()
+export const terminateAnalyticsSession = () => {
+  if (!posthog._isIdentified()) return
+  posthog.reset()
 }
 
 export type useAnalyticsProps = {
@@ -33,26 +22,18 @@ export type useAnalyticsProps = {
 
 export const useAnalytics = ({ id, host, isDisabled }: useAnalyticsProps) => {
   const [location] = useLocation()
-  const { user } = useUser()
-
   useEffect(() => {
     if (!id || !host || isDisabled) return
-    getPosthog().then((ph) => {
-      if (ph.__loaded) return
-      ph.init(id, { api_host: host, person_profiles: 'always' })
+    if (posthog.__loaded) return
+    posthog.init(id, {
+      api_host: host,
+      person_profiles: 'always',
     })
   }, [id, host, isDisabled])
 
-  useEffect(() => {
-    if (!user) return
-    startAnalyticsSession(user)
-  }, [user])
-
   // From PostHog tutorial on PageView tracking in a Single Page Application (SPA) context.
   useEffect(() => {
-    getPosthog().then((ph) => {
-      ph.capture('$pageview')
-    })
+    posthog.capture('$pageview')
   }, [location])
 
   return null

src/frontend/src/features/auth/api/useUser.tsx

@@ -2,7 +2,16 @@ import { useQuery } from '@tanstack/react-query'
 import { keys } from '@/api/queryKeys'
 import { fetchUser } from './fetchUser'
 import { type ApiUser } from './ApiUser'
-import { useMemo } from 'react'
+import { useEffect, useMemo } from 'react'
+import {
+  startAnalyticsSession,
+  terminateAnalyticsSession,
+} from '@/features/analytics/hooks/useAnalytics'
+import {
+  initializeSupportSession,
+  terminateSupportSession,
+} from '@/features/support/hooks/useSupport'
+import { logoutUrl } from '../utils/logoutUrl'
 import { useConfig } from '@/api/useConfig'
 
 /**
@@ -36,6 +45,19 @@ export const useUser = (
     enabled: !isConfigLoading,
   })
 
+  useEffect(() => {
+    if (query?.data) {
+      startAnalyticsSession(query.data)
+      initializeSupportSession(query.data)
+    }
+  }, [query.data])
+
+  const logout = () => {
+    terminateAnalyticsSession()
+    terminateSupportSession()
+    window.location.href = logoutUrl()
+  }
+
   const isLoggedIn =
     query.status === 'success' ? query.data !== false : undefined
   const isLoggedOut = isLoggedIn === false
@@ -45,5 +67,6 @@ export const useUser = (
     user: isLoggedOut ? undefined : (query.data as ApiUser | undefined),
     isLoggedIn,
     isLoading: query.isLoading,
+    logout,
   }
 }

src/frontend/src/features/auth/components/UserAware.tsx

@@ -1,4 +1,4 @@
-import { useUser } from '../api/useUser'
+import { useUser } from '@/features/auth'
 import { LoadingScreen } from '@/components/LoadingScreen'
 
 /**

src/frontend/src/features/auth/index.ts

@@ -0,0 +1,4 @@
+export { useUser } from './api/useUser'
+export { useSyncUserPreferencesWithBackend } from './api/useSyncUserPreferencesWithBackend'
+export { authUrl } from './utils/authUrl'
+export { UserAware } from './components/UserAware'

src/frontend/src/features/auth/utils/logout.ts

@@ -1,13 +0,0 @@
-import { apiUrl } from '@/api/apiUrl'
-import { terminateSupportSession } from '@/features/support/hooks/useSupport'
-import { terminateAnalyticsSession } from '@/features/analytics/hooks/useAnalytics'
-
-const logoutUrl = () => {
-  return apiUrl('/logout')
-}
-
-export const logout = async () => {
-  await terminateAnalyticsSession()
-  terminateSupportSession()
-  window.location.href = logoutUrl()
-}

src/frontend/src/features/auth/utils/logoutUrl.ts

@@ -0,0 +1,5 @@
+import { apiUrl } from '@/api/apiUrl'
+
+export const logoutUrl = () => {
+  return apiUrl('/logout')
+}

src/frontend/src/features/auth/utils/silentLogin.ts

@@ -1,4 +1,4 @@
-import { authUrl } from './authUrl'
+import { authUrl } from '@/features/auth'
 
 const SILENT_LOGIN_RETRY_KEY = 'silent-login-retry'
 

src/frontend/src/features/files/api/listFiles.ts

@@ -6,7 +6,7 @@ import {
   ApiFileType,
   ApiFileUploadState,
 } from '@/features/files/api/types.ts'
-import { useUser } from '@/features/auth/api/useUser'
+import { useUser } from '@/features/auth'
 import { useConfig } from '@/api/useConfig.ts'
 
