⬆️(backend) upgrade django-lasuite to v1.0.0

Upgrade django-lasuite from 0.0.29 to 1.0.0.

An inactive token on the external API is now refused with a 401 error
instead of a 400.

CHANGELOG.md

@@ -12,6 +12,8 @@ and this project adheres to
 
 - ⬆️(summary) update ffmpeg to 8.1.3-r0
 - ✨(frontend) replace the Crisp chat with the La Suite support form
+- 🔒️(frontend) keep rooms out of search engine and AI indexes
+- ⬆️(backend) upgrade django-lasuite to v1.0.0
 
 ## [1.36.3] - 2026-10-23
 

UPGRADE.md

@@ -21,6 +21,11 @@ the following command inside your docker container:
 The Crisp chat is gone, the support button, now open the La Suite support form. They are hidden unless these `FRONTEND_SUPPORT` keys are all set.
 The former help links for recording/transcription are now redirecting to the adhoc page in the official documentation
 
+### Pages hidden from search engines
+
+Every page except `/` now carries a `noindex` tag and, with the provided nginx configurations, an `X-Robots-Tag` header to stay out of search indexes.
+A new `robots.txt` also blocks the main AI crawlers. If you maintain your own nginx configuration, copy the `location = /` and `location = /home.html` blocks from `src/frontend/default.conf`, and the `X-Robots-Tag` header from its `location /`.
+
 ## [v1.35.0]
 
 ### Purging deleted rooms

deploy/paas/servers.conf.erb

@@ -38,6 +38,17 @@ server {
       add_header Cache-Control "public, max-age=2592000";
   }
 
+  location = / {
+      try_files /home.html /index.html;
+      add_header Cache-Control "no-cache, no-store, must-revalidate";
+      add_header Pragma "no-cache";
+      add_header Expires 0;
+  }
+
+  location = /home.html {
+      internal;
+  }
+
   # Serve static files
   location / {
       try_files $uri $uri/ /index.html;
@@ -45,6 +56,7 @@ server {
       add_header Cache-Control "no-cache, no-store, must-revalidate";
       add_header Pragma "no-cache";  # HTTP 1.0 header for backward compatibility
       add_header Expires 0;
+      add_header X-Robots-Tag "noindex, nofollow" always;
   }
 
   # Optionally, handle 404 errors by redirecting to index.html

docker/dinum-frontend/Dockerfile

@@ -65,7 +65,8 @@ RUN apk upgrade --no-cache libexpat && \
     apk add --no-cache --upgrade 'pcre2>=10.49-r0' 'tiff>=4.7.2-r0' \
         'libx11>=1.8.14-r0' 'ca-certificates>=20261020-r0' \
         'brotli-libs>=1.2.1-r0' && \
-    apk del curl
+    apk del curl && \
+    rm -f /usr/share/nginx/html/50x.html
 USER nginx
 
 USER nginx

docker/dinum-frontend/nginx/default.conf

@@ -43,6 +43,7 @@ server {
       add_header Cache-Control "no-cache, no-store, must-revalidate";
       add_header Pragma "no-cache" always;
       add_header Expires 0 always;
+      add_header X-Robots-Tag "noindex, nofollow" always;
 
       set $ms_domains "https://*.live.com https://*.office.com https://*.microsoft.com https://*.office365.com https://*.sharepoint.com";
 
@@ -76,6 +77,17 @@ server {
       add_header Cache-Control "public, max-age=2592000";
   }
 
+  location = / {
+      try_files /home.html /index.html;
+      add_header Cache-Control "no-cache, no-store, must-revalidate";
+      add_header Pragma "no-cache";
+      add_header Expires 0;
+  }
+
+  location = /home.html {
+      internal;
+  }
+
   # Serve static files
   location / {
       try_files $uri $uri/ /index.html;
@@ -83,6 +95,7 @@ server {
       add_header Cache-Control "no-cache, no-store, must-revalidate";
       add_header Pragma "no-cache";  # HTTP 1.0 header for backward compatibility
       add_header Expires 0;
+      add_header X-Robots-Tag "noindex, nofollow" always;
   }
 
