✨(frontend) add configurable ministries domains to add-in CSP

Introduce a variable to define allowed ministries domains in the
CSP configuration for the add-in.

This improves flexibility and avoids hardcoding domain lists.

CHANGELOG.md

@@ -8,6 +8,17 @@ and this project adheres to
 
 ## [Unreleased]
 
+### Added
+
+- 🔒️(backend) add validation of Room.configuration
+- ✨(helm) add support multiple transcribe worker / endpoint #1247
+
+### Fixed
+
+- ♻(frontend) standardize role terminology across localizations
+- 🐛(backend) make start-recording atomic and fault-tolerant
+- 🔒️(frontend) room ids are generated with non-cryptographic rand
+
 ## [1.15.0] - 2026-04-30
 
 ### Added

bin/Tiltfile

@@ -109,7 +109,7 @@ k8s_resource('meet-backend', resource_deps=['postgresql', 'minio', 'redis', 'liv
 k8s_resource('meet-celery-backend', resource_deps=['redis'])
 k8s_resource('meet-celery-summarize', resource_deps=['redis'])
 k8s_resource('meet-celery-summary-backend', resource_deps=['redis'])
-k8s_resource('meet-celery-transcribe', resource_deps=['redis'])
+k8s_resource('meet-celery-transcribe-default', resource_deps=['redis'])
 k8s_resource('meet-backend-migrate', resource_deps=['meet-backend'])
 k8s_resource('livekit-livekit-server', resource_deps=['redis'])
 k8s_resource('livekit-livekit-server-test-connection', resource_deps=['livekit-livekit-server'])

bin/prepare-release.sh

@@ -101,6 +101,12 @@ update_npm_version "mail"
 # Update backend pyproject.toml
 update_python_version "backend"
 
+# Run uv lock in backend
+print_info "Running uv lock in backend..."
+cd "src/backend"
+uv lock
+cd -
+
 # Update summary pyproject.toml
 update_python_version "summary"
 
@@ -149,6 +155,7 @@ echo "      - src/frontend/package.json"
 echo "      - src/sdk/package.json"
 echo "      - src/mail/package.json"
 echo "      - src/backend/pyproject.toml"
+echo "      - src/backend/uv.lock"
 echo "      - src/summary/pyproject.toml"
 echo "      - src/agents/pyproject.toml"
 echo "      - CHANGELOG.md"

docker/dinum-frontend/nginx/default.conf

@@ -44,14 +44,15 @@ server {
       add_header Pragma "no-cache" always;
       add_header Expires 0 always;
 
-      set $ms_domains "https://*.live.com https://*.office.com https://*.microsoft.com https://*.office365.com https://*.sharepoint.com";
+      set $ms_domains "https://*.live.com https://*.office.com https://*.microsoft.com https://*.office365.com https://*.sharepoint.com https://*.cloud.microsoft";
+      set $ministries_domains "https://courrieljf.ccomptes.fr";
 
       set $nonce $request_id;
 
       set $csp "upgrade-insecure-requests; ";
-      set $csp "${csp}frame-ancestors ${ms_domains}; ";
+      set $csp "${csp}frame-ancestors ${ms_domains} ${ministries_domains}; ";
       set $csp "${csp}script-src 'nonce-${nonce}' 'strict-dynamic'; ";
-      set $csp "${csp}connect-src 'self' ${ms_domains}; ";
+      set $csp "${csp}connect-src 'self' ${ms_domains} ${ministries_domains}; ";
       set $csp "${csp}frame-src 'none'; ";
       set $csp "${csp}object-src 'none'; ";
       set $csp "${csp}base-uri 'none'; ";

src/addons/outlook/package-lock.json

@@ -36,7 +36,7 @@
         "source-map-loader": "^5.0.0",
         "webpack": "^5.95.0",
         "webpack-cli": "^5.1.4",
-        "webpack-dev-server": "5.1.0"
+        "webpack-dev-server": "5.2.1"
       }
     },
     "node_modules/@apidevtools/json-schema-ref-parser": {
@@ -8996,23 +8996,6 @@
         "safe-buffer": "~5.1.0"
       }
     },
-    "node_modules/html-entities": {
-      "version": "2.6.0",
-      "resolved": "https://registry.npmjs.org/html-entities/-/html-entities-2.6.0.tgz",
-      "integrity": "sha512-kig+rMn/QOVRvr7c86gQ8lWXq+Hkv6CbAH1hLu+RG338StTpE8Z0b44SDVaqVu7HGKf27frdmUYEs9hTUX/cLQ==",
-      "dev": true,
-      "funding": [
-        {
-          "type": "github",
-          "url": "https://github.com/sponsors/mdevils"
-        },
-        {
-          "type": "patreon",
-          "url": "https://patreon.com/mdevils"
-        }
-      ],
-      "license": "MIT"
-    },
     "node_modules/html-escaper": {
       "version": "3.0.3",
       "resolved": "https://registry.npmjs.org/html-escaper/-/html-escaper-3.0.3.tgz",
@@ -15671,15 +15654,16 @@
       }
     },
     "node_modules/webpack-dev-server": {
-      "version": "5.1.0",
-      "resolved": "https://registry.npmjs.org/webpack-dev-server/-/webpack-dev-server-5.1.0.tgz",
-      "integrity": "sha512-aQpaN81X6tXie1FoOB7xlMfCsN19pSvRAeYUHOdFWOlhpQ/LlbfTqYwwmEDFV0h8GGuqmCmKmT+pxcUV/Nt2gQ==",
+      "version": "5.2.1",
+      "resolved": "https://registry.npmjs.org/webpack-dev-server/-/webpack-dev-server-5.2.1.tgz",
+      "integrity": "sha512-ml/0HIj9NLpVKOMq+SuBPLHcmbG+TGIjXRHsYfZwocUBIqEvws8NnS/V9AFQ5FKP+tgn5adwVwRrTEpGL33QFQ==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
         "@types/bonjour": "^3.5.13",
         "@types/connect-history-api-fallback": "^1.5.4",
         "@types/express": "^4.17.21",
+        "@types/express-serve-static-core": "^4.17.21",
         "@types/serve-index": "^1.9.4",
         "@types/serve-static": "^1.15.5",
         "@types/sockjs": "^0.3.36",
@@ -15690,10 +15674,9 @@
         "colorette": "^2.0.10",
         "compression": "^1.7.4",
         "connect-history-api-fallback": "^2.0.0",
-        "express": "^4.19.2",
+        "express": "^4.21.2",
         "graceful-fs": "^4.2.6",
-        "html-entities": "^2.4.0",
-        "http-proxy-middleware": "^2.0.3",
+        "http-proxy-middleware": "^2.0.7",
         "ipaddr.js": "^2.1.0",
         "launch-editor": "^2.6.1",
         "open": "^10.0.3",
@@ -15728,6 +15711,19 @@
         }
       }
     },
+    "node_modules/webpack-dev-server/node_modules/@types/express-serve-static-core": {
+      "version": "4.19.8",
+      "resolved": "https://registry.npmjs.org/@types/express-serve-static-core/-/express-serve-static-core-4.19.8.tgz",
+      "integrity": "sha512-02S5fmqeoKzVZCHPZid4b8JH2eM5HzQLZWN2FohQEy/0eXTq8VXZfSN6Pcr3F6N9R/vNrj7cpgbhjie6m/1tCA==",
+      "dev": true,
+      "license": "MIT",
+      "dependencies": {
+        "@types/node": "*",
+        "@types/qs": "*",
+        "@types/range-parser": "*",
+        "@types/send": "*"
+      }
+    },
     "node_modules/webpack-dev-server/node_modules/define-lazy-prop": {
       "version": "3.0.0",
       "resolved": "https://registry.npmjs.org/define-lazy-prop/-/define-lazy-prop-3.0.0.tgz",
@@ -15771,9 +15767,9 @@
       }
     },
     "node_modules/webpack-dev-server/node_modules/ws": {
-      "version": "8.19.0",
-      "resolved": "https://registry.npmjs.org/ws/-/ws-8.19.0.tgz",
-      "integrity": "sha512-blAT2mjOEIi0ZzruJfIhb3nps74PRWTCz1IjglWEEpQl5XS/UNama6u2/rjFkDDouqr4L67ry+1aGIALViWjDg==",
+      "version": "8.20.0",
+      "resolved": "https://registry.npmjs.org/ws/-/ws-8.20.0.tgz",
+      "integrity": "sha512-sAt8BhgNbzCtgGbt2OxmpuryO63ZoDk/sqaB/znQm94T4fCEsy/yV+7CdC1kJhOU9lboAEU7R3kquuycDoibVA==",
       "dev": true,
       "license": "MIT",
       "engines": {

