📝(docs) add missing trailing slash

A trailing slash was missing in the documentation.
Spotted by T. Lemeur when integrating the API.

.github/workflows/meet.yml

@@ -34,6 +34,32 @@ jobs:
         if: always()
         run: ~/.local/bin/gitlint --commits origin/${{ github.event.pull_request.base.ref }}..HEAD
 
+  check-changelog:
+    runs-on: ubuntu-latest
+    if: |
+      contains(github.event.pull_request.labels.*.name, 'noChangeLog') == false &&
+      github.event_name == 'pull_request'
+    steps:
+      - name: Checkout repository
+        uses: actions/checkout@v4
+        with:
+          fetch-depth: 50
+      - name: Check that the CHANGELOG has been modified in the current branch
+        run: git diff --name-only ${{ github.event.pull_request.base.sha }} ${{ github.event.after }} | grep 'CHANGELOG.md'
+
+  lint-changelog:
+    runs-on: ubuntu-latest
+    steps:
+      - name: Checkout repository
+        uses: actions/checkout@v4
+      - name: Check CHANGELOG max line length
+        run: |
+          max_line_length=$(cat CHANGELOG.md | grep -Ev "^\[.*\]: https://github.com" | wc -L)
+          if [ $max_line_length -ge 80 ]; then
+            echo "ERROR: CHANGELOG has lines longer than 80 characters."
+            exit 1
+          fi
+
   build-mails:
     runs-on: ubuntu-latest
     defaults:
@@ -183,6 +209,10 @@ jobs:
       AWS_S3_ENDPOINT_URL: http://localhost:9000
       AWS_S3_ACCESS_KEY_ID: meet
       AWS_S3_SECRET_ACCESS_KEY: password
+      OIDC_RS_CLIENT_ID: meet
+      OIDC_RS_CLIENT_SECRET: ThisIsAnExampleKeyForDevPurposeOnly
+      OIDC_OP_INTROSPECTION_ENDPOINT: https://oidc.example.com/introspect
+      OIDC_OP_URL: https://oidc.example.com
 
     steps:
       - name: Checkout repository

CHANGELOG.md

@@ -1,4 +1,3 @@
-
 # Changelog
 
 All notable changes to this project will be documented in this file.
@@ -9,4 +8,18 @@ and this project adheres to
 
 ## [Unreleased]
 
-- 🔧(backend) support `_FILE` for secret environment variables #566 
+### Added 
+
+- ✨(backend) enable user creation via email for external integrations
+- ✨(summary) add Langfuse observability for LLM API calls
+
+## [1.0.1] - 2025-12-17
+
+### Changed
+
+- ♿(frontend) improve accessibility:
+- ♿️(frontend) hover controls, focus, SR #803
+- ♿️(frontend) change ptt keybinding from space to v #813
+- ♿(frontend) indicate external link opens in new window on feedback #816 
+- ♿(frontend) fix heading level in modal to maintain semantic hierarchy #815
+- ♿️(frontend) Improve focus management when opening and closing chat #807

bin/prepare-release.sh

@@ -0,0 +1,160 @@
+#!/bin/bash
+
+set -e  # Exit on error
+
+# Colors for output
+RED='\033[0;31m'
+GREEN='\033[0;32m'
+YELLOW='\033[1;33m'
+NC='\033[0m' # No Color
+
+# Function to print colored output
+print_info() {
+    echo -e "${GREEN}[INFO]${NC} $1"
+}
+
+print_error() {
+    echo -e "${RED}[ERROR]${NC} $1"
+}
+
+print_warning() {
+    echo -e "${YELLOW}[WARNING]${NC} $1"
+}
+
+
+# Function to update npm package version
+update_npm_version() {
+    local component=$1
+    print_info "Updating $component version..."
+    cd "src/$component"
+    npm version "$VERSION" --no-git-tag-version
+    cd -
+}
+
+# Function to update Python project version in pyproject.toml
+update_python_version() {
+    local component=$1
+    print_info "Updating $component version..."
+    cd "src/$component"
+
+    if [ ! -f "pyproject.toml" ]; then
+        print_error "pyproject.toml not found in src/$component!"
+        exit 1
+    fi
+
+    if grep -q '^version = "' pyproject.toml; then
+        sed -i.bak "s/^version = \".*\"/version = \"$VERSION\"/" pyproject.toml
+        rm pyproject.toml.bak
+        print_info "Updated pyproject.toml version to $VERSION"
+    else
+        print_error "Could not find version line in pyproject.toml"
+        exit 1
+    fi
+
+    cd -
+}
+
+# Check if we're in a git repository
+if ! git rev-parse --git-dir > /dev/null 2>&1; then
+    print_error "Not a git repository. Please run this script from the root of your project."
+    exit 1
+fi
+
+# Check if working directory is clean
+if ! git diff-index --quiet HEAD --; then
+    print_error "Working directory is not clean. Please commit or stash your changes first."
+    exit 1
+fi
+
+# Ask user for release version number
+echo ""
+read -p "Enter release version number (e.g., 1.2.3): " VERSION
+
+# Validate version format (basic semver check)
+if ! [[ $VERSION =~ ^[0-9]+\.[0-9]+\.[0-9]+$ ]]; then
+    print_error "Invalid version format. Please use semantic versioning (e.g., 1.2.3)"
+    exit 1
+fi
+
+print_info "Release version: $VERSION"
+
+# Check if branch already exists
+BRANCH_NAME="release/$VERSION"
+if git show-ref --verify --quiet "refs/heads/$BRANCH_NAME"; then
+    print_error "Branch $BRANCH_NAME already exists!"
+    exit 1
+fi
+
+# Create and checkout new branch
+print_info "Creating branch: $BRANCH_NAME"
+git checkout -b "$BRANCH_NAME"
+
+# Update frontend
+update_npm_version "frontend"
+
+# Update SDK
+update_npm_version "sdk"
+
+# Update mail
+update_npm_version "mail"
+
+# Update backend pyproject.toml
+update_python_version "backend"
+
+# Update summary pyproject.toml
+update_python_version "summary"
+
+# Update agents pyproject.toml
+update_python_version "agents"
+
+# Update CHANGELOG
+print_info "Updating CHANGELOG..."
+
+if [ ! -f "CHANGELOG.md" ]; then
+    print_error "CHANGELOG.md not found in project root!"
+    exit 1
+fi
+
+# Get current date in YYYY-MM-DD format
+CURRENT_DATE=$(date +%Y-%m-%d)
+
+# Replace [Unreleased] with [version number] - YYYY-MM-DD
+if grep -q '\[Unreleased\]' CHANGELOG.md; then
+    sed -i.bak "s/\[Unreleased\]/[$VERSION] - $CURRENT_DATE/" CHANGELOG.md
+
+    # Add new [Unreleased] section after the header
+    # This adds it after the line containing "Semantic Versioning"
+    sed -i.bak "/Semantic Versioning/a\\
+\\
+## [Unreleased]
+" CHANGELOG.md
+
+    rm CHANGELOG.md.bak
+    print_info "Updated CHANGELOG.md"
+else
+    print_warning "Could not find [Unreleased] section in CHANGELOG.md"
+fi
+
+
+
+# Summary
+echo ""
+print_info "Release preparation complete!"
+echo ""
+echo "Summary:"
+echo "  - Branch created: $BRANCH_NAME"
+echo "  - Version updated to: $VERSION"
+echo "  - Files modified:"
+echo "      - src/frontend/package.json"
+echo "      - src/sdk/package.json"
+echo "      - src/mail/package.json"
+echo "      - src/backend/pyproject.toml"
+echo "      - src/summary/pyproject.toml"
+echo "      - src/agents/pyproject.toml"
+echo "      - CHANGELOG.md"
+echo ""
+print_warning "Next steps:"
+echo "  1. Review the changes: git status"
+echo "  2. Commit the changes: git add . && git commit -m 'Release $VERSION'"
+echo "  3. Push the branch: git push origin $BRANCH_NAME"
+echo ""

compose.yml

@@ -90,6 +90,9 @@ services:
         - createwebhook
     extra_hosts:
       - "127.0.0.1.nip.io:host-gateway"
+    networks:
+      - resource-server
+      - default
   
   celery-dev:
     user: ${DOCKER_USER:-1000}
@@ -145,6 +148,9 @@ services:
       - ./docker/files/etc/nginx/conf.d:/etc/nginx/conf.d:ro
     depends_on:
       - keycloak
+    networks:
+      - resource-server
+      - default
 
   frontend:
     user: "${DOCKER_USER:-1000}"
@@ -298,3 +304,7 @@ services:
       watch:
         - action: rebuild
           path: ./src/summary
+
+networks:
+  default:
+  resource-server:

docker/dinum-frontend/Dockerfile

@@ -42,7 +42,12 @@ COPY ./docker/dinum-frontend/fonts/ \
 FROM nginxinc/nginx-unprivileged:alpine3.21 AS frontend-production
 
 USER root
-RUN apk update && apk upgrade libssl3 libcrypto3 libxml2>=2.12.7-r2 libxslt>=1.1.39-r2 libexpat>=2.7.2-r0
+RUN apk update && apk upgrade libssl3 \
+    libcrypto3 \
+    libxml2>=2.12.7-r2 \
+    libxslt>=1.1.39-r2 \
+    libexpat>=2.7.2-r0 \
+    libpng>=1.6.53-r0
 
 USER nginx
 

docker/resource-server/compose.yml

@@ -0,0 +1,23 @@
+version: '3'
+
+# You can add any necessary service here that will join the same docker network
+# sharing keycloak. Services added to the 'meet_resource-server' network will be
+# able to communicate with keycloak and the backend on that network.
+services:
+  # busybox service is only used for testing purposes. It provides curl to test
+  # connectivity to the backend and keycloak services. Replace this with your
+  # relevant application services that need to communicate with keycloak.
+  busybox:
+    image: alpine:latest
+    privileged: true
+    command: sh -c "apk add --no-cache curl && sleep infinity"
+    stdin_open: true
+    tty: true
+    networks:
+      - default
+      - meet_resource-server
+
+networks:
+  default: {}
+  meet_resource-server:
+    external: true

docs/openapi.yaml

@@ -7,7 +7,7 @@ info:
     
     #### Authentication Flow
     
-    1. Exchange application credentials for a JWT token via `/external-api/v1.0/application/token`.
+    1. Exchange application credentials for a JWT token via `/external-api/v1.0/application/token/`.
     2. Use the JWT token in the `Authorization: Bearer <token>` header for all subsequent requests.
     3. Tokens are scoped and allow applications to act on behalf of specific users.
     
@@ -21,7 +21,6 @@ info:
     
     #### Upcoming Features
     
-    * **Create rooms for unknown users from the web app:** Support for generating rooms for users who are not yet registered in the system.
     * **Add attendees to a room:** You will be able to update a room to include a list of attendees, allowing them to bypass the lobby system automatically.
     * **Delete application-generated rooms:** Rooms created via the application can be deleted when no longer needed.
 
