📝(docs) document v1.30.0 in UPGRADE.md

Add the missing v1.30.0 entry in `UPGRADE.md`, which was overlooked when the release was published.
2026-09-06 07:29:04 +00:00 · 2026-09-01 16:21:52 +02:00
36 changed files with 138 additions and 2277 deletions
@@ -8,18 +8,12 @@ and this project adheres to

 ## [Unreleased]

-### Added
-
- ✨(frontend) add 1080p sending resolution option #1660
- ✨(backend) add Traefik support via configurable media-auth url header #1649
- ✨(backend) update a room's attributes from the external API
-
-### Fixed
-
- 🐛(frontend) keep the sending resolution picked while the camera is off #1667
-
 ## [1.30.0] - 2026-09-01

+### Changed
+
+- ♿️(frontend) close side panel with Escape key #1507
+
 ### Added

 - ✨(agent) support Voxtral realtime as inference engine
@@ -35,7 +29,6 @@ and this project adheres to
 - ⬆️(frontend) upgrade @fontsource/opendyslexic from 5.2.5 to 5.3.0
 - ⬆️(addons) upgrade core-js from 3.49.0 to 3.50.0
 - ♻️(backend) factorize s3 client creation in utils
- ♿️(frontend) close side panel with Escape key #1507

 ### Fixed

@@ -213,8 +213,6 @@ services:
      - "7880:7880"
      - "7881:7881"
      - "7882:7882/udp"
-      - "3478:3478/udp"
-      - "30000-30100:30000-30100/udp"
    volumes:
      - ./docker/livekit/config/livekit-server.yaml:/config.yaml
    depends_on:
@@ -65,7 +65,6 @@ RUN apk update && apk upgrade  \
    musl \
    musl-utils \
    zlib>=1.3.2-r0 \
-    libexpat>=2.8.4-r0 \
    && apk del curl

 USER nginx
@@ -8,16 +8,3 @@ webhook:
  api_key: devkey
  urls:
      - http://app-dev:8000/api/v1.0/rooms/webhooks-livekit/
-
-turn:
-  enabled: true
-  domain: turn.127.0.0.1.nip.io
-  udp_port: 3478
-  tls_port: 0
-  external_tls: false
-  relay_range_start: 30000
-  relay_range_end: 30100
-  allow_restricted_peer_cidrs:
-    - 192.168.0.0/16
-    - 172.16.0.0/12
-
@@ -16,11 +16,11 @@ info:
    * `rooms:list` – List rooms accessible to the delegated user.
    * `rooms:retrieve` – Retrieve details of a specific room.
    * `rooms:create` – Create new rooms.
-    * `rooms:update` – Update the access level and configuration of existing rooms.
+    * `rooms:update` – **Coming soon** Update existing rooms, e.g., add attendees to a room.
    * `rooms:delete` – **Coming soon** Delete rooms generated by the application.
-
+    
    #### Upcoming Features
-
+    
    * **Add attendees to a room:** You will be able to update a room to include a list of attendees, allowing them to bypass the lobby system automatically.
    * **Delete application-generated rooms:** Rooms created via the application can be deleted when no longer needed.

@@ -310,67 +310,6 @@ paths:
        '404':
          $ref: '#/components/responses/RoomNotFoundError'

-    patch:
-      tags:
-        - Rooms
-      summary: Update a room
-      description: |
-        Partially updates a room. Only the delegated user's rooms where they are
-        administrator or owner can be updated; any other role gets a `403`.
-
-        **Updatable fields:** `access_level` and `configuration`. Every other field
-        (`id`, `name`, `slug`, `pin_code`) is read-only and silently ignored when sent.
-
-        `configuration` is replaced as a whole, it is not merged with the stored one.
-        Send the complete object you want the room to end up with.
-
-        Full replacement (`PUT`) is not supported. Use `PATCH` instead.
-      operationId: updateRoom
-      security:
-        - BearerAuth: [rooms:update]
-      parameters:
-        - name: id
-          in: path
-          required: true
-          description: Room UUID
-          schema:
-            type: string
-            format: uuid
-      requestBody:
-        required: true
-        content:
-          application/json:
-            schema:
-              $ref: '#/components/schemas/RoomUpdate'
-            examples:
-              accessLevelOnly:
-                summary: Change the access level
-                value:
-                  access_level: "restricted"
-              configurationOnly:
-                summary: Replace the room configuration
-                value:
-                  configuration:
-                    everyone_can_mute: true
-      responses:
-        '200':
-          description: Room updated successfully
-          content:
-            application/json:
-              schema:
-                $ref: '#/components/schemas/Room'
-        '400':
-          $ref: '#/components/responses/BadRequestError'
-        '401':
-          $ref: '#/components/responses/UnauthorizedError'
-        '403':
-          $ref: '#/components/responses/ForbiddenError'
-        '404':
-          $ref: '#/components/responses/RoomNotFoundError'
-        '405':
-          description: |
-            Method not allowed, `PUT` is not supported on this endpoint.
-
 components:
  securitySchemes:
    BearerAuth:
@@ -447,17 +386,6 @@ components:
        configuration:
          $ref: '#/components/schemas/RoomConfiguration'

-    RoomUpdate:
-      type: object
-      description: |
-        Fields that can be updated on an existing room. Both are optional, omitted
-        fields keep their current value.
-      properties:
-        access_level:
-          $ref: '#/components/schemas/RoomAccessLevel'
-        configuration:
-          $ref: '#/components/schemas/RoomConfiguration'
-
    RoomConfiguration:
      type: object
      description: |
@@ -499,9 +427,6 @@ components:
        - `public`: Anyone with the room link can join directly, no authentication required.
        - `trusted`: Authenticated users join directly. Unauthenticated users wait in the lobby for approval.
        - `restricted`: Only participants explicitly trusted by the owner bypass the lobby. Everyone else waits for approval regardless of authentication.
-
-        `public` is rejected with a `400` unless the deployment explicitly enables it
-        for this API. This applies both when creating a room and when updating one.
      example: "trusted"

    Room:
@@ -20,7 +20,7 @@ info:
    * `lasuite_visio:rooms:list` – List rooms accessible to the delegated user.
    * `lasuite_visio:rooms:retrieve` – Retrieve details of a specific room.
    * `lasuite_visio:rooms:create` – Create new rooms.
-    * `lasuite_visio:rooms:update` – Update the access level and configuration of existing rooms.
+    * `lasuite_visio:rooms:update` – **Coming soon** Update existing rooms, e.g., add attendees to a room.
    * `lasuite_visio:rooms:delete` – **Coming soon** Delete rooms generated by the application.
    
    #### Upcoming Features
@@ -206,67 +206,6 @@ paths:
        '404':
          $ref: '#/components/responses/RoomNotFoundError'

-    patch:
-      tags:
-        - Rooms
-      summary: Update a room
-      description: |
-        Partially updates a room. Only rooms where the user is administrator or
-        owner can be updated; any other role gets a `403`.
-
-        **Updatable fields:** `access_level` and `configuration`. Every other field
-        (`id`, `name`, `slug`, `pin_code`) is read-only and silently ignored when sent.
-
-        `configuration` is replaced as a whole, it is not merged with the stored one.
-        Send the complete object you want the room to end up with.
-
-        Full replacement (`PUT`) is not supported. Use `PATCH` instead.
-      operationId: updateRoom
-      security:
-        - BearerAuth: [rooms:update]
-      parameters:
-        - name: id
-          in: path
-          required: true
-          description: Room UUID
-          schema:
-            type: string
-            format: uuid
-      requestBody:
-        required: true
-        content:
-          application/json:
-            schema:
-              $ref: '#/components/schemas/RoomUpdate'
-            examples:
-              accessLevelOnly:
-                summary: Change the access level
-                value:
-                  access_level: "restricted"
-              configurationOnly:
-                summary: Replace the room configuration
-                value:
-                  configuration:
-                    everyone_can_mute: true
-      responses:
-        '200':
-          description: Room updated successfully
-          content:
-            application/json:
-              schema:
-                $ref: '#/components/schemas/Room'
-        '400':
-          $ref: '#/components/responses/BadRequestError'
-        '401':
-          $ref: '#/components/responses/UnauthorizedError'
-        '403':
-          $ref: '#/components/responses/ForbiddenError'
-        '404':
-          $ref: '#/components/responses/RoomNotFoundError'
-        '405':
-          description: |
-            Method not allowed, `PUT` is not supported on this endpoint.
-
 components:
  securitySchemes:
    BearerAuth:
@@ -288,17 +227,6 @@ components:
        configuration:
          $ref: '#/components/schemas/RoomConfiguration'

-    RoomUpdate:
-      type: object
-      description: |
-        Fields that can be updated on an existing room. Both are optional, omitted
-        fields keep their current value.
-      properties:
-        access_level:
-          $ref: '#/components/schemas/RoomAccessLevel'
-        configuration:
-          $ref: '#/components/schemas/RoomConfiguration'
-
    RoomConfiguration:
      type: object
      description: |
@@ -340,9 +268,6 @@ components:
        - `public`: Anyone with the room link can join directly, no authentication required.
        - `trusted`: Authenticated users join directly. Unauthenticated users wait in the lobby for approval.
        - `restricted`: Only participants explicitly trusted by the owner bypass the lobby. Everyone else waits for approval regardless of authentication.
-
-        `public` is rejected with a `400` unless the deployment explicitly enables it
-        for this API. This applies both when creating a room and when updating one.
      example: "trusted"

    Room:
@@ -8,7 +8,6 @@ class AnalyticsEvent(StrEnum):

    # Rooms
    ROOM_CREATED = "room_created"
-    ROOM_UPDATED = "room_updated"

    # Roomkit (meeting-room SIP devices)
    ROOMKIT_JOINED = "roomkit_joined"
@@ -75,7 +75,11 @@ from core.services.participants_management import (
    ParticipantsManagementException,
 )
 from core.services.room_creation import RoomCreation
-from core.services.room_management import RoomManagement
+from core.services.room_management import (
+    RoomManagement,
+    RoomManagementException,
+    RoomNotFoundException,
+)
 from core.services.room_roles import (
    RoomRoleError,
    RoomRoleService,
@@ -352,7 +356,26 @@ class RoomViewSet(
        ):
            return

-        RoomManagement.sync_room_metadata(room)
+        metadata = {
+            "configuration": room.configuration,
+            "access_level": room.access_level,
+        }
+
+        try:
+            RoomManagement().update_metadata(
+                room_name=str(room.id),
+                metadata=metadata,
+            )
+        except RoomNotFoundException:
+            logger.info(
+                "LiveKit room %s does not exist yet, skipping metadata sync",
+                room.id,
+            )
+        except RoomManagementException:
+            logger.warning(
+                "Failed to sync metadata to LiveKit for room %s",
+                room.id,
+            )

    @decorators.action(
        detail=True,
@@ -1053,10 +1076,9 @@ class RecordingViewSet(

    def _auth_get_original_url(self, request):
        """
-        Extracts and parses the original URL from the configured header.
+        Extracts and parses the original URL from the "HTTP_X_ORIGINAL_URL" header.
        Raises PermissionDenied if the header is missing.
-        The original url is passed by the reverse proxy in the header named by the
-        MEDIA_AUTH_ORIGINAL_URL_HEADER setting, which defaults to "HTTP_X_ORIGINAL_URL".
+        The original url is passed by nginx in the "HTTP_X_ORIGINAL_URL" header.
        See corresponding ingress configuration in Helm chart and read about the
        nginx.ingress.kubernetes.io/auth-url annotation to understand how the Nginx ingress
        is configured to do this.
@@ -1066,13 +1088,9 @@ class RecordingViewSet(
        reasons.
        """
        # Extract the original URL from the request header
-        original_url = request.META.get(settings.MEDIA_AUTH_ORIGINAL_URL_HEADER)
+        original_url = request.META.get("HTTP_X_ORIGINAL_URL")
        if not original_url:
-            logger.warning(
-                "Missing %s header in subrequest. Set MEDIA_AUTH_ORIGINAL_URL_HEADER "
-                "to the header your reverse proxy sends.",
-                settings.MEDIA_AUTH_ORIGINAL_URL_HEADER,
-            )
+            logger.warning("Missing HTTP_X_ORIGINAL_URL header in subrequest")
            raise drf_exceptions.PermissionDenied()

        logger.debug("Original url: '%s'", original_url)
@@ -1397,8 +1415,7 @@ class FileViewSet(
        Authorize access based on the original URL of an Nginx subrequest
        and user permissions. Returns a dictionary of URL parameters if authorized.