src/addons/outlook/package.json

@@ -53,7 +53,7 @@
     "source-map-loader": "^5.0.0",
     "webpack": "^5.95.0",
     "webpack-cli": "^5.1.4",
-    "webpack-dev-server": "5.1.0"
+    "webpack-dev-server": "5.2.1"
   },
   "prettier": "office-addin-prettier-config",
   "browserslist": [

src/backend/core/api/serializers.py

@@ -14,6 +14,7 @@ from django.utils.translation import gettext_lazy as _
 
 from django_pydantic_field.rest_framework import SchemaField
 from pydantic import BaseModel, Field
+from pydantic import ValidationError as PydanticValidationError
 from rest_framework import serializers
 from rest_framework.exceptions import PermissionDenied
 from timezone_field.rest_framework import TimeZoneSerializerField
@@ -131,6 +132,16 @@ class RoomSerializer(serializers.ModelSerializer):
         fields = ["id", "name", "slug", "configuration", "access_level", "pin_code"]
         read_only_fields = ["id", "slug", "pin_code"]
 
+    def validate_configuration(self, value):
+        """Validate room configuration against the RoomConfiguration schema."""
+        if value is None or value == {}:
+            return value
+        try:
+            RoomConfiguration.model_validate(value)
+        except PydanticValidationError as e:
+            raise serializers.ValidationError(e.errors()) from e
+        return value
+
     def to_representation(self, instance):
         """
         Add users only for administrator users.
@@ -306,6 +317,22 @@ class MuteParticipantSerializer(BaseParticipantsManagementSerializer):
     )
 
 
+RoomConfigurationTrackSource = Literal[
+    "camera", "microphone", "screen_share", "screen_share_audio"
+]
+
+
+class RoomConfiguration(BaseModel):
+    """Validate room configuration structure.
+
+    Unknown fields are rejected.
+    """
+
+    can_publish_sources: list[RoomConfigurationTrackSource] | None = None
+
+    model_config = {"extra": "forbid"}
+
+
 TrackSource = Literal["SCREEN_SHARE", "SCREEN_SHARE_AUDIO", "CAMERA", "MICROPHONE"]
 
 

src/backend/core/api/viewsets.py

@@ -6,7 +6,9 @@ from logging import getLogger
 from urllib.parse import unquote, urlparse
 
 from django.conf import settings
+from django.core.exceptions import ValidationError as DjangoValidationError
 from django.core.files.storage import default_storage
+from django.db import IntegrityError, transaction
 from django.db.models import Q
 from django.http import Http404
 from django.shortcuts import get_object_or_404
@@ -320,16 +322,27 @@ class RoomViewSet(
         options = serializer.validated_data.get("options")
         room = self.get_object()
 
-        # May raise exception if an active or initiated recording already exist for the room
-        recording = models.Recording.objects.create(
-            room=room,
-            mode=mode,
-            options=options.model_dump(exclude_none=True) if options else {},
-        )
+        try:
+            with transaction.atomic():
+                recording = models.Recording.objects.create(
+                    room=room,
+                    mode=mode,
+                    options=options.model_dump(exclude_none=True) if options else {},
+                )
+                models.RecordingAccess.objects.create(
+                    user=self.request.user,
+                    role=models.RoleChoices.OWNER,
+                    recording=recording,
+                )
 