   # Optionally, handle 404 errors by redirecting to index.html

src/addons/outlook/src/commands/commands.html

@@ -2,6 +2,7 @@
 <html lang="fr">
 <head>
     <meta charset="UTF-8" />
+    <meta name="robots" content="noindex, nofollow" />
     <title data-app-name></title>
     <meta http-equiv="X-UA-Compatible" content="IE=Edge" />
     <script nonce="NONCE_PLACEHOLDER" src="https://appsforoffice.microsoft.com/lib/1/hosted/office.js"></script>

src/addons/outlook/src/success/success.html

@@ -4,6 +4,7 @@
     <meta charset="UTF-8" />
     <meta http-equiv="X-UA-Compatible" content="IE=Edge" />
     <meta name="viewport" content="width=device-width, initial-scale=1">
+    <meta name="robots" content="noindex, nofollow" />
     <title data-app-name></title>
     <link rel="stylesheet" href="../styles/spinner.css" />
     <script nonce="NONCE_PLACEHOLDER" src="/addons/outlook/config.js"></script>

src/addons/outlook/src/taskpane/taskpane.html

@@ -4,6 +4,7 @@
     <meta charset="UTF-8" />
     <meta http-equiv="X-UA-Compatible" content="IE=Edge" />
     <meta name="viewport" content="width=device-width, initial-scale=1">
+    <meta name="robots" content="noindex, nofollow" />
     <title data-app-name></title>
     <link rel="stylesheet" href="taskpane.css" />
     <script nonce="NONCE_PLACEHOLDER" src="/addons/outlook/config.js"></script>

src/addons/outlook/src/transit/transit.html

@@ -4,6 +4,7 @@
         <meta charset="UTF-8" />
         <meta http-equiv="X-UA-Compatible" content="IE=Edge" />
         <meta name="viewport" content="width=device-width, initial-scale=1">
+        <meta name="robots" content="noindex, nofollow" />
         <title data-app-name></title>
         <link rel="stylesheet" href="../styles/spinner.css" />
         <script nonce="NONCE_PLACEHOLDER" src="/addons/outlook/config.js"></script>

src/backend/core/tests/test_external_api_rooms.py

@@ -184,7 +184,7 @@ def test_api_rooms_list_with_application_disabled(mock_rs_authenticate, settings
 
 @responses.activate
 def test_api_rooms_list_with_invalid_rs_token(settings):
-    """Listing rooms with invalid resource server token should return 400."""
+    """Listing rooms with invalid resource server token should return 401."""
 
     settings.OIDC_OP_INTROSPECTION_ENDPOINT = "https://oidc.example.com/introspect"
     settings.OIDC_OP_URL = "https://oidc.example.com"
@@ -202,9 +202,8 @@ def test_api_rooms_list_with_invalid_rs_token(settings):
     client.credentials(HTTP_AUTHORIZATION="Bearer invalid-token-123")
     response = client.get("/external-api/v1.0/rooms/")
 
-    # Return 400 instead of 401 because ResourceServerAuthentication raises
-    # SuspiciousOperation when the introspected user is not active
-    assert response.status_code == 400
+    assert response.status_code == 401
+    assert "introspected user is not active" in str(response.data).lower()
 
 
 def test_api_rooms_list_missing_scope():
@@ -422,7 +421,7 @@ def test_api_rooms_retrieve_with_expired_token(settings):
 
 @responses.activate
 def test_api_rooms_retrieve_with_invalid_rs_token(settings):
-    """Retrieving rooms with invalid resource server token should return 400."""
+    """Retrieving rooms with invalid resource server token should return 401."""
 
     settings.OIDC_OP_INTROSPECTION_ENDPOINT = "https://oidc.example.com/introspect"
     settings.OIDC_OP_URL = "https://oidc.example.com"
@@ -443,9 +442,8 @@ def test_api_rooms_retrieve_with_invalid_rs_token(settings):
     client.credentials(HTTP_AUTHORIZATION="Bearer invalid-token-123")
     response = client.get(f"/external-api/v1.0/rooms/{room.id}/")
 
-    # Return 400 instead of 401 because ResourceServerAuthentication raises
-    # SuspiciousOperation when the introspected user is not active
-    assert response.status_code == 400
+    assert response.status_code == 401
+    assert "introspected user is not active" in str(response.data).lower()
 
 
 def test_api_rooms_retrieve_requires_scope():
@@ -647,7 +645,7 @@ def test_api_rooms_create_with_expired_token(settings):
 
 @responses.activate
 def test_api_rooms_create_with_invalid_rs_token(settings):
-    """Creating rooms with invalid resource server token should return 400."""
+    """Creating rooms with invalid resource server token should return 401."""
 