-        The original url is passed by the reverse proxy in the header named by the
-        MEDIA_AUTH_ORIGINAL_URL_HEADER setting, which defaults to "HTTP_X_ORIGINAL_URL".
+        The original url is passed by nginx in the "HTTP_X_ORIGINAL_URL" header.
        See corresponding ingress configuration in Helm chart and read about the
        nginx.ingress.kubernetes.io/auth-url annotation to understand how the Nginx ingress
        is configured to do this.
@@ -1417,13 +1434,9 @@ class FileViewSet(
        - PermissionDenied if authorization fails.
        """
        # Extract the original URL from the request header
-        original_url = request.META.get(settings.MEDIA_AUTH_ORIGINAL_URL_HEADER)
+        original_url = request.META.get("HTTP_X_ORIGINAL_URL")
        if not original_url:
-            logger.warning(
-                "Missing %s header in subrequest. Set MEDIA_AUTH_ORIGINAL_URL_HEADER "
-                "to the header your reverse proxy sends.",
-                settings.MEDIA_AUTH_ORIGINAL_URL_HEADER,
-            )
+            logger.warning("Missing HTTP_X_ORIGINAL_URL header in subrequest")
            raise drf_exceptions.PermissionDenied()

        parsed_url = urlparse(original_url)
@@ -1,6 +1,5 @@
 """External API endpoints"""

-import copy
 from logging import getLogger

 from django.conf import settings
@@ -26,7 +25,6 @@ from rest_framework import (
 from core import analytics, api, models
 from core.api.feature_flag import FeatureFlag
 from core.services.jwt_token import JwtTokenService
-from core.services.room_management import RoomManagement

 from ..services.provisional_user_service import (
    ProvisionalUserCreationDisabledError,
@@ -144,7 +142,6 @@ class RoomViewSet(
    mixins.CreateModelMixin,
    mixins.RetrieveModelMixin,
    mixins.ListModelMixin,
-    mixins.UpdateModelMixin,
    viewsets.GenericViewSet,
 ):
    """Application-delegated API for room management.
@@ -157,12 +154,8 @@ class RoomViewSet(
    - list: List rooms the user has access to (requires 'rooms:list' scope)
    - retrieve: Get room details (requires 'rooms:retrieve' scope)
    - create: Create a new room owned by the user (requires 'rooms:create' scope)
-    - partial_update: Update a room's access level and configuration, for
-      administrators and owners only (requires 'rooms:update' scope)
    """

-    http_method_names = ["get", "post", "patch", "head", "options"]
-
    authentication_classes = [
        authentication.ApplicationJWTAuthentication,
        authentication.AddonsJWTAuthentication,
@@ -196,39 +189,7 @@ class RoomViewSet(
        serializer = self.get_serializer(queryset, many=True)
        return drf_response.Response(serializer.data)

-    def _track_room_event(self, room, event, **extra_properties):
-        """Log a room operation for auditing and forward it to analytics."""
-
-        auth_method = type(self.request.successful_authenticator).__name__
-        client_id = (self.request.auth or {}).get("client_id", "unknown")
-
-        # Log for auditing
-        details = "".join(f", {key}={value}" for key, value in extra_properties.items())
-        logger.info(
-            "Room %s via application: room_id=%s, user_id=%s, client_id=%s, auth_method=%s%s",
-            event.removeprefix("room_"),
-            room.id,
-            self.request.user.id,
-            client_id,
-            auth_method,
-            details,
-        )
-
-        analytics.capture(
-            self.request.user,
-            event,
-            {
-                "room_id": str(room.pk),
-                "access_level": room.access_level,
-                "client_id": client_id,
-                "external_api": True,
-                "auth_method": auth_method,
-                **extra_properties,
-                "$set": {"email": self.request.user.email},
-            },
-        )
-
-    def perform_create(self, serializer: serializers.RoomSerializer):
+    def perform_create(self, serializer):
        """Set the current user as owner of the newly created room."""
        room = serializer.save()
        models.ResourceAccess.objects.create(
@@ -237,31 +198,27 @@ class RoomViewSet(
            role=models.RoleChoices.OWNER,
        )

-        self._track_room_event(room, analytics.AnalyticsEvent.ROOM_CREATED)
+        auth_method = type(self.request.successful_authenticator).__name__
+        client_id = (self.request.auth or {}).get("client_id", "unknown")

-    def perform_update(self, serializer: serializers.RoomSerializer):
-        """Persist the room update, sync it to LiveKit, then log and track it."""
-
-        previous_values = {
-            "access_level": serializer.instance.access_level,
-            "configuration": copy.deepcopy(serializer.instance.configuration),
-        }
-
-        room = serializer.save()
-
-        # Report the fields that actually changed, not the ones that were submitted.
-        updated_fields = sorted(
-            field
-            for field, previous_value in previous_values.items()
-            if getattr(room, field) != previous_value
+        # Log for auditing
+        logger.info(
+            "Room created via application: room_id=%s, user_id=%s, client_id=%s, auth_method=%s",
+            room.id,
+            self.request.user.id,
+            client_id,
+            auth_method,
        )

-        if updated_fields:
-            RoomManagement.sync_room_metadata(room)
-
-        self._track_room_event(
-            room,
-            analytics.AnalyticsEvent.ROOM_UPDATED,
-            updated_fields=updated_fields,
-            previous_access_level=previous_values["access_level"],
+        analytics.capture(
+            self.request.user,
+            analytics.AnalyticsEvent.ROOM_CREATED,
+            {
+                "room_id": str(room.pk),
+                "access_level": room.access_level,
+                "client_id": client_id,
+                "external_api": True,
+                "auth_method": auth_method,
+                "$set": {"email": self.request.user.email},
+            },
        )
@@ -48,6 +48,8 @@ class ResourceFactory(factory.django.DjangoModelFactory):
                else:
                    UserResourceAccessFactory(resource=self, user=item[0], role=item[1])

+        self.save()
+

 class UserResourceAccessFactory(factory.django.DjangoModelFactory):
    """Create fake resource user accesses for testing."""
@@ -95,6 +97,8 @@ class RecordingFactory(factory.django.DjangoModelFactory):
                        recording=self, user=item[0], role=item[1]
                    )

+            self.save()
+

 class UserRecordingAccessFactory(factory.django.DjangoModelFactory):
    """Create fake recording user accesses for testing."""
@@ -44,7 +44,7 @@ class RecordingEventsService:
        recording_status = status_mapping.get(egress_status)
        if recording_status:
            try:
-                RoomManagement.update_metadata(
+                RoomManagement().update_metadata(
                    room_name, {"recording_status": recording_status}
                )
            except RoomNotFoundException:
@@ -68,7 +68,7 @@ class WorkerServiceMediator:
        mode = recording.options.get("original_mode", None) or recording.mode

        try:
-            RoomManagement.update_metadata(
+            RoomManagement().update_metadata(
                room_name, {"recording_mode": mode, "recording_status": "starting"}
            )
        except RoomNotFoundException:
@@ -192,7 +192,7 @@ class LiveKitEventsService:

        try:
            room_name = str(recording.room.id)
-            RoomManagement.update_metadata(
+            RoomManagement().update_metadata(
                room_name, remove_keys=["recording_mode", "recording_status"]
            )
        except RoomNotFoundException:
@@ -30,10 +30,9 @@ class RoomNotFoundException(RoomManagementException):
 class RoomManagement:
    """Service for managing LiveKit rooms."""

-    @classmethod
    @async_to_sync
    async def update_metadata(
-        cls,
+        self,
        room_name: str,
        metadata: Optional[Dict] = None,
        remove_keys: Optional[list[str]] = None,
@@ -91,9 +90,8 @@ class RoomManagement:
        finally:
            await lkapi.aclose()

-    @classmethod
    @async_to_sync
-    async def delete_room(cls, room_name: str):
+    async def delete_room(self, room_name: str):
        """Delete a LiveKit room and disconnect all participants.

        Raises:
@@ -118,32 +116,3 @@ class RoomManagement:
            raise RoomManagementException("Could not delete room") from e
        finally:
            await lkapi.aclose()
-
-    @classmethod
-    def sync_room_metadata(cls, room):
-        """Push a room's configuration and access level to its LiveKit room metadata.
-
-        Failures are swallowed: a room that is not live yet, or a LiveKit hiccup,
-        should never fail the request that triggered the update.
-        """
-
-        metadata = {
-            "configuration": room.configuration,
-            "access_level": room.access_level,
-        }
-
-        try:
-            cls.update_metadata(
-                room_name=str(room.id),
-                metadata=metadata,
-            )
-        except RoomNotFoundException:
-            logger.info(
-                "LiveKit room %s does not exist yet, skipping metadata sync",
-                room.id,
-            )
-        except RoomManagementException:
-            logger.warning(
-                "Failed to sync metadata to LiveKit for room %s",
-                room.id,
-            )
@@ -31,7 +31,7 @@ def delete_connection_test_room(room_name: str):
        return

    try:
-        RoomManagement.delete_room(room_name)
+        RoomManagement().delete_room(room_name)
    except RoomNotFoundException:
        # Room may already be gone after empty/departure timeout.
        logger.info("Connection test room '%s' already gone.", room_name)
@@ -7,7 +7,6 @@ from urllib.parse import quote, urlparse

 from django.conf import settings
 from django.core.files.storage import default_storage
-from django.test import override_settings
 from django.utils import timezone

 import pytest
@@ -144,59 +143,3 @@ def test_api_files_media_auth_own_file_deleted():
    )

    assert response.status_code == 403
-
-
-@override_settings(MEDIA_AUTH_ORIGINAL_URL_HEADER="HTTP_X_FORWARDED_URI")
-def test_api_files_media_auth_custom_original_url_header():
-    """
-    Authorization should honour the configured original-url header.
-
-    Covers the attachment subrequest path, which resolves the header separately
-    from the recording one. Reverse proxies other than nginx-ingress use
-    different headers: Traefik's ForwardAuth sends X-Forwarded-Uri and cannot
-    emit X-Original-URL at all.
-    """
-    user = factories.UserFactory()
-
-    file = factories.FileFactory(
-        type=models.FileTypeChoices.BACKGROUND_IMAGE,
-        update_upload_state=models.FileUploadStateChoices.READY,
-        creator=user,
-    )
-
-    client = APIClient()
-    client.force_login(user)
-
-    default_storage.save(file.file_key, BytesIO(b"my prose"))
-
-    original_url = f"http://localhost/media/{file.file_key:s}"
-    response = client.get(
-        "/api/v1.0/files/media-auth/", HTTP_X_FORWARDED_URI=original_url
-    )
-
-    assert response.status_code == 200
-    assert "AWS4-HMAC-SHA256 Credential=" in response["Authorization"]
-
-
-@override_settings(MEDIA_AUTH_ORIGINAL_URL_HEADER="HTTP_X_FORWARDED_URI")
-def test_api_files_media_auth_default_header_ignored_when_reconfigured():
-    """
-    Only the configured header should be honoured, never a hardcoded fallback.
-    """
-    user = factories.UserFactory()
-
-    file = factories.FileFactory(
-        type=models.FileTypeChoices.BACKGROUND_IMAGE,
-        update_upload_state=models.FileUploadStateChoices.READY,
-        creator=user,
-    )
-
-    client = APIClient()
-    client.force_login(user)
-
-    original_url = f"http://localhost/media/{file.file_key:s}"
-    response = client.get(
-        "/api/v1.0/files/media-auth/", HTTP_X_ORIGINAL_URL=original_url
-    )
-
-    assert response.status_code == 403
@@ -8,7 +8,6 @@ from uuid import uuid4

 from django.conf import settings
 from django.core.files.storage import default_storage
-from django.test import override_settings
 from django.utils import timezone

 import pytest
@@ -283,63 +282,3 @@ def test_api_recordings_media_auth_success_administrator(mode):
        timeout=1,
    )
    assert response.content.decode("utf-8") == "my prose"
-
-
-def test_api_recordings_media_auth_missing_header():
-    """
-    Test that a subrequest without the configured original-url header is rejected.
-    """
-    user = UserFactory()
-
-    client = APIClient()
-    client.force_login(user)
-
-    response = client.get("/api/v1.0/recordings/media-auth/")
-
-    assert response.status_code == 403
-
-
-@override_settings(MEDIA_AUTH_ORIGINAL_URL_HEADER="HTTP_X_FORWARDED_URI")
-def test_api_recordings_media_auth_custom_original_url_header():
-    """
-    Test that the header carrying the original URL can be configured.
-
-    Reverse proxies other than nginx-ingress use different headers: Traefik's
-    ForwardAuth sends X-Forwarded-Uri and cannot emit X-Original-URL at all.
-    """
-    user = UserFactory()
-
-    client = APIClient()
-    client.force_login(user)
-
-    original_url = f"http://localhost/media/recordings/{uuid4()!s}.mp4"
-
-    response = client.get(
-        "/api/v1.0/recordings/media-auth/", HTTP_X_FORWARDED_URI=original_url
-    )
-
-    # The header was read and parsed: we get as far as looking the recording up,
-    # rather than being rejected for a missing header.
-    assert response.status_code == 404
-
-
-@override_settings(MEDIA_AUTH_ORIGINAL_URL_HEADER="HTTP_X_FORWARDED_URI")
-def test_api_recordings_media_auth_default_header_ignored_when_reconfigured():
-    """
-    Test that only the configured header is honoured.
-
-    Guards against the header being read from a hardcoded name in parallel with
-    the setting.
-    """
-    user = UserFactory()
-
-    client = APIClient()
-    client.force_login(user)
-
-    original_url = f"http://localhost/media/recordings/{uuid4()!s}.mp4"
-
-    response = client.get(
-        "/api/v1.0/recordings/media-auth/", HTTP_X_ORIGINAL_URL=original_url
-    )
-
-    assert response.status_code == 403
@@ -381,11 +381,38 @@ def test_api_rooms_update_administrators_of_another():
    assert other_room.slug == "old-name"