@@ -40,7 +39,7 @@ tags:
     description: Room management operations
 
 paths:
-  /application/token:
+  /application/token/:
     post:
       tags:
         - Authentication
@@ -283,7 +282,7 @@ components:
       scheme: bearer
       bearerFormat: JWT
       description: |
-        JWT token obtained from the `/application/token` endpoint.
+        JWT token obtained from the `/application/token/` endpoint.
         Include in requests as: `Authorization: Bearer <token>`
 
   schemas:

docs/resource_server.yaml

@@ -0,0 +1,393 @@
+openapi: 3.0.3
+info:
+  title: Meet External API
+  version: 1.0.0
+  description: |
+    External API for room management with resource server authentication.
+    [[description by Oauth 2.0]](https://www.oauth.com/oauth2-servers/the-resource-server/)
+    
+    #### Authentication Flow
+    
+    1. Authenticate with the authorization server using your credentials
+    2. During authentication, request the scopes you need: `lasuite_visio` (mandatory) plus action-specific scopes
+    3. Receive an access token and a refresh token that includes the requested scopes
+    4. Use the access token in the `Authorization: Bearer <token>` header for all API requests
+    5. When the access token expires, use the refresh token to obtain a new access token without re-authenticating
+    
+    #### Scopes
+    
+    * `lasuite_visio` - **Mandatory** Base scope required for any API access
+    * `lasuite_visio:rooms:list` – List rooms accessible to the delegated user.
+    * `lasuite_visio:rooms:retrieve` – Retrieve details of a specific room.
+    * `lasuite_visio:rooms:create` – Create new rooms.
+    * `lasuite_visio:rooms:update` – **Coming soon** Update existing rooms, e.g., add attendees to a room.
+    * `lasuite_visio:rooms:delete` – **Coming soon** Delete rooms generated by the application.
+    
+    #### Upcoming Features
+    
+    * **Add attendees to a room:** You will be able to update a room to include a list of attendees, allowing them to bypass the lobby system automatically.
+    * **Delete application-generated rooms:** Rooms created via the application can be deleted when no longer needed.
+
+  contact:
+    name: API Support
+    email: antoine.lebaud@mail.numerique.gouv.fr
+
+servers:
+  - url: https://visio-sandbox.beta.numerique.gouv.fr/external-api/v1.0
+    description: Sandbox server
+
+tags:
+  - name: Rooms
+    description: Room management operations
+
+paths:
+  /rooms:
+    get:
+      tags:
+        - Rooms
+      summary: List rooms
+      description: |
+        Returns a list of rooms accessible to the authenticated user.
+        Only rooms where the delegated user has access will be returned.
+      operationId: listRooms
+      security:
+        - BearerAuth: [rooms:list]
+      parameters:
+        - name: page
+          in: query
+          description: Page number for pagination
+          schema:
+            type: integer
+            minimum: 1
+            default: 1
+        - name: page_size
+          in: query
+          description: Number of items per page
+          schema:
+            type: integer
+            minimum: 1
+            maximum: 100
+            default: 20
+      responses:
+        '200':
+          description: List of accessible rooms
+          content:
+            application/json:
+              schema:
+                type: object
+                properties:
+                  count:
+                    type: integer
+                    description: Total number of rooms
+                  next:
+                    type: string
+                    nullable: true
+                    description: URL to next page
+                  previous:
+                    type: string
+                    nullable: true
+                    description: URL to previous page
+                  results:
+                    type: array
+                    items:
+                      $ref: '#/components/schemas/Room'
+              examples:
+                roomList:
+                  summary: Paginated room list
+                  value:
+                    count: 2
+                    next: "https://visio-sandbox.beta.numerique.gouv.fr/external-api/v1.0/rooms?page=2"
+                    previous: null
+                    results:
+                      - id: "7c9e6679-7425-40de-944b-e07fc1f90ae7"
+                        slug: "aae-erez-aaz"
+                        access_level: "trusted"
+                        url: "https://visio-sandbox.beta.numerique.gouv.fr/aae-erez-aaz"
+                        telephony:
+                          enabled: true
+                          pin_code: "123456"
+                          phone_number: "+1-555-0100"
+                          default_country: "US"
+        '401':
+          $ref: '#/components/responses/UnauthorizedError'
+        '403':
+          $ref: '#/components/responses/ForbiddenError'
+
+    post:
+      tags:
+        - Rooms
+      summary: Create a room
+      description: |
+        Creates a new room with secure defaults for external API usage.
+        
+        **Restrictions:**
+        - Rooms are always created with `trusted` access (no public rooms via API)
+        - Room access_level can be updated from the webapp interface.
+        
+        **Defaults:**
+        - Delegated user is set as owner
+        - Room slug auto-generated for uniqueness
+        - Telephony PIN auto-generated when enabled
+        - Creation tracked with application client_id for auditing
+      operationId: createRoom
+      security:
+        - BearerAuth: [rooms:create]
+      requestBody:
+        required: false
+        content:
+          application/json:
+            schema:
+              $ref: '#/components/schemas/RoomCreate'
+            examples:
+              emptyBody:
+                summary: No parameters (default)
+                value: {}
+      responses:
+        '201':
+          description: Room created successfully
+          content:
+            application/json:
+              schema:
+                $ref: '#/components/schemas/Room'
+        '401':
+          $ref: '#/components/responses/UnauthorizedError'
+        '403':
+          $ref: '#/components/responses/ForbiddenError'
+
+  /rooms/{id}:
+    get:
+      tags:
+        - Rooms
+      summary: Retrieve a room
+      description: Get detailed information about a specific room by its ID
+      operationId: retrieveRoom
+      security:
+        - BearerAuth: [rooms:retrieve]
+      parameters:
+        - name: id
+          in: path
+          required: true
+          description: Room UUID
+          schema:
+            type: string
+            format: uuid
+      responses:
+        '200':
+          description: Room details
+          content:
+            application/json:
+              schema:
+                $ref: '#/components/schemas/Room'
+              examples:
+                room:
+                  summary: Room details
+                  value:
+                    id: "7c9e6679-7425-40de-944b-e07fc1f90ae7"
+                    slug: "aae-erez-aaz"
+                    access_level: "trusted"
+                    url: "https://visio-sandbox.beta.numerique.gouv.fr/aae-erez-aaz"
+                    telephony:
+                      enabled: true
+                      pin_code: "123456"
+                      phone_number: "+1-555-0100"
+                      default_country: "US"
+        '401':
+          $ref: '#/components/responses/UnauthorizedError'
+        '403':
+          $ref: '#/components/responses/ForbiddenError'
+        '404':
+          $ref: '#/components/responses/RoomNotFoundError'
+
+components:
+  securitySchemes:
+    BearerAuth:
+      type: http
+      scheme: bearer
+      bearerFormat: JWT
+      description: |
+        JWT token obtained from the `/application/token` endpoint.
+        Include in requests as: `Authorization: Bearer <token>`
+
+  schemas:
+    TokenRequest:
+      type: object
+      required:
+        - client_id
+        - client_secret
+        - grant_type
+        - scope
+      properties:
+        client_id:
+          type: string
+          description: Application client identifier
+          example: "550e8400-e29b-41d4-a716-446655440000"
+        client_secret:
+          type: string
+          format: password
+          writeOnly: true
+          description: Application secret key
+          example: "1234567890abcdefghijklmnopqrstuvwxyz"
+        grant_type:
+          type: string
+          enum:
+            - client_credentials
+          description: OAuth2 grant type (must be 'client_credentials')
+          example: "client_credentials"
+        scope:
+          type: string
+          format: email
+          description: |
+            Email address of the user to delegate.
+            The application will act on behalf of this user.
+            Note: This parameter is named 'scope' to align with OAuth2 conventions,
+            but accepts an email address to identify the user. This design allows
+            for future extensibility.
+          example: "user@example.com"
+
+    TokenResponse:
+      type: object
+      properties:
+        access_token:
+          type: string
+          description: JWT access token
+          example: "eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJpc3MiOiJtZWV0LWFwaSIsImF1ZCI6Im1lZXQtY2xpZW50cyIsImlhdCI6MTcwOTQ5MTIwMCwiZXhwIjoxNzA5NDk0ODAwLCJjbGllbnRfaWQiOiI1NTBlODQwMC1lMjliLTQxZDQtYTcxNi00NDY2NTU0NDAwMDAiLCJzY29wZSI6InJvb21zOmxpc3Qgcm9vbXM6cmV0cmlldmUgcm9vbXM6Y3JlYXRlIiwidXNlcl9pZCI6IjdiOGQ5YzQwLTNhMmItNGVkZi04NzFjLTJmM2Q0ZTVmNmE3YiIsImRlbGVnYXRlZCI6dHJ1ZX0.signature"
+        token_type:
+          type: string
+          description: Token type (always 'Bearer')
+          example: "Bearer"
+        expires_in:
+          type: integer
+          description: Token lifetime in seconds
+          example: 3600
+        scope:
+          type: string
+          description: Space-separated list of granted permission scopes
+          example: "rooms:list rooms:retrieve rooms:create"
+
+    RoomCreate:
+      type: object
+      description: Empty object - all room properties are auto-generated
+      properties: {}
+
+    Room:
+      type: object
+      properties:
+        id:
+          type: string
+          format: uuid
+          readOnly: true
+          description: Unique room identifier
+          example: "7c9e6679-7425-40de-944b-e07fc1f90ae7"
+        slug:
+          type: string
+          readOnly: true
+          description: URL-friendly room identifier (auto-generated)
+          example: "aze-eere-zer"
+        access_level:
+          type: string
+          readOnly: true
+          description: Room access level (always 'trusted' for API-created rooms)
+          example: "trusted"
+        url:
+          type: string
+          format: uri
+          readOnly: true
+          description: Full URL to access the room
+          example: "https://visio-sandbox.beta.numerique.gouv.fr/aze-eere-zer"
+        telephony:
+          type: object
+          readOnly: true
+          description: Telephony dial-in information (if enabled)
+          properties:
+            enabled:
+              type: boolean
+              description: Whether telephony is available
+              example: true
+            pin_code:
+              type: string
+              description: PIN code for dial-in access
+              example: "123456"
+            phone_number:
+              type: string
+              description: Phone number to dial
+              example: "+1-555-0100"
+            default_country:
+              type: string
+              description: Default country code
+              example: "US"
+
+    OAuthError:
+      type: object
+      description: OAuth2-compliant error response
+      properties:
+        error:
+          type: string
+          description: Human-readable error description
+          example: "Invalid credentials"
+
+    Error:
+      type: object
+      properties:
+        detail:
+          type: string
+          description: Error message
+          example: "Invalid token."
+
+    ValidationError:
+      type: object
+      properties:
+        field_name:
+          type: array
+          items:
+            type: string
+          description: List of validation errors for this field
+          example: ["This field is required."]
+
+  responses:
+    UnauthorizedError:
+      description: The access token is expired, revoked, malformed, or invalid for other reasons. The client can obtain a new access token and try again.
+      content:
+        application/json:
+          schema:
+            $ref: '#/components/schemas/Error'
+          examples:
+            invalidToken:
+              summary: Invalid token
+              value:
+                error: "Invalid token."
+
+    ForbiddenError:
+      description: Insufficient scope for this operation
+      content:
+        application/json:
+          schema:
+            $ref: '#/components/schemas/Error'
+          examples:
+            insufficientScope:
+              summary: Missing required scope
+              value:
+                detail: "Insufficient permissions. Required scope: 'rooms:xxxx'"
+
+    RoomNotFoundError:
+      description: Room not found
+      content:
+        application/json:
+          schema:
+            $ref: '#/components/schemas/Error'
+          examples:
+            roomNotFound:
+              summary: Room does not exist
+              value:
+                detail: "Not found."
+
+    BadRequestError:
+      description: Invalid request data
+      content:
+        application/json:
+          schema:
+            $ref: '#/components/schemas/ValidationError'
+          examples:
+            validationError:
+              summary: Field validation failed
+              value:
+                scope: ["Invalid email address."]