-        models.RecordingAccess.objects.create(
-            user=self.request.user, role=models.RoleChoices.OWNER, recording=recording
-        )
+        except (DjangoValidationError, IntegrityError):
+            # DjangoValidationError covers the Python-level check (full_clean);
+            # IntegrityError covers the race where two concurrent requests both
+            # pass that check and the DB-level UNIQUE constraint catches the loser.
+            return drf_response.Response(
+                {"error": f"A recording is already in progress for room {room.slug}"},
+                status=drf_status.HTTP_409_CONFLICT,
+            )
 
         worker_service = get_worker_service(mode=recording.mode)
         worker_manager = WorkerServiceMediator(worker_service=worker_service)
@@ -337,9 +350,12 @@ class RoomViewSet(
         try:
             worker_manager.start(recording)
         except RecordingStartError:
+            models.Recording.objects.filter(pk=recording.pk).update(
+                status=models.RecordingStatusChoices.FAILED_TO_START
+            )
             return drf_response.Response(
                 {"error": f"Recording failed to start for room {room.slug}"},
-                status=drf_status.HTTP_500_INTERNAL_SERVER_ERROR,
+                status=drf_status.HTTP_502_BAD_GATEWAY,
             )
 
         if settings.METADATA_COLLECTOR_ENABLED and (

src/backend/core/services/lobby.py

@@ -123,7 +123,7 @@ class LobbyService:
 
     def request_entry(
         self,
-        room,
+        room: models.Room,
         request,
         username: str,
     ) -> Tuple[LobbyParticipant, Optional[Dict]]:

src/backend/core/tests/files/test_api_files_create.py

@@ -117,7 +117,7 @@ def test_api_files_create_file_authenticated_success():
     policy_parsed = urlparse(policy)
 
     assert policy_parsed.scheme == "http"
-    assert policy_parsed.netloc == "localhost:9000"
+    assert policy_parsed.netloc in ["minio:9000", "localhost:9000"]
     assert policy_parsed.path == f"/meet-media-storage/files/{file.id!s}.png"
 
     query_params = parse_qs(policy_parsed.query)

src/backend/core/tests/rooms/test_api_rooms_retrieve.py

@@ -232,7 +232,7 @@ def test_api_rooms_retrieve_authenticated_public(mock_token):
     """
     room = RoomFactory(
         access_level=RoomAccessLevel.PUBLIC,
-        configuration={"can_publish_sources": ["mock-source"]},
+        configuration={"can_publish_sources": ["camera"]},
     )
 
     user = UserFactory()
@@ -264,7 +264,7 @@ def test_api_rooms_retrieve_authenticated_public(mock_token):
         user=user,
         username=None,
         color=None,
-        sources=["mock-source"],
+        sources=["camera"],
         is_admin_or_owner=False,
         participant_id=None,
     )
@@ -363,7 +363,7 @@ def test_api_rooms_retrieve_members(mock_token, django_assert_num_queries, setti
     other_user = UserFactory()
 
     room = RoomFactory(
-        configuration={"can_publish_sources": ["mock-source"]},
+        configuration={"can_publish_sources": ["camera"]},
     )
     UserResourceAccessFactory(resource=room, user=user, role="member")
     UserResourceAccessFactory(resource=room, user=other_user, role="member")
@@ -401,7 +401,7 @@ def test_api_rooms_retrieve_members(mock_token, django_assert_num_queries, setti
         user=user,
         username=None,
         color=None,
-        sources=["mock-source"],
+        sources=["camera"],
         is_admin_or_owner=False,
         participant_id=None,
     )

src/backend/core/tests/rooms/test_api_rooms_start_recording.py

@@ -140,16 +140,18 @@ def test_start_recording_worker_error(
 
     mock_worker_service_factory.assert_called_once_with(mode="screen_recording")
 
-    assert response.status_code == 500
+    assert response.status_code == 502
     assert response.json() == {
         "error": f"Recording failed to start for room {room.slug}"
     }
 
-    # Recording object should be created even if worker fails
+    # Recording object should be created even if worker fails, and moved out
+    # of the unique-constraint window so the room is not locked.
     assert Recording.objects.count() == 1
     recording = Recording.objects.first()
     assert recording.room == room
     assert recording.mode == "screen_recording"
+    assert recording.status == "failed_to_start"
 
     # Verify recording access details
     assert recording.accesses.count() == 1
@@ -158,6 +160,72 @@ def test_start_recording_worker_error(
     assert access.role == "owner"
 
 
+@pytest.mark.parametrize(
+    "status",
+    ["active", "initiated"],
+)
+def test_start_recording_conflict_when_already_in_progress(
+    status, mock_worker_service_factory, mock_worker_manager, settings
+):
+    """Should return 409 when a second start is attempted while a recording is already active."""
+    settings.RECORDING_ENABLE = True
+
+    room = RoomFactory()
+    user = UserFactory()
+    room.accesses.create(user=user, role="owner")
+
+    # Pre-existing active recording for the same room.
+    Recording.objects.create(room=room, mode="screen_recording", status="active")
+
+    client = APIClient()
+    client.force_login(user)
+
+    response = client.post(
+        f"/api/v1.0/rooms/{room.id}/start-recording/",
+        {"mode": "screen_recording"},
+    )
+
+    assert response.status_code == 409
+    assert response.json() == {
+        "error": f"A recording is already in progress for room {room.slug}"
+    }
+    # No new recording row, no access row leaked from the rolled-back transaction.
+    assert Recording.objects.count() == 1
+    assert Recording.objects.first().accesses.count() == 0
+    mock_worker_manager.start.assert_not_called()
+
+
+def test_start_recording_after_worker_failure_unblocks_room(
+    mock_worker_service_factory, mock_worker_manager, settings
+):
+    """Should allow a new recording when the previous recording failed."""
+    settings.RECORDING_ENABLE = True
+
+    room = RoomFactory()
+    user = UserFactory()
+    room.accesses.create(user=user, role="owner")
+
+    mock_worker_manager.start = mock.Mock(
+        side_effect=[RecordingStartError("boom"), None]
+    )
+
+    client = APIClient()
+    client.force_login(user)
+
+    first = client.post(
+        f"/api/v1.0/rooms/{room.id}/start-recording/",
+        {"mode": "screen_recording"},
+    )
+    assert first.status_code == 502
+
+    second = client.post(
+        f"/api/v1.0/rooms/{room.id}/start-recording/",
+        {"mode": "screen_recording"},
+    )
+    assert second.status_code == 201
+    assert Recording.objects.count() == 2
+
+
 def test_start_recording_success(
     mock_worker_service_factory, mock_worker_manager, settings
 ):