-@pytest.mark.parametrize("exception", [RoomNotFoundException, RoomManagementException])
-@patch.object(RoomManagement, "update_metadata")
-def test_api_rooms_update_livekit_sync_failure(mock_update_metadata, exception):
-    """Should not fail the API request when the LiveKit metadata sync fails."""
-    mock_update_metadata.side_effect = exception
+@patch.object(RoomManagement, "update_metadata", side_effect=RoomNotFoundException)
+def test_api_rooms_update_livekit_room_not_found(mock_update_metadata):
+    """Should not fail the API request when the LiveKit room does not exist yet."""
+    user = UserFactory()
+    room = RoomFactory(
+        users=[(user, random.choice(["administrator", "owner"]))],
+        configuration={},
+    )
+    client = APIClient()
+    client.force_login(user)
+
+    response = client.patch(
+        f"/api/v1.0/rooms/{room.id!s}/",
+        {"configuration": {"can_publish_sources": ["camera"]}},
+        format="json",
+    )
+    assert response.status_code == 200
+    room.refresh_from_db()
+    assert room.configuration == {"can_publish_sources": ["camera"]}
+
+    mock_update_metadata.assert_called_once_with(
+        room_name=str(room.id),
+        metadata={
+            "access_level": room.access_level,
+            "configuration": {"can_publish_sources": ["camera"]},
+        },
+    )
+
+
+@patch.object(RoomManagement, "update_metadata", side_effect=RoomManagementException)
+def test_api_rooms_update_livekit_sync_failure(mock_update_metadata):
+    """Should not fail the API request when the LiveKit metadata sync fails."""
    user = UserFactory()
    room = RoomFactory(
        users=[(user, random.choice(["administrator", "owner"]))],
@@ -5,8 +5,6 @@ from unittest import mock
 import pytest
 from livekit.api import TwirpError

-from core.factories import RoomFactory
-from core.models import RoomAccessLevel
 from core.services.room_management import (
    RoomManagement,
    RoomManagementException,
@@ -22,7 +20,7 @@ def test_delete_room_calls_livekit(mock_create_livekit_client):
    mock_api.aclose = mock.AsyncMock()
    mock_create_livekit_client.return_value = mock_api

-    RoomManagement.delete_room("room-abc")
+    RoomManagement().delete_room("room-abc")

    mock_api.room.delete_room.assert_awaited_once()
    request = mock_api.room.delete_room.await_args.args[0]
@@ -41,7 +39,7 @@ def test_delete_room_raises_not_found(mock_create_livekit_client):
    mock_create_livekit_client.return_value = mock_api

    with pytest.raises(RoomNotFoundException):
-        RoomManagement.delete_room("missing-room")
+        RoomManagement().delete_room("missing-room")

    mock_api.aclose.assert_awaited_once()

@@ -57,25 +55,6 @@ def test_delete_room_raises_management_exception(mock_create_livekit_client):
    mock_create_livekit_client.return_value = mock_api

    with pytest.raises(RoomManagementException):
-        RoomManagement.delete_room("room-abc")
+        RoomManagement().delete_room("room-abc")

    mock_api.aclose.assert_awaited_once()
-
-
-@mock.patch.object(RoomManagement, "update_metadata")
-def test_sync_room_metadata_pushes_configuration_and_access_level(mock_update_metadata):
-    """The room's configuration and access level are forwarded to LiveKit."""
-    room = RoomFactory.build(
-        access_level=RoomAccessLevel.RESTRICTED,
-        configuration={"everyone_can_mute": True},
-    )
-
-    RoomManagement.sync_room_metadata(room)
-
-    mock_update_metadata.assert_called_once_with(
-        room_name=str(room.id),
-        metadata={
-            "configuration": {"everyone_can_mute": True},
-            "access_level": RoomAccessLevel.RESTRICTED,
-        },
-    )
@@ -16,17 +16,8 @@ import responses
 from lasuite.oidc_resource_server.authentication import ResourceServerAuthentication
 from rest_framework.test import APIClient

-from core.analytics import AnalyticsEvent
 from core.factories import ApplicationFactory, RoomFactory, UserFactory
-from core.models import (
-    Application,
-    ApplicationScope,
-    RoleChoices,
-    Room,
-    RoomAccessLevel,
-    User,
-)
-from core.services.room_management import RoomManagement
+from core.models import ApplicationScope, RoleChoices, Room, RoomAccessLevel, User

 pytestmark = pytest.mark.django_db

@@ -889,509 +880,6 @@ def test_api_rooms_create_public_access_level_when_default_is_public(settings):
    assert response.data["access_level"] == RoomAccessLevel.PUBLIC


