✨(frontend) add connection test feature

Introduce a new connection test page to allow users to verify
their device and network compatibility with the application.
The feature also supports generating and downloading a detailed report
of the test results.

CHANGELOG.md

@@ -12,6 +12,7 @@ and this project adheres to
 
 - ✨(summary) report exception type in failure analytics
 - ✨(frontend) add configurable documentation menu item
+- ✨(frontend) add connection test feature
 
 ## Fixed
 

src/backend/core/api/connection_test.py

@@ -0,0 +1,42 @@
+"""Connection test API endpoint."""
+
+from datetime import timedelta
+from uuid import uuid4
+
+from django.conf import settings
+
+from rest_framework.decorators import api_view, throttle_classes
+from rest_framework.response import Response
+
+from core.api.throttling import (
+    ConnectionTestAnonRateThrottle,
+    ConnectionTestUserRateThrottle,
+)
+from core.utils import generate_token
+
+CONNECTION_TEST_USERNAME = "Test connexion"
+
+
+@api_view(["GET"])
+@throttle_classes([ConnectionTestUserRateThrottle, ConnectionTestAnonRateThrottle])
+def get_connection_test_config(request):
+    """Return a short-lived LiveKit token for an ephemeral connection test room."""
+    room = f"{settings.CONNECTION_TEST_ROOM_PREFIX}{uuid4()}"
+    expires_in = settings.CONNECTION_TEST_TOKEN_TTL_SECONDS
+
+    return Response(
+        {
+            "livekit": {
+                "url": settings.LIVEKIT_CONFIGURATION["url"],
+                "room": room,
+                "token": generate_token(
+                    room=room,
+                    user=request.user,
+                    username=CONNECTION_TEST_USERNAME,
+                    is_admin_or_owner=False,
+                    ttl=timedelta(seconds=expires_in),
+                ),
+                "expires_in": expires_in,
+            },
+        }
+    )

src/backend/core/api/permissions.py

@@ -6,11 +6,6 @@ from django.http import Http404
 from rest_framework import permissions
 
 from ..models import RoleChoices
-from ..services.participants_management import (
-    ParticipantNotFoundException,
-    ParticipantsManagement,
-    ParticipantsManagementException,
-)
 
 ACTION_FOR_METHOD_TO_PERMISSION = {
     "versions_detail": {"DELETE": "versions_destroy", "GET": "versions_retrieve"}
@@ -171,30 +166,3 @@ class CanMuteParticipant(permissions.BasePermission):
 
         # LiveKit token scoped to this room
         return request.auth.video.room == str(obj.id)
-
-
-class IsPresentInMeeting(permissions.BasePermission):
-    """Check that the requesting user is currently connected to the meeting.
-
-    The requester must be session-authenticated (their DB identity is needed
-    to check privileges); presence is verified against LiveKit using their
-    `sub` as participant identity. Fails closed on LiveKit errors.
-    """
-
-    message = "You must be connected to the meeting to perform this action."
-
-    def has_object_permission(self, request, view, obj):
-        """Verify the requester's identity is a participant of the room."""
-        user = request.user
-
-        if not user or not user.is_authenticated:
-            return False
-
-        try:
-            return ParticipantsManagement().check_if_in_meeting(
-                room_name=str(obj.pk), identity=str(user.sub)
-            )
-        except ParticipantNotFoundException:
-            return False
-        except ParticipantsManagementException:
-            return False

src/backend/core/api/serializers.py

@@ -183,12 +183,13 @@ class RoomSerializer(serializers.ModelSerializer):
                 user=request.user,
                 username=username,
                 configuration=output["configuration"],
-                role=role,
-                is_authenticated=request.user.is_authenticated,
+                is_admin_or_owner=is_admin_or_owner,
             )
         else:
             del output["pin_code"]
 
+        output["is_administrable"] = is_admin_or_owner
+
         return output
 
 
@@ -311,15 +312,6 @@ class MuteParticipantSerializer(BaseParticipantsManagementSerializer):
     )
 
 
-class ParticipantRoleSerializer(BaseParticipantsManagementSerializer):
-    """Validate an in-meeting role change (promotion/demotion) request."""
-
-    role = serializers.ChoiceField(
-        choices=[models.RoleChoices.MEMBER, models.RoleChoices.ADMIN],
-        help_text="Target role. Ownership cannot be granted this way.",
-    )
-
-
 TrackSource = Literal["camera", "microphone", "screen_share", "screen_share_audio"]
 
 

src/backend/core/api/throttling.py

@@ -73,3 +73,15 @@ class CreationCallbackAnonRateThrottle(MonitoredAnonRateThrottle):
     """Throttle Anonymous user requesting room generation callback"""
 
     scope = "creation_callback"
+
+
+class ConnectionTestUserRateThrottle(MonitoredUserRateThrottle):
+    """Throttle authenticated users requesting connection test tokens."""
+
+    scope = "connection_test"
+
+
+class ConnectionTestAnonRateThrottle(MonitoredAnonRateThrottle):
+    """Throttle anonymous users requesting connection test tokens."""
+
+    scope = "connection_test"

src/backend/core/api/viewsets.py

@@ -88,10 +88,6 @@ from core.services.room_management import (
     RoomManagementException,
     RoomNotFoundException,
 )
-from core.services.room_roles import (
-    RoomRoleError,
-    RoomRoleService,
-)
 from core.services.subtitle import SubtitleException, SubtitleService
 from core.tasks.file import process_file_deletion
 
@@ -643,53 +639,6 @@ class RoomViewSet(
             status=drf_status.HTTP_200_OK,
         )
 
-    @decorators.action(
-        detail=True,
-        methods=["post"],
-        url_path="update-participant-role",
-        permission_classes=[
-            permissions.HasPrivilegesOnRoom,
-            permissions.IsPresentInMeeting,
-        ],
-    )
-    def update_participant_role(self, request, pk=None):  # pylint: disable=unused-argument
-        """Promote or demote a participant currently connected to the meeting.
-
-        Requires the requester to be session-authenticated, have privileges
-        (admin/owner) on the room, and be connected to the meeting.
-
-        If the target participant has a user account, the role is persisted
-        (`ResourceAccess`) then mirrored to their LiveKit attributes.
-
-        If the participant is anonymous, the promotion will fail.
-        """
-
-        room = self.get_object()
-
-        serializer = serializers.ParticipantRoleSerializer(data=request.data)
-        serializer.is_valid(raise_exception=True)
-
-        participant_identity = serializer.validated_data["participant_identity"]
-        role = serializer.validated_data["role"]
-
-        if str(request.user.sub) == str(participant_identity):
-            return drf_response.Response(
-                {"error": "You cannot change your own role."},
-                status=drf_status.HTTP_403_FORBIDDEN,
-            )
-
-        try:
-            result = RoomRoleService().set_participant_role(
-                room=room,
-                participant_identity=participant_identity,
-                role=role,
-                actor=request.user,
-            )
-        except RoomRoleError as e:
-            return drf_response.Response({"error": str(e)}, status=e.status_code)
-
-        return drf_response.Response(result, status=drf_status.HTTP_200_OK)
-
     @decorators.action(
         detail=True,
         methods=["post"],

src/backend/core/services/livekit_events.py

@@ -218,9 +218,21 @@ class LiveKitEventsService:
 
         # Silently ignoring EGRESS_ABORTED, EGRESS_FAILED
 
+    @staticmethod
+    def _is_connection_test_room(room_name: str) -> bool:
+        """Return True for ephemeral rooms created by the connection test endpoint."""
+        return room_name.startswith(settings.CONNECTION_TEST_ROOM_PREFIX)
+
     def _handle_room_started(self, data):
         """Handle 'room_started' event."""
 
+        if self._is_connection_test_room(data.room.name):
+            logger.info(
+                "Ignoring room_started event for connection test room '%s'.",
+                data.room.name,
+            )
+            return
+
         try:
             room_id = uuid.UUID(data.room.name)
         except ValueError as e:
@@ -246,6 +258,13 @@ class LiveKitEventsService:
     def _handle_room_finished(self, data):
         """Handle 'room_finished' event."""
 