 type ListFilesResponse = {

src/frontend/src/features/home/components/CreateMeetingMenu.tsx

@@ -1,62 +0,0 @@
-import { useTranslation } from 'react-i18next'
-import { MenuItem, Menu as RACMenu } from 'react-aria-components'
-import { Button, Menu } from '@/primitives'
-import { navigateTo } from '@/navigation/navigateTo'
-import { generateRoomId, useCreateRoom } from '@/features/rooms'
-import { RiAddLine, RiLink } from '@remixicon/react'
-import { LaterMeetingDialog } from '@/features/home/components/LaterMeetingDialog'
-import { useState } from 'react'
-
-import { menuRecipe } from '@/primitives/menuRecipe'
-import { ApiRoom } from '@/features/rooms/api/ApiRoom'
-import { loadUserChoices } from '@livekit/components-core'
-
-export const CreateMeetingMenu = () => {
-  const { username } = loadUserChoices()
-
-  const { t } = useTranslation('home')
-  const { mutateAsync: createRoom } = useCreateRoom()
-  const [laterRoom, setLaterRoom] = useState<null | ApiRoom>(null)
-
-  return (
-    <>
-      <Menu>
-        <Button variant="primary" data-attr="create-meeting">
-          {t('createMeeting')}
-        </Button>
-        <RACMenu>
-          <MenuItem
-            className={menuRecipe({ icon: true, variant: 'light' }).item}
-            onAction={() => {
-              const slug = generateRoomId()
-              createRoom({ slug, username }).then((data) =>
-                navigateTo('room', data.slug, {
-                  state: { create: true, initialRoomData: data },
-                })
-              )
-            }}
-            data-attr="create-option-instant"
-          >
-            <RiAddLine size={18} />
-            {t('createMenu.instantOption')}
-          </MenuItem>
-          <MenuItem
-            className={menuRecipe({ icon: true, variant: 'light' }).item}
-            onAction={() => {
-              const slug = generateRoomId()
-              createRoom({ slug, username }).then(setLaterRoom)
-            }}
-            data-attr="create-option-later"
-          >
-            <RiLink size={18} />
-            {t('createMenu.laterOption')}
-          </MenuItem>
-        </RACMenu>
-      </Menu>
-      <LaterMeetingDialog
-        room={laterRoom}
-        onOpenChange={() => setLaterRoom(null)}
-      />
-    </>
-  )
-}

src/frontend/src/features/home/index.ts

@@ -0,0 +1 @@
+export { Home as HomeRoute } from './routes/Home'

src/frontend/src/features/home/routes/Home.tsx

@@ -1,19 +1,24 @@
 import { useTranslation } from 'react-i18next'
-import { DialogTrigger } from 'react-aria-components'
-import { Button } from '@/primitives'
+import { DialogTrigger, MenuItem, Menu as RACMenu } from 'react-aria-components'
+import { Button, Menu } from '@/primitives'
 import { styled } from '@/styled-system/jsx'
+import { navigateTo } from '@/navigation/navigateTo'
 import { Screen } from '@/layout/Screen'
-import { UserAware } from '@/features/auth/components/UserAware'
-import { useUser } from '@/features/auth/api/useUser'
+import { generateRoomId, useCreateRoom } from '@/features/rooms'
+import { useUser, UserAware } from '@/features/auth'
 import { JoinMeetingDialog } from '../components/JoinMeetingDialog'
-import { IntroSlider } from '../components/IntroSlider'
-import { MoreLink } from '../components/MoreLink'
-import { CreateMeetingMenu } from '../components/CreateMeetingMenu'
+import { RiAddLine, RiLink } from '@remixicon/react'
+import { LaterMeetingDialog } from '@/features/home/components/LaterMeetingDialog'
+import { IntroSlider } from '@/features/home/components/IntroSlider'
+import { MoreLink } from '@/features/home/components/MoreLink'
 import { ReactNode, useEffect, useState } from 'react'
 
 import { css } from '@/styled-system/css'
+import { menuRecipe } from '@/primitives/menuRecipe.ts'
+import { usePersistentUserChoices } from '@/features/rooms/livekit/hooks/usePersistentUserChoices'
 import { useConfig } from '@/api/useConfig'
 import { LoginButton } from '@/components/LoginButton'
+import { ApiRoom } from '@/features/rooms/api/ApiRoom'
 import { LoadingScreen } from '@/components/LoadingScreen'
 
 const Columns = ({ children }: { children?: ReactNode }) => {
@@ -141,11 +146,18 @@ const IntroText = styled('div', {
   },
 })
 
-const Home = () => {
+export const Home = () => {
   const { t } = useTranslation('home')
   const { isLoggedIn } = useUser()
 
+  const {
+    userChoices: { username },
+  } = usePersistentUserChoices()
+
+  const { mutateAsync: createRoom } = useCreateRoom()
+  const [laterRoom, setLaterRoom] = useState<null | ApiRoom>(null)
   const [redirectFailed, setRedirectFailed] = useState(false)
+
   const { data } = useConfig()
 
   useEffect(() => {
@@ -188,7 +200,45 @@ const Home = () => {
               })}
             >
               {isLoggedIn ? (
-                <CreateMeetingMenu />
+                <Menu>
+                  <Button variant="primary" data-attr="create-meeting">
+                    {t('createMeeting')}
+                  </Button>
+                  <RACMenu>
+                    <MenuItem
+                      className={
+                        menuRecipe({ icon: true, variant: 'light' }).item
+                      }
+                      onAction={async () => {
+                        const slug = generateRoomId()
+                        createRoom({ slug, username }).then((data) =>
+                          navigateTo('room', data.slug, {
+                            state: { create: true, initialRoomData: data },
+                          })
+                        )
+                      }}
+                      data-attr="create-option-instant"
+                    >
+                      <RiAddLine size={18} />
+                      {t('createMenu.instantOption')}
+                    </MenuItem>
+                    <MenuItem
+                      className={
+                        menuRecipe({ icon: true, variant: 'light' }).item
+                      }
+                      onAction={() => {
+                        const slug = generateRoomId()
+                        createRoom({ slug, username }).then((data) =>
+                          setLaterRoom(data)
+                        )
+                      }}
+                      data-attr="create-option-later"
+                    >
+                      <RiLink size={18} />
+                      {t('createMenu.laterOption')}
+                    </MenuItem>
+                  </RACMenu>
+                </Menu>
               ) : (
                 <LoginButton proConnectHint={false} />
               )}
@@ -214,9 +264,11 @@ const Home = () => {
             <IntroSlider />
           </RightColumn>
         </Columns>
+        <LaterMeetingDialog
+          room={laterRoom}
+          onOpenChange={() => setLaterRoom(null)}
+        />
       </Screen>
     </UserAware>
   )
 }
-
-export default Home

src/frontend/src/features/layout/components/ControlBarRegion.tsx

@@ -12,7 +12,7 @@ const controlBarRegion = cva({
   variants: {
     mobile: {
       true: {
-        justifyContent: 'center',
+        justifyContent: 'space-between',
         width: '330px',
       },
     },
@@ -22,8 +22,6 @@ const controlBarRegion = cva({
   },
 })
 