-@mock.patch("core.external_api.viewsets.analytics.capture")
-def test_api_rooms_create_tracks_analytics(mock_capture):
-    """Creating a room should emit a ROOM_CREATED analytics event."""
-
-    user = UserFactory()
-    token = generate_test_token(user, [ApplicationScope.ROOMS_CREATE])
-    application = Application.objects.get()
-
-    client = APIClient()
-    client.credentials(HTTP_AUTHORIZATION=f"Bearer {token}")
-    response = client.post(
-        "/external-api/v1.0/rooms/",
-        {"access_level": RoomAccessLevel.RESTRICTED},
-        format="json",
-    )
-
-    assert response.status_code == 201
-
-    mock_capture.assert_called_once()
-    captured_user, event, properties = mock_capture.call_args[0]
-
-    assert captured_user == user
-    assert event == AnalyticsEvent.ROOM_CREATED
-    assert properties == {
-        "room_id": response.data["id"],
-        "access_level": RoomAccessLevel.RESTRICTED,
-        "client_id": str(application.client_id),
-        "external_api": True,
-        "auth_method": "ApplicationJWTAuthentication",
-        "$set": {"email": user.email},
-    }
-
-
-def test_api_rooms_update_requires_authentication():
-    """Updating a room without authentication should return 401."""
-
-    room = RoomFactory(users=[(UserFactory(), RoleChoices.OWNER)])
-
-    client = APIClient()
-    response = client.patch(
-        f"/external-api/v1.0/rooms/{room.id}/",
-        {"access_level": RoomAccessLevel.RESTRICTED},
-        format="json",
-    )
-
-    assert response.status_code == 401
-
-
-def test_api_rooms_update_requires_scope():
-    """Updating a room requires the ROOMS_UPDATE scope."""
-
-    user = UserFactory()
-    room = RoomFactory(users=[(user, RoleChoices.OWNER)])
-
-    # Token without ROOMS_UPDATE scope
-    token = generate_test_token(user, [ApplicationScope.ROOMS_RETRIEVE])
-
-    client = APIClient()
-    client.credentials(HTTP_AUTHORIZATION=f"Bearer {token}")
-    response = client.patch(
-        f"/external-api/v1.0/rooms/{room.id}/",
-        {"access_level": RoomAccessLevel.RESTRICTED},
-        format="json",
-    )
-
-    assert response.status_code == 403
-    assert (
-        "insufficient permissions. required scope: rooms:update"
-        in str(response.data).lower()
-    )
-
-
-def test_api_rooms_update_no_scope():
-    """Updating a room without any scope should return 403."""
-
-    user = UserFactory()
-    room = RoomFactory(users=[(user, RoleChoices.OWNER)])
-
-    token = generate_test_token(user, [])
-
-    client = APIClient()
-    client.credentials(HTTP_AUTHORIZATION=f"Bearer {token}")
-    response = client.patch(
-        f"/external-api/v1.0/rooms/{room.id}/",
-        {"access_level": RoomAccessLevel.RESTRICTED},
-        format="json",
-    )
-
-    assert response.status_code == 403
-    assert "insufficient permissions." in str(response.data).lower()
-
-
-@mock.patch.object(RoomManagement, "update_metadata")
-def test_api_rooms_update_owner_success(mock_update_metadata, settings):
-    """An owner should be able to update the access level and the configuration."""
-
-    settings.APPLICATION_BASE_URL = "http://your-application.com"
-
-    user = UserFactory()
-    room = RoomFactory(
-        users=[(user, RoleChoices.OWNER)],
-        access_level=RoomAccessLevel.TRUSTED,
-        configuration={},
-    )
-
-    token = generate_test_token(user, [ApplicationScope.ROOMS_UPDATE])
-
-    client = APIClient()
-    client.credentials(HTTP_AUTHORIZATION=f"Bearer {token}")
-    response = client.patch(
-        f"/external-api/v1.0/rooms/{room.id}/",
-        {
-            "access_level": RoomAccessLevel.RESTRICTED,
-            "configuration": {"everyone_can_mute": True},
-        },
-        format="json",
-    )
-
-    assert response.status_code == 200
-    assert response.data["id"] == str(room.id)
-    assert response.data["access_level"] == RoomAccessLevel.RESTRICTED
-    assert response.data["configuration"] == {"everyone_can_mute": True}
-    assert response.data["url"] == f"http://your-application.com/{room.slug}"
-
-    room.refresh_from_db()
-    assert room.access_level == RoomAccessLevel.RESTRICTED
-    assert room.configuration == {"everyone_can_mute": True}
-
-    mock_update_metadata.assert_called_once_with(
-        room_name=str(room.id),
-        metadata={
-            "configuration": {"everyone_can_mute": True},
-            "access_level": RoomAccessLevel.RESTRICTED,
-        },
-    )
-
-
-@mock.patch.object(RoomManagement, "update_metadata")
-def test_api_rooms_update_replaces_configuration(mock_update_metadata):
-    """The configuration is replaced as a whole, it is not merged with the stored one."""
-
-    user = UserFactory()
-    room = RoomFactory(
-        users=[(user, RoleChoices.OWNER)],
-        configuration={"can_publish_sources": ["camera"], "everyone_can_mute": True},
-    )
-
-    token = generate_test_token(user, [ApplicationScope.ROOMS_UPDATE])
-
-    client = APIClient()
-    client.credentials(HTTP_AUTHORIZATION=f"Bearer {token}")
-    response = client.patch(
-        f"/external-api/v1.0/rooms/{room.id}/",
-        {"configuration": {"everyone_can_mute": False}},
-        format="json",
-    )
-
-    assert response.status_code == 200
-
-    # The keys missing from the payload are dropped, not kept.
-    assert response.data["configuration"] == {"everyone_can_mute": False}
-
-    room.refresh_from_db()
-    assert room.configuration == {"everyone_can_mute": False}
-
-    mock_update_metadata.assert_called_once_with(
-        room_name=str(room.id),
-        metadata={
-            "configuration": {"everyone_can_mute": False},
-            "access_level": room.access_level,
-        },
-    )
-
-
-@mock.patch.object(RoomManagement, "update_metadata")
-def test_api_rooms_update_administrator_success(mock_update_metadata):
-    """An administrator should be able to update a room."""
-
-    user = UserFactory()
-    room = RoomFactory(
-        users=[(user, RoleChoices.ADMIN)],
-        access_level=RoomAccessLevel.TRUSTED,
-    )
-
-    token = generate_test_token(user, [ApplicationScope.ROOMS_UPDATE])
-
-    client = APIClient()
-    client.credentials(HTTP_AUTHORIZATION=f"Bearer {token}")
-    response = client.patch(
-        f"/external-api/v1.0/rooms/{room.id}/",
-        {"access_level": RoomAccessLevel.RESTRICTED},
-        format="json",
-    )
-
-    assert response.status_code == 200
-
-    room.refresh_from_db()
-    assert room.access_level == RoomAccessLevel.RESTRICTED
-    mock_update_metadata.assert_called_once()
-
-
-@mock.patch.object(RoomManagement, "update_metadata")
-def test_api_rooms_update_put_not_allowed(mock_update_metadata):
-    """PUT is not exposed: full replacement is not supported, only PATCH is."""
-
-    user = UserFactory()
-    room = RoomFactory(
-        users=[(user, RoleChoices.OWNER)],
-        access_level=RoomAccessLevel.TRUSTED,
-        configuration={},
-    )
-
-    token = generate_test_token(user, [ApplicationScope.ROOMS_UPDATE])
-
-    client = APIClient()
-    client.credentials(HTTP_AUTHORIZATION=f"Bearer {token}")
-    response = client.put(
-        f"/external-api/v1.0/rooms/{room.id}/",
-        {
-            "access_level": RoomAccessLevel.RESTRICTED,
-            "configuration": {"everyone_can_mute": True},
-        },
-        format="json",
-    )
-
-    assert response.status_code == 405
-
-    room.refresh_from_db()
-    assert room.access_level == RoomAccessLevel.TRUSTED
-    assert room.configuration == {}
-    mock_update_metadata.assert_not_called()
-
-
-@pytest.mark.parametrize("role", [RoleChoices.MEMBER, None])
-@mock.patch.object(RoomManagement, "update_metadata")
-def test_api_rooms_update_without_privileges(mock_update_metadata, role):
-    """Members and users without any role should not be able to update a room."""
-
-    user = UserFactory()
-    users = [(user, role)] if role else []
-    room = RoomFactory(users=users, access_level=RoomAccessLevel.TRUSTED)
-
-    token = generate_test_token(user, [ApplicationScope.ROOMS_UPDATE])
-
-    client = APIClient()
-    client.credentials(HTTP_AUTHORIZATION=f"Bearer {token}")
-    response = client.patch(
-        f"/external-api/v1.0/rooms/{room.id}/",
-        {"access_level": RoomAccessLevel.RESTRICTED},
-        format="json",
-    )
-
-    assert response.status_code == 403
-
-    room.refresh_from_db()
-    assert room.access_level == RoomAccessLevel.TRUSTED
-    mock_update_metadata.assert_not_called()
-
-
-@mock.patch.object(RoomManagement, "update_metadata")
-def test_api_rooms_update_readonly_enforcement(mock_update_metadata):
-    """Read-only fields provided on update should be ignored, the slug stays immutable."""
-
-    user = UserFactory()
-    room = RoomFactory(
-        users=[(user, RoleChoices.OWNER)],
-        access_level=RoomAccessLevel.TRUSTED,
-    )
-    expected_id, expected_name = str(room.id), room.name
-    expected_slug, expected_pin_code = room.slug, room.pin_code
-
-    token = generate_test_token(user, [ApplicationScope.ROOMS_UPDATE])
-
-    client = APIClient()
-    client.credentials(HTTP_AUTHORIZATION=f"Bearer {token}")
-    response = client.patch(
-        f"/external-api/v1.0/rooms/{room.id}/",
-        {
-            "id": str(uuid.uuid4()),
-            "name": "fake-name",
-            "slug": "fake-slug",
-            "pin_code": "000000",
-            "access_level": RoomAccessLevel.RESTRICTED,
-        },
-        format="json",
-    )
-
-    assert response.status_code == 200
-    assert response.data["id"] == expected_id
-    assert response.data["name"] == expected_name
-    assert response.data["slug"] == expected_slug
-
-    room.refresh_from_db()
-    assert str(room.id) == expected_id
-    assert room.name == expected_name
-    assert room.slug == expected_slug
-    assert room.pin_code == expected_pin_code
-
-    # The one writable field in the payload was applied
-    assert room.access_level == RoomAccessLevel.RESTRICTED
-    mock_update_metadata.assert_called_once()
-
-
-@mock.patch.object(RoomManagement, "update_metadata")
-def test_api_rooms_update_rejects_invalid_configuration(mock_update_metadata):
-    """Updating a room with unsupported configuration keys should fail."""
-
-    user = UserFactory()
-    room = RoomFactory(users=[(user, RoleChoices.OWNER)], configuration={})
-
-    token = generate_test_token(user, [ApplicationScope.ROOMS_UPDATE])
-
-    client = APIClient()
-    client.credentials(HTTP_AUTHORIZATION=f"Bearer {token}")
-    response = client.patch(
-        f"/external-api/v1.0/rooms/{room.id}/",
-        {"configuration": {"unsupported_flag": True}},
-        format="json",
-    )
-
-    assert response.status_code == 400
-    assert "extra inputs are not permitted" in str(response.data).lower()
-
-    room.refresh_from_db()
-    assert room.configuration == {}
-    mock_update_metadata.assert_not_called()
-
-
-@pytest.mark.parametrize(
-    "invalid_configuration",
-    [
-        {"can_publish_sources": ["invalid-source"]},
-        {"everyone_can_mute": "invalid-value"},
-    ],
-)
-@mock.patch.object(RoomManagement, "update_metadata")
-def test_api_rooms_update_rejects_invalid_configuration_values(
-    mock_update_metadata, invalid_configuration
-):
-    """Updating a room with invalid configuration values should fail."""
-
-    user = UserFactory()
-    room = RoomFactory(users=[(user, RoleChoices.OWNER)], configuration={})
-
-    token = generate_test_token(user, [ApplicationScope.ROOMS_UPDATE])
-
-    client = APIClient()
-    client.credentials(HTTP_AUTHORIZATION=f"Bearer {token}")
-    response = client.patch(
-        f"/external-api/v1.0/rooms/{room.id}/",
-        {"configuration": invalid_configuration},
-        format="json",
-    )
-
-    assert response.status_code == 400
-
-    room.refresh_from_db()
-    assert room.configuration == {}
-    mock_update_metadata.assert_not_called()
-
-
-@mock.patch.object(RoomManagement, "update_metadata")
-def test_api_rooms_update_public_access_disabled_by_default(mock_update_metadata):
-    """Switching a room to public should be disabled for the external API by default."""
-
-    user = UserFactory()
-    room = RoomFactory(
-        users=[(user, RoleChoices.OWNER)],
-        access_level=RoomAccessLevel.TRUSTED,
-    )
-
-    token = generate_test_token(user, [ApplicationScope.ROOMS_UPDATE])
-
-    client = APIClient()
-    client.credentials(HTTP_AUTHORIZATION=f"Bearer {token}")
-    response = client.patch(
-        f"/external-api/v1.0/rooms/{room.id}/",
-        {"access_level": RoomAccessLevel.PUBLIC},
-        format="json",
-    )
-
-    assert response.status_code == 400
-    assert "public rooms are disabled" in str(response.data).lower()
-
-    room.refresh_from_db()
-    assert room.access_level == RoomAccessLevel.TRUSTED
-    mock_update_metadata.assert_not_called()
-
-
-@mock.patch.object(RoomManagement, "update_metadata")
-def test_api_rooms_update_public_access_enabled_with_settings(
-    mock_update_metadata, settings
-):
-    """Switching a room to public should be allowed when explicitly enabled."""
-
-    settings.EXTERNAL_API_ALLOW_PUBLIC_ACCESS = True
-
-    user = UserFactory()
-    room = RoomFactory(
-        users=[(user, RoleChoices.OWNER)],
-        access_level=RoomAccessLevel.TRUSTED,
-    )
-
-    token = generate_test_token(user, [ApplicationScope.ROOMS_UPDATE])
-
-    client = APIClient()
-    client.credentials(HTTP_AUTHORIZATION=f"Bearer {token}")
-    response = client.patch(
-        f"/external-api/v1.0/rooms/{room.id}/",
-        {"access_level": RoomAccessLevel.PUBLIC},
-        format="json",
-    )
-
-    assert response.status_code == 200
-    assert response.data["access_level"] == RoomAccessLevel.PUBLIC
-
-    room.refresh_from_db()
-    assert room.access_level == RoomAccessLevel.PUBLIC
-    mock_update_metadata.assert_called_once()
-
-
-@mock.patch("core.external_api.viewsets.analytics.capture")
-@mock.patch.object(RoomManagement, "update_metadata")
-def test_api_rooms_update_unchanged_skips_livekit_sync(
-    mock_update_metadata, mock_capture
-):
-    """An update that changes nothing should not sync metadata nor report changes."""
-
-    user = UserFactory()
-    room = RoomFactory(
-        users=[(user, RoleChoices.OWNER)],
-        access_level=RoomAccessLevel.TRUSTED,
-        configuration={"everyone_can_mute": True},
-    )
-
-    token = generate_test_token(user, [ApplicationScope.ROOMS_UPDATE])
-
-    client = APIClient()
-    client.credentials(HTTP_AUTHORIZATION=f"Bearer {token}")
-    response = client.patch(
-        f"/external-api/v1.0/rooms/{room.id}/",
-        {
-            "access_level": RoomAccessLevel.TRUSTED,
-            "configuration": {"everyone_can_mute": True},
-        },
-        format="json",
-    )
-
-    assert response.status_code == 200
-    mock_update_metadata.assert_not_called()
-
-    # The event is still emitted for auditing, but reports an empty delta.
-    _, _, properties = mock_capture.call_args[0]
-    assert properties["updated_fields"] == []
-
-
-@mock.patch("core.external_api.viewsets.analytics.capture")
-@mock.patch.object(RoomManagement, "update_metadata")
-def test_api_rooms_update_tracks_analytics(mock_update_metadata, mock_capture):
-    """Updating a room should emit a ROOM_UPDATED analytics event."""
-
-    user = UserFactory()
-    room = RoomFactory(
-        users=[(user, RoleChoices.OWNER)],
-        access_level=RoomAccessLevel.TRUSTED,
-        configuration={},
-    )
-
-    token = generate_test_token(user, [ApplicationScope.ROOMS_UPDATE])
-    application = Application.objects.get()
-
-    client = APIClient()
-    client.credentials(HTTP_AUTHORIZATION=f"Bearer {token}")
-    response = client.patch(
-        f"/external-api/v1.0/rooms/{room.id}/",
-        {
-            "access_level": RoomAccessLevel.RESTRICTED,
-            "configuration": {"everyone_can_mute": True},
-        },
-        format="json",
-    )
-
-    assert response.status_code == 200
-
-    mock_capture.assert_called_once()
-    captured_user, event, properties = mock_capture.call_args[0]
-
-    assert captured_user == user
-    assert event == AnalyticsEvent.ROOM_UPDATED
-    assert properties == {
-        "room_id": str(room.pk),
-        "access_level": RoomAccessLevel.RESTRICTED,
-        "updated_fields": ["access_level", "configuration"],
-        "previous_access_level": RoomAccessLevel.TRUSTED,
-        "client_id": str(application.client_id),
-        "external_api": True,
-        "auth_method": "ApplicationJWTAuthentication",
-        "$set": {"email": user.email},
-    }
-
-    mock_update_metadata.assert_called_once()
-
-
 def test_api_rooms_response_no_url(settings):
    """Response should not include url field when APPLICATION_BASE_URL is None."""
    settings.APPLICATION_BASE_URL = None
@@ -2009,106 +1497,6 @@ def test_resource_server_denies_access_with_insufficient_scopes(settings):
    assert response.status_code == 403