+        if self._is_connection_test_room(data.room.name):
+            logger.info(
+                "Ignoring room_finished event for connection test room '%s'.",
+                data.room.name,
+            )
+            return
+
         try:
             room_id = uuid.UUID(data.room.name)
         except ValueError as e:

src/backend/core/services/lobby.py

@@ -162,6 +162,7 @@ class LobbyService:
                 username=username,
                 color=participant.color,
                 configuration=room.configuration,
+                is_admin_or_owner=False,
                 participant_id=participant_id,
             )
             return participant, livekit_config
@@ -182,6 +183,7 @@ class LobbyService:
                 username=username,
                 color=participant.color,
                 configuration=room.configuration,
+                is_admin_or_owner=False,
                 participant_id=participant_id,
             )
 

src/backend/core/services/room_roles.py

@@ -1,178 +0,0 @@
-"""Room role management service.
-
-Single entry point for changing a user's role on a room, used by:
-- the in-meeting endpoint (promote/demote a connected participant)
-- (more to come soon)
-
-`ResourceAccess` is the source of truth. The LiveKit `room_role`
-participant attribute is only a projection of it, synced best-effort.
-"""
-
-from logging import getLogger
-from uuid import UUID
-
-from core import models
-from core.services.participants_management import (
-    ParticipantNotFoundException,
-    ParticipantsManagement,
-    ParticipantsManagementException,
-)
-
-logger = getLogger(__name__)
-
-
-class RoomRoleError(Exception):
-    """Base exception for room role management errors."""
-
-    status_code = 400
-
-
-class SelfActionError(RoomRoleError):
-    """Raised when a user tries to change their own role."""
-
-    status_code = 403
-
-
-class OwnerRoleError(RoomRoleError):
-    """Raised when trying to demote an owner or grant ownership."""
-
-    status_code = 403
-
-
-class ParticipantNotInMeetingError(RoomRoleError):
-    """Raised when the target participant is not connected to the meeting."""
-
-    status_code = 404
-
-
-class UserNotFoundError(RoomRoleError):
-    """Raised when the target participant has no user account in database."""
-
-    status_code = 404
-
-
-ASSIGNABLE_ROLES = (models.RoleChoices.MEMBER, models.RoleChoices.ADMIN)
-
-
-class RoomRoleService:
-    """Manage promotion and demotion of room co-hosts."""
-
-    def set_role(
-        self, room: models.Room, user: models.User, role: str, actor: models.User
-    ):
-        """Persist `role` for `user` on `room`, idempotently and atomically.
-
-        Returns the up-to-date `ResourceAccess`. Never grants or removes
-        ownership: granting OWNER is refused, and an existing OWNER access
-        is never modified.
-        """
-
-        if role not in ASSIGNABLE_ROLES:
-            raise OwnerRoleError("Ownership cannot be granted through this action.")
-
-        if actor is not None and user == actor:
-            raise SelfActionError("You cannot change your own role.")
-
-        access, created = models.ResourceAccess.objects.get_or_create(
-            resource=room,
-            user=user,
-            defaults={"role": role},
-        )
-
-        if created:
-            return access
-
-        if access.role == models.RoleChoices.OWNER:
-            raise OwnerRoleError("Room owners cannot be demoted.")
-
-        if access.role != role:
-            access.role = role
-            access.save(update_fields=["role", "updated_at"])
-
-        return access
-
-    def set_participant_role(
-        self,
-        room: models.Room,
-        participant_identity: UUID,
-        role: str,
-        actor: models.User,
-    ):
-        """Change the role of a participant currently connected to the meeting.
-
-        - The participant must be connected (checked against LiveKit).
-        - The participant must map to a user account.
-        - The role is persisted in DB then mirrored to LiveKit.
-
-        Returns a dict: {"role", "livekit_synced"}.
-        """
-
-        room_name = str(room.pk)
-        participants_management = ParticipantsManagement()
-
-        try:
-            is_in_meeting = participants_management.check_if_in_meeting(
-                room_name=room_name, identity=str(participant_identity)
-            )
-        except ParticipantNotFoundException as e:
-            raise ParticipantNotInMeetingError(
-                "Participant is not connected to this meeting."
-            ) from e
-
-        if not is_in_meeting:
-            raise ParticipantNotInMeetingError(
-                "Participant is not connected to this meeting."
-            )
-
-        user = models.User.objects.filter(sub=participant_identity).first()
-
-        if user is None:
-            raise UserNotFoundError(
-                "This participant has no user account and cannot be assigned a role."
-            )
-
-        # Source of truth first: even if the LiveKit sync below fails,
-        # the role is real and any fresh token will carry it.
-        self.set_role(room=room, user=user, role=role, actor=actor)
-
-        livekit_synced = self._sync_livekit_role(
-            room_name=room_name,
-            participant_identity=str(participant_identity),
-            role=str(role),
-        )
-
-        return {
-            "role": role,
-            "livekit_synced": livekit_synced,
-        }
-
-    @staticmethod
-    def _sync_livekit_role(room_name: str, participant_identity: str, role: str):
-        """Mirror the role to the participant's LiveKit attributes.
-
-        Best-effort: returns False on failure instead of raising, so callers
-        can report a partial success. Re-running the action re-syncs.
-        """
-        try:
-            ParticipantsManagement().update(
-                room_name=room_name,
-                identity=participant_identity,
-                attributes={"room_role": role},
-            )
-        except ParticipantNotFoundException:
-            # The participant left between the presence check and the update:
-            # harmless, the DB state (if any) remains authoritative.
-            logger.info(
-                "Participant %s left room %s before role sync",
-                participant_identity,
-                room_name,
-            )
-            return False
-        except ParticipantsManagementException:
-            logger.exception(
-                "Could not sync role to LiveKit for participant %s in room %s",
-                participant_identity,
-                room_name,
-            )
-            return False
-        return True

src/backend/core/tests/rooms/test_api_rooms_participants_management.py

@@ -80,7 +80,7 @@ def test_mute_participant_with_livekit_token_for_this_room(mock_livekit_client):
     room = RoomFactory()
 
     user = AnonymousUser()
-    token = utils.generate_token(str(room.id), user)
+    token = utils.generate_token(str(room.id), user, is_admin_or_owner=False)
 
     url = reverse("rooms-mute-participant", kwargs={"pk": room.id})
     response = client.post(
@@ -106,7 +106,7 @@ def test_mute_participant_with_livekit_token_for_another_room_forbidden(
     other_room = RoomFactory()
 
     user = AnonymousUser()
-    token = utils.generate_token(str(other_room.id), user)
+    token = utils.generate_token(str(other_room.id), user, is_admin_or_owner=False)
 
     url = reverse("rooms-mute-participant", kwargs={"pk": target_room.id})
     response = client.post(
@@ -146,7 +146,7 @@ def test_mute_participant_everyone_can_mute_disabled_blocks_non_admin(
     room = RoomFactory(configuration={"everyone_can_mute": False})
 
     user = AnonymousUser()
-    token = utils.generate_token(str(room.id), user)
+    token = utils.generate_token(str(room.id), user, is_admin_or_owner=False)
 
     url = reverse("rooms-mute-participant", kwargs={"pk": room.id})
     response = client.post(
@@ -293,7 +293,7 @@ def test_mute_participant_admin_with_token_for_this_room(mock_livekit_client):
     )
     # Token identity matches the admin user so LiveKitTokenAuthentication
     # resolves request.user back to the admin.
-    token = utils.generate_token(str(room.id), user)
+    token = utils.generate_token(str(room.id), user, is_admin_or_owner=True)
 
     url = reverse("rooms-mute-participant", kwargs={"pk": room.id})
     response = client.post(
@@ -323,7 +323,7 @@ def test_mute_participant_admin_with_token_for_another_room(mock_livekit_client)
     # Token is scoped to a DIFFERENT room, and admin status must only be
     # honored when established via session, never via a LiveKit
     # token, which can be replayed off-host.
-    token = utils.generate_token(str(other_room.id), user)
+    token = utils.generate_token(str(other_room.id), user, is_admin_or_owner=True)
 
     url = reverse("rooms-mute-participant", kwargs={"pk": target_room.id})
     response = client.post(
@@ -354,7 +354,7 @@ def test_mute_participant_admin_token_replayed_does_not_grant_admin(
         role=random.choice(["administrator", "owner"]),
     )
     # The token is the only credential.
-    token = utils.generate_token(str(room.id), admin_user)
+    token = utils.generate_token(str(room.id), admin_user, is_admin_or_owner=True)
 
     url = reverse("rooms-mute-participant", kwargs={"pk": room.id})
     response = client.post(
@@ -374,7 +374,7 @@ def test_mute_participant_livekit_token_triggers_presence_check(mock_livekit_cli
     room = RoomFactory()
 
     user = AnonymousUser()
-    token = utils.generate_token(str(room.id), user)
+    token = utils.generate_token(str(room.id), user, is_admin_or_owner=False)
 
     url = reverse("rooms-mute-participant", kwargs={"pk": room.id})
     response = client.post(
@@ -405,7 +405,7 @@ def test_mute_participant_livekit_token_presence_check_returns_participant(
     )
 
     user = AnonymousUser()
-    token = utils.generate_token(str(room.id), user)
+    token = utils.generate_token(str(room.id), user, is_admin_or_owner=False)
 
     url = reverse("rooms-mute-participant", kwargs={"pk": room.id})
     response = client.post(
@@ -433,7 +433,7 @@ def test_mute_participant_livekit_token_presence_check_participant_not_found(
     )
 
     user = AnonymousUser()
-    token = utils.generate_token(str(room.id), user)
+    token = utils.generate_token(str(room.id), user, is_admin_or_owner=False)
 
     url = reverse("rooms-mute-participant", kwargs={"pk": room.id})
     response = client.post(
@@ -462,7 +462,7 @@ def test_mute_participant_livekit_token_presence_check_twirp_error_forbidden(
     )
 
     user = AnonymousUser()
-    token = utils.generate_token(str(room.id), user)
+    token = utils.generate_token(str(room.id), user, is_admin_or_owner=False)
 
     url = reverse("rooms-mute-participant", kwargs={"pk": room.id})
     response = client.post(

src/backend/core/tests/rooms/test_api_rooms_retrieve.py

@@ -12,7 +12,7 @@ import pytest
 from rest_framework.test import APIClient
 
 from ...factories import RoomFactory, UserFactory, UserResourceAccessFactory
-from ...models import RoleChoices, RoomAccessLevel
+from ...models import RoomAccessLevel
 