-export const CONTROL_BAR_REGION_ID = 'control-bar-region'
-
 export type ControlBarRegionProps = React.HTMLAttributes<HTMLDivElement> &
   RecipeVariantProps<typeof controlBarRegion>
 
@@ -36,7 +34,6 @@ export function ControlBarRegion({
   return (
     <div
       role="region"
-      id={CONTROL_BAR_REGION_ID}
       aria-label={t('controls.region')}
       className={controlBarRegion({ mobile })}
       {...props}

src/frontend/src/features/legalsTerms/Accessibility.tsx

@@ -3,7 +3,7 @@ import { H, P, A, Italic, Ul } from '@/primitives'
 import { HStack } from '@/styled-system/jsx'
 import { useTranslation } from 'react-i18next'
 
-const AccessibilityRoute = () => {
+export const AccessibilityRoute = () => {
   const { t } = useTranslation('accessibility', { keyPrefix: 'accessibility' })
 
   return (
@@ -78,5 +78,3 @@ const AccessibilityRoute = () => {
     </Screen>
   )
 }
-
-export default AccessibilityRoute

src/frontend/src/features/legalsTerms/LegalTermsRoute.tsx

@@ -4,7 +4,7 @@ import { css } from '@/styled-system/css'
 import { HStack } from '@/styled-system/jsx'
 import { useTranslation } from 'react-i18next'
 
-const LegalTermsRoute = () => {
+export const LegalTermsRoute = () => {
   const { t } = useTranslation('legals')
 
   const indentedStyle = css({
@@ -72,5 +72,3 @@ const LegalTermsRoute = () => {
     </Screen>
   )
 }
-
-export default LegalTermsRoute

src/frontend/src/features/legalsTerms/TermsOfService.tsx

@@ -12,7 +12,7 @@ const ensureArray = (value: any) => {
 }
 /* eslint-enable @typescript-eslint/no-explicit-any */
 
-const TermsOfServiceRoute = () => {
+export const TermsOfServiceRoute = () => {
   const { t } = useTranslation('termsOfService')
 
   return (
@@ -199,5 +199,3 @@ const TermsOfServiceRoute = () => {
     </Screen>
   )
 }
-
-export default TermsOfServiceRoute

src/frontend/src/features/notifications/MainNotificationToast.tsx

@@ -1,19 +1,24 @@
-import { useCallback, useEffect } from 'react'
+import { useCallback, useEffect, useRef } from 'react'
 import { useRoomContext } from '@livekit/components-react'
 import { Participant, RemoteParticipant, RoomEvent } from 'livekit-client'
-import { type ChatMessage, isMobileBrowser } from '@livekit/components-core'
+import { ChatMessage, isMobileBrowser } from '@livekit/components-core'
 import { useTranslation } from 'react-i18next'
+import { Div } from '@/primitives'
 import { NotificationType } from './NotificationType'
 import { NotificationDuration } from './NotificationDuration'
 import { decodeNotificationDataReceived } from './utils'
 import { useNotificationSound } from '@/features/notifications/hooks/useSoundNotification'
-import { toastQueue } from './components/ToastProvider'
+import { ToastProvider, toastQueue } from './components/ToastProvider'
+import { WaitingParticipantNotification } from './components/WaitingParticipantNotification'
 import { layoutStore } from '@/stores/layout'
 import { PanelId } from '@/features/rooms/livekit/hooks/useSidePanel'
 import { useScreenReaderAnnounce } from '@/hooks/useScreenReaderAnnounce'
 import { Emoji } from '@/features/reactions/types'
 import { useReactions } from '@/features/reactions/hooks/useReactions'
-import { NotificationProvider } from './NotificationProvider'
+
+// Sliding window of recent chat ids kept for deduplication. Sized to comfortably
+// cover bursts and re-emits while staying negligible in memory.
+const MAX_TRACKED_CHAT_IDS = 16
 
 export const MainNotificationToast = () => {
   const room = useRoomContext()
@@ -23,12 +28,23 @@ export const MainNotificationToast = () => {
 
   const { appendReaction } = useReactions()
 
+  // Multiple Chat instances may re-emit the same RoomEvent.ChatMessage.
+  // Dedupe against a small ring of recent ids.
+  const seenChatMsgIdsRef = useRef<string[]>([])
+
   useEffect(() => {
     const handleChatMessage = (
       chatMessage: ChatMessage,
       participant?: Participant | undefined
     ) => {
       if (!participant || participant.isLocal) return
+      const id = chatMessage.id
+      if (id) {
+        const seen = seenChatMsgIdsRef.current
+        if (seen.includes(id)) return
+        seen.push(id)
+        if (seen.length > MAX_TRACKED_CHAT_IDS) seen.shift()
+      }
       triggerNotificationSound(NotificationType.MessageReceived)
       toastQueue.add(
         {
@@ -232,5 +248,10 @@ export const MainNotificationToast = () => {
   // the 'notifications' namespace might not be loaded yet
   useTranslation(['notifications'])
 