-@responses.activate
-@mock.patch.object(RoomManagement, "update_metadata")
-def test_resource_server_updates_room_with_prefixed_scope(
-    mock_update_metadata, settings
-):
-    """A resource server token carrying the prefixed update scope should be accepted."""
-
-    user = UserFactory(sub="very-specific-sub")
-    room = RoomFactory(
-        users=[(user, RoleChoices.OWNER)],
-        access_level=RoomAccessLevel.TRUSTED,
-    )
-
-    settings.OIDC_RS_CLIENT_ID = "some_client_id"
-    settings.OIDC_RS_CLIENT_SECRET = "some_client_secret"
-    settings.OIDC_RS_SCOPES_PREFIX = "lasuite_meet"
-
-    settings.OIDC_OP_URL = "https://oidc.example.com"
-    settings.OIDC_VERIFY_SSL = False
-    settings.OIDC_TIMEOUT = 5
-    settings.OIDC_PROXY = None
-    settings.OIDC_OP_JWKS_ENDPOINT = "https://oidc.example.com/jwks"
-    settings.OIDC_OP_INTROSPECTION_ENDPOINT = "https://oidc.example.com/introspect"
-
-    responses.add(
-        responses.POST,
-        "https://oidc.example.com/introspect",
-        json={
-            "iss": "https://oidc.example.com",
-            "aud": "some_client_id",  # settings.OIDC_RS_CLIENT_ID
-            "sub": "very-specific-sub",
-            "client_id": "some_service_provider",
-            "scope": "openid lasuite_meet lasuite_meet:rooms:update",
-            "active": True,
-        },
-    )
-
-    client = APIClient()
-    client.credentials(HTTP_AUTHORIZATION="Bearer some_token")
-    response = client.patch(
-        f"/external-api/v1.0/rooms/{room.id}/",
-        {"access_level": RoomAccessLevel.RESTRICTED},
-        format="json",
-    )
-
-    assert response.status_code == 200
-
-    room.refresh_from_db()
-    assert room.access_level == RoomAccessLevel.RESTRICTED
-    mock_update_metadata.assert_called_once()
-
-
-@responses.activate
-def test_resource_server_denies_room_update_without_update_scope(settings):
-    """A resource server token without the update scope should be denied."""
-
-    user = UserFactory(sub="very-specific-sub")
-    room = RoomFactory(
-        users=[(user, RoleChoices.OWNER)],
-        access_level=RoomAccessLevel.TRUSTED,
-    )
-
-    settings.OIDC_RS_CLIENT_ID = "some_client_id"
-    settings.OIDC_RS_CLIENT_SECRET = "some_client_secret"
-    settings.OIDC_RS_SCOPES_PREFIX = "lasuite_meet"
-
-    settings.OIDC_OP_URL = "https://oidc.example.com"
-    settings.OIDC_VERIFY_SSL = False
-    settings.OIDC_TIMEOUT = 5
-    settings.OIDC_PROXY = None
-    settings.OIDC_OP_JWKS_ENDPOINT = "https://oidc.example.com/jwks"
-    settings.OIDC_OP_INTROSPECTION_ENDPOINT = "https://oidc.example.com/introspect"
-
-    responses.add(
-        responses.POST,
-        "https://oidc.example.com/introspect",
-        json={
-            "iss": "https://oidc.example.com",
-            "aud": "some_client_id",  # settings.OIDC_RS_CLIENT_ID
-            "sub": "very-specific-sub",
-            "client_id": "some_service_provider",
-            "scope": "openid lasuite_meet lasuite_meet:rooms:retrieve",
-            "active": True,
-        },
-    )
-
-    client = APIClient()
-    client.credentials(HTTP_AUTHORIZATION="Bearer some_token")
-    response = client.patch(
-        f"/external-api/v1.0/rooms/{room.id}/",
-        {"access_level": RoomAccessLevel.RESTRICTED},
-        format="json",
-    )
-
-    assert response.status_code == 403
-
-    room.refresh_from_db()
-    assert room.access_level == RoomAccessLevel.TRUSTED
-
-
 # ==============================
 # Addons
 # ==============================
@@ -2160,32 +1548,6 @@ def test_api_rooms_create_with_valid_addons_token():
    assert room.get_role(user) == RoleChoices.OWNER


-@mock.patch.object(RoomManagement, "update_metadata")
-def test_api_rooms_update_with_valid_addons_token(mock_update_metadata):
-    """Updating a room with a valid addons token should succeed."""
-    user = UserFactory()
-    room = RoomFactory(
-        users=[(user, RoleChoices.OWNER)],
-        access_level=RoomAccessLevel.TRUSTED,
-    )
-
-    token = generate_addons_test_token(user, [ApplicationScope.ROOMS_UPDATE])
-
-    client = APIClient()
-    client.credentials(HTTP_AUTHORIZATION=f"Bearer {token}")
-    response = client.patch(
-        f"/external-api/v1.0/rooms/{room.id}/",
-        {"access_level": RoomAccessLevel.RESTRICTED},
-        format="json",
-    )
-
-    assert response.status_code == 200
-
-    room.refresh_from_db()
-    assert room.access_level == RoomAccessLevel.RESTRICTED
-    mock_update_metadata.assert_called_once()
-
-
 def test_api_rooms_addons_token_inactive_user():
    """Addons token for an inactive user should return 401."""
    user = UserFactory(is_active=False)
@@ -129,15 +129,6 @@ class Base(Configuration):
    MEDIA_BASE_URL = values.Value(
        "", environ_name="MEDIA_BASE_URL", environ_prefix=None
    )
-    # Header the reverse proxy uses to pass the original request URL to the
-    # media-auth subrequest views. nginx-ingress sends X-Original-URL, which is
-    # the default. Other proxies use different headers -- Traefik's ForwardAuth,
-    # for instance, sends X-Forwarded-Uri and cannot emit X-Original-URL at all.
-    MEDIA_AUTH_ORIGINAL_URL_HEADER = values.Value(
-        default="HTTP_X_ORIGINAL_URL",
-        environ_name="MEDIA_AUTH_ORIGINAL_URL_HEADER",
-        environ_prefix=None,
-    )

    SITE_ID = 1

@@ -53,7 +53,6 @@ RUN apk update && apk upgrade  \
    musl \
    musl-utils \
    zlib>=1.3.2-r0 \
-    libexpat>=2.8.4-r0 \
    && apk del curl