 pytestmark = pytest.mark.django_db
 
@@ -31,6 +31,7 @@ def test_api_rooms_retrieve_anonymous_private_pk():
         "configuration": {},
         "access_level": "restricted",
         "id": str(room.id),
+        "is_administrable": False,
         "name": room.name,
         "slug": room.slug,
     }
@@ -50,6 +51,7 @@ def test_api_rooms_retrieve_anonymous_trusted_pk():
         "configuration": {},
         "access_level": "trusted",
         "id": str(room.id),
+        "is_administrable": False,
         "name": room.name,
         "slug": room.slug,
     }
@@ -68,6 +70,7 @@ def test_api_rooms_retrieve_anonymous_private_pk_no_dashes():
         "configuration": {},
         "access_level": "restricted",
         "id": str(room.id),
+        "is_administrable": False,
         "name": room.name,
         "slug": room.slug,
     }
@@ -84,6 +87,7 @@ def test_api_rooms_retrieve_anonymous_private_slug():
         "configuration": {},
         "access_level": "restricted",
         "id": str(room.id),
+        "is_administrable": False,
         "name": room.name,
         "slug": room.slug,
     }
@@ -100,6 +104,7 @@ def test_api_rooms_retrieve_anonymous_private_slug_not_normalized():
         "configuration": {},
         "access_level": "restricted",
         "id": str(room.id),
+        "is_administrable": False,
         "name": room.name,
         "slug": room.slug,
     }
@@ -209,6 +214,7 @@ def test_api_rooms_retrieve_anonymous_public(mock_token):
         "configuration": {},
         "access_level": str(room.access_level),
         "id": str(room.id),
+        "is_administrable": False,
         "livekit": {
             "url": "test_url_value",
             "room": expected_name,
@@ -255,6 +261,7 @@ def test_api_rooms_retrieve_authenticated_public(mock_token):
         "configuration": {"can_publish_sources": ["camera"]},
         "access_level": str(room.access_level),
         "id": str(room.id),
+        "is_administrable": False,
         "livekit": {
             "url": "test_url_value",
             "room": expected_name,
@@ -271,9 +278,8 @@ def test_api_rooms_retrieve_authenticated_public(mock_token):
         username=None,
         color=None,
         sources=["camera"],
-        role=None,
+        is_admin_or_owner=False,
         participant_id=None,
-        is_authenticated=True,
     )
 
 
@@ -307,6 +313,7 @@ def test_api_rooms_retrieve_authenticated_trusted(mock_token):
         "configuration": {},
         "access_level": str(room.access_level),
         "id": str(room.id),
+        "is_administrable": False,
         "livekit": {
             "url": "test_url_value",
             "room": expected_name,
@@ -323,9 +330,8 @@ def test_api_rooms_retrieve_authenticated_trusted(mock_token):
         username=None,
         color=None,
         sources=None,
-        role=None,
+        is_admin_or_owner=False,
         participant_id=None,
-        is_authenticated=True,
     )
 
 
@@ -349,6 +355,7 @@ def test_api_rooms_retrieve_authenticated():
         "configuration": {},
         "access_level": "restricted",
         "id": str(room.id),
+        "is_administrable": False,
         "name": room.name,
         "slug": room.slug,
     }
@@ -394,6 +401,7 @@ def test_api_rooms_retrieve_members(mock_token, django_assert_num_queries, setti
         "configuration": {"can_publish_sources": ["camera"]},
         "access_level": str(room.access_level),
         "id": str(room.id),
+        "is_administrable": False,
         "livekit": {
             "url": "test_url_value",
             "room": expected_name,
@@ -410,9 +418,8 @@ def test_api_rooms_retrieve_members(mock_token, django_assert_num_queries, setti
         username=None,
         color=None,
         sources=["camera"],
-        role=str(RoleChoices.MEMBER),
+        is_admin_or_owner=False,
         participant_id=None,
-        is_authenticated=True,
     )
 
 
@@ -486,6 +493,7 @@ def test_api_rooms_retrieve_administrators(
     assert content_dict == {
         "access_level": str(room.access_level),
         "id": str(room.id),
+        "is_administrable": True,
         "configuration": {},
         "livekit": {
             "url": "test_url_value",
@@ -503,7 +511,6 @@ def test_api_rooms_retrieve_administrators(
         username=None,
         color=None,
         sources=None,
-        role=str(user_access.role),
+        is_admin_or_owner=True,
         participant_id=None,
-        is_authenticated=True,
     )