     settings.OIDC_OP_INTROSPECTION_ENDPOINT = "https://oidc.example.com/introspect"
     settings.OIDC_OP_URL = "https://oidc.example.com"
@@ -665,9 +663,8 @@ def test_api_rooms_create_with_invalid_rs_token(settings):
     client.credentials(HTTP_AUTHORIZATION="Bearer invalid-token-123")
     response = client.post("/external-api/v1.0/rooms/")
 
-    # Return 400 instead of 401 because ResourceServerAuthentication raises
-    # SuspiciousOperation when the introspected user is not active
-    assert response.status_code == 400
+    assert response.status_code == 401
+    assert "introspected user is not active" in str(response.data).lower()
 
 
 def test_api_rooms_create_inactive_user():
@@ -2971,6 +2968,36 @@ def test_api_rooms_missing_token_is_audited_as_denial(audit_events):
     assert event["url"]["path"] == "/external-api/v1.0/rooms/"
 
 
+@responses.activate
+def test_api_rooms_invalid_rs_token_is_audited_as_denial(audit_events, settings):
+    """A token refused by the identity provider is recorded as a denial."""
+    settings.OIDC_OP_INTROSPECTION_ENDPOINT = "https://oidc.example.com/introspect"
+    settings.OIDC_OP_URL = "https://oidc.example.com"
+
+    responses.add(
+        responses.POST,
+        "https://oidc.example.com/introspect",
+        json={"iss": "https://oidc.example.com", "active": False},
+    )
+
+    client = APIClient()
+    client.credentials(HTTP_AUTHORIZATION="Bearer invalid-token-123")
+    response = client.get("/external-api/v1.0/rooms/")
+
+    assert response.status_code == 401
+    assert response.headers["WWW-Authenticate"] == "Bearer"
+    responses.assert_call_count("https://oidc.example.com/introspect", 1)
+
+    [event] = find_events(audit_events, "room.list")
+
+    assert event["event"]["category"] == ["api", "authentication"]
+    assert event["event"]["reason"] == "authentication_failed"
+    assert event["lasuite"]["outcome"] == "denied"
+    assert event["lasuite"]["actor"] == {"type": "anonymous"}
+    assert event["http"]["response"] == {"status_code": 401}
+    assert event["error"]["message"] == response.json()["detail"]
+
+
 def test_api_rooms_missing_scope_is_audited_as_denial(audit_events):
     """A token without the required scope is a permission denial by the application."""
     user = UserFactory()

src/backend/pyproject.toml

@@ -33,7 +33,7 @@ dependencies = [
     "django-cors-headers==4.9.0",
     "django-countries==9.0.0",
     "django-filter==26.1",
-    "django-lasuite[all]==0.0.29",
+    "django-lasuite[all]==1.0.0",
     "django-parler==2.4",
     "redis==5.2.1",
     "django-redis==7.0.0",

src/backend/uv.lock

@@ -837,26 +837,28 @@ wheels = [
 
 [[package]]
 name = "django-lasuite"
-version = "0.0.29"
+version = "1.0.0"
 source = { registry = "https://pypi.org/simple" }
 dependencies = [
     { name = "django" },
-    { name = "djangorestframework" },
-    { name = "joserfc" },
-    { name = "mozilla-django-oidc" },
-    { name = "pyjwt" },
-    { name = "requests" },
-    { name = "requests-toolbelt" },
 ]
-sdist = { url = "https://files.pythonhosted.org/packages/f4/ab/72a79b7133fb2d17835bef40f45f7e6d2b4343469c37fd00386122e9068d/django_lasuite-0.0.29.tar.gz", hash = "sha256:831cb859e45e33963c9d89168c2de14f9844e805000b0f0d1512ffd0b9731a39", size = 35248, upload-time = "2026-08-25T13:03:43.597Z" }
+sdist = { url = "https://files.pythonhosted.org/packages/0f/cc/35335b826b039c43da68a0e624e154f60c3ac6c83f01f9b4ad6ce91faf03/django_lasuite-1.0.0.tar.gz", hash = "sha256:8921aaba5a78f1f9728cee2cc4596755478108f17146d4a2fccb393c043a05a3", size = 45815, upload-time = "2026-10-30T14:57:31.764Z" }
 wheels = [
-    { url = "https://files.pythonhosted.org/packages/a1/cf/86648643221816f18ebd5a3e59b6d2a85ee85b38b19c7abe939f798a2845/django_lasuite-0.0.29-py3-none-any.whl", hash = "sha256:33bcff90ced2709190ef01241badb17ceed08a32725b9cdd3105650b36da303b", size = 54899, upload-time = "2026-08-25T13:03:42.212Z" },
+    { url = "https://files.pythonhosted.org/packages/a4/6f/d1df3f2881cda711e569b8e685ad3a846ca9c71226340597cee1c09beae0/django_lasuite-1.0.0-py3-none-any.whl", hash = "sha256:23d589be9496b1f484772b49f3c4c4a81e70affd537e3c50abf15303c84d7cb0", size = 68529, upload-time = "2026-10-30T14:57:30.416Z" },
 ]
 