env.d/development/common.dist

@@ -32,6 +32,8 @@ OIDC_OP_JWKS_ENDPOINT=http://nginx:8083/realms/meet/protocol/openid-connect/cert
 OIDC_OP_AUTHORIZATION_ENDPOINT=http://localhost:8083/realms/meet/protocol/openid-connect/auth
 OIDC_OP_TOKEN_ENDPOINT=http://nginx:8083/realms/meet/protocol/openid-connect/token
 OIDC_OP_USER_ENDPOINT=http://nginx:8083/realms/meet/protocol/openid-connect/userinfo
+OIDC_OP_INTROSPECTION_ENDPOINT=http://nginx:8083/realms/meet/protocol/openid-connect/token/introspect
+OIDC_OP_URL=http://localhost:8083/realms/meet
 
 OIDC_RP_CLIENT_ID=meet
 OIDC_RP_CLIENT_SECRET=ThisIsAnExampleKeyForDevPurposeOnly
@@ -45,6 +47,9 @@ LOGOUT_REDIRECT_URL=http://localhost:3000
 OIDC_REDIRECT_ALLOWED_HOSTS=localhost:8083,localhost:3000
 OIDC_AUTH_REQUEST_EXTRA_PARAMS={"acr_values": "eidas1"}
 
+OIDC_RS_CLIENT_ID=meet
+OIDC_RS_CLIENT_SECRET=ThisIsAnExampleKeyForDevPurposeOnly
+
 # Livekit Token settings
 LIVEKIT_API_SECRET=secret
 LIVEKIT_API_KEY=devkey

src/agents/pyproject.toml

@@ -1,7 +1,7 @@
 
 [project]
 name = "agents"
-version = "0.1.42"
+version = "1.0.1"
 requires-python = ">=3.12"
 dependencies = [
     "livekit-agents==1.2.18",

src/backend/core/api/serializers.py

@@ -159,6 +159,8 @@ class RoomSerializer(serializers.ModelSerializer):
                 configuration=configuration,
                 is_admin_or_owner=is_admin_or_owner,
             )
+        else:
+            del output["pin_code"]
 
         output["is_administrable"] = is_admin_or_owner
 

src/backend/core/external_api/authentication.py

@@ -4,8 +4,10 @@ import logging
 
 from django.conf import settings
 from django.contrib.auth import get_user_model
+from django.core.exceptions import SuspiciousOperation
 
-import jwt
+import jwt as pyJwt
+from lasuite.oidc_resource_server.backend import ResourceServerBackend as LaSuiteBackend
 from rest_framework import authentication, exceptions
 
 User = get_user_model()
@@ -25,9 +27,11 @@ class ApplicationJWTAuthentication(authentication.BaseAuthentication):
         Returns:
             Tuple of (user, payload) if authentication successful, None otherwise
         """
+
         auth_header = authentication.get_authorization_header(request).split()
 
         if not auth_header or auth_header[0].lower() != b"bearer":
+            # Defer to next authentication backend
             return None
 
         if len(auth_header) != 2:
@@ -45,6 +49,8 @@ class ApplicationJWTAuthentication(authentication.BaseAuthentication):
     def authenticate_credentials(self, token):
         """Validate JWT token and return authenticated user.
 
+        If token is invalid, defer to next authentication backend.
+
         Args:
             token: JWT token string
 
@@ -52,29 +58,29 @@ class ApplicationJWTAuthentication(authentication.BaseAuthentication):
             Tuple of (user, payload)
 
         Raises:
-            AuthenticationFailed: If token is invalid, expired, or user not found
+            AuthenticationFailed: If token is expired, or user not found
         """
         # Decode and validate JWT
         try:
-            payload = jwt.decode(
+            payload = pyJwt.decode(
                 token,
                 settings.APPLICATION_JWT_SECRET_KEY,
                 algorithms=[settings.APPLICATION_JWT_ALG],
                 issuer=settings.APPLICATION_JWT_ISSUER,
                 audience=settings.APPLICATION_JWT_AUDIENCE,
             )
-        except jwt.ExpiredSignatureError as e:
+        except pyJwt.ExpiredSignatureError as e:
             logger.warning("Token expired")
             raise exceptions.AuthenticationFailed("Token expired.") from e
-        except jwt.InvalidIssuerError as e:
+        except pyJwt.InvalidIssuerError as e:
             logger.warning("Invalid JWT issuer: %s", e)
             raise exceptions.AuthenticationFailed("Invalid token.") from e
-        except jwt.InvalidAudienceError as e:
+        except pyJwt.InvalidAudienceError as e:
             logger.warning("Invalid JWT audience: %s", e)
             raise exceptions.AuthenticationFailed("Invalid token.") from e
-        except jwt.InvalidTokenError as e:
-            logger.warning("Invalid JWT token: %s", e)
-            raise exceptions.AuthenticationFailed("Invalid token.") from e
+        except pyJwt.InvalidTokenError:
+            # Invalid JWT token - defer to next authentication backend
+            return None
 
         user_id = payload.get("user_id")
         client_id = payload.get("client_id")
@@ -107,3 +113,55 @@ class ApplicationJWTAuthentication(authentication.BaseAuthentication):
     def authenticate_header(self, request):
         """Return authentication scheme for WWW-Authenticate header."""
         return "Bearer"
+
+
+class ResourceServerBackend(LaSuiteBackend):
+    """OIDC Resource Server backend for user creation and retrieval."""
+
+    def get_or_create_user(self, access_token, id_token, payload):
+        """Get or create user from OIDC token claims.
+
+        Despite the LaSuiteBackend's method name suggesting "get_or_create",
+        its implementation only performs a GET operation.
+        Create new user from the sub claim.
+
+        Args:
+            access_token: The access token string
+            id_token: The ID token string (unused)
+            payload: Token payload dict (unused)
+
+        Returns:
+            User instance
+
+        Raises:
+            SuspiciousOperation: If user info validation fails
+        """
+
+        sub = payload.get("sub")
+
+        if sub is None:
+            message = "User info contained no recognizable user identification"
+            logger.debug(message)
+            raise SuspiciousOperation(message)
+
+        user = self.get_user(access_token, id_token, payload)
+
+        if user is None and settings.OIDC_CREATE_USER:
+            user = self.create_user(sub)
+
+        return user
+
+    def create_user(self, sub):
+        """Create new user from subject claim.
+
+        Args:
+            sub: Subject identifier from token
+
+        Returns:
+            Newly created User instance
+        """
+        user = self.UserModel(sub=sub)
+        user.set_unusable_password()
+        user.save()
+
+        return user

src/backend/core/external_api/permissions.py

@@ -3,6 +3,8 @@
 import logging
 from typing import Dict
 
+from django.conf import settings
+
 from rest_framework import exceptions, permissions
 
 from .. import models
@@ -55,6 +57,12 @@ class BaseScopePermission(permissions.BasePermission):
         if isinstance(token_scopes, str):
             token_scopes = token_scopes.split()
 
+        if settings.OIDC_RS_SCOPES_PREFIX:
+            token_scopes = [
+                scope.replace(f"{settings.OIDC_RS_SCOPES_PREFIX}:", "")
+                for scope in token_scopes
+            ]
+
         if required_scope not in token_scopes:
             raise exceptions.PermissionDenied(
                 f"Insufficient permissions. Required scope: {required_scope}"

src/backend/core/external_api/viewsets.py

@@ -9,6 +9,7 @@ from django.core.exceptions import ValidationError
 from django.core.validators import validate_email
 
 import jwt
+from lasuite.oidc_resource_server.authentication import ResourceServerAuthentication
 from rest_framework import decorators, mixins, viewsets
 from rest_framework import (
     exceptions as drf_exceptions,
@@ -94,11 +95,34 @@ class ApplicationViewSet(viewsets.GenericViewSet):
         try:
             user = models.User.objects.get(email=email)
         except models.User.DoesNotExist as e:
-            raise drf_exceptions.NotFound(
-                {
-                    "error": "User not found.",
-                }
-            ) from e
+            if (
+                settings.APPLICATION_ALLOW_USER_CREATION
+                and settings.OIDC_FALLBACK_TO_EMAIL_FOR_IDENTIFICATION
+                and not settings.OIDC_USER_SUB_FIELD_IMMUTABLE
+            ):
+                # Create a provisional user without `sub`, identified by email only.
+                #
+                # This relies on Django LaSuite implicitly updating the `sub` field on the
+                # user's first successful OIDC authentication. If this stops working,
+                # check for behavior changes in Django LaSuite.
+                #
+                # `OIDC_USER_SUB_FIELD_IMMUTABLE` comes from Django LaSuite and prevents `sub`
+                # updates. We override its default value to allow setting `sub` for
+                # provisional users.
+                user = models.User(
+                    sub=None,
+                    email=email,
+                )
+                user.set_unusable_password()
+                user.save()
+                logger.info(
+                    "Provisional user created via application: user_id=%s, email=%s, client_id=%s",
+                    user.id,
+                    email,
+                    application.client_id,
+                )
+            else:
+                raise drf_exceptions.NotFound("User not found.") from e
 
         now = datetime.now(timezone.utc)
         scope = " ".join(application.scopes or [])
@@ -149,7 +173,10 @@ class RoomViewSet(
     - create: Create a new room owned by the user (requires 'rooms:create' scope)
     """
 