src/backend/core/tests/rooms/test_api_rooms_update.py

@@ -67,7 +67,7 @@ def test_api_rooms_update_members():
             "name": "New name",
             "slug": "should-be-ignored",
             "access_level": RoomAccessLevel.RESTRICTED,
-            "configuration": {"the_key": "the_value"},
+            "configuration": {"can_publish_sources": ["camera", "microphone"]},
         },
         format="json",
     )
@@ -95,7 +95,7 @@ def test_api_rooms_update_administrators():
             "name": "New name",
             "slug": "should-be-ignored",
             "access_level": RoomAccessLevel.PUBLIC,
-            "configuration": {"the_key": "the_value"},
+            "configuration": {"can_publish_sources": ["camera", "microphone"]},
         },
         format="json",
     )
@@ -104,7 +104,98 @@ def test_api_rooms_update_administrators():
     assert room.name == "New name"
     assert room.slug == "new-name"
     assert room.access_level == RoomAccessLevel.PUBLIC
-    assert room.configuration == {"the_key": "the_value"}
+    assert room.configuration == {"can_publish_sources": ["camera", "microphone"]}
+
+
+@pytest.mark.parametrize(
+    "configuration",
+    [
+        {},
+        {"can_publish_sources": ["camera", "microphone"]},
+        {
+            "can_publish_sources": [
+                "camera",
+                "microphone",
+                "screen_share",
+                "screen_share_audio",
+            ]
+        },
+        {"can_publish_sources": []},
+        {"can_publish_sources": None},
+    ],
+)
+def test_api_rooms_update_configuration_valid(configuration):
+    """Administrators should be allowed to set valid configurations."""
+    user = UserFactory()
+    room = RoomFactory(users=[(user, "owner")])
+    client = APIClient()
+    client.force_login(user)
+
+    response = client.patch(
+        f"/api/v1.0/rooms/{room.id!s}/",
+        {"configuration": configuration},
+        format="json",
+    )
+    assert response.status_code == 200
+    room.refresh_from_db()
+    assert room.configuration == configuration
+
+
+def test_api_rooms_update_configuration_extra_keys_rejected():
+    """Extra keys in configuration should be rejected."""
+    user = UserFactory()
+    room = RoomFactory(users=[(user, "owner")])
+    client = APIClient()
+    client.force_login(user)
+
+    response = client.patch(
+        f"/api/v1.0/rooms/{room.id!s}/",
+        {
+            "configuration": {
+                "can_publish_sources": ["camera"],
+                "arbitrary_key": "value",
+            }
+        },
+        format="json",
+    )
+    assert response.status_code == 400
+    room.refresh_from_db()
+    assert room.configuration == {}
+
+
+@pytest.mark.parametrize("invalid_source", ["invalid_source", "CAMERA"])
+def test_api_rooms_update_configuration_invalid_source_value(invalid_source):
+    """Invalid source values should be rejected."""
+    user = UserFactory()
+    room = RoomFactory(users=[(user, "owner")])
+    client = APIClient()
+    client.force_login(user)
+
+    response = client.patch(
+        f"/api/v1.0/rooms/{room.id!s}/",
+        {"configuration": {"can_publish_sources": [invalid_source]}},
+        format="json",
+    )
+    assert response.status_code == 400
+    room.refresh_from_db()
+    assert room.configuration == {}
+
+
+def test_api_rooms_update_configuration_wrong_type():
+    """Configuration values with wrong types should be rejected."""
+    user = UserFactory()
+    room = RoomFactory(users=[(user, "owner")])
+    client = APIClient()
+    client.force_login(user)
+
+    response = client.patch(
+        f"/api/v1.0/rooms/{room.id!s}/",
+        {"configuration": {"can_publish_sources": "camera"}},
+        format="json",
+    )
+    assert response.status_code == 400
+    room.refresh_from_db()
+    assert room.configuration == {}
 
 
 def test_api_rooms_update_administrators_of_another():