src/backend/core/tests/rooms/test_api_rooms_update_participant_role.py

@@ -1,319 +0,0 @@
-"""
-Test rooms API endpoints in the Meet core app: update-participant-role.
-"""
-
-# pylint: disable=redefined-outer-name,unused-argument
-
-import uuid
-from unittest import mock
-
-import pytest
-from rest_framework.test import APIClient
-
-from ...factories import RoomFactory, UserFactory
-from ...models import ResourceAccess, RoleChoices
-from ...services.participants_management import ParticipantNotFoundException
-
-pytestmark = pytest.mark.django_db
-
-
-def test_update_participant_role_anonymous():
-    """Anonymous requesters are rejected."""
-    client = APIClient()
-    room = RoomFactory()
-
-    response = client.post(
-        f"/api/v1.0/rooms/{room.id}/update-participant-role/",
-        {"participant_identity": "some-identity", "role": "administrator"},
-        format="json",
-    )
-
-    assert response.status_code == 401
-
-
-def test_update_participant_role_requires_privileges():
-    """A simple member cannot promote other participants."""
-    client = APIClient()
-    user = UserFactory()
-    room = RoomFactory(users=[(user, RoleChoices.MEMBER)])
-    client.force_login(user)
-
-    response = client.post(
-        f"/api/v1.0/rooms/{room.id}/update-participant-role/",
-        {"participant_identity": "some-identity", "role": "administrator"},
-        format="json",
-    )
-
-    assert response.status_code == 403
-
-
-@mock.patch("core.api.permissions.ParticipantsManagement")
-def test_update_participant_role_requester_not_in_meeting(mock_perm_pm):
-    """An admin who is not connected to the meeting is rejected."""
-    mock_perm_pm.return_value.check_if_in_meeting.return_value = False
-    client = APIClient()
-    user = UserFactory()
-    room = RoomFactory(users=[(user, RoleChoices.ADMIN)])
-    client.force_login(user)
-
-    response = client.post(
-        f"/api/v1.0/rooms/{room.id}/update-participant-role/",
-        {"participant_identity": "some-identity", "role": "administrator"},
-        format="json",
-    )
-
-    assert response.status_code == 403
-    mock_perm_pm.return_value.check_if_in_meeting.assert_called_once_with(
-        room_name=str(room.pk), identity=str(user.sub)
-    )
-
-
-@mock.patch("core.api.permissions.ParticipantsManagement")
-def test_update_participant_role_cannot_target_self(mock_perm_pm):
-    """Requesters cannot change their own role."""
-    mock_perm_pm.return_value.check_if_in_meeting.return_value = True
-    client = APIClient()
-    user = UserFactory(sub=uuid.uuid4())
-    room = RoomFactory(users=[(user, RoleChoices.ADMIN)])
-    client.force_login(user)
-
-    response = client.post(
-        f"/api/v1.0/rooms/{room.id}/update-participant-role/",
-        {"participant_identity": user.sub, "role": "member"},
-        format="json",
-    )
-
-    assert response.status_code == 403
-    assert response.json() == {"error": "You cannot change your own role."}
-
-
-@mock.patch("core.services.room_roles.RoomRoleService._sync_livekit_role")
-@mock.patch("core.services.room_roles.ParticipantsManagement")
-@mock.patch("core.api.permissions.ParticipantsManagement")
-def test_update_participant_role_promotes_authenticated_target(
-    mock_perm_pm, mock_svc_pm, mock_sync
-):
-    """Promoting a connected, authenticated participant persists the role."""
-    mock_perm_pm.return_value.check_if_in_meeting.return_value = True
-    mock_svc_pm.return_value.check_if_in_meeting.return_value = True
-    mock_sync.return_value = True
-
-    client = APIClient()
-    admin = UserFactory()
-    target = UserFactory(sub=uuid.uuid4())
-    room = RoomFactory(users=[(admin, RoleChoices.OWNER)])
-    client.force_login(admin)
-
-    response = client.post(
-        f"/api/v1.0/rooms/{room.id}/update-participant-role/",
-        {"participant_identity": str(target.sub), "role": "administrator"},
-        format="json",
-    )
-
-    assert response.status_code == 200
-    assert response.json() == {
-        "role": "administrator",
-        "livekit_synced": True,
-    }
-    access = ResourceAccess.objects.get(resource=room, user=target)
-    assert access.role == RoleChoices.ADMIN
-    mock_sync.assert_called_once_with(
-        room_name=str(room.pk),
-        participant_identity=str(target.sub),
-        role="administrator",
-    )
-
-
-@mock.patch("core.services.room_roles.RoomRoleService._sync_livekit_role")
-@mock.patch("core.services.room_roles.ParticipantsManagement")
-@mock.patch("core.api.permissions.ParticipantsManagement")
-def test_update_participant_role_demotes_authenticated_target(
-    mock_perm_pm, mock_svc_pm, mock_sync
-):
-    """Demoting a connected admin back to member updates the access row."""
-    mock_perm_pm.return_value.check_if_in_meeting.return_value = True
-    mock_svc_pm.return_value.check_if_in_meeting.return_value = True
-    mock_sync.return_value = True
-
-    client = APIClient()
-    admin = UserFactory()
-    target = UserFactory(sub=uuid.uuid4())
-    room = RoomFactory(users=[(admin, RoleChoices.OWNER), (target, RoleChoices.ADMIN)])
-    client.force_login(admin)
-
-    response = client.post(
-        f"/api/v1.0/rooms/{room.id}/update-participant-role/",
-        {"participant_identity": str(target.sub), "role": "member"},
-        format="json",
-    )
-
-    assert response.status_code == 200
-    access = ResourceAccess.objects.get(resource=room, user=target)
-    assert access.role == RoleChoices.MEMBER
-
-
-@mock.patch("core.services.room_roles.RoomRoleService._sync_livekit_role")
-@mock.patch("core.services.room_roles.ParticipantsManagement")
-@mock.patch("core.api.permissions.ParticipantsManagement")
-def test_update_participant_role_cannot_demote_owner(
-    mock_perm_pm, mock_svc_pm, mock_sync
-):
-    """Room owners can never be demoted."""
-    mock_perm_pm.return_value.check_if_in_meeting.return_value = True
-    mock_svc_pm.return_value.check_if_in_meeting.return_value = True
-
-    client = APIClient()
-    admin = UserFactory()
-    owner = UserFactory(sub=uuid.uuid4())
-    room = RoomFactory(users=[(admin, RoleChoices.ADMIN), (owner, RoleChoices.OWNER)])
-    client.force_login(admin)
-
-    response = client.post(
-        f"/api/v1.0/rooms/{room.id}/update-participant-role/",
-        {"participant_identity": str(owner.sub), "role": "member"},
-        format="json",
-    )
-
-    assert response.status_code == 403
-    assert response.json() == {"error": "Room owners cannot be demoted."}
-    assert (
-        ResourceAccess.objects.get(resource=room, user=owner).role == RoleChoices.OWNER
-    )
-    mock_sync.assert_not_called()
-
-
-@mock.patch("core.services.room_roles.RoomRoleService._sync_livekit_role")
-@mock.patch("core.services.room_roles.ParticipantsManagement")
-@mock.patch("core.api.permissions.ParticipantsManagement")
-def test_update_participant_role_anonymous_target_is_ephemeral(
-    mock_perm_pm, mock_svc_pm, mock_sync
-):
-    """Promoting an anonymous participant should not be possible."""
-    mock_perm_pm.return_value.check_if_in_meeting.return_value = True
-    mock_svc_pm.return_value.check_if_in_meeting.return_value = True
-    mock_sync.return_value = True
-
-    client = APIClient()
-    admin = UserFactory()
-    room = RoomFactory(users=[(admin, RoleChoices.ADMIN)])
-    client.force_login(admin)
-
-    anonymous_identity = uuid.uuid4()
-    response = client.post(
-        f"/api/v1.0/rooms/{room.id}/update-participant-role/",
-        {"participant_identity": anonymous_identity, "role": "administrator"},
-        format="json",
-    )
-
-    assert response.status_code == 404
-    assert response.json() == {
-        "error": "This participant has no user account and cannot be assigned a role."
-    }
-    assert not ResourceAccess.objects.filter(resource=room).exclude(user=admin).exists()
-
-
-@mock.patch("core.services.room_roles.RoomRoleService._sync_livekit_role")
-@mock.patch("core.services.room_roles.ParticipantsManagement")
-@mock.patch("core.api.permissions.ParticipantsManagement")
-def test_update_participant_role_target_not_in_meeting(
-    mock_perm_pm, mock_svc_pm, mock_sync
-):
-    """Only connected participants can be promoted or demoted."""
-    mock_perm_pm.return_value.check_if_in_meeting.return_value = True
-    mock_svc_pm.return_value.check_if_in_meeting.side_effect = (
-        ParticipantNotFoundException("Participant does not exist")
-    )
-
-    client = APIClient()
-    admin = UserFactory()
-    target = UserFactory(sub=uuid.uuid4())
-    room = RoomFactory(users=[(admin, RoleChoices.ADMIN)])
-    client.force_login(admin)
-
-    response = client.post(
-        f"/api/v1.0/rooms/{room.id}/update-participant-role/",
-        {"participant_identity": str(target.sub), "role": "administrator"},
-        format="json",
-    )
-
-    assert response.status_code == 404
-    assert not ResourceAccess.objects.filter(resource=room, user=target).exists()
-    mock_sync.assert_not_called()
-
-
-@mock.patch("core.services.room_roles.RoomRoleService._sync_livekit_role")
-@mock.patch("core.services.room_roles.ParticipantsManagement")
-@mock.patch("core.api.permissions.ParticipantsManagement")
-def test_update_participant_role_is_idempotent_and_resyncs(
-    mock_perm_pm, mock_svc_pm, mock_sync
-):
-    """Promoting an existing admin succeeds and still re-syncs LiveKit."""
-    mock_perm_pm.return_value.check_if_in_meeting.return_value = True
-    mock_svc_pm.return_value.check_if_in_meeting.return_value = True
-    mock_sync.return_value = True
-
-    client = APIClient()
-    admin = UserFactory()
-    target = UserFactory(sub=uuid.uuid4())
-    room = RoomFactory(users=[(admin, RoleChoices.OWNER), (target, RoleChoices.ADMIN)])
-    client.force_login(admin)
-
-    response = client.post(
-        f"/api/v1.0/rooms/{room.id}/update-participant-role/",
-        {"participant_identity": str(target.sub), "role": "administrator"},
-        format="json",
-    )
-
-    assert response.status_code == 200
-    mock_sync.assert_called_once()
-
-
-@mock.patch("core.services.room_roles.RoomRoleService._sync_livekit_role")
-@mock.patch("core.services.room_roles.ParticipantsManagement")
-@mock.patch("core.api.permissions.ParticipantsManagement")
-def test_update_participant_role_livekit_failure_reports_partial_success(
-    mock_perm_pm, mock_svc_pm, mock_sync
-):
-    """A LiveKit sync failure does not lose the persisted role."""
-    mock_perm_pm.return_value.check_if_in_meeting.return_value = True
-    mock_svc_pm.return_value.check_if_in_meeting.return_value = True
-    mock_sync.return_value = False
-
-    client = APIClient()
-    admin = UserFactory()
-    target = UserFactory(sub=uuid.uuid4())
-    room = RoomFactory(users=[(admin, RoleChoices.OWNER)])
-    client.force_login(admin)
-
-    response = client.post(
-        f"/api/v1.0/rooms/{room.id}/update-participant-role/",
-        {"participant_identity": str(target.sub), "role": "administrator"},
-        format="json",
-    )
-
-    assert response.status_code == 200
-    assert response.json() == {
-        "role": "administrator",
-        "livekit_synced": False,
-    }
-    assert (
-        ResourceAccess.objects.get(resource=room, user=target).role == RoleChoices.ADMIN
-    )
-
-
-@mock.patch("core.api.permissions.ParticipantsManagement")
-def test_update_participant_role_rejects_owner_role(mock_perm_pm):
-    """The owner role can never be granted through this endpoint."""
-    client = APIClient()
-    admin = UserFactory()
-    room = RoomFactory(users=[(admin, RoleChoices.ADMIN)])
-    client.force_login(admin)
-
-    mock_perm_pm.return_value.check_if_in_meeting.return_value = True
-    response = client.post(
-        f"/api/v1.0/rooms/{room.id}/update-participant-role/",
-        {"participant_identity": "some-identity", "role": "owner"},
-        format="json",
-    )
-
-    assert response.status_code == 400

src/backend/core/tests/services/test_livekit_events.py

@@ -6,6 +6,8 @@ Test LiveKitEvents service.
 import uuid
 from unittest import mock
 
+from django.test.utils import override_settings
+
 import pytest
 from livekit.api import EgressStatus
 
@@ -550,6 +552,23 @@ def test_handle_room_finished_raises_error_when_telephony_deletion_fails(
     mock_clear_cache.assert_not_called()
 
 
+@override_settings(CONNECTION_TEST_ROOM_PREFIX="connection-test-")
+@mock.patch.object(LobbyService, "clear_room_cache")
+@mock.patch.object(TelephonyService, "delete_dispatch_rule")
+def test_handle_room_finished_ignores_connection_test_room(
+    mock_delete_dispatch_rule, mock_clear_cache, service, settings
+):
+    """Should ignore room_finished events for connection test rooms."""
+    settings.ROOM_TELEPHONY_ENABLED = True
+    mock_data = mock.MagicMock()
+    mock_data.room.name = f"{settings.CONNECTION_TEST_ROOM_PREFIX}{uuid.uuid4()}"
+
+    service._handle_room_finished(mock_data)
+
+    mock_delete_dispatch_rule.assert_not_called()
+    mock_clear_cache.assert_not_called()
+
+
 def test_handle_room_finished_raises_error_for_invalid_room_name(service):
     """Should raise ActionFailedError when room name format is invalid when room finishes."""
     mock_data = mock.MagicMock()
@@ -600,6 +619,15 @@ def test_handle_room_started_raises_error_for_invalid_room_name(service):
         service._handle_room_started(mock_data)
 