-    authentication_classes = [authentication.ApplicationJWTAuthentication]
+    authentication_classes = [
+        authentication.ApplicationJWTAuthentication,
+        ResourceServerAuthentication,
+    ]
     permission_classes = [
         api.permissions.IsAuthenticated & permissions.HasRequiredRoomScope
     ]

src/backend/core/migrations/0001_initial.py

@@ -41,7 +41,7 @@ class Migration(migrations.Migration):
                 ('id', models.UUIDField(default=uuid.uuid4, editable=False, help_text='primary key for the record as UUID', primary_key=True, serialize=False, verbose_name='id')),
                 ('created_at', models.DateTimeField(auto_now_add=True, help_text='date and time at which a record was created', verbose_name='created on')),
                 ('updated_at', models.DateTimeField(auto_now=True, help_text='date and time at which a record was last updated', verbose_name='updated on')),
-                ('sub', models.CharField(blank=True, help_text='Required. 255 characters or fewer. Letters, numbers, and @/./+/-/_ characters only.', max_length=255, null=True, unique=True, validators=[django.core.validators.RegexValidator(message='Enter a valid sub. This value may contain only letters, numbers, and @/./+/-/_ characters.', regex='^[\\w.@+-]+\\Z')], verbose_name='sub')),
+                ('sub', models.CharField(blank=True, help_text='Optional for pending users; required upon account activation. 255 characters or fewer. Letters, numbers, and @/./+/-/_ characters only.', max_length=255, null=True, unique=True, validators=[django.core.validators.RegexValidator(message='Enter a valid sub. This value may contain only letters, numbers, and @/./+/-/_ characters.', regex='^[\\w.@+-]+\\Z')], verbose_name='sub')),
                 ('email', models.EmailField(blank=True, max_length=254, null=True, verbose_name='identity email address')),
                 ('admin_email', models.EmailField(blank=True, max_length=254, null=True, unique=True, verbose_name='admin email address')),
                 ('language', models.CharField(choices="(('en-us', 'English'), ('fr-fr', 'French'))", default='en-us', help_text='The language in which the user wants to see the interface.', max_length=10, verbose_name='language')),

src/backend/core/models.py

@@ -146,7 +146,8 @@ class User(AbstractBaseUser, BaseModel, auth_models.PermissionsMixin):
     sub = models.CharField(
         _("sub"),
         help_text=_(
-            "Required. 255 characters or fewer. Letters, numbers, and @/./+/-/_ characters only."
+            "Optional for pending users; required upon account activation. "
+            "255 characters or fewer. Letters, numbers, and @/./+/-/_ characters only."
         ),
         max_length=255,
         unique=True,

src/backend/core/tests/rooms/test_api_rooms_retrieve.py

@@ -32,7 +32,6 @@ def test_api_rooms_retrieve_anonymous_private_pk():
         "id": str(room.id),
         "is_administrable": False,
         "name": room.name,
-        "pin_code": room.pin_code,
         "slug": room.slug,
     }
 
@@ -52,7 +51,6 @@ def test_api_rooms_retrieve_anonymous_trusted_pk():
         "id": str(room.id),
         "is_administrable": False,
         "name": room.name,
-        "pin_code": room.pin_code,
         "slug": room.slug,
     }
 
@@ -71,7 +69,6 @@ def test_api_rooms_retrieve_anonymous_private_pk_no_dashes():
         "id": str(room.id),
         "is_administrable": False,
         "name": room.name,
-        "pin_code": room.pin_code,
         "slug": room.slug,
     }
 
@@ -88,7 +85,6 @@ def test_api_rooms_retrieve_anonymous_private_slug():
         "id": str(room.id),
         "is_administrable": False,
         "name": room.name,
-        "pin_code": room.pin_code,
         "slug": room.slug,
     }
 
@@ -105,7 +101,6 @@ def test_api_rooms_retrieve_anonymous_private_slug_not_normalized():
         "id": str(room.id),
         "is_administrable": False,
         "name": room.name,
-        "pin_code": room.pin_code,
         "slug": room.slug,
     }
 
@@ -347,7 +342,6 @@ def test_api_rooms_retrieve_authenticated():
         "id": str(room.id),
         "is_administrable": False,
         "name": room.name,
-        "pin_code": room.pin_code,
         "slug": room.slug,
     }
 

src/backend/core/tests/test_external_api_rooms.py

@@ -10,13 +10,14 @@ from django.conf import settings
 
 import jwt
 import pytest
+import responses
 from rest_framework.test import APIClient
 
 from core.factories import (
     RoomFactory,
     UserFactory,
 )
-from core.models import ApplicationScope, RoleChoices, Room
+from core.models import ApplicationScope, RoleChoices, Room, RoomAccessLevel, User
 
 pytestmark = pytest.mark.django_db
 
@@ -90,13 +91,29 @@ def test_api_rooms_list_with_expired_token(settings):
     assert "expired" in str(response.data).lower()
 
 
-def test_api_rooms_list_with_invalid_token():
-    """Listing rooms with invalid token should return 401."""
+@responses.activate
+def test_api_rooms_list_with_invalid_token(settings):
+    """Listing rooms with invalid token should return 400."""
+
+    settings.OIDC_OP_INTROSPECTION_ENDPOINT = "https://oidc.example.com/introspect"
+    settings.OIDC_OP_URL = "https://oidc.example.com"
+
+    responses.add(
+        responses.POST,
+        "https://oidc.example.com/introspect",
+        json={
+            "iss": "https://oidc.example.com",
+            "active": False,
+        },
+    )
+
     client = APIClient()
     client.credentials(HTTP_AUTHORIZATION="Bearer invalid-token-123")
     response = client.get("/external-api/v1.0/rooms/")
 
-    assert response.status_code == 401
+    # Return 400 instead of 401 because ResourceServerAuthentication raises
+    # SuspiciousOperation when the introspected user is not active
+    assert response.status_code == 400
 
 
 def test_api_rooms_list_missing_scope(settings):
@@ -332,3 +349,221 @@ def test_api_rooms_token_missing_client_id(settings):
 
     assert response.status_code == 401
     assert "Invalid token claims." in str(response.data)
+
+
+@responses.activate
+def test_resource_server_creates_user_on_first_authentication(settings):
+    """New user should be created during first authentication.
+
+    Verifies that the ResourceServerBackend.get_or_create_user() creates a user
+    in the database when authenticating with a token from an unknown subject (sub).
+    This tests the user creation workflow during the OIDC introspection process.
+    """
+
+    with pytest.raises(
+        User.DoesNotExist,
+        match="User matching query does not exist.",
+    ):
+        User.objects.get(sub="very-specific-sub")
+
+    assert (
+        settings.OIDC_RS_BACKEND_CLASS
+        == "core.external_api.authentication.ResourceServerBackend"
+    )
+
+    settings.OIDC_RS_CLIENT_ID = "some_client_id"
+    settings.OIDC_RS_CLIENT_SECRET = "some_client_secret"
+    settings.OIDC_RS_SCOPES_PREFIX = "lasuite_meet"
+
+    settings.OIDC_OP_URL = "https://oidc.example.com"
+    settings.OIDC_VERIFY_SSL = False
+    settings.OIDC_TIMEOUT = 5
+    settings.OIDC_PROXY = None
+    settings.OIDC_OP_JWKS_ENDPOINT = "https://oidc.example.com/jwks"
+    settings.OIDC_OP_INTROSPECTION_ENDPOINT = "https://oidc.example.com/introspect"
+
+    responses.add(
+        responses.POST,
+        "https://oidc.example.com/introspect",
+        json={
+            "iss": "https://oidc.example.com",
+            "aud": "some_client_id",  # settings.OIDC_RS_CLIENT_ID
+            "sub": "very-specific-sub",
+            "client_id": "some_service_provider",
+            "scope": "openid lasuite_meet lasuite_meet:rooms:list",
+            "active": True,
+        },
+    )
+
+    client = APIClient()
+    client.credentials(HTTP_AUTHORIZATION="Bearer some_token")
+    response = client.get("/external-api/v1.0/rooms/")
+
+    assert response.status_code == 200
+
+    results = response.json()["results"]
+    assert len(results) == 0
+
+    db_user = User.objects.get(sub="very-specific-sub")
+    assert db_user is not None
+    assert db_user.email is None
+
+
+@responses.activate
+def test_resource_server_skips_user_creation_when_auto_creation_disabled(settings):
+    """Verify that ResourceServerBackend respects the user auto-creation setting.
+
+    This ensures that the OIDC introspection process respects the configuration flag
+    that controls whether new users should be automatically provisioned during
+    authentication, preventing unwanted user proliferation when auto-creation is
+    explicitly disabled.
+    """
+
+    settings.OIDC_CREATE_USER = False
+
+    with pytest.raises(
+        User.DoesNotExist,
+        match="User matching query does not exist.",
+    ):
+        User.objects.get(sub="very-specific-sub")
+
+    assert (
+        settings.OIDC_RS_BACKEND_CLASS
+        == "core.external_api.authentication.ResourceServerBackend"
+    )
+
+    settings.OIDC_RS_CLIENT_ID = "some_client_id"
+    settings.OIDC_RS_CLIENT_SECRET = "some_client_secret"
+
+    settings.OIDC_OP_URL = "https://oidc.example.com"
+    settings.OIDC_VERIFY_SSL = False
+    settings.OIDC_TIMEOUT = 5
+    settings.OIDC_PROXY = None
+    settings.OIDC_OP_JWKS_ENDPOINT = "https://oidc.example.com/jwks"
+    settings.OIDC_OP_INTROSPECTION_ENDPOINT = "https://oidc.example.com/introspect"
+
+    responses.add(
+        responses.POST,
+        "https://oidc.example.com/introspect",
+        json={
+            "iss": "https://oidc.example.com",
+            "aud": "some_client_id",  # settings.OIDC_RS_CLIENT_ID
+            "sub": "very-specific-sub",
+            "client_id": "some_service_provider",
+            "scope": "openid lasuite_meet rooms:list",
+            "active": True,
+        },
+    )
+
+    client = APIClient()
+    client.credentials(HTTP_AUTHORIZATION="Bearer some_token")
+    response = client.get("/external-api/v1.0/rooms/")
+
+    assert response.status_code == 401
+
+
+@responses.activate
+def test_resource_server_authentication_successful(settings):
+    """Authenticated requests should be processed and user-specific data is returned.
+
+    Verifies that once a user is authenticated via OIDC token introspection,
+    the API correctly identifies the user and returns only data accessible to that user
+    (e.g., rooms with appropriate access levels).
+    """
+
+    user = UserFactory(sub="very-specific-sub")
+
+    other_user = UserFactory()
+
+    RoomFactory(access_level=RoomAccessLevel.PUBLIC)
+    RoomFactory(access_level=RoomAccessLevel.TRUSTED)
+    RoomFactory(access_level=RoomAccessLevel.RESTRICTED)
+    room_user_accesses = RoomFactory(
+        access_level=RoomAccessLevel.RESTRICTED, users=[user]
+    )
+    RoomFactory(access_level=RoomAccessLevel.RESTRICTED, users=[other_user])
+
+    assert (
+        settings.OIDC_RS_BACKEND_CLASS
+        == "core.external_api.authentication.ResourceServerBackend"
+    )
+
+    settings.OIDC_RS_CLIENT_ID = "some_client_id"
+    settings.OIDC_RS_CLIENT_SECRET = "some_client_secret"
+    settings.OIDC_RS_SCOPES_PREFIX = "lasuite_meet"
+
+    settings.OIDC_OP_URL = "https://oidc.example.com"
+    settings.OIDC_VERIFY_SSL = False
+    settings.OIDC_TIMEOUT = 5
+    settings.OIDC_PROXY = None
+    settings.OIDC_OP_JWKS_ENDPOINT = "https://oidc.example.com/jwks"
+    settings.OIDC_OP_INTROSPECTION_ENDPOINT = "https://oidc.example.com/introspect"
+
+    responses.add(
+        responses.POST,
+        "https://oidc.example.com/introspect",
+        json={
+            "iss": "https://oidc.example.com",
+            "aud": "some_client_id",  # settings.OIDC_RS_CLIENT_ID
+            "sub": "very-specific-sub",
+            "client_id": "some_service_provider",
+            "scope": "openid lasuite_meet lasuite_meet:rooms:list",
+            "active": True,
+        },
+    )
+
+    client = APIClient()
+    client.credentials(HTTP_AUTHORIZATION="Bearer some_token")
+    response = client.get("/external-api/v1.0/rooms/")
+
+    assert response.status_code == 200
+    results = response.json()["results"]
+    assert len(results) == 1
+    expected_ids = {
+        str(room_user_accesses.id),
+    }
+    results_id = {result["id"] for result in results}
+    assert expected_ids == results_id
+
+
+@responses.activate
+def test_resource_server_denies_access_with_insufficient_scopes(settings):
+    """Requests should be denied when the token lacks required scopes.
+
+    Verifies that the ResourceServerBackend validates token scopes during introspection
+    and returns 403 Forbidden when the token is missing required scopes for the endpoint.
+    """
+
+    assert (
+        settings.OIDC_RS_BACKEND_CLASS
+        == "core.external_api.authentication.ResourceServerBackend"
+    )
+
+    settings.OIDC_RS_CLIENT_ID = "some_client_id"
+    settings.OIDC_RS_CLIENT_SECRET = "some_client_secret"
+
+    settings.OIDC_OP_URL = "https://oidc.example.com"
+    settings.OIDC_VERIFY_SSL = False
+    settings.OIDC_TIMEOUT = 5
+    settings.OIDC_PROXY = None
+    settings.OIDC_OP_JWKS_ENDPOINT = "https://oidc.example.com/jwks"
+    settings.OIDC_OP_INTROSPECTION_ENDPOINT = "https://oidc.example.com/introspect"
+
+    responses.add(
+        responses.POST,
+        "https://oidc.example.com/introspect",
+        json={
+            "iss": "https://oidc.example.com",
+            "aud": "some_client_id",  # settings.OIDC_RS_CLIENT_ID
+            "sub": "very-specific-sub",
+            "client_id": "some_service_provider",
+            "scope": "openid lasuite_meet",  # missing rooms:list scope
+            "active": True,
+        },
+    )
+
+    client = APIClient()
+    client.credentials(HTTP_AUTHORIZATION="Bearer some_token")
+    response = client.get("/external-api/v1.0/rooms/")
+
+    assert response.status_code == 403