src/frontend/package-lock.json

@@ -54,7 +54,7 @@
         "eslint-plugin-jsx-a11y": "6.10.2",
         "eslint-plugin-react-hooks": "5.2.0",
         "eslint-plugin-react-refresh": "0.4.20",
-        "postcss": "8.5.6",
+        "postcss": "8.5.10",
         "prettier": "3.8.1",
         "typescript": "5.8.3",
         "vite": "7.3.2",
@@ -1759,6 +1759,35 @@
         "ts-pattern": "5.9.0"
       }
     },
+    "node_modules/@pandacss/core/node_modules/postcss": {
+      "version": "8.5.6",
+      "resolved": "https://registry.npmjs.org/postcss/-/postcss-8.5.6.tgz",
+      "integrity": "sha512-3Ybi1tAuwAP9s0r1UQ2J4n5Y0G05bJkpUIO0/bI9MhwmD70S5aTWbXGBwxHrelT+XM1k6dM0pk+SwNkpTRN7Pg==",
+      "dev": true,
+      "funding": [
+        {
+          "type": "opencollective",
+          "url": "https://opencollective.com/postcss/"
+        },
+        {
+          "type": "tidelift",
+          "url": "https://tidelift.com/funding/github/npm/postcss"
+        },
+        {
+          "type": "github",
+          "url": "https://github.com/sponsors/ai"
+        }
+      ],
+      "license": "MIT",
+      "dependencies": {
+        "nanoid": "^3.3.11",
+        "picocolors": "^1.1.1",
+        "source-map-js": "^1.2.1"
+      },
+      "engines": {
+        "node": "^10 || ^12 || >=14"
+      }
+    },
     "node_modules/@pandacss/dev": {
       "version": "1.8.2",
       "resolved": "https://registry.npmjs.org/@pandacss/dev/-/dev-1.8.2.tgz",
@@ -1816,6 +1845,35 @@
         "ts-pattern": "5.9.0"
       }
     },
+    "node_modules/@pandacss/generator/node_modules/postcss": {
+      "version": "8.5.6",
+      "resolved": "https://registry.npmjs.org/postcss/-/postcss-8.5.6.tgz",
+      "integrity": "sha512-3Ybi1tAuwAP9s0r1UQ2J4n5Y0G05bJkpUIO0/bI9MhwmD70S5aTWbXGBwxHrelT+XM1k6dM0pk+SwNkpTRN7Pg==",
+      "dev": true,
+      "funding": [
+        {
+          "type": "opencollective",
+          "url": "https://opencollective.com/postcss/"
+        },
+        {
+          "type": "tidelift",
+          "url": "https://tidelift.com/funding/github/npm/postcss"
+        },
+        {
+          "type": "github",
+          "url": "https://github.com/sponsors/ai"
+        }
+      ],
+      "license": "MIT",
+      "dependencies": {
+        "nanoid": "^3.3.11",
+        "picocolors": "^1.1.1",
+        "source-map-js": "^1.2.1"
+      },
+      "engines": {
+        "node": "^10 || ^12 || >=14"
+      }
+    },
     "node_modules/@pandacss/is-valid-prop": {
       "version": "1.8.2",
       "resolved": "https://registry.npmjs.org/@pandacss/is-valid-prop/-/is-valid-prop-1.8.2.tgz",
@@ -1917,6 +1975,35 @@
         "url": "https://github.com/sponsors/jonschlinkert"
       }
     },
+    "node_modules/@pandacss/node/node_modules/postcss": {
+      "version": "8.5.6",
+      "resolved": "https://registry.npmjs.org/postcss/-/postcss-8.5.6.tgz",
+      "integrity": "sha512-3Ybi1tAuwAP9s0r1UQ2J4n5Y0G05bJkpUIO0/bI9MhwmD70S5aTWbXGBwxHrelT+XM1k6dM0pk+SwNkpTRN7Pg==",
+      "dev": true,
+      "funding": [
+        {
+          "type": "opencollective",
+          "url": "https://opencollective.com/postcss/"
+        },
+        {
+          "type": "tidelift",
+          "url": "https://tidelift.com/funding/github/npm/postcss"
+        },
+        {
+          "type": "github",
+          "url": "https://github.com/sponsors/ai"
+        }
+      ],
+      "license": "MIT",
+      "dependencies": {
+        "nanoid": "^3.3.11",
+        "picocolors": "^1.1.1",
+        "source-map-js": "^1.2.1"
+      },
+      "engines": {
+        "node": "^10 || ^12 || >=14"
+      }
+    },
     "node_modules/@pandacss/node/node_modules/prettier": {
       "version": "3.2.5",
       "resolved": "https://registry.npmjs.org/prettier/-/prettier-3.2.5.tgz",
@@ -1976,6 +2063,35 @@
         "postcss": "8.5.6"
       }
     },
+    "node_modules/@pandacss/postcss/node_modules/postcss": {
+      "version": "8.5.6",
+      "resolved": "https://registry.npmjs.org/postcss/-/postcss-8.5.6.tgz",
+      "integrity": "sha512-3Ybi1tAuwAP9s0r1UQ2J4n5Y0G05bJkpUIO0/bI9MhwmD70S5aTWbXGBwxHrelT+XM1k6dM0pk+SwNkpTRN7Pg==",
+      "dev": true,
+      "funding": [
+        {
+          "type": "opencollective",
+          "url": "https://opencollective.com/postcss/"
+        },
+        {
+          "type": "tidelift",
+          "url": "https://tidelift.com/funding/github/npm/postcss"
+        },
+        {
+          "type": "github",
+          "url": "https://github.com/sponsors/ai"
+        }
+      ],
+      "license": "MIT",
+      "dependencies": {
+        "nanoid": "^3.3.11",
+        "picocolors": "^1.1.1",
+        "source-map-js": "^1.2.1"
+      },
+      "engines": {
+        "node": "^10 || ^12 || >=14"
+      }
+    },
     "node_modules/@pandacss/preset-base": {
       "version": "1.8.2",
       "resolved": "https://registry.npmjs.org/@pandacss/preset-base/-/preset-base-1.8.2.tgz",
@@ -9432,9 +9548,9 @@
       }
     },
     "node_modules/postcss": {
-      "version": "8.5.6",
-      "resolved": "https://registry.npmjs.org/postcss/-/postcss-8.5.6.tgz",
-      "integrity": "sha512-3Ybi1tAuwAP9s0r1UQ2J4n5Y0G05bJkpUIO0/bI9MhwmD70S5aTWbXGBwxHrelT+XM1k6dM0pk+SwNkpTRN7Pg==",
+      "version": "8.5.10",
+      "resolved": "https://registry.npmjs.org/postcss/-/postcss-8.5.10.tgz",
+      "integrity": "sha512-pMMHxBOZKFU6HgAZ4eyGnwXF/EvPGGqUr0MnZ5+99485wwW41kW91A4LOGxSHhgugZmSChL5AlElNdwlNgcnLQ==",
       "dev": true,
       "funding": [
         {

src/frontend/package.json

@@ -59,7 +59,7 @@
     "eslint-plugin-jsx-a11y": "6.10.2",
     "eslint-plugin-react-hooks": "5.2.0",
     "eslint-plugin-react-refresh": "0.4.20",
-    "postcss": "8.5.6",
+    "postcss": "8.5.10",
     "prettier": "3.8.1",
     "typescript": "5.8.3",
     "vite": "7.3.2",

src/frontend/src/features/rooms/utils/generateRoomId.ts

@@ -1,10 +1,20 @@
 // Google Meet uses only letters in a room identifier
 const ROOM_ID_ALLOWED_CHARACTERS = 'abcdefghijklmnopqrstuvwxyz'
 
-const getRandomChar = () =>
-  ROOM_ID_ALLOWED_CHARACTERS[
-    Math.floor(Math.random() * ROOM_ID_ALLOWED_CHARACTERS.length)
+const getRandomChar = () => {
+  const maxValue =
+    Math.floor(0x100000000 / ROOM_ID_ALLOWED_CHARACTERS.length) *
+    ROOM_ID_ALLOWED_CHARACTERS.length
+  const randomValue = new Uint32Array(1)
+
+  do {
+    crypto.getRandomValues(randomValue)
+  } while (randomValue[0] >= maxValue)
+
+  return ROOM_ID_ALLOWED_CHARACTERS[
+    randomValue[0] % ROOM_ID_ALLOWED_CHARACTERS.length
   ]
+}
 
 const generateSegment = (length: number): string =>
   Array.from(Array(length), getRandomChar).join('')

src/frontend/src/locales/de/recording.json

@@ -1,7 +1,7 @@
 {
   "error": {
     "title": "Aufzeichnung nicht verfügbar",
-    "body": "Die Aufzeichnung ist nicht verfügbar oder wurde möglicherweise gelöscht. Nur die*der Organisator:in der Besprechung hat Zugriff darauf. Wende dich bei Bedarf gerne an die Person."
+    "body": "Die Aufzeichnung ist nicht verfügbar oder wurde möglicherweise gelöscht. Nur der Host der Besprechung hat Zugriff darauf. Wende dich bei Bedarf gerne an die Person."
   },
   "expired": {
     "title": "Aufzeichnung abgelaufen",
@@ -22,7 +22,7 @@
     "button": "Herunterladen",
     "warning": {
       "title": "Linkfreigabe deaktiviert",
-      "body": "Die Freigabe der Aufzeichnung per Link ist noch nicht verfügbar. Nur Organisator:innen können sie herunterladen."
+      "body": "Die Freigabe der Aufzeichnung per Link ist noch nicht verfügbar. Nur Hosts können sie herunterladen."
     }
   }
 }