 
+@override_settings(CONNECTION_TEST_ROOM_PREFIX="connection-test-")
+def test_handle_room_started_ignores_connection_test_room(service, settings):
+    """Should ignore room_started events for connection test rooms."""
+    mock_data = mock.MagicMock()
+    mock_data.room.name = f"{settings.CONNECTION_TEST_ROOM_PREFIX}{uuid.uuid4()}"
+
+    service._handle_room_started(mock_data)
+
+
 def test_handle_room_started_raises_error_for_nonexistent_room(service):
     """Should raise ActionFailedError when a room starts that doesn't exist in the database."""
     mock_data = mock.MagicMock()

src/backend/core/tests/services/test_lobby.py

@@ -266,6 +266,7 @@ def test_request_entry_public_room(
         username=username,
         color=participant.color,
         configuration=room.configuration,
+        is_admin_or_owner=False,
         participant_id="test-participant-id",
     )
 
@@ -304,6 +305,7 @@ def test_request_entry_trusted_room(
         username=username,
         color=participant.color,
         configuration=room.configuration,
+        is_admin_or_owner=False,
         participant_id="test-participant-id",
     )
 
@@ -398,6 +400,7 @@ def test_request_entry_accepted_participant(
         username=username,
         color="#123456",
         configuration=room.configuration,
+        is_admin_or_owner=False,
         participant_id="test-participant-id",
     )
     lobby_service._get_participant.assert_called_once_with(room.id, participant_id)

src/backend/core/tests/test_api_connection_test.py

@@ -0,0 +1,66 @@
+"""Test connection test API endpoint."""
+
+import uuid
+
+from django.test.utils import override_settings
+
+import jwt
+import pytest
+from rest_framework.test import APIClient
+
+from core.api.connection_test import CONNECTION_TEST_USERNAME
+
+pytestmark = pytest.mark.django_db
+
+
+@override_settings(
+    CONNECTION_TEST_TOKEN_TTL_SECONDS=600,
+    CONNECTION_TEST_ROOM_PREFIX="connection-test-",
+)
+def test_api_connection_test_returns_ephemeral_livekit_config():
+    """Each request gets a dedicated room and a short-lived token."""
+    client = APIClient()
+    response_a = client.get("/api/v1.0/connection-test/")
+    response_b = client.get("/api/v1.0/connection-test/")
+
+    assert response_a.status_code == 200
+    assert response_b.status_code == 200
+
+    data_a = response_a.json()
+    data_b = response_b.json()
+
+    room_a = data_a["livekit"]["room"]
+    room_b = data_b["livekit"]["room"]
+
+    assert room_a.startswith("connection-test-")
+    assert room_b.startswith("connection-test-")
+    uuid.UUID(room_a.removeprefix("connection-test-"))
+    uuid.UUID(room_b.removeprefix("connection-test-"))
+    assert room_a != room_b
+    assert data_a["livekit"]["url"]
+    assert data_a["livekit"]["token"]
+    assert data_a["livekit"]["expires_in"] == 600
+    assert data_a["livekit"]["token"] != data_b["livekit"]["token"]
+
+
+@override_settings(CONNECTION_TEST_TOKEN_TTL_SECONDS=300)
+def test_api_connection_test_token_is_short_lived_for_user(settings):
+    """Connection test tokens expire quickly for users."""
+    client = APIClient()
+    response = client.get("/api/v1.0/connection-test/")
+
+    assert response.status_code == 200
+
+    config = response.json()["livekit"]
+    payload = jwt.decode(
+        config["token"],
+        settings.LIVEKIT_CONFIGURATION["api_secret"],
+        algorithms=["HS256"],
+        options={"verify_exp": False},
+    )
+
+    assert config["expires_in"] == 300
+    assert payload["video"]["room"] == config["room"]
+    assert payload["name"] == CONNECTION_TEST_USERNAME
+    assert payload["video"]["roomAdmin"] is False
+    assert payload["exp"] - payload["nbf"] == 300

src/backend/core/urls.py

@@ -8,6 +8,7 @@ from rest_framework.routers import DefaultRouter, SimpleRouter
 
 from core.addons import viewsets as addons_viewsets
 from core.api import get_frontend_configuration, viewsets
+from core.api.connection_test import get_connection_test_config
 from core.external_api import viewsets as external_viewsets
 
 # - Main endpoints
@@ -46,6 +47,11 @@ urlpatterns = [
                 *router.urls,
                 *oidc_urls,
                 path("config/", get_frontend_configuration, name="config"),
+                path(
+                    "connection-test/",
+                    get_connection_test_config,
+                    name="connection_test",
+                ),
             ]
         ),
     ),

src/backend/core/utils.py

@@ -12,6 +12,7 @@ import mimetypes
 import random
 import secrets
 import string
+from datetime import timedelta
 from functools import lru_cache
 from typing import List, Optional
 from uuid import uuid4
@@ -66,9 +67,9 @@ def generate_token(
     username: Optional[str] = None,
     color: Optional[str] = None,
     sources: Optional[List[str]] = None,
-    role: Optional[str] = None,
+    is_admin_or_owner: bool = False,
     participant_id: Optional[str] = None,
-    is_authenticated: Optional[bool] = False,
+    ttl: Optional[timedelta] = None,
 ) -> str:
     """Generate a LiveKit access token for a user in a specific room.
 
@@ -81,16 +82,15 @@ def generate_token(
                          If none, a value will be generated
         sources: (Optional[List[str]]): List of media sources the user can publish
                          If none, defaults to LIVEKIT_DEFAULT_SOURCES.
-        role (Optional[str]): Room's access role if any
+        is_admin_or_owner (bool): Whether user has admin privileges
         participant_id (Optional[str]): Stable identifier for anonymous users;
                          used as identity when user.is_anonymous.
-        is_authenticated (Optional[bool]): Is user authentified.
+        ttl (Optional[timedelta]): Token validity duration. Defaults to LiveKit SDK default.
 
     Returns:
         str: The LiveKit JWT access token.
     """
 
-    is_admin_or_owner = role in ("owner", "administrator")
     if is_admin_or_owner:
         sources = settings.LIVEKIT_DEFAULT_SOURCES
 
@@ -131,9 +131,11 @@ def generate_token(
         .with_identity(identity)
         .with_name(display_name)
         .with_attributes(
-            {"color": color, "room_role": role, "is_authenticated": 'true' if is_authenticated else 'false'}
+            {"color": color, "room_admin": "true" if is_admin_or_owner else "false"}
         )
     )
+    if ttl is not None:
+        token = token.with_ttl(ttl)
 
     return token.to_jwt()
 
@@ -142,11 +144,10 @@ def generate_livekit_config(
     room_id: str,
     user,
     username: str,
-    role: Optional[str] = None,
+    is_admin_or_owner: bool,
     color: Optional[str] = None,
     configuration: Optional[dict] = None,
     participant_id: Optional[str] = None,
-    is_authenticated: Optional[bool] = False,
 ) -> dict:
     """Generate LiveKit configuration for room access.
 
@@ -154,12 +155,11 @@ def generate_livekit_config(
         room_id: Room identifier
         user: User instance requesting access
         username: Display name in room
-        role (str): Room's access role if any
+        is_admin_or_owner (bool): Whether the user has admin/owner privileges for this room.
         color (Optional[str]): Optional color to associate with the participant.
         configuration (Optional[dict]): Room configuration dict that can override default settings.
         participant_id (Optional[str]): Stable identifier for anonymous users;
                          used as identity when user.is_anonymous.
-        is_authenticated: Optional[bool]: Is user authentified.
 
     Returns:
         dict: LiveKit configuration with URL, room and access token
@@ -178,9 +178,8 @@ def generate_livekit_config(
             username=username,
             color=color,
             sources=sources,
-            role=role,
+            is_admin_or_owner=is_admin_or_owner,
             participant_id=participant_id,
-            is_authenticated=is_authenticated,
         ),
     }
 

src/backend/meet/settings.py

@@ -349,6 +349,11 @@ class Base(Configuration):
                 environ_name="CREATION_CALLBACK_THROTTLE_RATES",
                 environ_prefix=None,
             ),
+            "connection_test": values.Value(
+                default="30/minute",
+                environ_name="CONNECTION_TEST_THROTTLE_RATES",
+                environ_prefix=None,
+            ),
         },
     }
     MONITORED_THROTTLE_FAILURE_CALLBACK = (
@@ -655,6 +660,16 @@ class Base(Configuration):
         environ_prefix=None,
         default=False,
     )
+    CONNECTION_TEST_TOKEN_TTL_SECONDS = values.PositiveIntegerValue(
+        600,
+        environ_name="CONNECTION_TEST_TOKEN_TTL_SECONDS",
+        environ_prefix=None,
+    )
+    CONNECTION_TEST_ROOM_PREFIX = values.Value(
+        "connection-test-",
+        environ_name="CONNECTION_TEST_ROOM_PREFIX",
+        environ_prefix=None,
+    )
     LIVEKIT_VERIFY_SSL = values.BooleanValue(
         True, environ_name="LIVEKIT_VERIFY_SSL", environ_prefix=None
     )

src/frontend/src/features/connection-test/api/fetchConnectionTestToken.ts

@@ -0,0 +1,13 @@
+import { fetchApi } from '@/api/fetchApi'
+
+export type ConnectionTestTokenResponse = {
+  livekit: {
+    url: string
+    room: string
+    token: string
+    expires_in: number
+  }
+}
+
+export const fetchConnectionTestToken = () =>
+  fetchApi<ConnectionTestTokenResponse>('/connection-test/')