src/backend/core/tests/test_external_api_token.py

@@ -14,7 +14,7 @@ from core.factories import (
     ApplicationFactory,
     UserFactory,
 )
-from core.models import ApplicationScope
+from core.models import ApplicationScope, User
 
 pytestmark = pytest.mark.django_db
 
@@ -232,6 +232,7 @@ def test_api_applications_token_payload_structure(settings):
     """Generated token should have correct payload structure."""
     settings.APPLICATION_JWT_SECRET_KEY = "devKey"
     user = UserFactory(email="user@example.com")
+
     application = ApplicationFactory(
         active=True,
         scopes=[ApplicationScope.ROOMS_LIST, ApplicationScope.ROOMS_CREATE],
@@ -273,3 +274,119 @@ def test_api_applications_token_payload_structure(settings):
         "delegated": True,
         "scope": "rooms:list rooms:create",
     }
+
+
+@freeze_time("2023-01-15 12:00:00")
+def test_api_applications_token_new_user(settings):
+    """Should create a new pending user when creation is allowed and user doesn't exist."""
+
+    settings.APPLICATION_JWT_SECRET_KEY = "devKey"
+    settings.APPLICATION_ALLOW_USER_CREATION = True
+    settings.OIDC_FALLBACK_TO_EMAIL_FOR_IDENTIFICATION = True
+    settings.OIDC_USER_SUB_FIELD_IMMUTABLE = False
+
+    assert len(User.objects.all()) == 0
+
+    application = ApplicationFactory(
+        active=True,
+        scopes=[ApplicationScope.ROOMS_LIST, ApplicationScope.ROOMS_CREATE],
+    )
+
+    plain_secret = "test-secret-123"
+    application.client_secret = plain_secret
+    application.save()
+
+    client = APIClient()
+    response = client.post(
+        "/external-api/v1.0/application/token/",
+        {
+            "client_id": application.client_id,
+            "client_secret": plain_secret,
+            "grant_type": "client_credentials",
+            "scope": "unknown@world.com",
+        },
+        format="json",
+    )
+
+    # Decode token to verify payload
+    token = response.data["access_token"]
+    payload = jwt.decode(
+        token,
+        settings.APPLICATION_JWT_SECRET_KEY,
+        algorithms=[settings.APPLICATION_JWT_ALG],
+        issuer=settings.APPLICATION_JWT_ISSUER,
+        audience=settings.APPLICATION_JWT_AUDIENCE,
+    )
+
+    user = User.objects.get(email="unknown@world.com")
+    assert user.sub is None
+
+    assert payload == {
+        "iss": settings.APPLICATION_JWT_ISSUER,
+        "aud": settings.APPLICATION_JWT_AUDIENCE,
+        "client_id": application.client_id,
+        "exp": 1673787600,
+        "iat": 1673784000,
+        "user_id": str(user.id),
+        "delegated": True,
+        "scope": "rooms:list rooms:create",
+    }
+
+
+@freeze_time("2023-01-15 12:00:00")
+def test_api_applications_token_existing_user(settings):
+    """Application should not create a new user when user exist."""
+
+    settings.APPLICATION_JWT_SECRET_KEY = "devKey"
+    user = UserFactory(email="user@example.com")
+
+    settings.APPLICATION_ALLOW_USER_CREATION = True
+    settings.OIDC_FALLBACK_TO_EMAIL_FOR_IDENTIFICATION = True
+    settings.OIDC_USER_SUB_FIELD_IMMUTABLE = False
+
+    assert len(User.objects.all()) == 1
+
+    application = ApplicationFactory(
+        active=True,
+        scopes=[ApplicationScope.ROOMS_LIST, ApplicationScope.ROOMS_CREATE],
+    )
+
+    plain_secret = "test-secret-123"
+    application.client_secret = plain_secret
+    application.save()
+
+    client = APIClient()
+    response = client.post(
+        "/external-api/v1.0/application/token/",
+        {
+            "client_id": application.client_id,
+            "client_secret": plain_secret,
+            "grant_type": "client_credentials",
+            "scope": user.email,
+        },
+        format="json",
+    )
+
+    # Assert no new user was created
+    assert len(User.objects.all()) == 1
+
+    # Decode token to verify payload
+    token = response.data["access_token"]
+    payload = jwt.decode(
+        token,
+        settings.APPLICATION_JWT_SECRET_KEY,
+        algorithms=[settings.APPLICATION_JWT_ALG],
+        issuer=settings.APPLICATION_JWT_ISSUER,
+        audience=settings.APPLICATION_JWT_AUDIENCE,
+    )
+
+    assert payload == {
+        "iss": settings.APPLICATION_JWT_ISSUER,
+        "aud": settings.APPLICATION_JWT_AUDIENCE,
+        "client_id": application.client_id,
+        "exp": 1673787600,
+        "iat": 1673784000,
+        "user_id": str(user.id),
+        "delegated": True,
+        "scope": "rooms:list rooms:create",
+    }

src/backend/locale/de_DE/LC_MESSAGES/django.po

@@ -8,7 +8,7 @@ msgid ""
 msgstr ""
 "Project-Id-Version: PACKAGE VERSION\n"
 "Report-Msgid-Bugs-To: \n"
-"POT-Creation-Date: 2025-11-13 16:21+0000\n"
+"POT-Creation-Date: 2025-12-17 15:12+0000\n"
 "PO-Revision-Date: YEAR-MO-DA HO:MI+ZONE\n"
 "Last-Translator: FULL NAME <EMAIL@ADDRESS>\n"
 "Language-Team: LANGUAGE <LL@li.org>\n"
@@ -177,61 +177,61 @@ msgstr "Sub"
 
 #: core/models.py:149
 msgid ""
-"Required. 255 characters or fewer. Letters, numbers, and @/./+/-/_ "
-"characters only."
+"Optional for pending users; required upon account activation. 255 characters "
+"or fewer. Letters, numbers, and @/./+/-/_ characters only."
 msgstr ""
-"Erforderlich. Maximal 255 Zeichen. Nur Buchstaben, Zahlen und @/./+/-/_ sind "
-"erlaubt."
+"Optional für ausstehende Benutzer; erforderlich nach Kontoaktivierung. "
+"Maximal 255 Zeichen. Nur Buchstaben, Zahlen und @/./+/-/_ Zeichen erlaubt."
 
-#: core/models.py:157
+#: core/models.py:158
 msgid "identity email address"
 msgstr "Identitäts-E-Mail-Adresse"
 
-#: core/models.py:162
+#: core/models.py:163
 msgid "admin email address"
 msgstr "Administrator-E-Mail-Adresse"
 
-#: core/models.py:164
+#: core/models.py:165
 msgid "full name"
 msgstr "Vollständiger Name"
 
-#: core/models.py:166
+#: core/models.py:167
 msgid "short name"
 msgstr "Kurzname"
 
-#: core/models.py:172
+#: core/models.py:173
 msgid "language"
 msgstr "Sprache"
 
-#: core/models.py:173
+#: core/models.py:174
 msgid "The language in which the user wants to see the interface."
 msgstr "Die Sprache, in der der Benutzer die Oberfläche sehen möchte."
 
-#: core/models.py:179
+#: core/models.py:180
 msgid "The timezone in which the user wants to see times."
 msgstr "Die Zeitzone, in der der Benutzer die Zeiten sehen möchte."
 
-#: core/models.py:182
+#: core/models.py:183
 msgid "device"
 msgstr "Gerät"
 
-#: core/models.py:184
+#: core/models.py:185
 msgid "Whether the user is a device or a real user."
 msgstr "Ob es sich um ein Gerät oder einen echten Benutzer handelt."
 
-#: core/models.py:187
+#: core/models.py:188
 msgid "staff status"
 msgstr "Mitarbeiterstatus"
 
-#: core/models.py:189
+#: core/models.py:190
 msgid "Whether the user can log into this admin site."
 msgstr "Ob der Benutzer sich bei dieser Admin-Seite anmelden kann."
 
-#: core/models.py:192
+#: core/models.py:193
 msgid "active"
 msgstr "aktiv"
 
-#: core/models.py:195
+#: core/models.py:196
 msgid ""
 "Whether this user should be treated as active. Unselect this instead of "
 "deleting accounts."
@@ -239,66 +239,66 @@ msgstr ""
 "Ob dieser Benutzer als aktiv behandelt werden soll. Deaktivieren Sie dies "
 "anstelle des Löschens des Kontos."
 
-#: core/models.py:208
+#: core/models.py:209
 msgid "user"
 msgstr "Benutzer"
 
-#: core/models.py:209
+#: core/models.py:210
 msgid "users"
 msgstr "Benutzer"
 
-#: core/models.py:268
+#: core/models.py:269
 msgid "Resource"
 msgstr "Ressource"
 
-#: core/models.py:269
+#: core/models.py:270
 msgid "Resources"
 msgstr "Ressourcen"
 
-#: core/models.py:323
+#: core/models.py:324
 msgid "Resource access"
 msgstr "Ressourcenzugriff"
 
-#: core/models.py:324
+#: core/models.py:325
 msgid "Resource accesses"
 msgstr "Ressourcenzugriffe"
 
-#: core/models.py:330
+#: core/models.py:331
 msgid "Resource access with this User and Resource already exists."
 msgstr ""
 "Ein Ressourcenzugriff mit diesem Benutzer und dieser Ressource existiert "
 "bereits."
 