 USER nginx
@@ -1,595 +0,0 @@
-import { CSSProperties, useState } from 'react'
-import { useConnectionState, useRoomContext } from '@livekit/components-react'
-import { ConnectionState } from 'livekit-client'
-import { StatsSnapshot, TrackRow, useWebRTCStats } from './useWebRTCStats'
-import { readRoomConfig } from './roomConfig'
-import {
-  forceTransport,
-  releaseForcedTransport,
-  Scenario,
-  SCENARIOS,
-  setDownlinkCap,
-  setUplinkCap,
-  stepBitrate,
-  TransportMode,
-  transportModeFromRoute,
-} from './simulation'
-
-const SANS =
-  "-apple-system, BlinkMacSystemFont, 'Segoe UI', Roboto, Helvetica, Arial, sans-serif"
-const MONO = 'ui-monospace, SFMono-Regular, Menlo, Consolas, monospace'
-
-const COLOR = {
-  text: '#e8e8e8',
-  muted: '#9a9a9a',
-  faint: '#6f6f6f',
-  hairline: '#2c2d31',
-  border: '#3d3e44',
-  surface: '#1b1c1e',
-  chartBg: '#141517',
-  down: '#f6821f',
-  up: '#5a9cf8',
-  ok: '#10b981',
-  bad: '#f05a4a',
-  busy: '#e5a13c',
-}
-
-const stateColor = (state: ConnectionState): string => {
-  switch (state) {
-    case ConnectionState.Connected:
-      return COLOR.ok
-    case ConnectionState.Reconnecting:
-    case ConnectionState.SignalReconnecting:
-      return COLOR.busy
-    case ConnectionState.Connecting:
-      return COLOR.up
-    case ConnectionState.Disconnected:
-      return COLOR.bad
-  }
-}
-
-const styles: Record<string, CSSProperties> = {
-  toggle: {
-    position: 'fixed',
-    bottom: 12,
-    right: 12,
-    zIndex: 9999,
-    fontFamily: SANS,
-    fontSize: 12,
-    lineHeight: 1,
-    padding: '8px 12px',
-    borderRadius: 999,
-    borderWidth: 1,
-    borderStyle: 'solid',
-    borderColor: COLOR.border,
-    background: COLOR.surface,
-    color: COLOR.text,
-    cursor: 'pointer',
-    boxShadow: '0 2px 10px #0006',
-  },
-  panel: {
-    position: 'fixed',
-    bottom: 12,
-    right: 12,
-    zIndex: 9999,
-    width: 460,
-    maxWidth: 'calc(100vw - 24px)',
-    maxHeight: 'calc(100vh - 24px)',
-    overflowY: 'auto',
-    fontFamily: SANS,
-    fontSize: 11,
-    lineHeight: 1.5,
-    color: COLOR.text,
-    background: COLOR.surface,
-    borderWidth: 1,
-    borderStyle: 'solid',
-    borderColor: COLOR.border,
-    borderRadius: 10,
-    padding: 14,
-    boxShadow: '0 10px 34px #00000080',
-  },
-  sectionTitle: {
-    margin: '14px 0 5px',
-    color: COLOR.faint,
-    textTransform: 'uppercase',
-    letterSpacing: 1.2,
-    fontSize: 9,
-    fontWeight: 600,
-    display: 'flex',
-    justifyContent: 'space-between',
-  },
-  metricsLine: {
-    display: 'flex',
-    alignItems: 'center',
-    gap: 16,
-    margin: '0 0 10px',
-    paddingBottom: 10,
-    borderBottom: `1px solid ${COLOR.hairline}`,
-    fontVariantNumeric: 'tabular-nums',
-  },
-  legend: {
-    display: 'flex',
-    gap: 12,
-    marginTop: 3,
-    color: COLOR.faint,
-    fontSize: 10,
-  },
-  list: {
-    display: 'flex',
-    flexDirection: 'column',
-    maxHeight: '400px',
-    overflowY: 'auto',
-  },
-  configList: { display: 'flex', flexWrap: 'wrap' },
-  configRow: {
-    display: 'flex',
-    gap: 6,
-    flex: '0 0 50%',
-    minWidth: 0,
-    boxSizing: 'border-box',
-    padding: '1px 8px 1px 0',
-  },
-  configLabel: {
-    color: COLOR.muted,
-    flex: '0 0 45%',
-    whiteSpace: 'nowrap',
-    overflow: 'hidden',
-    textOverflow: 'ellipsis',
-  },
-  configValue: {
-    flex: 1,
-    minWidth: 0,
-    whiteSpace: 'nowrap',
-    overflow: 'hidden',
-    textOverflow: 'ellipsis',
-  },
-  trackRow: {
-    display: 'flex',
-    gap: 8,
-    padding: '3px 0',
-    borderBottom: `1px solid ${COLOR.hairline}`,
-    alignItems: 'baseline',
-  },
-  trackLabel: {
-    flex: '0 0 34%',
-    whiteSpace: 'nowrap',
-    overflow: 'hidden',
-    textOverflow: 'ellipsis',
-  },
-  trackCodec: {
-    flex: '0 0 11%',
-    fontFamily: MONO,
-    fontSize: 10,
-    color: COLOR.muted,
-  },
-  trackKbps: {
-    flex: '0 0 9%',
-    textAlign: 'right',
-    fontVariantNumeric: 'tabular-nums',
-  },
-  trackDetail: {
-    flex: 1,
-    minWidth: 0,
-    whiteSpace: 'nowrap',
-    overflow: 'hidden',
-    textOverflow: 'ellipsis',
-  },
-  mono: { fontFamily: MONO, fontSize: 10, color: COLOR.muted },
-  button: {
-    fontFamily: SANS,
-    fontSize: 11,
-    padding: '3px 9px',
-    borderRadius: 5,
-    borderWidth: 1,
-    borderStyle: 'solid',
-    borderColor: COLOR.border,
-    background: '#232428',
-    color: COLOR.text,
-    cursor: 'pointer',
-  },
-  buttonActive: { borderColor: COLOR.down, color: COLOR.down },
-  buttonDisabled: { color: COLOR.faint, cursor: 'not-allowed' },
-  row: { display: 'flex', alignItems: 'center', gap: 6, flexWrap: 'wrap' },
-  stepperValue: {
-    minWidth: 92,
-    textAlign: 'center',
-    borderWidth: 1,
-    borderStyle: 'solid',
-    borderColor: COLOR.hairline,
-    borderRadius: 4,
-    padding: '2px 6px',
-    background: COLOR.chartBg,
-    fontVariantNumeric: 'tabular-nums',
-  },
-  close: {
-    background: 'none',
-    border: 'none',
-    color: COLOR.faint,
-    cursor: 'pointer',
-    fontSize: 14,
-  },
-}
-
-const Sparkline = ({ history }: { history: StatsSnapshot[] }) => {
-  const width = 430
-  const height = 54
-  const max = Math.max(...history.map((s) => Math.max(s.upKbps, s.downKbps)), 1)
-  const points = (pick: (s: StatsSnapshot) => number) =>
-    history
-      .map(
-        (s, i) =>
-          `${((i / Math.max(history.length - 1, 1)) * width).toFixed(1)},${(
-            height -
-            (pick(s) / max) * (height - 6) -
-            3
-          ).toFixed(1)}`
-      )
-      .join(' ')
-  return (
-    <>
-      <svg
-        width={width}
-        height={height}
-        role="img"
-        aria-label="Bandwidth over the last minute"
-        style={{
-          display: 'block',
-          background: COLOR.chartBg,
-          borderRadius: 6,
-          border: `1px solid ${COLOR.hairline}`,
-        }}
-      >
-        {history.length >= 2 && (
-          <>
-            <polyline
-              points={points((s) => s.downKbps)}
-              fill="none"
-              stroke={COLOR.down}
-              strokeWidth="1.5"
-            />
-            <polyline
-              points={points((s) => s.upKbps)}
-              fill="none"
-              stroke={COLOR.up}
-              strokeWidth="1.5"
-            />
-          </>
-        )}
-      </svg>
-      {/* Legend outside the plot: text over the lines was unreadable. */}
-      <div style={styles.legend}>
-        <span>
-          <span style={{ color: COLOR.down }}>●</span> down
-        </span>
-        <span>
-          <span style={{ color: COLOR.up }}>●</span> up
-        </span>
-        <span>last 60s · max {Math.round(max)} kbps</span>
-      </div>
-    </>
-  )
-}
-
-const CapStepper = ({
-  label,
-  hint,
-  valueKbps,
-  onChange,
-}: {
-  label: string
-  hint: string
-  valueKbps: number | null
-  onChange: (kbps: number | null) => void
-}) => (
-  <div style={styles.row}>
-    <span style={{ flex: '0 0 70px' }}>{label}</span>
-    <button
-      type="button"
-      style={styles.button}
-      aria-label={`Decrease ${label} bandwidth`}
-      onClick={() => onChange(stepBitrate(valueKbps, 'decrease'))}
-    >
-      −
-    </button>
-    <span
-      style={{
-        ...styles.stepperValue,
-        ...(valueKbps !== null ? { color: COLOR.down } : {}),
-      }}
-    >
-      {valueKbps === null ? 'unlimited' : `≤ ${valueKbps} kbps`}
-    </span>
-    <button
-      type="button"
-      style={styles.button}
-      aria-label={`Increase ${label} bandwidth`}
-      onClick={() => onChange(stepBitrate(valueKbps, 'increase'))}
-    >
-      +
-    </button>
-    <span style={styles.mono}>{hint}</span>
-  </div>
-)
-
-const TrackList = ({ title, rows }: { title: string; rows: TrackRow[] }) => (
-  <>
-    <div style={styles.sectionTitle}>
-      <span>
-        {title} ({rows.length})
-      </span>
-      <span>
-        {Math.round(rows.reduce((sum, t) => sum + t.kbps, 0))} kbps media
-      </span>
-    </div>
-    <div style={styles.list}>
-      {rows.map((track) => (
-        <div key={track.key} style={styles.trackRow}>
-          <span style={styles.trackLabel}>{track.label}</span>
-          <span style={styles.trackCodec}>{track.codec ?? '–'}</span>
-          <span style={styles.trackKbps}>{Math.round(track.kbps)}</span>
-          <span style={styles.trackDetail}>
-            {[
-              track.res,
-              track.fps !== undefined && `${Math.round(track.fps)}fps`,
-            ]
-              .filter(Boolean)
-              .join(' · ')}
-          </span>
-        </div>
-      ))}
-      {rows.length === 0 && <span style={{ color: COLOR.faint }}>none</span>}
-    </div>
-  </>
-)
-
-const MeetDevtools = () => {
-  const room = useRoomContext()
-  const connState = useConnectionState(room)
-  const [open, setOpen] = useState(false)
-  const [firedScenario, setFiredScenario] = useState<string>()
-  const [uplinkCap, setUplinkCapState] = useState<number | null>(null)
-  const [downlinkCap, setDownlinkCapState] = useState<number | null>(null)
-  const { snapshot, history } = useWebRTCStats(room, open)
-
-  const transportMode: TransportMode = transportModeFromRoute(snapshot?.route)
-
-  const fireScenario = (scenario: Scenario) => {
-    setFiredScenario(scenario.id)
-    scenario.run(room).catch((e) => {
-      console.warn('[MeetDevtools] simulateScenario failed', e)
-    })
-    window.setTimeout(
-      () =>
-        setFiredScenario((current) =>
-          current === scenario.id ? undefined : current
-        ),
-      1200
-    )
-  }
-
-  if (!open) {
-    return (
-      <button
-        type="button"
-        style={styles.toggle}
-        onClick={() => setOpen(true)}
-        aria-label="Open WebRTC devtools"
-      >
-        <span style={{ color: stateColor(connState) }}>●</span> rtc
-      </button>
-    )
-  }
-
-  const config = readRoomConfig(room)
-  const published = snapshot?.tracks.filter((t) => t.dir === 'up') ?? []
-  const subscribed = snapshot?.tracks.filter((t) => t.dir === 'down') ?? []
-  const turnProtocols = snapshot?.turnProtocols ?? []
-  const transports: Array<{
-    mode: TransportMode
-    label: string
-    requires?: string
-    title: string
-  }> = [
-    {
-      mode: 'auto',
-      label: 'auto (udp)',
-      title:
-        'clears the server-cached transport preference and relay-only policy, then full reconnect',
-    },
-    {
-      mode: 'tcp',
-      label: 'tcp',
-      title: 'force-tcp — server prefers TCP candidates (ICE/TCP)',
-    },
-    {
-      mode: 'turn-udp',
-      label: 'turn:udp',
-      requires: 'udp',
-      title:
-        'client-side: iceTransportPolicy relay + full reconnect (no server hook exists)',
-    },
-    {
-      mode: 'turn-tcp',
-      label: 'turn:tcp',
-      requires: 'tcp',
-      title: 'force-tcp — lands on TURN/TCP when it is the TCP path',
-    },
-    {
-      mode: 'turn-tls',
-      label: 'turn:tls',
-      requires: 'tls',
-      title: 'force-tls — server switches you to TURN over TLS',
-    },
-  ]
-
-  return (
-    <section style={styles.panel} aria-label="WebRTC devtools">
-      <div style={styles.metricsLine}>
-        <span>
-          <span style={{ color: COLOR.down }}>↓</span> {snapshot?.downKbps ?? 0}{' '}
-          kbps
-        </span>
-        <span>
-          <span style={{ color: COLOR.up }}>↑</span> {snapshot?.upKbps ?? 0}{' '}
-          kbps
-        </span>
-        <span style={{ color: COLOR.muted }}>
-          rtt{' '}
-          <span style={{ color: COLOR.text }}>{snapshot?.rttMs ?? '–'}</span> ms
-        </span>
-        <span style={{ color: COLOR.muted }}>
-          jitter{' '}
-          <span style={{ color: COLOR.text }}>{snapshot?.jitterMs ?? '–'}</span>{' '}
-          ms
-        </span>
-        <span
-          style={{
-            color: stateColor(connState),
-            fontSize: 10,
-            marginLeft: 'auto',
-          }}
-        >
-          ● {connState}
-        </span>
-        <button
-          type="button"
-          style={styles.close}
-          onClick={() => setOpen(false)}
-          aria-label="Close WebRTC devtools"
-        >
-          ✕
-        </button>
-      </div>
-
-      <Sparkline history={history} />
-
-      <div style={styles.sectionTitle}>room configuration (live)</div>
-      <div style={styles.configList}>
-        {config.map((entry) => (
-          <div key={entry.label} style={styles.configRow}>
-            <span
-              style={{
-                color:
-                  entry.on === undefined
-                    ? COLOR.faint
-                    : entry.on
-                      ? COLOR.ok
-                      : COLOR.bad,
-              }}
-            >
-              ●
-            </span>
-            <span style={styles.configLabel}>{entry.label}</span>
-            <span style={styles.configValue} title={entry.value}>
-              {entry.value}
-            </span>
-          </div>
-        ))}
-      </div>
-
-      <TrackList title="published ↑" rows={published} />
-      <TrackList title="subscribed ↓" rows={subscribed} />
-
-      <div style={styles.sectionTitle}>bandwidth</div>
-      <div style={{ ...styles.list, gap: 4 }}>
-        <CapStepper
-          label="uplink"
-          hint="encoder cap (setParameters)"
-          valueKbps={uplinkCap}
-          onChange={(kbps) => {
-            setUplinkCapState(kbps)
-            void setUplinkCap(room, kbps)
-          }}
-        />
-        <CapStepper
-          label="downlink"
-          hint="SFU limit (subscriber-bandwidth)"
-          valueKbps={downlinkCap}
-          onChange={(kbps) => {
-            setDownlinkCapState(kbps)
-            void setDownlinkCap(room, kbps).catch((e) =>
-              console.warn('[MeetDevtools] downlink cap failed', e)
-            )
-          }}
-        />
-      </div>
-
-      <div style={styles.sectionTitle}>transport</div>
-      <div style={styles.row}>
-        {transports.map(({ mode, label, requires, title }) => {
-          const available = !requires || turnProtocols.includes(requires)
-          const active = transportMode === mode
-          const clickable = available && !active
-          return (
-            <button
-              key={mode}
-              type="button"
-              aria-pressed={active}
-              disabled={!clickable}
-              title={available ? title : `${title} — not configured`}
-              style={{
-                ...styles.button,
-                ...(clickable || active ? {} : styles.buttonDisabled),
-                ...(active ? styles.buttonActive : {}),
-              }}
-              onClick={() => {
-                if (!clickable) return
-                void (
-                  mode === 'auto'
-                    ? releaseForcedTransport(room)
-                    : forceTransport(
-                        room,
-                        mode as 'tcp' | 'turn-udp' | 'turn-tcp' | 'turn-tls'
-                      )
-                ).catch((e) =>
-                  console.warn('[MeetDevtools] transport change failed', e)
-                )
-              }}
-            >
-              {requires && (
-                <span style={{ color: available ? COLOR.ok : COLOR.faint }}>
-                  ●{' '}
-                </span>
-              )}
-              {label}
-            </button>
-          )
-        })}
-        <span style={styles.mono}>
-          route:{' '}
-          {snapshot?.route
-            ? [
-                snapshot.route.protocol,
-                snapshot.route.type,
-                snapshot.route.relayProtocol &&
-                  `relay:${snapshot.route.relayProtocol}`,
-              ]
-                .filter(Boolean)
-                .join('·')
-            : '–'}
-        </span>
-      </div>
-
-      <div style={styles.sectionTitle}>connection scenarios</div>
-      <div style={styles.row}>
-        {SCENARIOS.map((scenario) => (
-          <button
-            key={scenario.id}
-            type="button"
-            title={`${scenario.side}-side simulation — momentary, watch the state dot`}
-            style={{
-              ...styles.button,
-              ...(firedScenario === scenario.id ? styles.buttonActive : {}),
-            }}
-            onClick={() => fireScenario(scenario)}
-          >
-            {scenario.side === 'server' ? '☁ ' : ''}
-            {scenario.label}
-          </button>
-        ))}
-      </div>
-    </section>
-  )
-}
-
-export default MeetDevtools
@@ -1,14 +0,0 @@
-import { lazy, Suspense } from 'react'
-
-const LazyPanel = import.meta.env.DEV
-  ? lazy(() => import('./MeetDevtools'))
-  : null
-
-export const MeetDevtools = () => {
-  if (!LazyPanel) return null
-  return (
-    <Suspense fallback={null}>