src/frontend/src/features/connection-test/hooks/useConnectionTestRunner.ts

@@ -0,0 +1,245 @@
+import { useRef, useState } from 'react'
+import {
+  CheckStatus,
+  ConnectionCheck,
+  createLocalAudioTrack,
+  createLocalVideoTrack,
+  getBrowser,
+  type CheckInfo,
+  type LocalVideoTrack,
+} from 'livekit-client'
+import { fetchConnectionTestToken } from '../api/fetchConnectionTestToken'
+import {
+  createInitialSteps,
+  type ConnectionTestLog,
+  type ConnectionTestStepId,
+  type ConnectionTestStepResult,
+  type ConnectionTestStepStatus,
+} from '../types'
+import { openPermissionsDialog } from '@/stores/permissions'
+
+const LIVEKIT_STEP_IDS: ConnectionTestStepId[] = [
+  'websocket',
+  'webrtc',
+  'turn',
+  'reconnect',
+  'publishAudio',
+  'publishVideo',
+]
+
+const CHECK_STATUS_TO_STEP: Record<CheckStatus, ConnectionTestStepStatus> = {
+  [CheckStatus.IDLE]: 'pending',
+  [CheckStatus.RUNNING]: 'running',
+  [CheckStatus.SUCCESS]: 'success',
+  [CheckStatus.FAILED]: 'failed',
+  [CheckStatus.SKIPPED]: 'skipped',
+}
+
+const getErrorMessage = (error: unknown, fallback = 'Unknown error') =>
+  error instanceof Error ? error.message : fallback
+
+const fromCheckInfo = (info: CheckInfo): Partial<ConnectionTestStepResult> => ({
+  status: CHECK_STATUS_TO_STEP[info.status] ?? 'failed',
+  summary: info.description,
+  logs: info.logs,
+})
+
+const groupDevicesByKind = (devices: MediaDeviceInfo[]) => {
+  const grouped: Record<MediaDeviceKind, string[]> = {
+    audioinput: [],
+    audiooutput: [],
+    videoinput: [],
+  }
+  for (const device of devices) {
+    grouped[device.kind].push(device.label || device.deviceId)
+  }
+  return grouped
+}
+
+export const useConnectionTestRunner = () => {
+  const [steps, setSteps] = useState(createInitialSteps)
+  const [isRunning, setIsRunning] = useState(false)
+  const [videoTrack, setVideoTrack] = useState<LocalVideoTrack | null>(null)
+  const videoTrackRef = useRef<LocalVideoTrack | null>(null)
+  const abortRef = useRef<AbortController | null>(null)
+
+  const updateStep = (
+    id: ConnectionTestStepId,
+    patch: Partial<ConnectionTestStepResult>
+  ) => {
+    setSteps((current) =>
+      current.map((step) => (step.id === id ? { ...step, ...patch } : step))
+    )
+  }
+
+  const stopVideoTrack = () => {
+    videoTrackRef.current?.stop()
+    videoTrackRef.current = null
+    setVideoTrack(null)
+  }
+
+  const skipSteps = (
+    ids: ConnectionTestStepId[],
+    summary: string,
+    logs?: ConnectionTestLog[]
+  ) => {
+    for (const id of ids) {
+      updateStep(id, { status: 'skipped', summary, logs })
+    }
+  }
+
+  /** Returns true on success, false on failure, null if aborted. */
+  const runStep = async (
+    id: ConnectionTestStepId,
+    signal: AbortSignal,
+    fn: () => Promise<Partial<ConnectionTestStepResult>>
+  ): Promise<boolean | null> => {
+    if (signal.aborted) return null
+
+    updateStep(id, { status: 'running', summary: undefined, logs: undefined })
+
+    try {
+      const result = await fn()
+      if (signal.aborted) return null
+      // `result.status` overrides when set (LiveKit checks map their own status)
+      updateStep(id, { status: 'success', ...result })
+      return true
+    } catch (error) {
+      if (signal.aborted) return null
+      updateStep(id, {
+        status: 'failed',
+        summary: getErrorMessage(error),
+      })
+      return false
+    }
+  }
+
+  const runTest = async () => {
+    abortRef.current?.abort()
+    const controller = new AbortController()
+    abortRef.current = controller
+    const { signal } = controller
+
+    setIsRunning(true)
+    setSteps(createInitialSteps())
+    stopVideoTrack()
+
+    try {
+      await runStep('browser', signal, async () => {
+        const browser = getBrowser()
+        if (!browser) throw new Error('Browser not detected')
+        return {
+          summary: `${browser.name} ${browser.version}`,
+          data: {
+            name: browser.name,
+            version: browser.version,
+            os: browser.os,
+            osVersion: browser.osVersion,
+          },
+        }
+      })
+      if (signal.aborted) return
+
+      const microphoneOk = await runStep('microphone', signal, async () => {
+        const track = await createLocalAudioTrack()
+        const label =
+          track.mediaStreamTrack.label ||
+          track.mediaStreamTrack.getSettings().deviceId ||
+          ''
+        track.stop()
+        return { summary: label, data: { label } }
+      })
+      if (signal.aborted) return
+      if (!microphoneOk) openPermissionsDialog('audioinput')
+
+      const cameraOk = await runStep('camera', signal, async () => {
+        const track = await createLocalVideoTrack()
+        videoTrackRef.current = track
+        setVideoTrack(track)
+        const settings = track.mediaStreamTrack.getSettings()
+        const label = track.mediaStreamTrack.label || ''
+        return {
+          summary: label,
+          data: {
+            label,
+            width: settings.width,
+            height: settings.height,
+          },
+        }
+      })
+      if (signal.aborted) return
+      if (!cameraOk) openPermissionsDialog('videoinput')
+
+      await runStep('devices', signal, async () => {
+        const devices = await navigator.mediaDevices.enumerateDevices()
+        return {
+          summary: String(devices.length),
+          data: groupDevicesByKind(devices),
+        }
+      })
+      if (signal.aborted) return
+
+      let checker: ConnectionCheck
+      try {
+        const { livekit } = await fetchConnectionTestToken()
+        checker = new ConnectionCheck(livekit.url, livekit.token)
+      } catch (error) {
+        skipSteps(
+          LIVEKIT_STEP_IDS,
+          getErrorMessage(error, 'Failed to fetch test token')
+        )
+        return
+      }
+
+      await runStep('websocket', signal, async () =>
+        fromCheckInfo(await checker.checkWebsocket())
+      )
+      await runStep('webrtc', signal, async () =>
+        fromCheckInfo(await checker.checkWebRTC())
+      )
+      await runStep('turn', signal, async () =>
+        fromCheckInfo(await checker.checkTURN())
+      )
+      await runStep('reconnect', signal, async () =>
+        fromCheckInfo(await checker.checkReconnect())
+      )
+
+      if (!microphoneOk) {
+        skipSteps(['publishAudio'], 'Microphone permission required')
+      } else {
+        await runStep('publishAudio', signal, async () =>
+          fromCheckInfo(await checker.checkPublishAudio())
+        )
+      }
+
+      if (!cameraOk) {
+        skipSteps(['publishVideo'], 'Camera permission required')
+      } else {
+        stopVideoTrack()
+        await runStep('publishVideo', signal, async () =>
+          fromCheckInfo(await checker.checkPublishVideo())
+        )
+      }
+    } finally {
+      if (!signal.aborted) {
+        stopVideoTrack()
+        setIsRunning(false)
+      }
+    }
+  }
+
+  const reset = () => {
+    abortRef.current?.abort()
+    stopVideoTrack()
+    setSteps(createInitialSteps())
+    setIsRunning(false)
+  }
+
+  return {
+    steps,
+    isRunning,
+    videoTrack,
+    runTest,
+    reset,
+  }
+}