-  return <NotificationProvider />
+  return (
+    <Div position="absolute" bottom={0} right={5} zIndex={1000}>
+      <ToastProvider />
+      <WaitingParticipantNotification />
+    </Div>
+  )
 }

src/frontend/src/features/notifications/NotificationPayload.ts

@@ -1,4 +1,4 @@
-import type { NotificationType } from './NotificationType'
+import { NotificationType } from './NotificationType'
 
 export interface NotificationPayload {
   type: NotificationType

src/frontend/src/features/notifications/NotificationProvider.tsx

@@ -1,16 +0,0 @@
-import { Div } from '@/primitives'
-import { ToastProvider } from './components/ToastProvider'
-import { WaitingParticipantNotification } from './components/WaitingParticipantNotification'
-
-export const NotificationProvider = ({
-  bottom = 0,
-  right = 5,
-}: {
-  bottom?: number
-  right?: number
-}) => (
-  <Div position="absolute" bottom={bottom} right={right} zIndex={1000}>
-    <ToastProvider />
-    <WaitingParticipantNotification />
-  </Div>
-)

src/frontend/src/features/notifications/components/Toast.tsx

@@ -1,10 +1,10 @@
 import { useToast } from '@react-aria/toast'
 import { Button } from '@/primitives'
 import { RiCloseLine } from '@remixicon/react'
+import { ToastState } from '@react-stately/toast'
 import { styled } from '@/styled-system/jsx'
 import { useRef } from 'react'
-import type { ToastState } from '@react-stately/toast'
-import type { ToastData } from './ToastProvider'
+import { ToastData } from './ToastProvider'
 import type { QueuedToast } from '@react-stately/toast'
 
 export const StyledToastContainer = styled('div', {

src/frontend/src/features/notifications/components/ToastAnyRecording.tsx

@@ -1,7 +1,7 @@
 import { useToast } from '@react-aria/toast'
 import { useMemo, useRef } from 'react'
 
-import { StyledToastContainer, type ToastProps } from './Toast'
+import { StyledToastContainer, ToastProps } from './Toast'
 import { HStack } from '@/styled-system/jsx'
 import { useTranslation } from 'react-i18next'
 import { NotificationType } from '../NotificationType'

src/frontend/src/features/notifications/components/ToastJoined.tsx

@@ -6,7 +6,7 @@ import Source = Track.Source
 
 import { useMaybeLayoutContext } from '@livekit/components-react'
 import { ParticipantTile } from '@/features/rooms/livekit/components/ParticipantTile'
-import { StyledToastContainer, type ToastProps } from './Toast'
+import { StyledToastContainer, ToastProps } from './Toast'
 import { HStack, styled } from '@/styled-system/jsx'
 import { Div } from '@/primitives'
 import { useTranslation } from 'react-i18next'

src/frontend/src/features/notifications/components/ToastLowerHand.tsx

@@ -1,7 +1,7 @@
 import { useToast } from '@react-aria/toast'
 import { useRef } from 'react'
 
-import { StyledToastContainer, type ToastProps } from './Toast'
+import { StyledToastContainer, ToastProps } from './Toast'
 import { HStack } from '@/styled-system/jsx'
 import { useTranslation } from 'react-i18next'
 import { Button } from '@/primitives'

src/frontend/src/features/notifications/components/ToastMessageReceived.tsx

@@ -1,7 +1,7 @@
 import { useToast } from '@react-aria/toast'
 import { useEffect, useRef } from 'react'
 
-import { StyledToastContainer, type ToastProps } from './Toast'
+import { StyledToastContainer, ToastProps } from './Toast'
 import { Text } from '@/primitives'
 import { RiMessage2Line } from '@remixicon/react'
 import { useSidePanel } from '@/features/rooms/livekit/hooks/useSidePanel'

src/frontend/src/features/notifications/components/ToastMuted.tsx

@@ -1,7 +1,7 @@
 import { useToast } from '@react-aria/toast'
 import { useRef } from 'react'
 
-import { StyledToastContainer, type ToastProps } from './Toast'
+import { StyledToastContainer, ToastProps } from './Toast'
 import { HStack } from '@/styled-system/jsx'
 import { useTranslation } from 'react-i18next'
 

src/frontend/src/features/notifications/components/ToastPermissionsRemoved.tsx

@@ -1,7 +1,7 @@
 import { useToast } from '@react-aria/toast'
 import { useMemo, useRef } from 'react'
 
-import { StyledToastContainer, type ToastProps } from './Toast'
+import { StyledToastContainer, ToastProps } from './Toast'
 import { HStack } from '@/styled-system/jsx'
 import { useTranslation } from 'react-i18next'
 

src/frontend/src/features/notifications/components/ToastProvider.tsx

@@ -2,7 +2,7 @@
 import { ToastQueue, useToastQueue } from '@react-stately/toast'
 import { ToastRegion } from './ToastRegion'
 import { Participant } from 'livekit-client'
-import type { NotificationType } from '../NotificationType'
+import { NotificationType } from '../NotificationType'
 
 export interface ToastData {
   participant?: Participant

src/frontend/src/features/notifications/components/ToastRaised.tsx

@@ -1,7 +1,7 @@
 import { useToast } from '@react-aria/toast'
 import { useRef } from 'react'
 
-import { StyledToastContainer, type ToastProps } from './Toast'
+import { StyledToastContainer, ToastProps } from './Toast'
 import { HStack } from '@/styled-system/jsx'
 import { Button, Div } from '@/primitives'
 import { useTranslation } from 'react-i18next'

src/frontend/src/features/notifications/components/ToastRecordingRequest.tsx

@@ -1,7 +1,7 @@
 import { useToast } from '@react-aria/toast'
 import { useMemo, useRef } from 'react'
 