-#: core/models.py:386
+#: core/models.py:387
 msgid "Visio room configuration"
 msgstr "Visio-Raumkonfiguration"
 
-#: core/models.py:387
+#: core/models.py:388
 msgid "Values for Visio parameters to configure the room."
 msgstr "Werte für Visio-Parameter zur Konfiguration des Raums."
 
-#: core/models.py:394
+#: core/models.py:395
 msgid "Room PIN code"
 msgstr "PIN-Code für den Raum"
 
-#: core/models.py:395
+#: core/models.py:396
 msgid "Unique n-digit code that identifies this room in telephony mode."
 msgstr ""
 "Eindeutiger n-stelliger Code, der diesen Raum im Telephonmodus identifiziert."
 
-#: core/models.py:401 core/models.py:555
+#: core/models.py:402 core/models.py:556
 msgid "Room"
 msgstr "Raum"
 
-#: core/models.py:402
+#: core/models.py:403
 msgid "Rooms"
 msgstr "Räume"
 
-#: core/models.py:566
+#: core/models.py:567
 msgid "Worker ID"
 msgstr "Worker-ID"
 
-#: core/models.py:568
+#: core/models.py:569
 msgid ""
 "Enter an identifier for the worker recording.This ID is retained even when "
 "the worker stops, allowing for easy tracking."
@@ -307,99 +307,100 @@ msgstr ""
 "erhalten, auch wenn der Worker stoppt, was ein einfaches Nachverfolgen "
 "ermöglicht."
 
-#: core/models.py:576
+#: core/models.py:577
 msgid "Recording mode"
 msgstr "Aufzeichnungsmodus"
 
-#: core/models.py:577
+#: core/models.py:578
 msgid "Defines the mode of recording being called."
 msgstr "Definiert den aufgerufenen Aufzeichnungsmodus."
 
-#: core/models.py:583
+#: core/models.py:584
 msgid "Recording"
 msgstr "Aufzeichnung"
 
-#: core/models.py:584
+#: core/models.py:585
 msgid "Recordings"
 msgstr "Aufzeichnungen"
 
-#: core/models.py:692
+#: core/models.py:693
 msgid "Recording/user relation"
 msgstr "Beziehung Aufzeichnung/Benutzer"
 
-#: core/models.py:693
+#: core/models.py:694
 msgid "Recording/user relations"
 msgstr "Beziehungen Aufzeichnung/Benutzer"
 
-#: core/models.py:699
+#: core/models.py:700
 msgid "This user is already in this recording."
 msgstr "Dieser Benutzer ist bereits Teil dieser Aufzeichnung."
 
-#: core/models.py:705
+#: core/models.py:706
 msgid "This team is already in this recording."
 msgstr "Dieses Team ist bereits Teil dieser Aufzeichnung."
 
-#: core/models.py:711
+#: core/models.py:712
 msgid "Either user or team must be set, not both."
 msgstr "Entweder Benutzer oder Team muss festgelegt werden, nicht beides."
 
-#: core/models.py:728
+#: core/models.py:729
 msgid "Create rooms"
 msgstr "Räume erstellen"
 
-#: core/models.py:729
+#: core/models.py:730
 msgid "List rooms"
 msgstr "Räume auflisten"
 
-#: core/models.py:730
+#: core/models.py:731
 msgid "Retrieve room details"
 msgstr "Raumdetails abrufen"
 
-#: core/models.py:731
+#: core/models.py:732
 msgid "Update rooms"
 msgstr "Räume aktualisieren"
 
-#: core/models.py:732
+#: core/models.py:733
 msgid "Delete rooms"
 msgstr "Räume löschen"
 
-#: core/models.py:745
+#: core/models.py:746
 msgid "Application name"
 msgstr "Anwendungsname"
 
-#: core/models.py:746
+#: core/models.py:747
 msgid "Descriptive name for this application."
 msgstr "Beschreibender Name für diese Anwendung."
 
-#: core/models.py:756
+#: core/models.py:757
 msgid "Hashed on Save. Copy it now if this is a new secret."
-msgstr "Beim Speichern gehasht. Jetzt kopieren, wenn dies ein neues Geheimnis ist."
+msgstr ""
+"Beim Speichern gehasht. Jetzt kopieren, wenn dies ein neues Geheimnis ist."
 
-#: core/models.py:767
+#: core/models.py:768
 msgid "Application"
 msgstr "Anwendung"
 
-#: core/models.py:768
+#: core/models.py:769
 msgid "Applications"
 msgstr "Anwendungen"
 
-#: core/models.py:791
+#: core/models.py:792
 msgid "Enter a valid domain"
 msgstr "Geben Sie eine gültige Domain ein"
 
-#: core/models.py:794
+#: core/models.py:795
 msgid "Domain"
 msgstr "Domain"
 
-#: core/models.py:795
+#: core/models.py:796
 msgid "Email domain this application can act on behalf of."
 msgstr "E-Mail-Domain, im Namen der diese Anwendung handeln kann."
 
-#: core/models.py:807
+#: core/models.py:808
 msgid "Application domain"
 msgstr "Anwendungsdomain"
 
-#: core/models.py:808
+#: core/models.py:809
 msgid "Application domains"
 msgstr "Anwendungsdomains"
 
@@ -531,18 +532,18 @@ msgstr ""
 " Wenn Sie Fragen haben oder Unterstützung benötigen, wenden Sie sich bitte "
 "an unser Support-Team unter %(support_email)s. "
 
-#: meet/settings.py:167
+#: meet/settings.py:169
 msgid "English"
 msgstr "Englisch"
 
-#: meet/settings.py:168
+#: meet/settings.py:170
 msgid "French"
 msgstr "Französisch"
 
-#: meet/settings.py:169
+#: meet/settings.py:171
 msgid "Dutch"
 msgstr "Niederländisch"
 
-#: meet/settings.py:170
+#: meet/settings.py:172
 msgid "German"
 msgstr "Deutsch"

src/backend/locale/en_US/LC_MESSAGES/django.po

@@ -8,7 +8,7 @@ msgid ""
 msgstr ""
 "Project-Id-Version: PACKAGE VERSION\n"
 "Report-Msgid-Bugs-To: \n"
-"POT-Creation-Date: 2025-11-13 16:21+0000\n"
+"POT-Creation-Date: 2025-12-17 15:12+0000\n"
 "PO-Revision-Date: YEAR-MO-DA HO:MI+ZONE\n"
 "Last-Translator: FULL NAME <EMAIL@ADDRESS>\n"
 "Language-Team: LANGUAGE <LL@li.org>\n"
@@ -175,61 +175,61 @@ msgstr "sub"
 
 #: core/models.py:149
 msgid ""
-"Required. 255 characters or fewer. Letters, numbers, and @/./+/-/_ "
-"characters only."
+"Optional for pending users; required upon account activation. 255 characters "
+"or fewer. Letters, numbers, and @/./+/-/_ characters only."
 msgstr ""
 "Required. 255 characters or fewer. Letters, numbers, and @/./+/-/_ "
 "characters only."
 
-#: core/models.py:157
+#: core/models.py:158
 msgid "identity email address"
 msgstr "identity email address"
 
-#: core/models.py:162
+#: core/models.py:163
 msgid "admin email address"
 msgstr "admin email address"
 
-#: core/models.py:164
+#: core/models.py:165
 msgid "full name"
 msgstr "full name"
 
-#: core/models.py:166
+#: core/models.py:167
 msgid "short name"
 msgstr "short name"
 
-#: core/models.py:172
+#: core/models.py:173
 msgid "language"
 msgstr "language"
 
-#: core/models.py:173
+#: core/models.py:174
 msgid "The language in which the user wants to see the interface."
 msgstr "The language in which the user wants to see the interface."
 
-#: core/models.py:179
+#: core/models.py:180
 msgid "The timezone in which the user wants to see times."
 msgstr "The timezone in which the user wants to see times."
 
-#: core/models.py:182
+#: core/models.py:183
 msgid "device"
 msgstr "device"
 
-#: core/models.py:184
+#: core/models.py:185
 msgid "Whether the user is a device or a real user."
 msgstr "Whether the user is a device or a real user."
 
-#: core/models.py:187
+#: core/models.py:188
 msgid "staff status"
 msgstr "staff status"
 
-#: core/models.py:189
+#: core/models.py:190
 msgid "Whether the user can log into this admin site."
 msgstr "Whether the user can log into this admin site."
 
-#: core/models.py:192
+#: core/models.py:193
 msgid "active"
 msgstr "active"
 
-#: core/models.py:195
+#: core/models.py:196
 msgid ""
 "Whether this user should be treated as active. Unselect this instead of "
 "deleting accounts."
@@ -237,63 +237,63 @@ msgstr ""
 "Whether this user should be treated as active. Unselect this instead of "
 "deleting accounts."
 
-#: core/models.py:208
+#: core/models.py:209
 msgid "user"
 msgstr "user"
 
-#: core/models.py:209
+#: core/models.py:210
 msgid "users"
 msgstr "users"
 
-#: core/models.py:268
+#: core/models.py:269
 msgid "Resource"
 msgstr "Resource"
 
-#: core/models.py:269
+#: core/models.py:270
 msgid "Resources"
 msgstr "Resources"
 
-#: core/models.py:323
+#: core/models.py:324
 msgid "Resource access"
 msgstr "Resource access"
 
-#: core/models.py:324
+#: core/models.py:325
 msgid "Resource accesses"
 msgstr "Resource accesses"
 
-#: core/models.py:330
+#: core/models.py:331
 msgid "Resource access with this User and Resource already exists."
 msgstr "Resource access with this User and Resource already exists."
 
-#: core/models.py:386
+#: core/models.py:387
 msgid "Visio room configuration"
 msgstr "Visio room configuration"
 
-#: core/models.py:387
+#: core/models.py:388
 msgid "Values for Visio parameters to configure the room."
 msgstr "Values for Visio parameters to configure the room."
 
-#: core/models.py:394
+#: core/models.py:395
 msgid "Room PIN code"
 msgstr "Room PIN code"
 
-#: core/models.py:395
+#: core/models.py:396
 msgid "Unique n-digit code that identifies this room in telephony mode."
 msgstr "Unique n-digit code that identifies this room in telephony mode."
 
-#: core/models.py:401 core/models.py:555
+#: core/models.py:402 core/models.py:556
 msgid "Room"
 msgstr "Room"
 
-#: core/models.py:402
+#: core/models.py:403
 msgid "Rooms"
 msgstr "Rooms"
 
-#: core/models.py:566
+#: core/models.py:567
 msgid "Worker ID"
 msgstr "Worker ID"
 
-#: core/models.py:568
+#: core/models.py:569
 msgid ""
 "Enter an identifier for the worker recording.This ID is retained even when "
 "the worker stops, allowing for easy tracking."
@@ -301,103 +301,103 @@ msgstr ""
 "Enter an identifier for the worker recording.This ID is retained even when "
 "the worker stops, allowing for easy tracking."
 