src/frontend/src/features/connection-test/routes/ConnectionTest.tsx

@@ -0,0 +1,156 @@
+import { useEffect, useRef, useState } from 'react'
+import { useTranslation } from 'react-i18next'
+import { CenteredContent } from '@/layout/CenteredContent'
+import { Screen } from '@/layout/Screen'
+import { Box, Button, Text, Ul } from '@/primitives'
+import { Spinner } from '@/primitives/Spinner'
+import { Center, HStack, VStack } from '@/styled-system/jsx'
+import { Permissions } from '@/features/rooms/components/Permissions'
+import { useConnectionTestRunner } from '../hooks/useConnectionTestRunner'
+import type { ConnectionTestStepId, ConnectionTestStepResult } from '../types'
+import { downloadConnectionTestReport } from '../utils/downloadConnectionTestReport'
+
+const HIDE_LIVEKIT_VIDEO_CLASS = 'connection-test-hide-livekit-video'
+
+const TestStepItem = ({ step }: { step: ConnectionTestStepResult }) => {
+  const { t } = useTranslation('connectionTest')
+  const [showDetails, setShowDetails] = useState(false)
+  const hasLogs = Boolean(step.logs?.length)
+  const statusLabel = t(`status.${step.status}`)
+  const stepLabel = t(`steps.${step.id as ConnectionTestStepId}`)
+
+  const statusVariant =
+    step.status === 'failed'
+      ? 'warning'
+      : step.status === 'success'
+        ? 'body'
+        : 'smNote'
+
+  return (
+    <VStack gap="0.25rem" alignItems="stretch" width="100%">
+      <HStack
+        justifyContent="space-between"
+        alignItems="flex-start"
+        width="100%"
+      >
+        <Text variant="bodyXsMedium">{stepLabel}</Text>
+        {step.status === 'running' ? (
+          <Spinner size={20} />
+        ) : (
+          <Text variant={statusVariant}>{statusLabel}</Text>
+        )}
+      </HStack>
+      {step.summary && (
+        <Text variant="smNote" margin={false}>
+          {step.summary}
+        </Text>
+      )}
+      {hasLogs && step.status !== 'pending' && step.status !== 'running' && (
+        <Button
+          variant="secondaryText"
+          size="sm"
+          onPress={() => setShowDetails((open) => !open)}
+        >
+          {t('details')}
+        </Button>
+      )}
+      {showDetails && step.logs && (
+        <Ul>
+          {step.logs.map((log, index) => (
+            <li key={index}>
+              <Text variant="xsNote" as="span">
+                {log.message}
+              </Text>
+            </li>
+          ))}
+        </Ul>
+      )}
+    </VStack>
+  )
+}
+
+const ConnectionTest = () => {
+  const { t } = useTranslation('connectionTest')
+  const { steps, isRunning, videoTrack, runTest } = useConnectionTestRunner()
+  const videoRef = useRef<HTMLVideoElement>(null)
+
+  const hasStarted = steps.some((step) => step.status !== 'pending')
+  const hasFailed = steps.some((step) => step.status === 'failed')
+  const isPublishVideoRunning = steps.some(
+    (step) => step.id === 'publishVideo' && step.status === 'running'
+  )
+
+  useEffect(() => {
+    const element = videoRef.current
+    if (!element || !videoTrack) return
+
+    videoTrack.attach(element)
+    return () => {
+      videoTrack.detach(element)
+    }
+  }, [videoTrack])
+
+  // LiveKit appends a bare <video> to document.body during publishVideo.
+  // Keep it in the DOM (so the frame check still works) but hide it visually.
+  useEffect(() => {
+    document.body.classList.toggle(
+      HIDE_LIVEKIT_VIDEO_CLASS,
+      isPublishVideoRunning
+    )
+    return () => {
+      document.body.classList.remove(HIDE_LIVEKIT_VIDEO_CLASS)
+    }
+  }, [isPublishVideoRunning])
+
+  return (
+    <Screen layout="centered">
+      <Permissions />
+      <CenteredContent title={t('title')} withBackButton>
+        <Center>
+          <VStack gap="1.5rem" maxWidth="36rem" width="100%">
+            <Text as="p" variant="paragraph" centered last>
+              {t('intro')}
+            </Text>
+
+            <Button variant="primary" onPress={runTest} isDisabled={isRunning}>
+              {hasStarted ? t('reset') : t('runTest')}
+            </Button>
+
+            {videoTrack && (
+              <Center>
+                <video ref={videoRef} autoPlay playsInline muted />
+              </Center>
+            )}
+
+            {hasStarted && (
+              <Box variant="light" width="100%">
+                <VStack gap="1rem" alignItems="stretch">
+                  {steps.map((step) => (
+                    <TestStepItem key={step.id} step={step} />
+                  ))}
+                </VStack>
+              </Box>
+            )}
+
+            {hasFailed && !isRunning && (
+              <Text variant="smNote" centered>
+                {t('help.firewall')}
+              </Text>
+            )}
+
+            {hasStarted && !isRunning && (
+              <Button
+                variant="secondary"
+                onPress={() => downloadConnectionTestReport(steps)}
+              >
+                {t('downloadReport')}
+              </Button>
+            )}
+          </VStack>
+        </Center>
+      </CenteredContent>
+    </Screen>
+  )
+}
+
+export default ConnectionTest

src/frontend/src/features/connection-test/types.ts

@@ -0,0 +1,47 @@
+export type ConnectionTestStepId =
+  | 'browser'
+  | 'microphone'
+  | 'camera'
+  | 'devices'
+  | 'websocket'
+  | 'webrtc'
+  | 'turn'
+  | 'reconnect'
+  | 'publishAudio'
+  | 'publishVideo'
+
+export type ConnectionTestStepStatus =
+  | 'pending'
+  | 'running'
+  | 'success'
+  | 'failed'
+  | 'skipped'
+
+export type ConnectionTestLog = {
+  level: 'info' | 'warning' | 'error'
+  message: string
+}
+
+export type ConnectionTestStepResult = {
+  id: ConnectionTestStepId
+  status: ConnectionTestStepStatus
+  summary?: string
+  logs?: ConnectionTestLog[]
+  data?: Record<string, unknown>
+}
+
+export const CONNECTION_TEST_STEP_IDS: ConnectionTestStepId[] = [
+  'browser',
+  'microphone',
+  'camera',
+  'devices',
+  'websocket',
+  'webrtc',
+  'turn',
+  'reconnect',
+  'publishAudio',
+  'publishVideo',
+]
+
+export const createInitialSteps = (): ConnectionTestStepResult[] =>
+  CONNECTION_TEST_STEP_IDS.map((id) => ({ id, status: 'pending' }))

src/frontend/src/features/connection-test/utils/downloadConnectionTestReport.ts

@@ -0,0 +1,49 @@
+import type { ConnectionTestStepResult } from '../types'
+
+export type ConnectionTestReport = {
+  generatedAt: string
+  userAgent: string
+  steps: Record<
+    string,
+    {
+      status: ConnectionTestStepResult['status']
+      summary?: string
+      logs?: ConnectionTestStepResult['logs']
+      data?: ConnectionTestStepResult['data']
+    }
+  >
+}
+
+export const buildConnectionTestReport = (
+  steps: ConnectionTestStepResult[]
+): ConnectionTestReport => ({
+  generatedAt: new Date().toISOString(),
+  userAgent: navigator.userAgent,
+  steps: Object.fromEntries(
+    steps.map(({ id, status, summary, logs, data }) => [
+      id,
+      {
+        status,
+        ...(summary !== undefined ? { summary } : {}),
+        ...(logs?.length ? { logs } : {}),
+        ...(data !== undefined ? { data } : {}),
+      },
+    ])
+  ),
+})
+
+export const downloadConnectionTestReport = (
+  steps: ConnectionTestStepResult[]
+) => {
+  const report = buildConnectionTestReport(steps)
+  const timestamp = report.generatedAt.slice(0, 19).replace(/:/g, '-')
+  const blob = new Blob([JSON.stringify(report, null, 2)], {
+    type: 'application/json',
+  })
+  const url = URL.createObjectURL(blob)
+  const anchor = document.createElement('a')
+  anchor.href = url
+  anchor.download = `connection-test-${timestamp}.json`
+  anchor.click()
+  URL.revokeObjectURL(url)
+}

src/frontend/src/features/participants/components/ParticipantRow.tsx

@@ -5,7 +5,7 @@ import { Text } from '@/primitives/Text'
 import { useTranslation } from 'react-i18next'
 import { Avatar } from '@/components/Avatar'
 import { getParticipantColor } from '@/features/rooms/utils/getParticipantColor'
-import { getParticipantIsRoomOwner } from '@/features/rooms/utils/getParticipantIsRoomAdminOrOwner'
+import { getParticipantIsRoomAdmin } from '@/features/rooms/utils/getParticipantIsRoomAdmin'
 import { type LocalParticipant, type Participant, Track } from 'livekit-client'
 import { isLocal } from '@/utils/livekit'
 import {
@@ -146,7 +146,7 @@ export const ParticipantRow = ({ participant }: ParticipantListItemProps) => {
               </span>
             )}
           </Text>
-          {getParticipantIsRoomOwner(participant) && (
+          {getParticipantIsRoomAdmin(participant) && (
             <Text variant="xsNote">{t('participants.host')}</Text>
           )}
         </VStack>

src/frontend/src/features/rooms/api/ApiRoom.ts

@@ -28,6 +28,3 @@ export type ApiRoom = {
   livekit?: ApiLiveKit
   configuration?: RoomConfiguration
 }
-
-export type ParticipantRole = 'member' | 'administrator' | 'owner'
-export type AssignableParticipantRole = Exclude<ParticipantRole, 'owner'>

src/frontend/src/features/rooms/api/updateParticipantRole.ts

@@ -1,32 +0,0 @@
-import type { Participant } from 'livekit-client'
-import { fetchApi } from '@/api/fetchApi'
-import { useRoomData } from '@/features/rooms/livekit/hooks/useRoomData'
-import { AssignableParticipantRole } from '@/features/rooms/api/ApiRoom'
-
-export const useParticipantRole = () => {
-  const data = useRoomData()
-
-  const updateParticipantRole = async (
-    participant: Participant,
-    role: AssignableParticipantRole
-  ) => {
-    if (!data?.id) {
-      throw new Error('Room id is not available')
-    }
-
-    try {
-      return fetchApi(`rooms/${data.id}/update-participant-role/`, {
-        method: 'POST',
-        body: JSON.stringify({
-          participant_identity: participant.identity,
-          role: role,
-        }),
-      })
-    } catch (error) {
-      console.error(
-        `Failed to update participant's role ${participant.identity}: ${error instanceof Error ? error.message : 'Unknown error'}`
-      )
-    }
-  }
-  return { updateParticipantRole }
-}

src/frontend/src/features/rooms/livekit/hooks/useIsAdminOrOwner.ts

@@ -1,17 +1,6 @@
-import {
-  useParticipantAttribute,
-  useRoomContext,
-} from '@livekit/components-react'
-import { ParticipantRole } from '@/features/rooms/api/ApiRoom'
+import { useRoomData } from './useRoomData'
 