-import { StyledToastContainer, type ToastProps } from './Toast'
+import { StyledToastContainer, ToastProps } from './Toast'
 import { HStack } from '@/styled-system/jsx'
 import { useTranslation } from 'react-i18next'
 import { NotificationType } from '../NotificationType'

src/frontend/src/features/notifications/components/ToastRecordingSaving.tsx

@@ -2,10 +2,10 @@ import { useToast } from '@react-aria/toast'
 import { useMemo, useRef } from 'react'
 import { Text } from '@/primitives'
 
-import { StyledToastContainer, type ToastProps } from './Toast'
+import { StyledToastContainer, ToastProps } from './Toast'
 import { HStack } from '@/styled-system/jsx'
 import { useTranslation } from 'react-i18next'
-import { useUser } from '@/features/auth/api/useUser'
+import { useUser } from '@/features/auth'
 import { css } from '@/styled-system/css'
 import { RecordingMode } from '@/features/recording'
 

src/frontend/src/features/notifications/hooks/useNotifyParticipants.ts

@@ -1,6 +1,6 @@
 import { useRoomContext } from '@livekit/components-react'
-import type { NotificationType } from '../NotificationType'
-import type { NotificationPayload } from '../NotificationPayload'
+import { NotificationType } from '../NotificationType'
+import { NotificationPayload } from '../NotificationPayload'
 
 export const useNotifyParticipants = () => {
   const room = useRoomContext()

src/frontend/src/features/notifications/hooks/useSoundNotification.tsx

@@ -1,7 +1,7 @@
 import useSound from 'use-sound'
 import { useSnapshot } from 'valtio'
 import { notificationsStore } from '@/stores/notifications'
-import type { NotificationType } from '@/features/notifications/NotificationType'
+import { NotificationType } from '@/features/notifications/NotificationType'
 
 // fixme - handle dynamic audio output changes
 export const useNotificationSound = () => {

src/frontend/src/features/notifications/utils.ts

@@ -1,9 +1,9 @@
 import { toastQueue } from './components/ToastProvider'
 import { NotificationType } from './NotificationType'
 import { NotificationDuration } from './NotificationDuration'
-import type { Participant } from 'livekit-client'
-import type { NotificationPayload } from './NotificationPayload'
-import type { RecordingMode } from '@/features/recording'
+import { Participant } from 'livekit-client'
+import { NotificationPayload } from './NotificationPayload'
+import { RecordingMode } from '@/features/recording'
 