src/frontend/src/locales/de/rooms.json

@@ -3,7 +3,7 @@
     "heading": {
       "normal": "Du hast das Meeting verlassen",
       "duplicateIdentity": "Du bist dem Meeting von einem anderen Gerät aus beigetreten",
-      "participantRemoved": "Du wurdest von der*dem Organisator:in aus dem Meeting entfernt"
+      "participantRemoved": "Du wurdest vom Host aus dem Meeting entfernt"
     },
     "home": "Zur Startseite zurückkehren",
     "back": "Dem Meeting erneut beitreten"
@@ -383,7 +383,7 @@
     "body": "Transkribiere bis zu {{max_duration}} Meetingdauer.",
     "bodyWithoutMaxDuration": "Transkribieren dein Meeting ohne Zeitbegrenzung.",
     "details": {
-      "receiver": "Das Transkript wird an die*den Organisator:in und die Mitorganisierenden gesendet.",
+      "receiver": "Das Transkript wird an den Host und die Co-Hosts gesendet.",
       "destination": "Ein neues Dokument wird erstellt auf",
       "destinationUnknown": "Ein neues Dokument wird erstellt",
       "language": "Meeting-Sprache:",
@@ -438,7 +438,7 @@
     "linkMore": "Dokumentation öffnen",
     "linkAriaLabel": "Dokumentation zur Aufzeichnung öffnen – öffnet in neuem Tab",
     "details": {
-      "receiver": "Die Aufzeichnung wird an die*den Organisator:in und die Mitorganisierenden gesendet.",
+      "receiver": "Die Aufzeichnung wird an den Host und die Co-Hosts gesendet.",
       "destination": "Diese Aufzeichnung wird vorübergehend auf unseren Servern gespeichert",
       "loading": "Aufzeichnung wird gestartet",
       "linkMore": "Mehr erfahren",
@@ -494,7 +494,7 @@
     "button": "OK"
   },
   "admin": {
-    "description": "Diese Einstellungen für Organisierende ermöglichen dir die Kontrolle über dein Meeting. Nur Organisierende haben Zugriff auf diese Optionen.",
+    "description": "Diese Host-Einstellungen ermöglichen dir die Kontrolle über dein Meeting. Nur Hosts haben Zugriff auf diese Optionen.",
     "access": {
       "title": "Raumzugang",
       "description": "Diese Einstellungen gelten auch für zukünftige Meetings in diesem Raum.",

src/frontend/src/locales/en/recording.json

@@ -1,7 +1,7 @@
 {
   "error": {
     "title": "Recording unavailable",
-    "body": "The recording is unavailable or may have been deleted. Only the meeting organizer can access it. Feel free to contact them if needed."
+    "body": "The recording is unavailable or may have been deleted. Only the meeting host can access it. Feel free to contact them if needed."
   },
   "expired": {
     "title": "Recording expired",
@@ -22,7 +22,7 @@
     "button": "Download",
     "warning": {
       "title": "Link sharing disabled",
-      "body": "Sharing the recording via link is not yet available. Only organizers can download it."
+      "body": "Sharing the recording via link is not yet available. Only hosts can download it."
     }
   }
 }

src/frontend/src/locales/en/rooms.json

@@ -3,7 +3,7 @@
     "heading": {
       "normal": "You have left the meeting",
       "duplicateIdentity": "You have joined the meeting from another device",
-      "participantRemoved": "You have been removed from the meeting by an administrator"
+      "participantRemoved": "You have been removed from the meeting by a host"
     },
     "home": "Return to home",
     "back": "Rejoin the meeting"
@@ -328,7 +328,7 @@
       "chat": "Messages in the chat",
       "transcript": "Transcribe",
       "screenRecording": "Record",
-      "admin": "Admin settings",
+      "admin": "Host settings",
       "tools": "More tools",
       "info": "Meeting information"
     },
@@ -338,7 +338,7 @@
       "chat": "messages",
       "transcript": "transcribe",
       "screenRecording": "record",
-      "admin": "admin settings",
+      "admin": "host settings",
       "tools": "more tools",
       "info": "meeting information"
     },
@@ -493,7 +493,7 @@
     "button": "OK"
   },
   "admin": {
-    "description": "These organizer settings allow you to maintain control of your meeting. Only organizers can access these controls.",
+    "description": "These host settings allow you to maintain control of your meeting. Only hosts can access these controls.",
     "access": {
       "title": "Room access",
       "description": "These settings will also apply to future occurrences of this meeting.",

src/frontend/src/locales/nl/recording.json

@@ -1,7 +1,7 @@
 {
   "error": {
     "title": "Opname niet beschikbaar",
-    "body": "De opname is niet beschikbaar of is mogelijk verwijderd. Alleen de organisator van de vergadering heeft toegang. Neem gerust contact met hem of haar op als dat nodig is."
+    "body": "De opname is niet beschikbaar of is mogelijk verwijderd. Alleen de host van de vergadering heeft toegang. Neem gerust contact met hem of haar op als dat nodig is."
   },
   "expired": {
     "title": "Opname verlopen",
@@ -22,7 +22,7 @@
     "button": "Downloaden",
     "warning": {
       "title": "Delen via link uitgeschakeld",
-      "body": "Het delen van de opname via een link is nog niet beschikbaar. Alleen organisatoren kunnen deze downloaden."
+      "body": "Het delen van de opname via een link is nog niet beschikbaar. Alleen hosts kunnen deze downloaden."
     }
   }
 }