-      <LazyPanel />
-    </Suspense>
-  )
-}
@@ -1,88 +0,0 @@
-import { Room } from 'livekit-client'
-
-export type ConfigEntry = {
-  label: string
-  value: string
-  /** true = feature actively on, false = off, undefined = informational */
-  on?: boolean
-}
-
-const formatBackupCodec = (backup: unknown): string => {
-  if (backup === undefined || backup === true) return 'auto'
-  if (backup === false) return 'off'
-  if (typeof backup === 'object' && backup !== null && 'codec' in backup) {
-    return String((backup as { codec: unknown }).codec)
-  }
-  return String(backup)
-}
-
-export const readRoomConfig = (room: Room): ConfigEntry[] => {
-  const options = room.options
-  const publish = options.publishDefaults
-  const adaptive = options.adaptiveStream
-
-  const entries: ConfigEntry[] = [
-    {
-      label: 'adaptiveStream',
-      value:
-        typeof adaptive === 'object'
-          ? JSON.stringify(adaptive)
-          : String(!!adaptive),
-      on: !!adaptive,
-    },
-    {
-      label: 'dynacast',
-      value: String(!!options.dynacast),
-      on: !!options.dynacast,
-    },
-    {
-      label: 'e2ee',
-      value: String(room.isE2EEEnabled),
-      on: room.isE2EEEnabled,
-    },
-    {
-      label: 'videoCodec',
-      value: publish?.videoCodec ?? 'default',
-    },
-    {
-      label: 'backupCodec',
-      value: formatBackupCodec(publish?.backupCodec),
-    },
-    {
-      label: 'simulcast',
-      value: String(publish?.simulcast ?? true),
-      on: publish?.simulcast ?? true,
-    },
-    {
-      label: 'audio dtx',
-      value: String(publish?.dtx ?? true),
-      on: publish?.dtx ?? true,
-    },
-    {
-      label: 'audio red',
-      value: String(publish?.red ?? true),
-      on: publish?.red ?? true,
-    },
-    {
-      label: 'quality (local)',
-      value: room.localParticipant.connectionQuality,
-    },
-  ]
-
-  const server = room.serverInfo
-  if (server) {
-    entries.push({
-      label: 'server',
-      value: [
-        server.version && `v${server.version}`,
-        server.region,
-        server.protocol !== undefined && `proto ${server.protocol}`,
-        server.edition !== undefined && `edition ${server.edition}`,
-      ]
-        .filter(Boolean)
-        .join(' · '),
-    })
-  }
-
-  return entries
-}
@@ -1,192 +0,0 @@
-import { Room, Track } from 'livekit-client'
-// Transitive dependency of livekit-client (pinned by it); used only to
-// build the one signal request room.simulateScenario cannot express.
-import { SimulateScenario } from '@livekit/protocol'
-
-/** Shared bandwidth ladder for the −/+ steppers; null = unlimited. */
-export const BITRATE_LADDER_KBPS: Array<number | null> = [
-  null,
-  2000,
-  1000,
-  600,
-  300,
-  150,
-]
-
-export const stepBitrate = (
-  current: number | null,
-  direction: 'decrease' | 'increase'
-): number | null => {
-  const index = BITRATE_LADDER_KBPS.indexOf(current)
-  const safeIndex = index === -1 ? 0 : index
-  const next =
-    direction === 'decrease'
-      ? Math.min(safeIndex + 1, BITRATE_LADDER_KBPS.length - 1)
-      : Math.max(safeIndex - 1, 0)
-  return BITRATE_LADDER_KBPS[next]
-}
-
-const savedEncodings = new WeakMap<RTCRtpSender, Array<number | undefined>>()
-
-export const setUplinkCap = async (
-  room: Room,
-  kbps: number | null
-): Promise<void> => {
-  const senders: RTCRtpSender[] = []
-  room.localParticipant.trackPublications.forEach((pub) => {
-    const track = pub.track
-    if (track?.kind === Track.Kind.Video && track.sender) {
-      senders.push(track.sender)
-    }
-  })
-
-  for (const sender of senders) {
-    const params = sender.getParameters()
-    if (!params.encodings || params.encodings.length === 0) continue
-
-    if (kbps === null) {
-      const original = savedEncodings.get(sender)
-      params.encodings.forEach((encoding, i) => {
-        encoding.maxBitrate = original?.[i]
-      })
-      savedEncodings.delete(sender)
-    } else {
-      if (!savedEncodings.has(sender)) {
-        savedEncodings.set(
-          sender,
-          params.encodings.map((encoding) => encoding.maxBitrate)
-        )
-      }
-      const activeCount =
-        params.encodings.filter((encoding) => encoding.active !== false)
-          .length || 1
-      // Split the budget across active simulcast layers / SVC encoding.
-      const perEncoding = Math.max(
-        30_000,
-        Math.floor((kbps * 1000) / activeCount)
-      )
-      params.encodings.forEach((encoding) => {
-        encoding.maxBitrate = perEncoding
-      })
-    }
-
-    try {
-      await sender.setParameters(params)
-    } catch (e) {
-      console.warn('[MeetDevtools] setParameters failed', e)
-    }
-  }
-}
-
-export const setDownlinkCap = (
-  room: Room,
-  kbps: number | null
-): Promise<void> =>
-  room.simulateScenario('subscriber-bandwidth', kbps === null ? 0 : kbps * 1000)
-
-export type Scenario = {
-  id: string
-  label: string
-  /** where the simulation happens */
-  side: 'client' | 'server'
-  run: (room: Room) => Promise<void>
-}
-
-export const SCENARIOS: Scenario[] = [
-  {
-    id: 'resume',
-    label: 'reconnect (resume)',
-    side: 'client',
-    // Replays a signaling WebSocket loss; media keeps flowing, client resumes.
-    run: (room) => room.simulateScenario('signal-reconnect'),
-  },
-  {
-    id: 'resume-fail',
-    label: 'reconnect (resume fails)',
-    side: 'client',
-    // Same, but the next resume attempt fails → exercises the retry ladder.
-    run: (room) => room.simulateScenario('resume-reconnect'),
-  },
-  {
-    id: 'full-reconnect',
-    label: 'full reconnect',
-    side: 'client',
-    // Complete rejoin with brand-new peer connections.
-    run: (room) => room.simulateScenario('full-reconnect'),
-  },
-  {
-    id: 'migration',
-    label: 'server migration',
-    side: 'server',
-    run: (room) => room.simulateScenario('migration'),
-  },
-  {
-    id: 'node-failure',
-    label: 'SFU node failure',
-    side: 'server',
-    run: (room) => room.simulateScenario('node-failure'),
-  },
-  {
-    id: 'server-leave',
-    label: 'server disconnect',
-    side: 'server',
-    // Server-initiated leave: the closest thing to "you got kicked".
-    run: (room) => room.simulateScenario('server-leave'),
-  },
-]
-
-export type TransportMode =
-  | 'auto'
-  | 'tcp'
-  | 'turn-udp'
-  | 'turn-tcp'
-  | 'turn-tls'
-
-const clearServerTransportPreference = (room: Room): Promise<void> =>
-  room.engine.client.sendSimulateScenario(
-    new SimulateScenario({
-      scenario: { case: 'switchCandidateProtocol', value: 0 },
-    })
-  )
-
-const setRelayOnly = (room: Room, relay: boolean) => {
-  room.engine.rtcConfig = {
-    ...room.engine.rtcConfig,
-    iceTransportPolicy: relay ? 'relay' : 'all',
-  }
-}
-
-const settle = () => new Promise((resolve) => setTimeout(resolve, 300))
-
-export const forceTransport = async (
-  room: Room,
-  mode: 'tcp' | 'turn-udp' | 'turn-tcp' | 'turn-tls'
-): Promise<void> => {
-  if (mode === 'turn-udp') {
-    await clearServerTransportPreference(room)
-    setRelayOnly(room, true)
-    await settle()
-    return room.simulateScenario('full-reconnect')
-  }
-  setRelayOnly(room, false)
-  return room.simulateScenario(mode === 'turn-tls' ? 'force-tls' : 'force-tcp')
-}
-
-export const releaseForcedTransport = async (room: Room): Promise<void> => {
-  setRelayOnly(room, false)
-  await clearServerTransportPreference(room)
-  await settle()
-  await room.simulateScenario('full-reconnect')
-}
-
-export const transportModeFromRoute = (route?: {
-  protocol?: string
-  relayProtocol?: string
-}): TransportMode => {
-  // relayProtocol is the client→TURN leg; protocol alone means no relay.
-  if (route?.relayProtocol === 'tls') return 'turn-tls'
-  if (route?.relayProtocol === 'tcp') return 'turn-tcp'
-  if (route?.relayProtocol === 'udp') return 'turn-udp'
-  if (route?.protocol === 'tcp') return 'tcp'
-  return 'auto'
-}
@@ -1,243 +0,0 @@
-import { useEffect, useRef, useState } from 'react'
-import { Room } from 'livekit-client'
-
-export type TrackRow = {
-  key: string
-  dir: 'up' | 'down'
-  label: string
-  codec?: string
-  kbps: number
-  fps?: number
-  res?: string
-}
-
-export type StatsSnapshot = {
-  ts: number
-  /** wire totals from transport stats (includes headers, RTCP, FEC) */
-  upKbps: number
-  downKbps: number
-  rttMs?: number
-  /** worst inbound RTP jitter across subscribed tracks */
-  jitterMs?: number
-  availableOutKbps?: number
-  /** selected ICE route of the publisher transport (measured, not assumed) */
-  route?: { protocol?: string; type?: string; relayProtocol?: string }
-  /**
-   * relayProtocol values of gathered relay local candidates — i.e. which
-   * client→TURN transports are actually configured (udp/tcp/tls). Empty
-   * when no TURN server is configured.
-   */
-  turnProtocols: string[]
-  tracks: TrackRow[]
-}
-
-type StatDict = Record<string, unknown>
-type Counters = Record<string, number>
-
-const asNumber = (v: unknown): number | undefined =>
-  typeof v === 'number' && Number.isFinite(v) ? v : undefined
-
-const asString = (v: unknown): string | undefined =>
-  typeof v === 'string' ? v : undefined
-
-const shortCodec = (mimeType?: string) =>
-  mimeType ? mimeType.replace(/^(audio|video)\//, '') : undefined
-
-const buildTrackLabels = (room: Room) => {
-  const labels = new Map<string, string>()
-  room.localParticipant.trackPublications.forEach((pub) => {
-    const id = pub.track?.mediaStreamTrack?.id
-    if (id) labels.set(id, `local ${pub.source}`)
-  })
-  room.remoteParticipants.forEach((participant) => {
-    // Keep rows scannable: participant names capped at 10 chars.
-    const rawName = participant.name || participant.identity
-    const name = rawName.length > 10 ? `${rawName.slice(0, 10)}.` : rawName
-    participant.trackPublications.forEach((pub) => {
-      const id = pub.track?.mediaStreamTrack?.id
-      if (id) labels.set(id, `${name} ${pub.source}`)
-    })
-  })
-  return labels
-}
-
-export const useWebRTCStats = (
-  room: Room,
-  enabled: boolean,
-  intervalMs = 1000
-) => {
-  // Single source of truth: the snapshot is just the last history entry.
-  const [history, setHistory] = useState<StatsSnapshot[]>([])
-  const prevRef = useRef(new Map<string, Counters>())
-
-  useEffect(() => {
-    if (!enabled) return
-
-    let cancelled = false
-    const prev = prevRef.current
-
-    /** Per-stat counter deltas; returns 0 on the first sighting. */
-    const deltas = (key: string, now: Counters): Counters => {
-      const before = prev.get(key)
-      prev.set(key, now)
-      const out: Counters = {}
-      for (const [name, value] of Object.entries(now)) {
-        out[name] = before?.[name] !== undefined ? value - before[name] : 0
-      }
-      return out
-    }
-
-    const collect = async () => {
-      const reports: Array<{ pc: 'pub' | 'sub'; report: RTCStatsReport }> = []
-      try {
-        // Not public API — see file header.
-        const manager = room.engine?.pcManager
-        const pub = await manager?.publisher?.getStats()
-        if (pub) reports.push({ pc: 'pub', report: pub })
-        const sub = await manager?.subscriber?.getStats()
-        if (sub) reports.push({ pc: 'sub', report: sub })
-      } catch {
-        // Engine not ready or SDK internals changed; panel shows nothing.
-      }
-      if (cancelled || reports.length === 0) return
-
-      const labels = buildTrackLabels(room)
-      const tracks: TrackRow[] = []
-      let upKbps = 0
-      let downKbps = 0
-      let rttMs: number | undefined
-      let jitterMs: number | undefined
-      let availableOutKbps: number | undefined
-      let route: StatsSnapshot['route']
-      const turnProtocols = new Set<string>()
-
-      for (const { pc, report } of reports) {
-        const byId = new Map<string, StatDict>()
-        report.forEach((stat) => byId.set(stat.id as string, stat as StatDict))
-
-        report.forEach((raw) => {
-          const stat = raw as StatDict
-          const type = asString(stat.type)
-          const ts = asNumber(stat.timestamp) ?? Date.now()
-          const key = `${pc}:${asString(stat.id) ?? ''}`
-
-          if (
-            type === 'local-candidate' &&
-            asString(stat.candidateType) === 'relay'
-          ) {
-            // Relay candidates are only gathered when a TURN server is
-            // configured and reachable; relayProtocol says how the client
-            // reaches it (udp/tcp/tls).
-            turnProtocols.add(
-              asString(stat.relayProtocol) ?? asString(stat.protocol) ?? 'udp'
-            )
-          }
-
-          if (type === 'transport') {
-            const d = deltas(key, {
-              sent: asNumber(stat.bytesSent) ?? 0,
-              received: asNumber(stat.bytesReceived) ?? 0,
-              ts,
-            })
-            if (d.ts > 0) {
-              upKbps += Math.max(0, (d.sent * 8) / d.ts)
-              downKbps += Math.max(0, (d.received * 8) / d.ts)
-            }
-          }
-
-          if (type === 'candidate-pair' && stat.nominated === true) {
-            const rtt = asNumber(stat.currentRoundTripTime)
-            if (rtt !== undefined) rttMs = Math.round(rtt * 1000)
-            const available = asNumber(stat.availableOutgoingBitrate)
-            if (available !== undefined && pc === 'pub') {
-              availableOutKbps = Math.round(available / 1000)
-            }
-            if (pc === 'pub') {
-              const local = byId.get(asString(stat.localCandidateId) ?? '')
-              route = {
-                protocol: asString(local?.protocol),
-                type: asString(local?.candidateType),
-                relayProtocol: asString(local?.relayProtocol),
-              }
-            }
-          }
-
-          if (type === 'outbound-rtp' || type === 'inbound-rtp') {
-            const isUp = type === 'outbound-rtp'
-
-            if (!isUp) {
-              const jitter = asNumber(stat.jitter)
-              if (jitter !== undefined) {
-                const ms = Math.round(jitter * 1000)
-                if (jitterMs === undefined || ms > jitterMs) jitterMs = ms
-              }
-            }
-
-            const d = deltas(key, {
-              bytes: asNumber(isUp ? stat.bytesSent : stat.bytesReceived) ?? 0,
-              ts,
-            })
-            const kbps = d.ts > 0 ? Math.max(0, (d.bytes * 8) / d.ts) : 0
-
-            // Resolve codec + source track.
-            const codecStat = byId.get(asString(stat.codecId) ?? '')
-            let msTrackId = asString(stat.trackIdentifier)
-            if (!msTrackId && isUp) {
-              const mediaSource = byId.get(asString(stat.mediaSourceId) ?? '')
-              msTrackId = asString(mediaSource?.trackIdentifier)
-            }
-            const rid = asString(stat.rid)
-            const baseLabel =
-              (msTrackId && labels.get(msTrackId)) ??
-              `${asString(stat.kind) ?? 'media'} ssrc ${asNumber(stat.ssrc) ?? '?'}`
-
-            const width = asNumber(stat.frameWidth)
-            const height = asNumber(stat.frameHeight)
-
-            tracks.push({
-              key,
-              dir: isUp ? 'up' : 'down',
-              label: rid ? `${baseLabel} [${rid}]` : baseLabel,
-              codec: shortCodec(asString(codecStat?.mimeType)),
-              kbps,
-              fps: asNumber(stat.framesPerSecond),
-              res: width && height ? `${width}x${height}` : undefined,
-            })
-          }
-        })
-      }
-
-      // Stable order (direction, then label): sorting by bitrate would
-      // reshuffle rows on every tick as kbps fluctuates.
-      tracks.sort((a, b) =>
-        a.dir === b.dir
-          ? a.label.localeCompare(b.label)
-          : a.dir === 'up'
-            ? -1
-            : 1
-      )
-
-      const next: StatsSnapshot = {
-        ts: Date.now(),
-        upKbps: Math.round(upKbps),
-        downKbps: Math.round(downKbps),
-        rttMs,
-        jitterMs,
-        availableOutKbps,
-        route,
-        turnProtocols: Array.from(turnProtocols).sort(),
-        tracks,
-      }
-      setHistory((h) => [...h.slice(-59), next])
-    }
-
-    void collect()
-    const id = window.setInterval(() => void collect(), intervalMs)
-    return () => {
-      cancelled = true
-      window.clearInterval(id)
-    }
-  }, [room, enabled, intervalMs])
-
-  return { snapshot: history[history.length - 1], history }
-}
@@ -43,7 +43,6 @@ import { useSnapshot } from 'valtio'
 import { userPreferencesStore } from '@/stores/userPreferences'
 import { userStore } from '@/stores/user'
 import { WatchMediaDeviceErrors } from './WatchMediaDeviceErrors'
-import { MeetDevtools } from '@/features/devtools'
 import { VOICE_AUDIO_CONSTRAINTS } from '@/features/rooms/livekit/utils/constants'