 export const showLowerHandToast = (
   participant: Participant,

src/frontend/src/features/pip/components/DocumentPiPPortal.tsx

@@ -0,0 +1,236 @@
+import { type ReactNode, useEffect, useMemo, useRef, useState } from 'react'
+import { createPortal } from 'react-dom'
+import { useTranslation } from 'react-i18next'
+import { useDocumentPiP } from '../hooks/useDocumentPiP'
+import { useScreenReaderAnnounce } from '@/hooks/useScreenReaderAnnounce'
+import { useRestoreFocus } from '@/hooks/useRestoreFocus'
+import { UNSAFE_PortalProvider as PortalProvider } from '@react-aria/overlays'
+import { VisualOnlyTooltipsContext } from '@/primitives/VisualOnlyTooltipsContext'
+
+// Minimal base styles so the PiP window renders correctly on first paint.
+const ensureBaseStyles = (target: Document) => {
+  if (target.getElementById('pip-base-styles')) return
+  const style = target.createElement('style')
+  style.id = 'pip-base-styles'
+  style.textContent = `
+    html, body { margin: 0; padding: 0; height: 100%; background: #0b0f19; }
+    body { overflow: hidden; }
+    * { box-sizing: border-box; }
+  `
+  target.head.appendChild(style)
+}
+
+// Clone existing styles to keep the PiP window visually consistent.
+const copyStyles = (source: Document, target: Document) => {
+  if (target.getElementById('pip-style-clone')) return
+  const marker = target.createElement('meta')
+  marker.id = 'pip-style-clone'
+  target.head.appendChild(marker)
+
+  source.querySelectorAll('style, link[rel="stylesheet"]').forEach((node) => {
+    const cloned = node.cloneNode(true) as HTMLElement
+    target.head.appendChild(cloned)
+  })
+}
+
+const syncThemeAttribute = (source: Document, target: Document) => {
+  const theme = source.documentElement.dataset.lkTheme
+  if (theme) {
+    target.documentElement.dataset.lkTheme = theme
+  } else {
+    delete target.documentElement.dataset.lkTheme
+  }
+}
+
+const cssVarNameCacheByElement = new WeakMap<HTMLElement, string[]>()
+const cssVarNameCacheByUri = new Map<string, string[]>()
+
+const syncCssVariables = (source: Document, target: Document) => {
+  const sourceView = source.defaultView
+  if (!sourceView) return
+
+  const getCachedVarNames = () => {
+    const docEl = source.documentElement
+    if (!docEl) return []
+
+    const cachedByElement = cssVarNameCacheByElement.get(docEl)
+    if (cachedByElement) return cachedByElement
+
+    const cachedByUri = source.baseURI
+      ? cssVarNameCacheByUri.get(source.baseURI)
+      : undefined
+    if (cachedByUri) return cachedByUri
+
+    const varNames = new Set<string>()
+    const collectVarsFrom = (element: HTMLElement | null) => {
+      if (!element) return
+      const styles = sourceView.getComputedStyle(element)
+      for (const property of Array.from(styles)) {
+        if (property.startsWith('--')) {
+          varNames.add(property)
+        }
+      }
+    }
+
+    collectVarsFrom(source.documentElement)
+    collectVarsFrom(source.body)
+
+    const result = Array.from(varNames)
+    cssVarNameCacheByElement.set(docEl, result)
+    if (source.baseURI) {
+      cssVarNameCacheByUri.set(source.baseURI, result)
+    }
+    return result
+  }
+
+  const varNames = getCachedVarNames()
+  if (!varNames.length) return
+
+  const rootStyles = sourceView.getComputedStyle(source.documentElement)
+  const bodyStyles = source.body
+    ? sourceView.getComputedStyle(source.body)
+    : null
+
+  varNames.forEach((property) => {
+    const bodyValue = bodyStyles?.getPropertyValue(property)
+    const value = bodyValue || rootStyles.getPropertyValue(property)
+    if (value) {
+      target.documentElement.style.setProperty(property, value)
+    }
+  })
+}
+
+/**
+ * React portal into a Document Picture-in-Picture window. Handles window
+ * lifecycle, style/theme sync and routes React Aria overlays via
+ * `UNSAFE_PortalProvider` so they render inside the PiP document.
+ */
+export const DocumentPiPPortal = ({
+  isOpen,
+  width,
+  height,
+  children,
+  onClose,
+}: {
+  isOpen: boolean
+  width?: number
+  height?: number
+  children: React.ReactNode
+  onClose?: () => void
+}): ReactNode => {
+  const { openPiP, closePiP, pipWindow, isSupported } = useDocumentPiP({
+    width,
+    height,
+  })
+  const { t } = useTranslation('rooms', {
+    keyPrefix: 'options.items.pictureInPicture',
+  })
+  const announce = useScreenReaderAnnounce()
+  const [container, setContainer] = useState<HTMLElement | null>(null)
+  const containerRef = useRef<HTMLElement | null>(null)
+  const prevOpenRef = useRef(false)
+
+  useEffect(() => {
+    if (!isOpen) {
+      closePiP()
+      setContainer(null)
+      containerRef.current = null
+      return
+    }
+
+    if (!isSupported) return
+
+    let cancelled = false
+    openPiP().then((win) => {
+      if (!win || cancelled) return
+      const doc = win.document
+      ensureBaseStyles(doc)
+      copyStyles(document, doc)
+      syncThemeAttribute(document, doc)
+      syncCssVariables(document, doc)
+
+      doc.documentElement.setAttribute('lang', document.documentElement.lang)
+      doc.title = t('windowLabel')
+
+      const existingContainer = containerRef.current
+      if (!existingContainer || existingContainer.ownerDocument !== doc) {
+        const nextContainer = doc.createElement('div')
+        nextContainer.id = 'pip-root'
+        nextContainer.style.width = '100%'
+        nextContainer.style.height = '100%'
+        nextContainer.style.display = 'flex'
+        nextContainer.style.alignItems = 'stretch'
+        nextContainer.style.justifyContent = 'center'
+        doc.body.appendChild(nextContainer)
+        containerRef.current = nextContainer
+        setContainer(nextContainer)
+      } else {
+        setContainer(existingContainer)
+      }
+    })
+
+    return () => {
+      cancelled = true
+    }
+  }, [closePiP, isOpen, isSupported, openPiP, t])
+
+  // Focus stays on the trigger; PiP is announced as an auxiliary surface.
+  useEffect(() => {
+    const wasOpen = prevOpenRef.current
+    prevOpenRef.current = isOpen
+
+    if (isOpen && !wasOpen) {
+      announce(t('opened'), 'polite')
+    }
+    if (!isOpen && wasOpen) {
+      announce(t('closed'), 'polite')
+    }
+  }, [isOpen, announce, t])
+
+  useRestoreFocus(isOpen, { restoreFocusRaf: true })
+
+  // Escape from either document closes PiP (unless a nested overlay handled it).
+  useEffect(() => {
+    if (!isOpen) return
+    const handleKeyDown = (event: KeyboardEvent) => {
+      if (event.key !== 'Escape' || event.defaultPrevented) return
+      event.preventDefault()
+      onClose?.()
+    }
+    document.addEventListener('keydown', handleKeyDown)
+    pipWindow?.document.addEventListener('keydown', handleKeyDown)
+    return () => {
+      document.removeEventListener('keydown', handleKeyDown)
+      pipWindow?.document.removeEventListener('keydown', handleKeyDown)
+    }
+  }, [isOpen, onClose, pipWindow])
+
+  useEffect(() => {
+    if (!pipWindow) return
+    const handleClose = () => {
+      containerRef.current = null
+      setContainer(null)
+      onClose?.()
+    }
+    pipWindow.addEventListener('pagehide', handleClose)
+    pipWindow.addEventListener('beforeunload', handleClose)
+    return () => {
+      pipWindow.removeEventListener('pagehide', handleClose)
+      pipWindow.removeEventListener('beforeunload', handleClose)
+    }
+  }, [onClose, pipWindow])
+
+  const portal = useMemo(() => {
+    if (!container) return null
+    return createPortal(
+      <PortalProvider getContainer={() => container}>
+        <VisualOnlyTooltipsContext.Provider value={true}>
+          {children}
+        </VisualOnlyTooltipsContext.Provider>
+      </PortalProvider>,
+      container
+    )
+  }, [children, container])
+
+  return portal as unknown as ReactNode
+}