 export const useIsAdminOrOwner = () => {
-  const room = useRoomContext()
-  const localParticipant = room.localParticipant
-  const role = useParticipantAttribute('room_role', {
-    participant: localParticipant,
-  })
-  return (
-    role !== undefined &&
-    ['administrator', 'owner'].includes(role as ParticipantRole)
-  )
+  const apiRoomData = useRoomData()
+  return apiRoomData?.is_administrable
 }

src/frontend/src/features/rooms/livekit/hooks/usePublishSourcesManager.ts

@@ -8,7 +8,7 @@ import { useRemoteParticipants } from '@livekit/components-react'
 import { useUpdateParticipantsPermissions } from '@/features/rooms/api/updateParticipantsPermissions'
 import { useRoomData } from '@/features/rooms/livekit/hooks/useRoomData'
 import { isSubsetOf } from '@/features/rooms/utils/isSubsetOf'
-import { getParticipantIsRoomAdminOrOwner } from '@/features/rooms/utils/getParticipantIsRoomAdminOrOwner'
+import { getParticipantIsRoomAdmin } from '@/features/rooms/utils/getParticipantIsRoomAdmin'
 import Source = Track.Source
 import {
   NotificationType,
@@ -48,7 +48,7 @@ export const usePublishSourcesManager = () => {
   })
 
   const unprivilegedRemoteParticipants = remoteParticipants.filter(
-    (participant) => !getParticipantIsRoomAdminOrOwner(participant)
+    (participant) => !getParticipantIsRoomAdmin(participant)
   )
 
   const currentSources = useMemo(() => {

src/frontend/src/features/rooms/utils/getParticipantIsAuthenticated.ts

@@ -1,8 +0,0 @@
-import type { Participant } from 'livekit-client'
-
-export const getParticipantIsAuthenticated = (
-  participant: Participant
-): boolean => {
-  const isAuthenticated = participant.attributes?.is_authenticated
-  return isAuthenticated == 'true'
-}

src/frontend/src/features/rooms/utils/getParticipantIsRoomAdmin.ts

@@ -0,0 +1,12 @@
+import type { Participant } from 'livekit-client'
+
+export const getParticipantIsRoomAdmin = (
+  participant: Participant
+): boolean => {
+  const attributes = participant.attributes
+
+  if (!attributes) {
+    return false
+  }
+  return attributes?.room_admin === 'true'
+}

src/frontend/src/features/rooms/utils/getParticipantIsRoomAdminOrOwner.ts

@@ -1,20 +0,0 @@
-import type { Participant } from 'livekit-client'
-import { ParticipantRole } from '@/features/rooms/api/ApiRoom'
-
-const participantHasRoomRole = (
-  participant: Participant,
-  roles: ParticipantRole[]
-): boolean => {
-  const role = participant.attributes?.room_role
-  return role !== undefined && roles.includes(role as ParticipantRole)
-}
-
-export const getParticipantIsRoomAdmin = (participant: Participant): boolean =>
-  participantHasRoomRole(participant, ['administrator'])
-
-export const getParticipantIsRoomOwner = (participant: Participant): boolean =>
-  participantHasRoomRole(participant, ['owner'])
-
-export const getParticipantIsRoomAdminOrOwner = (
-  participant: Participant
-): boolean => participantHasRoomRole(participant, ['administrator', 'owner'])

src/frontend/src/layout/Footer.tsx

@@ -266,6 +266,16 @@ export const Footer = () => {
               {t('links.accessibility')}
             </Link>
           </StyledLi>
+          <StyledLi divider>
+            <Link
+              underline={false}
+              footer="minor"
+              to="/test-connection"
+              aria-label={t('links.connectionTest')}
+            >
+              {t('links.connectionTest')}
+            </Link>
+          </StyledLi>
           <StyledLi>
             <A
               externalIcon

src/frontend/src/locales/en/connectionTest.json

@@ -0,0 +1,31 @@
+{
+  "title": "Test your configuration",
+  "intro": "Check that your device works with Visio: browser, media devices, and server connectivity.",
+  "runTest": "Run test",
+  "reset": "Run again",
+  "details": "Details",
+  "downloadReport": "Download report",
+  "homeLink": "Test your configuration",
+  "steps": {
+    "browser": "Browser",
+    "microphone": "Microphone",
+    "camera": "Camera",
+    "devices": "Media devices",
+    "websocket": "WebSocket",
+    "webrtc": "WebRTC",
+    "turn": "TURN",
+    "reconnect": "Reconnect",
+    "publishAudio": "Audio publishing",
+    "publishVideo": "Video publishing"
+  },
+  "status": {
+    "pending": "Pending",
+    "running": "Running…",
+    "success": "Passed",
+    "failed": "Failed",
+    "skipped": "Skipped"
+  },
+  "help": {
+    "firewall": "If network tests fail, check your browser permissions and network filtering rules (WebRTC, WebSocket, TURN) with your IT department."
+  }
+}

src/frontend/src/locales/en/global.json

@@ -36,6 +36,7 @@
       "legalsTerms": "Legal Notice",
       "data": "Personal Data and Cookies",
       "accessibility": "Accessibility: non-compliant",
+      "connectionTest": "Test your configuration",
       "ariaLabel": "new window",
       "codeAnnotation": "Our code is open and available on this",
       "code": "Open Source Code Repository",

src/frontend/src/locales/en/home.json

@@ -13,6 +13,7 @@
   "moreLinkLabel": "Learn more about {{appTitle}} - new tab",
   "moreLink": "Learn more",
   "moreAbout": "about {{appTitle}}",
+  "connectionTestLink": "Test your configuration",
   "createMenu": {
     "laterOption": "Create a meeting for a later date",
     "instantOption": "Start an instant meeting"

src/frontend/src/locales/fr/connectionTest.json

@@ -0,0 +1,31 @@
+{
+  "title": "Tester votre configuration",
+  "intro": "Vérifiez la compatibilité de votre poste avec Visio : navigateur, périphériques médias et connexion au serveur.",
+  "runTest": "Lancer le test",
+  "reset": "Relancer",
+  "details": "Détails",
+  "downloadReport": "Télécharger le rapport",
+  "homeLink": "Tester votre configuration",
+  "steps": {
+    "browser": "Navigateur",
+    "microphone": "Microphone",
+    "camera": "Caméra",
+    "devices": "Périphériques médias",
+    "websocket": "WebSocket",
+    "webrtc": "WebRTC",
+    "turn": "TURN",
+    "reconnect": "Reconnexion",
+    "publishAudio": "Publication audio",
+    "publishVideo": "Publication vidéo"
+  },
+  "status": {
+    "pending": "En attente",
+    "running": "En cours…",
+    "success": "Réussi",
+    "failed": "Échec",
+    "skipped": "Ignoré"
+  },
+  "help": {
+    "firewall": "En cas d'échec des tests réseau, vérifiez vos permissions navigateur et les règles de filtrage réseau (WebRTC, WebSocket, TURN) auprès de votre service informatique."
+  }
+}

src/frontend/src/locales/fr/global.json

@@ -36,6 +36,7 @@
       "legalsTerms": "Mentions légales",
       "data": "Données personnelles et cookie",
       "accessibility": "Accessibilité : non conforme",
+      "connectionTest": "Tester votre configuration",
       "ariaLabel": "nouvelle fenêtre",
       "codeAnnotation": "Notre code est ouvert et disponible sur ce",
       "code": "dépôt de code Open Source",

src/frontend/src/locales/fr/home.json

@@ -13,6 +13,7 @@
   "moreLinkLabel": "En savoir plus sur {{appTitle}} - nouvelle fenêtre",
   "moreLink": "En savoir plus",
   "moreAbout": "sur {{appTitle}}",
+  "connectionTestLink": "Tester votre configuration",
   "createMenu": {
     "laterOption": "Créer une réunion pour une date ultérieure",
     "instantOption": "Démarrer une réunion instantanée"

src/frontend/src/routes.ts

@@ -20,6 +20,9 @@ const AccessibilityRoute = lazy(
 )
 const RoomRoute = lazy(() => import('@/features/rooms/routes/Room'))
 const FeedbackRoute = lazy(() => import('@/features/rooms/routes/Feedback'))
+const ConnectionTestRoute = lazy(
+  () => import('@/features/connection-test/routes/ConnectionTest')
+)
 
 const roomIdRegex = new RegExp(`^[/](?<roomId>${flexibleRoomIdPattern})$`)
 
@@ -27,6 +30,7 @@ export const routes: Record<
   | 'home'
   | 'room'
   | 'feedback'
+  | 'connectionTest'
   | 'legalTerms'
   | 'accessibility'
   | 'termsOfService'
@@ -57,6 +61,11 @@ export const routes: Record<
     path: '/feedback',
     Component: FeedbackRoute,
   },
+  connectionTest: {
+    name: 'connectionTest',
+    path: '/test-connection',
+    Component: ConnectionTestRoute,
+  },
   legalTerms: {
     name: 'legalTerms',
     path: '/mentions-legales',

src/frontend/src/styles/index.css

@@ -31,6 +31,19 @@ html.font-opendyslexic {
   border: 0;
 }
 
+/* LiveKit ConnectionCheck appends a temporary <video> to body during publishVideo.
+   Keep it decodable (not display:none) but invisible. */
+body.connection-test-hide-livekit-video > video {
+  position: fixed;
+  top: 0;
+  left: 0;
+  width: 10px;
+  height: 10px;
+  opacity: 0;
+  pointer-events: none;
+  z-index: -1;
+}
+
 * {
   outline: 2px solid transparent;
 }