 export const Conference = ({
@@ -299,7 +298,6 @@ export const Conference = ({
          <VideoConference />
          {!isMobile && <InviteDialog mode={mode} />}
          <PictureInPictureConference />
-          <MeetDevtools />
        </LiveKitRoom>
      </Screen>
    </QueryAware>
@@ -2,7 +2,7 @@ import { useTranslation } from 'react-i18next'
 import { useTrackToggle, UseTrackToggleProps } from '@livekit/components-react'
 import { Button, Popover } from '@/primitives'
 import { RiArrowUpSLine, RiImageCircleAiFill } from '@remixicon/react'
-import { Track, type VideoCaptureOptions, VideoPresets } from 'livekit-client'
+import { Track, type VideoCaptureOptions } from 'livekit-client'

 import { ToggleDevice } from './ToggleDevice'
 import { css } from '@/styled-system/css'
@@ -57,8 +57,7 @@ export const VideoDeviceControl = ({
 }: VideoDeviceControlProps) => {
  const { t } = useTranslation('rooms', { keyPrefix: 'selectDevice' })

-  const { videoDeviceId, processorConfig, videoPublishResolution } =
-    useSnapshot(userChoicesStore)
+  const { videoDeviceId, processorConfig } = useSnapshot(userChoicesStore)

  const onChange = React.useCallback(
    (enabled: boolean, isUserInitiated: boolean) =>
@@ -98,9 +97,6 @@ export const VideoDeviceControl = ({

    await toggle(!trackProps.enabled, {
      processor: processor,
-      ...(videoPublishResolution && {
-        resolution: VideoPresets[videoPublishResolution].resolution,
-      }),
    } as VideoCaptureOptions)
  }

@@ -18,7 +18,6 @@ import {
  saveVideoPublishResolution,
  saveVideoSubscribeQuality,
  userChoicesStore,
-  VIDEO_RESOLUTIONS,
  VideoResolution,
 } from '@/stores/userChoices'
 import { RowWrapper } from './layout/RowWrapper'
@@ -33,8 +32,7 @@ const EMPTY_PROPS = {}

 export const VideoTab = ({ id }: VideoTabProps) => {
  const { t } = useTranslation('settings', { keyPrefix: 'video' })
-  const room = useRoomContext()
-  const { localParticipant, remoteParticipants } = room
+  const { localParticipant, remoteParticipants } = useRoomContext()

  const {
    videoDeviceId,
@@ -71,21 +69,20 @@ export const VideoTab = ({ id }: VideoTabProps) => {
        isDisabled: true,
      }

-  const handleVideoResolutionChange = async (key: VideoResolution) => {
-    saveVideoPublishResolution(key)
-    const videoTrack = localParticipant.getTrackPublication(
+  const handleVideoResolutionChange = async (key: 'h720' | 'h360' | 'h180') => {
+    const videoPublication = localParticipant.getTrackPublication(
      Track.Source.Camera
-    )?.track
-    if (!videoTrack) {
-      return
+    )
+    const videoTrack = videoPublication?.track
+    if (videoTrack) {
+      saveVideoPublishResolution(key)
+      await videoTrack.restartTrack({
+        resolution: VideoPresets[key].resolution,
+        deviceId: { exact: videoDeviceId },
+        processor:
+          BackgroundProcessorFactory.fromProcessorConfig(processorConfig),
+      })
    }
-
-    await videoTrack.restartTrack({
-      resolution: VideoPresets[key].resolution,
-      deviceId: { exact: videoDeviceId },
-      processor:
-        BackgroundProcessorFactory.fromProcessorConfig(processorConfig),
-    })
  }

  /**
@@ -125,13 +122,20 @@ export const VideoTab = ({ id }: VideoTabProps) => {
  }, [videoDeviceId, videoElement])

  const resolutionItems = useMemo(() => {
-    const labels: Record<VideoResolution, string> = {
-      h1080: `${t('resolution.publish.items.veryHigh')} (1080p)`,
-      h720: `${t('resolution.publish.items.high')} (720p)`,
-      h360: `${t('resolution.publish.items.medium')} (360p)`,
-      h180: `${t('resolution.publish.items.low')} (180p)`,
-    }
-    return VIDEO_RESOLUTIONS.map((value) => ({ value, label: labels[value] }))
+    return [
+      {
+        value: 'h720',
+        label: `${t('resolution.publish.items.high')} (720p)`,
+      },
+      {
+        value: 'h360',
+        label: `${t('resolution.publish.items.medium')} (360p)`,
+      },
+      {
+        value: 'h180',
+        label: `${t('resolution.publish.items.low')} (180p)`,
+      },
+    ]
  }, [t])

  const videoQualityItems = useMemo(() => {
@@ -56,7 +56,6 @@
      "publish": {
        "label": "Wähle die maximale Auflösung beim Senden",
        "items": {
-          "veryHigh": "Sehr hohe Auflösung",
          "high": "Hohe Auflösung",
          "medium": "Mittlere Auflösung",
          "low": "Niedrige Auflösung"
@@ -56,7 +56,6 @@
      "publish": {
        "label": "Select your sending resolution (max.)",
        "items": {
-          "veryHigh": "Very high definition",
          "high": "High definition",
          "medium": "Standard definition",
          "low": "Low definition"
@@ -56,7 +56,6 @@
      "publish": {
        "label": "Selecciona tu resolución de envío (máx.)",
        "items": {
-          "veryHigh": "Muy alta definición",
          "high": "Alta definición",
          "medium": "Definición estándar",
          "low": "Baja definición"
@@ -56,7 +56,6 @@
      "publish": {
        "label": "Sélectionner votre résolution d'envoi (max.)",
        "items": {
-          "veryHigh": "Très haute définition",
          "high": "Haute définition",
          "medium": "Définition standard",
          "low": "Basse définition"
@@ -56,7 +56,6 @@
      "publish": {
        "label": "Selecteer uw verzendresolutie (max.)",
        "items": {
-          "veryHigh": "Zeer hoge definitie",
          "high": "Hoge definitie",
          "medium": "Standaarddefinitie",
          "low": "Lage definitie"
@@ -10,12 +10,7 @@ import {
 } from '@livekit/components-core'
 import { VideoQuality } from 'livekit-client'

-export const VIDEO_RESOLUTIONS = ['h1080', 'h720', 'h360', 'h180'] as const
-
-export type VideoResolution = (typeof VIDEO_RESOLUTIONS)[number]
-
-const isVideoResolution = (value: unknown): value is VideoResolution =>
-  VIDEO_RESOLUTIONS.includes(value as VideoResolution)
+export type VideoResolution = 'h720' | 'h360' | 'h180'

 export type LocalUserChoices = Omit<LocalUserChoicesLK, 'username'> & {
  processorConfig?: ProcessorConfig
@@ -26,17 +21,13 @@ export type LocalUserChoices = Omit<LocalUserChoicesLK, 'username'> & {
 }

 function getUserChoicesState(): LocalUserChoices {
-  const stored: LocalUserChoices = {
+  return {
    noiseReductionEnabled: false,
    audioOutputDeviceId: 'default', // Use 'default' to match LiveKit's standard device selection behavior
    videoPublishResolution: 'h720',
    videoSubscribeQuality: VideoQuality.HIGH,
    ...loadUserChoices(),
  }
-  if (!isVideoResolution(stored.videoPublishResolution)) {
-    stored.videoPublishResolution = 'h720'
-  }
-  return stored
 }

 export const userChoicesStore = proxy<LocalUserChoices>(getUserChoicesState())