src/frontend/src/features/pip/components/PictureInPictureConference.tsx

@@ -1,8 +0,0 @@
-import { PictureInPicturePortal } from '@/features/pip/components/PictureInPicturePortal'
-import { PipView } from '@/features/pip/components/PipView'
-
-export const PictureInPictureConference = () => (
-  <PictureInPicturePortal>
-    <PipView />
-  </PictureInPicturePortal>
-)

src/frontend/src/features/pip/components/PictureInPicturePortal.tsx

@@ -1,56 +0,0 @@
-import { usePictureInPicture } from '../hooks/usePictureInPicture'
-import { createPortal } from 'react-dom'
-import { UNSAFE_PortalProvider } from '@react-aria/overlays'
-import { documentPictureInPictureStore } from '@/stores/documentPictureInPicture'
-import { useSnapshot } from 'valtio'
-import { useEffect, useMemo } from 'react'
-import { CrossDocumentOverlaysContext } from '@/primitives/CrossDocumentOverlaysContext'
-
-const InternalPortal = ({ children }: { children: React.ReactNode }) => {
-  const pipStoreSnap = useSnapshot(documentPictureInPictureStore)
-
-  const container = useMemo(() => {
-    return pipStoreSnap?.window?.document.getElementById('root')
-  }, [pipStoreSnap.window])
-
-  useEffect(() => {
-    return () => {
-      documentPictureInPictureStore.window?.close()
-    }
-  }, [])
-
-  if (!container) return null
-
-  return createPortal(
-    /**
-     * UNSAFE_PortalProvider is marked unsafe because overlays are normally
-     * portalled to `document.body` to avoid clipping, stacking, and accessibility
-     * issues. Redirecting them to another container can break those guarantees.
-     *
-     * We accept that risk here because the PiP window is a separate document with
-     * its own `body`. Rendering overlays into the main document would make them
-     * invisible in PiP, so we intentionally portal them into the PiP document root
-     * instead.
-     */
-    <UNSAFE_PortalProvider getContainer={() => container}>
-      {/*React Aria computes overlay position based on the main window size, so*/}
-      {/*we must disable it to position overlays correctly across documents.*/}
-      <CrossDocumentOverlaysContext.Provider value={true}>
-        {children}
-      </CrossDocumentOverlaysContext.Provider>
-    </UNSAFE_PortalProvider>,
-    container
-  )
-}
-
-export const PictureInPicturePortal = ({
-  children,
-}: {
-  children: React.ReactNode
-}): React.ReactNode => {
-  const { isSupported } = usePictureInPicture()
-
-  if (!isSupported) return null
-
-  return <InternalPortal>{children}</InternalPortal>
-}

src/frontend/src/features/pip/components/PipControlBar.tsx

@@ -1,15 +1,17 @@
 import { styled } from '@/styled-system/jsx'
+import { useRef, useMemo, useCallback } from 'react'
 import { useTranslation } from 'react-i18next'
+import { useRegisterKeyboardShortcut } from '@/features/shortcuts/useRegisterKeyboardShortcut'
+import { findFirstFocusable } from '@/utils/dom'
 import { AudioDevicesControl } from '@/features/rooms/livekit/components/controls/Device/AudioDevicesControl'
 import { VideoDeviceControl } from '@/features/rooms/livekit/components/controls/Device/VideoDeviceControl'
 import { ScreenShareToggle } from '@/features/rooms/livekit/components/controls/ScreenShareToggle'
 import { LeaveButton } from '@/features/rooms/livekit/components/controls/LeaveButton'
 import { HandToggle } from '@/features/rooms/livekit/components/controls/HandToggle'
 import { StartMediaButton } from '@/features/rooms/livekit/components/controls/StartMediaButton'
-import { ReactionsToggle } from '@/features/reactions/components/ReactionsToggle'
-import { PipOptionsMenu } from './controls/PipOptionsMenu'
 import { usePipElementSize } from '../hooks/usePipElementSize'
-import { useMemo, useRef } from 'react'
+import { PipOptionsMenu } from './controls/PipOptionsMenu'
+import { ReactionsToggle } from '@/features/reactions/components/ReactionsToggle'
 
 export const CollapsibleControls = {
   HAND: 'hand',
@@ -57,7 +59,7 @@ export const PipControlBar = ({
   const containerRef = useRef<HTMLDivElement>(null)
   const { width } = usePipElementSize(containerRef)
   const { t } = useTranslation('rooms', {
-    keyPrefix: 'pictureInPicture',
+    keyPrefix: 'options.items.pictureInPicture',
   })
 
   const hidden = useMemo(
@@ -65,6 +67,14 @@ export const PipControlBar = ({
     [width, showScreenShare]
   )
 
+  useRegisterKeyboardShortcut({
+    id: 'focus-toolbar',
+    handler: useCallback(() => {
+      const doc = containerRef.current?.ownerDocument ?? document
+      findFirstFocusable(doc.getElementById('pip-control-bar'))?.focus()
+    }, []),
+  })
+
   return (
     <PipControls
       ref={containerRef}
@@ -75,14 +85,16 @@ export const PipControlBar = ({
       <PipControlsCenter>
         <AudioDevicesControl hideMenu />
         <VideoDeviceControl hideMenu />
-        {!hidden.has(CollapsibleControls.REACTIONS) && <ReactionsToggle />}
+        {!hidden.has(CollapsibleControls.REACTIONS) && (
+          <ReactionsToggle id="pip-reactions-toggle" />
+        )}
         {showScreenShare && !hidden.has(CollapsibleControls.SCREEN_SHARE) && (
           <ScreenShareToggle />
         )}
         {!hidden.has(CollapsibleControls.HAND) && <HandToggle />}
-        <StartMediaButton />
         <PipOptionsMenu overflowControls={hidden} />
         <LeaveButton />
+        <StartMediaButton />
       </PipControlsCenter>
     </PipControls>
   )
@@ -95,12 +107,10 @@ const PipControls = styled('div', {
     justifyContent: 'center',
     alignItems: 'center',
     gap: '0.5rem',
-    padding: '1.125rem',
+    padding: '0.5rem 0.75rem',
+    backgroundColor: 'primaryDark.50',
     width: '100%',
-    position: 'absolute',
-    bottom: 0,
-    left: 0,
-    right: 0,
+    position: 'relative',
   },
 })
 