-#: core/models.py:576
+#: core/models.py:577
 msgid "Recording mode"
 msgstr "Recording mode"
 
-#: core/models.py:577
+#: core/models.py:578
 msgid "Defines the mode of recording being called."
 msgstr "Defines the mode of recording being called."
 
-#: core/models.py:583
+#: core/models.py:584
 msgid "Recording"
 msgstr "Recording"
 
-#: core/models.py:584
+#: core/models.py:585
 msgid "Recordings"
 msgstr "Recordings"
 
-#: core/models.py:692
+#: core/models.py:693
 msgid "Recording/user relation"
 msgstr "Recording/user relation"
 
-#: core/models.py:693
+#: core/models.py:694
 msgid "Recording/user relations"
 msgstr "Recording/user relations"
 
-#: core/models.py:699
+#: core/models.py:700
 msgid "This user is already in this recording."
 msgstr "This user is already in this recording."
 
-#: core/models.py:705
+#: core/models.py:706
 msgid "This team is already in this recording."
 msgstr "This team is already in this recording."
 
-#: core/models.py:711
+#: core/models.py:712
 msgid "Either user or team must be set, not both."
 msgstr "Either user or team must be set, not both."
 
-#: core/models.py:728
+#: core/models.py:729
 #, fuzzy
 #| msgid "created on"
 msgid "Create rooms"
 msgstr "Create rooms"
 
-#: core/models.py:729
+#: core/models.py:730
 msgid "List rooms"
 msgstr "List rooms"
 
-#: core/models.py:730
+#: core/models.py:731
 msgid "Retrieve room details"
 msgstr "Retrieve room details"
 
-#: core/models.py:731
+#: core/models.py:732
 #, fuzzy
 #| msgid "updated on"
 msgid "Update rooms"
 msgstr "Update rooms"
 
-#: core/models.py:732
+#: core/models.py:733
 msgid "Delete rooms"
 msgstr "Delete rooms"
 
-#: core/models.py:745
+#: core/models.py:746
 msgid "Application name"
 msgstr "Application name"
 
-#: core/models.py:746
+#: core/models.py:747
 msgid "Descriptive name for this application."
 msgstr "Descriptive name for this application."
 
-#: core/models.py:756
+#: core/models.py:757
 msgid "Hashed on Save. Copy it now if this is a new secret."
 msgstr "Hashed on Save. Copy it now if this is a new secret."
 
-#: core/models.py:767
+#: core/models.py:768
 msgid "Application"
 msgstr "Application"
 
-#: core/models.py:768
+#: core/models.py:769
 msgid "Applications"
 msgstr "Applications"
 
-#: core/models.py:791
+#: core/models.py:792
 msgid "Enter a valid domain"
 msgstr "Enter a valid domain"
 
-#: core/models.py:794
+#: core/models.py:795
 msgid "Domain"
 msgstr "Domain"
 
-#: core/models.py:795
+#: core/models.py:796
 msgid "Email domain this application can act on behalf of."
 msgstr "Email domain this application can act on behalf of."
 
-#: core/models.py:807
+#: core/models.py:808
 msgid "Application domain"
 msgstr "Application domain"
 
-#: core/models.py:808
+#: core/models.py:809
 msgid "Application domains"
 msgstr "Application domains"
 
@@ -529,18 +529,18 @@ msgstr ""
 " If you have any questions or need assistance, please contact our support "
 "team at %(support_email)s. "
 
-#: meet/settings.py:167
+#: meet/settings.py:169
 msgid "English"
 msgstr "English"
 
-#: meet/settings.py:168
+#: meet/settings.py:170
 msgid "French"
 msgstr "French"
 
-#: meet/settings.py:169
+#: meet/settings.py:171
 msgid "Dutch"
 msgstr "Dutch"
 
-#: meet/settings.py:170
+#: meet/settings.py:172
 msgid "German"
 msgstr "German"

src/backend/locale/fr_FR/LC_MESSAGES/django.po

@@ -8,7 +8,7 @@ msgid ""
 msgstr ""
 "Project-Id-Version: PACKAGE VERSION\n"
 "Report-Msgid-Bugs-To: \n"
-"POT-Creation-Date: 2025-11-13 16:21+0000\n"
+"POT-Creation-Date: 2025-12-17 15:12+0000\n"
 "PO-Revision-Date: YEAR-MO-DA HO:MI+ZONE\n"
 "Last-Translator: antoine.lebaud@mail.numerique.gouv.fr\n"
 "Language-Team: LANGUAGE <LL@li.org>\n"
@@ -179,61 +179,61 @@ msgstr "sub"
 
 #: core/models.py:149
 msgid ""
-"Required. 255 characters or fewer. Letters, numbers, and @/./+/-/_ "
-"characters only."
+"Optional for pending users; required upon account activation. 255 characters "
+"or fewer. Letters, numbers, and @/./+/-/_ characters only."
 msgstr ""
-"Obligatoire. 255 caractères ou moins. Lettres, chiffres et caractères @/./"
-"+/-/_ uniquement."
+"Optionnel pour les utilisateurs en attente ; requis lors de l'activation du "
+"compte. 255 caractères maximum. Lettres, chiffres et @/./+/-/_ uniquement."
 
-#: core/models.py:157
+#: core/models.py:158
 msgid "identity email address"
 msgstr "adresse e-mail d'identité"
 
-#: core/models.py:162
+#: core/models.py:163
 msgid "admin email address"
 msgstr "adresse e-mail d'administrateur"
 
-#: core/models.py:164
+#: core/models.py:165
 msgid "full name"
 msgstr "nom complet"
 
-#: core/models.py:166
+#: core/models.py:167
 msgid "short name"
 msgstr "nom court"
 
-#: core/models.py:172
+#: core/models.py:173
 msgid "language"
 msgstr "langue"
 
-#: core/models.py:173
+#: core/models.py:174
 msgid "The language in which the user wants to see the interface."
 msgstr "La langue dans laquelle l'utilisateur souhaite voir l'interface."
 
-#: core/models.py:179
+#: core/models.py:180
 msgid "The timezone in which the user wants to see times."
 msgstr "Le fuseau horaire dans lequel l'utilisateur souhaite voir les heures."
 
-#: core/models.py:182
+#: core/models.py:183
 msgid "device"
 msgstr "appareil"
 
-#: core/models.py:184
+#: core/models.py:185
 msgid "Whether the user is a device or a real user."
 msgstr "Si l'utilisateur est un appareil ou un utilisateur réel."
 
-#: core/models.py:187
+#: core/models.py:188
 msgid "staff status"
 msgstr "statut du personnel"
 
-#: core/models.py:189
+#: core/models.py:190
 msgid "Whether the user can log into this admin site."
 msgstr "Si l'utilisateur peut se connecter à ce site d'administration."
 
-#: core/models.py:192
+#: core/models.py:193
 msgid "active"
 msgstr "actif"
 
-#: core/models.py:195
+#: core/models.py:196
 msgid ""
 "Whether this user should be treated as active. Unselect this instead of "
 "deleting accounts."
@@ -241,65 +241,65 @@ msgstr ""
 "Si cet utilisateur doit être traité comme actif. Désélectionnez cette option "
 "au lieu de supprimer des comptes."
 
-#: core/models.py:208
+#: core/models.py:209
 msgid "user"
 msgstr "utilisateur"
 
-#: core/models.py:209
+#: core/models.py:210
 msgid "users"
 msgstr "utilisateurs"
 
-#: core/models.py:268
+#: core/models.py:269
 msgid "Resource"
 msgstr "Ressource"
 
-#: core/models.py:269
+#: core/models.py:270
 msgid "Resources"
 msgstr "Ressources"
 
-#: core/models.py:323
+#: core/models.py:324
 msgid "Resource access"
 msgstr "Accès aux ressources"
 
-#: core/models.py:324
+#: core/models.py:325
 msgid "Resource accesses"
 msgstr "Accès aux ressources"
 
-#: core/models.py:330
+#: core/models.py:331
 msgid "Resource access with this User and Resource already exists."
 msgstr ""
 "L'accès à la ressource avec cet utilisateur et cette ressource existe déjà."
 
-#: core/models.py:386
+#: core/models.py:387
 msgid "Visio room configuration"
 msgstr "Configuration de la salle de visioconférence"
 
-#: core/models.py:387
+#: core/models.py:388
 msgid "Values for Visio parameters to configure the room."
 msgstr "Valeurs des paramètres de visioconférence pour configurer la salle."
 
-#: core/models.py:394
+#: core/models.py:395
 msgid "Room PIN code"
 msgstr "Code PIN de la salle"
 
-#: core/models.py:395
+#: core/models.py:396
 msgid "Unique n-digit code that identifies this room in telephony mode."
 msgstr ""
 "Code unique à n chiffres qui identifie cette salle en mode téléphonique."
 
-#: core/models.py:401 core/models.py:555
+#: core/models.py:402 core/models.py:556
 msgid "Room"
 msgstr "Salle"
 
-#: core/models.py:402
+#: core/models.py:403
 msgid "Rooms"
 msgstr "Salles"
 
-#: core/models.py:566
+#: core/models.py:567
 msgid "Worker ID"
 msgstr "ID du Worker"
 
-#: core/models.py:568
+#: core/models.py:569
 msgid ""
 "Enter an identifier for the worker recording.This ID is retained even when "
 "the worker stops, allowing for easy tracking."
@@ -307,99 +307,101 @@ msgstr ""
 "Entrez un identifiant pour l'enregistrement du Worker. Cet identifiant est "
 "conservé même lorsque le Worker s'arrête, permettant un suivi facile."
 
-#: core/models.py:576
+#: core/models.py:577
 msgid "Recording mode"
 msgstr "Mode d'enregistrement"
 
-#: core/models.py:577
+#: core/models.py:578
 msgid "Defines the mode of recording being called."
 msgstr "Définit le mode d'enregistrement appelé."
 
-#: core/models.py:583
+#: core/models.py:584
 msgid "Recording"
 msgstr "Enregistrement"
 
-#: core/models.py:584
+#: core/models.py:585
 msgid "Recordings"
 msgstr "Enregistrements"
 
-#: core/models.py:692
+#: core/models.py:693
 msgid "Recording/user relation"
 msgstr "Relation enregistrement/utilisateur"
 
-#: core/models.py:693
+#: core/models.py:694
 msgid "Recording/user relations"
 msgstr "Relations enregistrement/utilisateur"
 
-#: core/models.py:699
+#: core/models.py:700
 msgid "This user is already in this recording."
 msgstr "Cet utilisateur est déjà dans cet enregistrement."
 
-#: core/models.py:705
+#: core/models.py:706
 msgid "This team is already in this recording."
 msgstr "Cette équipe est déjà dans cet enregistrement."
 
-#: core/models.py:711
+#: core/models.py:712
 msgid "Either user or team must be set, not both."
 msgstr "Soit l'utilisateur, soit l'équipe doit être défini, pas les deux."
 