 [package.optional-dependencies]
 all = [
     { name = "celery" },
+    { name = "cryptography" },
     { name = "django-configurations" },
+    { name = "djangorestframework" },
+    { name = "joserfc" },
+    { name = "mozilla-django-oidc" },
+    { name = "pyjwt" },
+    { name = "python-icap" },
+    { name = "requests" },
+    { name = "requests-toolbelt" },
 ]
 
 [[package]]
@@ -1440,7 +1442,7 @@ requires-dist = [
     { name = "django-cors-headers", specifier = "==4.9.0" },
     { name = "django-countries", specifier = "==9.0.0" },
     { name = "django-filter", specifier = "==26.1" },
-    { name = "django-lasuite", extras = ["all"], specifier = "==0.0.29" },
+    { name = "django-lasuite", extras = ["all"], specifier = "==1.0.0" },
     { name = "django-parler", specifier = "==2.4" },
     { name = "django-pydantic-field", specifier = "==0.5.4" },
     { name = "django-redis", specifier = "==7.0.0" },
@@ -2258,6 +2260,15 @@ wheels = [
     { url = "https://files.pythonhosted.org/packages/a6/a3/17c284b4f4d8ad50f0f9ba70ad8fcc35c777aeafcdbbffdd91bbdc5ab379/python_frontmatter-1.3.0-py3-none-any.whl", hash = "sha256:9f7dd9260bec99044219159a329f64f039087f9d1a2124c9442556f2fe6f82ec", size = 10562, upload-time = "2026-05-20T19:21:43.323Z" },
 ]
 
+[[package]]
+name = "python-icap"
+version = "0.2.0"
+source = { registry = "https://pypi.org/simple" }
+sdist = { url = "https://files.pythonhosted.org/packages/5c/0a/123c30f4041eabb94c587d35fb64aa9498435d028a8577340a4e5adc5224/python_icap-0.2.0.tar.gz", hash = "sha256:627869ac29119074542de6ae95370914854fdb35ee0a13c8ae4c55847cfcb80e", size = 684516, upload-time = "2026-07-08T22:21:58.842Z" }
+wheels = [
+    { url = "https://files.pythonhosted.org/packages/d8/f2/b437a5e08b94dfc4cd8505cfc3e63922247e9ce3957707550ab08c514560/python_icap-0.2.0-py3-none-any.whl", hash = "sha256:b648d55b68abe387849a124d1b4a443801342a566afd2141f4515953ed4bd738", size = 70680, upload-time = "2026-07-08T22:21:57.307Z" },
+]
+
 [[package]]
 name = "python-magic"
 version = "0.4.27"

src/frontend/Dockerfile

@@ -54,7 +54,8 @@ RUN apk upgrade --no-cache libexpat && \
     apk add --no-cache --upgrade 'pcre2>=10.49-r0' 'tiff>=4.7.2-r0' \
         'libx11>=1.8.14-r0' 'ca-certificates>=20261020-r0' \
         'brotli-libs>=1.2.1-r0' && \
-    apk del curl
+    apk del curl && \
+    rm -f /usr/share/nginx/html/50x.html
 USER nginx
 
 # Un-privileged user running the application

src/frontend/default.conf

@@ -16,6 +16,17 @@ server {
       add_header Cache-Control "public, max-age=2592000";
   }
 
+  location = / {
+      try_files /home.html /index.html;
+      add_header Cache-Control "no-cache, no-store, must-revalidate";
+      add_header Pragma "no-cache";
+      add_header Expires 0;
+  }
+
+  location = /home.html {
+      internal;
+  }
+
   # Serve static files
   location / {
       try_files $uri $uri/ /index.html;
@@ -23,6 +34,7 @@ server {
       add_header Cache-Control "no-cache, no-store, must-revalidate";
       add_header Pragma "no-cache";  # HTTP 1.0 header for backward compatibility
       add_header Expires 0;
+      add_header X-Robots-Tag "noindex, nofollow" always;
   }
 