src/frontend/src/locales/nl/rooms.json

@@ -437,7 +437,7 @@
     "linkMore": "Documentatie openen",
     "linkAriaLabel": "Documentatie over opname openen - opent in nieuw venster",
     "details": {
-      "receiver": "De opname wordt verzonden naar de organisator en co-organisatoren.",
+      "receiver": "De opname wordt verzonden naar de host en co-hosts.",
       "destination": "Deze opname wordt tijdelijk op onze servers bewaard",
       "loading": "Opname wordt gestart",
       "linkMore": "Meer informatie",
@@ -493,7 +493,7 @@
     "button": "Opnieuw proberen"
   },
   "admin": {
-    "description": "Deze organisatorinstellingen geven u controle over uw vergadering. Alleen organisatoren hebben toegang tot deze bedieningselementen.",
+    "description": "Deze hostinstellingen geven u controle over uw vergadering. Alleen hosts hebben toegang tot deze bedieningselementen.",
     "access": {
       "title": "Toegang tot vergadering",
       "description": "Deze instellingen zijn ook van toepassing op toekomstige sessies van deze vergadering.",

src/helm/meet/templates/celery_transcribe_deployment.yaml

@@ -1,52 +1,62 @@
-{{- $envVars := include "meet.common.env" (list . .Values.celeryTranscribe) -}}
-{{- $fullName := include "meet.celeryTranscribe.fullname" . -}}
+{{- $sharedEnvVars := default (dict) .Values.celeryTranscribe.envVars -}}
 {{- $component := "celery-transcribe" -}}
+
+{{- range $idx, $instance := .Values.celeryTranscribe.instances }}
+{{- $instanceValues := merge $instance $.Values.celeryTranscribe }}
+{{- $fullName := printf "%s-%s" (include "meet.celeryTranscribe.fullname" $) $instance.name }}
+{{- $extraInstanceEnvVars := default (dict) $instance.extraEnvVars -}}
+{{- $mergedInstanceEnvVars := merge $extraInstanceEnvVars $sharedEnvVars -}}
+{{- $fakeInstanceObjectForEnvHelper := dict "envVars" $mergedInstanceEnvVars -}}
+{{- $envVars := include "meet.common.env" (list . $fakeInstanceObjectForEnvHelper) -}}
 apiVersion: apps/v1
 kind: Deployment
 metadata:
   name: {{ $fullName }}
   annotations:
-   {{- with .Values.celeryTranscribe.dpAnnotations }}
+   {{- with $instanceValues.dpAnnotations }}
    {{- toYaml . | nindent 4 }}
    {{- end }}
-  namespace: {{ .Release.Namespace | quote }}
+  namespace: {{ $.Release.Namespace | quote }}
   labels:
-    {{- include "meet.common.labels" (list . $component) | nindent 4 }}
+    {{- include "meet.common.labels" (list $ $component) | nindent 4 }}
+    instance: {{ $instance.name }}
 spec:
-  replicas: {{ .Values.celeryTranscribe.replicas }}
+  replicas: {{ $instanceValues.replicas }}
   selector:
     matchLabels:
-      {{- include "meet.common.selectorLabels" (list . $component) | nindent 6 }}
+      {{- include "meet.common.selectorLabels" (list $ $component) | nindent 6 }}
+      instance: {{ $instance.name }}
   template:
     metadata:
       annotations:
-        {{- with .Values.celeryTranscribe.podAnnotations }}
+        {{- with $instanceValues.podAnnotations }}
         {{- toYaml . | nindent 8 }}
         {{- end }}
       labels:
-        {{- include "meet.common.selectorLabels" (list . $component) | nindent 8 }}
+        {{- include "meet.common.selectorLabels" (list $ $component) | nindent 8 }}
+        instance: {{ $instance.name }}
     spec:
       {{- if $.Values.image.credentials }}
       imagePullSecrets:
-        - name: {{ include "meet.secret.dockerconfigjson.name" (dict "fullname" (include "meet.fullname" .) "imageCredentials" $.Values.image.credentials) }}
+        - name: {{ include "meet.secret.dockerconfigjson.name" (dict "fullname" (include "meet.fullname" $) "imageCredentials" $.Values.image.credentials) }}
       {{- end }}
-      shareProcessNamespace: {{ .Values.celeryTranscribe.shareProcessNamespace }}
-      {{- with .Values.celeryTranscribe.podSecurityContext }}
+      shareProcessNamespace: {{ $instanceValues.shareProcessNamespace }}
+      {{- with $instanceValues.podSecurityContext }}
       securityContext:
         {{- toYaml . | nindent 8 }}
       {{- end }}
       containers:
-        {{- with .Values.celeryTranscribe.sidecars }}
+        {{- with $instanceValues.sidecars }}
           {{- toYaml . | nindent 8 }}
         {{- end }}
-        - name: {{ .Chart.Name }}
-          image: "{{ (.Values.celeryTranscribe.image | default dict).repository | default .Values.image.repository }}:{{ (.Values.celeryTranscribe.image | default dict).tag | default .Values.image.tag }}"
-          imagePullPolicy: {{ (.Values.celeryTranscribe.image | default dict).pullPolicy | default .Values.image.pullPolicy }}
-          {{- with .Values.celeryTranscribe.command }}
+        - name: {{ $.Chart.Name }}
+          image: "{{ ($instanceValues.image | default dict).repository | default $.Values.image.repository }}:{{ ($instanceValues.image | default dict).tag | default $.Values.image.tag }}"
+          imagePullPolicy: {{ ($instanceValues.image | default dict).pullPolicy | default $.Values.image.pullPolicy }}
+          {{- with $instanceValues.command }}
           command:
             {{- toYaml . | nindent 12 }}
           {{- end }}
-          {{- with .Values.celeryTranscribe.args }}
+          {{- with $instanceValues.args }}
           args:
             {{- toYaml . | nindent 12 }}
           {{- end }}
@@ -54,65 +64,65 @@ spec:
             {{- if $envVars }}
             {{- $envVars | indent 12 }}
             {{- end }}
-          {{- with .Values.celeryTranscribe.securityContext }}
+          {{- with $instanceValues.securityContext }}
           securityContext:
             {{- toYaml . | nindent 12 }}
           {{- end }}
           ports:
             - name: http
-              containerPort: {{ .Values.celeryTranscribe.service.targetPort }}
+              containerPort: {{ $instanceValues.service.targetPort }}
               protocol: TCP
-          {{- if .Values.celeryTranscribe.probes.liveness }}
+          {{- if $instanceValues.probes.liveness }}
           livenessProbe:
-            {{- include "meet.probes.abstract" (merge .Values.celeryTranscribe.probes.liveness (dict "targetPort" .Values.celeryTranscribe.service.targetPort )) | nindent 12 }}
+            {{- include "meet.probes.abstract" (merge $instanceValues.probes.liveness (dict "targetPort" $instanceValues.service.targetPort)) | nindent 12 }}
           {{- end }}
-          {{- if .Values.celeryTranscribe.probes.readiness }}
+          {{- if $instanceValues.probes.readiness }}
           readinessProbe:
-            {{- include "meet.probes.abstract" (merge .Values.celeryTranscribe.probes.readiness (dict "targetPort" .Values.celeryTranscribe.service.targetPort )) | nindent 12 }}
+            {{- include "meet.probes.abstract" (merge $instanceValues.probes.readiness (dict "targetPort" $instanceValues.service.targetPort)) | nindent 12 }}
           {{- end }}
-          {{- if .Values.celeryTranscribe.probes.startup }}
+          {{- if $instanceValues.probes.startup }}
           startupProbe:
-            {{- include "meet.probes.abstract" (merge .Values.celeryTranscribe.probes.startup (dict "targetPort" .Values.celeryTranscribe.service.targetPort )) | nindent 12 }}
+            {{- include "meet.probes.abstract" (merge $instanceValues.probes.startup (dict "targetPort" $instanceValues.service.targetPort)) | nindent 12 }}
           {{- end }}
-          {{- with .Values.celeryTranscribe.resources }}
+          {{- with $instanceValues.resources }}
           resources:
             {{- toYaml . | nindent 12 }}
           {{- end }}
           volumeMounts:
-            {{- range $index, $value := .Values.mountFiles }}
+            {{- range $index, $value := $.Values.mountFiles }}
             - name: "files-{{ $index }}"
               mountPath: {{ $value.path }}
               subPath: content
             {{- end }}
-            {{- range $name, $volume := .Values.celeryTranscribe.persistence }}
+            {{- range $name, $volume := $instanceValues.persistence }}
             - name: "{{ $name }}"
               mountPath: "{{ $volume.mountPath }}"
             {{- end }}
-            {{- range .Values.celeryTranscribe.extraVolumeMounts }}
+            {{- range $instanceValues.extraVolumeMounts }}
             - name: {{ .name }}
               mountPath: {{ .mountPath }}
               subPath: {{ .subPath | default "" }}
               readOnly: {{ .readOnly }}
             {{- end }}
-      {{- with .Values.celeryTranscribe.nodeSelector }}
+      {{- with $instanceValues.nodeSelector }}
       nodeSelector:
         {{- toYaml . | nindent 8 }}
       {{- end }}
-      {{- with .Values.celeryTranscribe.affinity }}
+      {{- with $instanceValues.affinity }}
       affinity:
         {{- toYaml . | nindent 8 }}
       {{- end }}
-      {{- with .Values.celeryTranscribe.tolerations }}
+      {{- with $instanceValues.tolerations }}
       tolerations:
         {{- toYaml . | nindent 8 }}
       {{- end }}
       volumes:
-        {{- range $index, $value := .Values.mountFiles }}
+        {{- range $index, $value := $.Values.mountFiles }}
         - name: "files-{{ $index }}"
           configMap:
             name: "{{ include "meet.fullname" $ }}-files-{{ $index }}"
         {{- end }}
-        {{- range $name, $volume := .Values.celeryTranscribe.persistence }}
+        {{- range $name, $volume := $instanceValues.persistence }}
         - name: "{{ $name }}"
           {{- if eq $volume.type "emptyDir" }}
           emptyDir: {}
@@ -121,7 +131,7 @@ spec:
             claimName: "{{ $fullName }}-{{ $name }}"
           {{- end }}
         {{- end }}
-        {{- range .Values.celeryTranscribe.extraVolumes }}
+        {{- range $instanceValues.extraVolumes }}
         - name: {{ .name }}
           {{- if .existingClaim }}
           persistentVolumeClaim:
@@ -143,15 +153,18 @@ spec:
           {{- end }}
         {{- end }}
 ---
-{{ if .Values.celeryTranscribe.pdb.enabled }}
+{{ if $instanceValues.pdb.enabled }}
 apiVersion: policy/v1
 kind: PodDisruptionBudget
 metadata:
   name: {{ $fullName }}
-  namespace: {{ .Release.Namespace | quote }}
+  namespace: {{ $.Release.Namespace | quote }}
 spec:
   maxUnavailable: 1
   selector:
     matchLabels:
-      {{- include "meet.common.selectorLabels" (list . $component) | nindent 6 }}
+      {{- include "meet.common.selectorLabels" (list $ $component) | nindent 6 }}
+      instance: {{ $instance.name }}
+---
 {{ end }}
+{{- end }}