src/frontend/src/features/pip/components/PipPlaceholder.tsx

@@ -0,0 +1,85 @@
+import { useTranslation } from 'react-i18next'
+import { styled } from '@/styled-system/jsx'
+import { useRoomPiP } from '../hooks/useRoomPiP'
+
+export const PipPlaceholder = () => {
+  const { t } = useTranslation('rooms', {
+    keyPrefix: 'options.items.pictureInPicture.placeholder',
+  })
+  const { close } = useRoomPiP()
+
+  return (
+    <Container>
+      <Illustration
+        src="/assets/pip.svg"
+        alt=""
+        width={102}
+        height={72}
+        aria-hidden="true"
+      />
+      <Title>{t('title')}</Title>
+      <Description>{t('description')}</Description>
+      <BringBackLink onClick={close}>{t('bringBack')}</BringBackLink>
+    </Container>
+  )
+}
+
+const Container = styled('div', {
+  base: {
+    display: 'flex',
+    flexDirection: 'column',
+    alignItems: 'center',
+    justifyContent: 'center',
+    width: '100%',
+    height: '100%',
+    gap: '0.5rem',
+    padding: '1.5rem',
+    textAlign: 'center',
+  },
+})
+
+const Illustration = styled('img', {
+  base: {
+    marginBottom: '0.25rem',
+  },
+})
+
+const Title = styled('p', {
+  base: {
+    color: 'white',
+    fontSize: '0.875rem',
+    fontWeight: 600,
+    lineHeight: 1.3,
+    margin: 0,
+  },
+})
+
+const Description = styled('p', {
+  base: {
+    color: '#DFE2EA',
+    fontSize: '0.75rem',
+    fontWeight: 400,
+    lineHeight: 1.4,
+    margin: 0,
+    maxWidth: '312px',
+  },
+})
+
+const BringBackLink = styled('button', {
+  base: {
+    color: '#A2B6FF',
+    fontSize: '0.75rem',
+    fontWeight: 500,
+    lineHeight: 1.4,
+    cursor: 'pointer',
+    marginTop: '0.25rem',
+    borderRadius: '2px',
+    _hover: {
+      textDecoration: 'underline',
+    },
+    _focusVisible: {
+      outline: '2px solid #A2B6FF',
+      outlineOffset: '2px',
+    },
+  },
+})

src/frontend/src/features/pip/components/PipReactionPortals.tsx

@@ -1,11 +1,15 @@
-import { useSnapshot } from 'valtio'
-import { reactionsStore } from '@/stores/reactions'
 import { useMemo, useRef } from 'react'
-import { FloatingReaction } from '@/features/reactions/components/ReactionPortals'
-import { Reaction } from '@/features/reactions/types'
+import { useSnapshot } from 'valtio'
 import { css } from '@/styled-system/css'
+import { reactionsStore } from '@/stores/reactions'
+import { FloatingReaction } from '@/features/reactions/components/ReactionPortals'
+import type { Reaction } from '@/features/reactions/types'
 
-export const PipFloatingReactions = () => {
+/**
+ * Renders floating emoji reactions inside the PiP window.
+ * Reads the same shared reactionsStore used by the main window.
+ */
+export const PipReactionPortals = () => {
   const { reactions } = useSnapshot(reactionsStore)
 
   return (
@@ -21,6 +25,7 @@ const PipFloatingReaction = ({ reaction }: { reaction: Reaction }) => {
   const containerRef = useRef<HTMLDivElement>(null)
   const speed = useMemo(() => Math.random() * 1.5 + 0.5, [])
   const scale = useMemo(() => Math.max(Math.random() + 0.5, 1), [])
+
   return (
     <div
       ref={containerRef}

src/frontend/src/features/pip/components/PipRoomPlaceholder.tsx

@@ -1,48 +0,0 @@
-import { useTranslation } from 'react-i18next'
-import { styled } from '@/styled-system/jsx'
-import { usePictureInPicture } from '../hooks/usePictureInPicture'
-import { Button, Text } from '@/primitives'
-
-export const PipRoomPlaceholder = () => {
-  const { t } = useTranslation('rooms', {
-    keyPrefix: 'pictureInPicture.placeholder',
-  })
-  const { close } = usePictureInPicture()
-
-  return (
-    <Container>
-      <img
-        src="/assets/pip.svg"
-        alt=""
-        width={300}
-        height={72}
-        aria-hidden="true"
-        style={{
-          marginBottom: '0.25rem',
-        }}
-      />
-      <Text variant="body">{t('title')}</Text>
-      <Text variant="sm" style={{ maxWidth: '312px' }}>
-        {t('description')}
-      </Text>
-      <Button variant="primaryTextDark" onPress={close}>
-        {t('bringBack')}
-      </Button>
-    </Container>
-  )
-}
-
-const Container = styled('div', {
-  base: {
-    display: 'flex',
-    flexDirection: 'column',
-    alignItems: 'center',
-    justifyContent: 'center',
-    width: '100%',
-    height: '100%',
-    gap: '0.5rem',
-    padding: '1.5rem',
-    textAlign: 'center',
-    color: 'white',
-  },
-})