   # Optionally, handle 404 errors by redirecting to index.html

src/frontend/index.html

@@ -7,6 +7,7 @@
     <link rel="icon" type="image/png" sizes="16x16" href="/favicon-16x16.png">
     <link rel="manifest" href="/site.webmanifest">
     <meta name="viewport" content="width=device-width, initial-scale=1.0" />
+    <meta name="robots" content="noindex, nofollow" />
     <title>%VITE_APP_TITLE%</title>
   </head>
   <body>

src/frontend/public/robots.txt

@@ -0,0 +1,18 @@
+User-agent: GPTBot
+User-agent: OAI-SearchBot
+User-agent: ChatGPT-User
+User-agent: ClaudeBot
+User-agent: Claude-SearchBot
+User-agent: Claude-User
+User-agent: PerplexityBot
+User-agent: Perplexity-User
+User-agent: Google-Extended
+User-agent: Applebot-Extended
+User-agent: CCBot
+User-agent: Meta-ExternalAgent
+User-agent: Amazonbot
+User-agent: Bytespider
+Disallow: /
+
+User-agent: *
+Allow: /

src/frontend/vite.config.ts

@@ -1,5 +1,6 @@
-import { readFileSync } from 'node:fs'
-import { defineConfig, loadEnv } from 'vite'
+import { readFileSync, writeFileSync } from 'node:fs'
+import { join } from 'node:path'
+import { defineConfig, loadEnv, type Plugin } from 'vite'
 import react from '@vitejs/plugin-react'
 import { visualizer } from 'rollup-plugin-visualizer'
 import svgr from 'vite-plugin-svgr'
@@ -25,6 +26,23 @@ if (mediapipeVersion !== livekitMediapipeVersion) {
   )
 }
 
+const NOINDEX_TAG = '<meta name="robots" content="noindex, nofollow" />'
+
+const homePage = (): Plugin => ({
+  name: 'home-page',
+  apply: 'build',
+  writeBundle({ dir = 'dist' }) {
+    const html = readFileSync(join(dir, 'index.html'), 'utf-8')
+    if (!html.includes(NOINDEX_TAG)) {
+      throw new Error(
+        `${dir}/index.html does not contain ${NOINDEX_TAG}, so home.html ` +
+          `cannot be generated from it. The two must stay in sync.`
+      )
+    }
+    writeFileSync(join(dir, 'home.html'), html.replace(NOINDEX_TAG, ''))
+  },
+})
+
 // https://vitejs.dev/config/
 export default defineConfig(({ mode }) => {
   const env = loadEnv(mode, process.cwd())
@@ -66,6 +84,7 @@ export default defineConfig(({ mode }) => {
           },
         ],
       }),
+      homePage(),
       env.VITE_ANALYZE === 'true' &&
         visualizer({
           open: true,

src/helm/extra/templates/frontend_nginx_cm.yaml

@@ -51,6 +51,7 @@ data:
             add_header Cache-Control "no-cache, no-store, must-revalidate";
             add_header Pragma "no-cache" always;
             add_header Expires 0 always;
+            add_header X-Robots-Tag "noindex, nofollow" always;
 
             set $ms_domains "https://*.live.com https://*.office.com https://*.microsoft.com https://*.office365.com https://*.sharepoint.com";
 
@@ -84,6 +85,17 @@ data:
             add_header Cache-Control "public, max-age=2592000";
         }
 
+        location = / {
+            try_files /home.html /index.html;
+            add_header Cache-Control "no-cache, no-store, must-revalidate";
+            add_header Pragma "no-cache";
+            add_header Expires 0;
+        }
+
+        location = /home.html {
+            internal;
+        }
+
         # Serve static files
         location / {
             try_files $uri $uri/ /index.html;
@@ -91,6 +103,7 @@ data:
             add_header Cache-Control "no-cache, no-store, must-revalidate";
             add_header Pragma "no-cache";  # HTTP 1.0 header for backward compatibility
             add_header Expires 0;
+            add_header X-Robots-Tag "noindex, nofollow" always;
         }
 
         # Optionally, handle 404 errors by redirecting to index.html