src/helm/meet/values.yaml

@@ -848,6 +848,21 @@ celeryTranscribe:
   pdb:
     enabled: false
 
+  ## @param celeryTranscribe.instances List of celeryTranscribe instances to deploy. Each entry creates a dedicated Deployment. Useful when wanting to use multiple instances of WhisperX (configure each endpoint in the extraEnv value specific to that instance).
+  ## @extra celeryTranscribe.instances[].name Unique name suffix for the instance (used in the Deployment name and pod labels)
+  ## @extra celeryTranscribe.instances[].replicas Override the number of replicas for this specific instance
+  ## @extra celeryTranscribe.instances[].extraEnvVars Additional environment variables for this specific instance (same structure as envVars)
+  ## @extra celeryTranscribe.instances[].command Override the container command for this specific instance
+  ## @extra celeryTranscribe.instances[].args Override the container args for this specific instance
+  ## @extra celeryTranscribe.instances[].resources Override resource requirements for this specific instance
+  ## @extra celeryTranscribe.instances[].nodeSelector Override node selector for this specific instance
+  ## @extra celeryTranscribe.instances[].affinity Override affinity for this specific instance
+  ## @extra celeryTranscribe.instances[].tolerations Override tolerations for this specific instance
+  ## @extra celeryTranscribe.instances[].pdb.enabled Enable pdb for this specific instance
+  instances:
+    - name: default
+      extraEnvVars: {}
+
 ## @section celerySummarize
 
 celerySummarize:

src/summary/pyproject.toml

@@ -20,7 +20,7 @@ dependencies = [
 [project.optional-dependencies]
 dev = [
     "ruff==0.15.6",
-    "pytest==9.0.2",
+    "pytest==9.0.3",
     "responses>=0.25.8",
 ]