-#: core/models.py:728
+#: core/models.py:729
 msgid "Create rooms"
 msgstr "Créer des salles"
 
-#: core/models.py:729
+#: core/models.py:730
 msgid "List rooms"
 msgstr "Lister les salles"
 
-#: core/models.py:730
+#: core/models.py:731
 msgid "Retrieve room details"
 msgstr "Afficher les détails d’une salle"
 
-#: core/models.py:731
+#: core/models.py:732
 msgid "Update rooms"
 msgstr "Mettre à jour les salles"
 
-#: core/models.py:732
+#: core/models.py:733
 msgid "Delete rooms"
 msgstr "Supprimer les salles"
 
-#: core/models.py:745
+#: core/models.py:746
 msgid "Application name"
 msgstr "Nom de l’application"
 
-#: core/models.py:746
+#: core/models.py:747
 msgid "Descriptive name for this application."
 msgstr "Nom descriptif de cette application."
 
-#: core/models.py:756
+#: core/models.py:757
 msgid "Hashed on Save. Copy it now if this is a new secret."
-msgstr "Haché lors de l’enregistrement. Copiez-le maintenant s’il s’agit d’un nouveau secret."
+msgstr ""
+"Haché lors de l’enregistrement. Copiez-le maintenant s’il s’agit d’un "
+"nouveau secret."
 
-#: core/models.py:767
+#: core/models.py:768
 msgid "Application"
 msgstr "Application"
 
-#: core/models.py:768
+#: core/models.py:769
 msgid "Applications"
 msgstr "Applications"
 
-#: core/models.py:791
+#: core/models.py:792
 msgid "Enter a valid domain"
 msgstr "Saisissez un domaine valide"
 
-#: core/models.py:794
+#: core/models.py:795
 msgid "Domain"
 msgstr "Domaine"
 
-#: core/models.py:795
+#: core/models.py:796
 msgid "Email domain this application can act on behalf of."
 msgstr "Domaine de messagerie au nom duquel cette application peut agir."
 
-#: core/models.py:807
+#: core/models.py:808
 msgid "Application domain"
 msgstr "Domaine d’application"
 
-#: core/models.py:808
+#: core/models.py:809
 msgid "Application domains"
 msgstr "Domaines d’application"
 
@@ -531,18 +533,18 @@ msgstr ""
 " Si vous avez des questions ou besoin d'assistance, veuillez contacter notre "
 "équipe d'assistance à %(support_email)s. "
 
-#: meet/settings.py:167
+#: meet/settings.py:169
 msgid "English"
 msgstr "Anglais"
 
-#: meet/settings.py:168
+#: meet/settings.py:170
 msgid "French"
 msgstr "Français"
 
-#: meet/settings.py:169
+#: meet/settings.py:171
 msgid "Dutch"
 msgstr "Néerlandais"
 
-#: meet/settings.py:170
+#: meet/settings.py:172
 msgid "German"
 msgstr "Allemand"

src/backend/locale/nl_NL/LC_MESSAGES/django.po

@@ -8,7 +8,7 @@ msgid ""
 msgstr ""
 "Project-Id-Version: PACKAGE VERSION\n"
 "Report-Msgid-Bugs-To: \n"
-"POT-Creation-Date: 2025-11-13 16:21+0000\n"
+"POT-Creation-Date: 2025-12-17 15:12+0000\n"
 "PO-Revision-Date: YEAR-MO-DA HO:MI+ZONE\n"
 "Last-Translator: FULL NAME <EMAIL@ADDRESS>\n"
 "Language-Team: LANGUAGE <LL@li.org>\n"
@@ -176,60 +176,61 @@ msgstr "sub"
 
 #: core/models.py:149
 msgid ""
-"Required. 255 characters or fewer. Letters, numbers, and @/./+/-/_ "
-"characters only."
+"Optional for pending users; required upon account activation. 255 characters "
+"or fewer. Letters, numbers, and @/./+/-/_ characters only."
 msgstr ""
-"Vereist. 255 tekens of minder. Alleen letters, cijfers en @/./+/-/_ tekens."
+"Optioneel voor gebruikers in afwachting; vereist bij accountactivering. "
+"Maximum 255 tekens. Alleen letters, cijfers en @/./+/-/_ toegestaan."
 
-#: core/models.py:157
+#: core/models.py:158
 msgid "identity email address"
 msgstr "identiteit e-mailadres"
 
-#: core/models.py:162
+#: core/models.py:163
 msgid "admin email address"
 msgstr "beheerder e-mailadres"
 
-#: core/models.py:164
+#: core/models.py:165
 msgid "full name"
 msgstr "volledige naam"
 
-#: core/models.py:166
+#: core/models.py:167
 msgid "short name"
 msgstr "korte naam"
 
-#: core/models.py:172
+#: core/models.py:173
 msgid "language"
 msgstr "taal"
 
-#: core/models.py:173
+#: core/models.py:174
 msgid "The language in which the user wants to see the interface."
 msgstr "De taal waarin de gebruiker de interface wil zien."
 
-#: core/models.py:179
+#: core/models.py:180
 msgid "The timezone in which the user wants to see times."
 msgstr "De tijdzone waarin de gebruiker tijden wil zien."
 
-#: core/models.py:182
+#: core/models.py:183
 msgid "device"
 msgstr "apparaat"
 
-#: core/models.py:184
+#: core/models.py:185
 msgid "Whether the user is a device or a real user."
 msgstr "Of de gebruiker een apparaat is of een echte gebruiker."
 
-#: core/models.py:187
+#: core/models.py:188
 msgid "staff status"
 msgstr "personeelsstatus"
 
-#: core/models.py:189
+#: core/models.py:190
 msgid "Whether the user can log into this admin site."
 msgstr "Of de gebruiker kan inloggen op deze beheersite."
 
-#: core/models.py:192
+#: core/models.py:193
 msgid "active"
 msgstr "actief"
 
-#: core/models.py:195
+#: core/models.py:196
 msgid ""
 "Whether this user should be treated as active. Unselect this instead of "
 "deleting accounts."
@@ -237,64 +238,64 @@ msgstr ""
 "Of deze gebruiker als actief moet worden behandeld. Deselecteer dit in "
 "plaats van accounts te verwijderen."
 
-#: core/models.py:208
+#: core/models.py:209
 msgid "user"
 msgstr "gebruiker"
 
-#: core/models.py:209
+#: core/models.py:210
 msgid "users"
 msgstr "gebruikers"
 
-#: core/models.py:268
+#: core/models.py:269
 msgid "Resource"
 msgstr "Bron"
 
-#: core/models.py:269
+#: core/models.py:270
 msgid "Resources"
 msgstr "Bronnen"
 
-#: core/models.py:323
+#: core/models.py:324
 msgid "Resource access"
 msgstr "Brontoegang"
 
-#: core/models.py:324
+#: core/models.py:325
 msgid "Resource accesses"
 msgstr "Brontoegangsrechten"
 
-#: core/models.py:330
+#: core/models.py:331
 msgid "Resource access with this User and Resource already exists."
 msgstr "Brontoegang met deze gebruiker en bron bestaat al."
 
-#: core/models.py:386
+#: core/models.py:387
 msgid "Visio room configuration"
 msgstr "Visio-ruimteconfiguratie"
 
-#: core/models.py:387
+#: core/models.py:388
 msgid "Values for Visio parameters to configure the room."
 msgstr "Waarden voor Visio-parameters om de ruimte te configureren."
 
-#: core/models.py:394
+#: core/models.py:395
 msgid "Room PIN code"
 msgstr "Pincode van de kamer"
 
-#: core/models.py:395
+#: core/models.py:396
 msgid "Unique n-digit code that identifies this room in telephony mode."
 msgstr ""
 "Unieke n-cijferige code die deze kamer identificeert in telefonie-modus."
 
-#: core/models.py:401 core/models.py:555
+#: core/models.py:402 core/models.py:556
 msgid "Room"
 msgstr "Ruimte"
 
-#: core/models.py:402
+#: core/models.py:403
 msgid "Rooms"
 msgstr "Ruimtes"
 
-#: core/models.py:566
+#: core/models.py:567
 msgid "Worker ID"
 msgstr "Worker ID"
 
-#: core/models.py:568
+#: core/models.py:569
 msgid ""
 "Enter an identifier for the worker recording.This ID is retained even when "
 "the worker stops, allowing for easy tracking."
@@ -302,99 +303,100 @@ msgstr ""
 "Voer een identificatie in voor de worker-opname. Deze ID blijft behouden, "
 "zelfs wanneer de worker stopt, waardoor eenvoudige tracking mogelijk is."
 
-#: core/models.py:576
+#: core/models.py:577
 msgid "Recording mode"
 msgstr "Opnamemodus"
 
-#: core/models.py:577
+#: core/models.py:578
 msgid "Defines the mode of recording being called."
 msgstr "Definieert de modus van opname die wordt aangeroepen."
 
-#: core/models.py:583
+#: core/models.py:584
 msgid "Recording"
 msgstr "Opname"
 
-#: core/models.py:584
+#: core/models.py:585
 msgid "Recordings"
 msgstr "Opnames"
 
-#: core/models.py:692
+#: core/models.py:693
 msgid "Recording/user relation"
 msgstr "Opname/gebruiker-relatie"
 
-#: core/models.py:693
+#: core/models.py:694
 msgid "Recording/user relations"
 msgstr "Opname/gebruiker-relaties"
 
-#: core/models.py:699
+#: core/models.py:700
 msgid "This user is already in this recording."
 msgstr "Deze gebruiker is al in deze opname."
 
-#: core/models.py:705
+#: core/models.py:706
 msgid "This team is already in this recording."
 msgstr "Dit team is al in deze opname."
 
-#: core/models.py:711
+#: core/models.py:712
 msgid "Either user or team must be set, not both."
 msgstr "Ofwel gebruiker of team moet worden ingesteld, niet beide."
 
-#: core/models.py:728
+#: core/models.py:729
 msgid "Create rooms"
 msgstr "Ruimtes aanmaken"
 
-#: core/models.py:729
+#: core/models.py:730
 msgid "List rooms"
 msgstr "Ruimtes weergeven"
 
-#: core/models.py:730
+#: core/models.py:731
 msgid "Retrieve room details"
 msgstr "Details van een ruimte ophalen"
 
-#: core/models.py:731
+#: core/models.py:732
 msgid "Update rooms"
 msgstr "Ruimtes bijwerken"
 
-#: core/models.py:732
+#: core/models.py:733
 msgid "Delete rooms"
 msgstr "Ruimtes verwijderen"
 
-#: core/models.py:745
+#: core/models.py:746
 msgid "Application name"
 msgstr "Naam van de applicatie"
 
-#: core/models.py:746
+#: core/models.py:747
 msgid "Descriptive name for this application."
 msgstr "Beschrijvende naam voor deze applicatie."
 
-#: core/models.py:756
+#: core/models.py:757
 msgid "Hashed on Save. Copy it now if this is a new secret."
-msgstr "Wordt gehasht bij het opslaan. Kopieer het nu als dit een nieuw geheim is."
+msgstr ""
+"Wordt gehasht bij het opslaan. Kopieer het nu als dit een nieuw geheim is."
 
-#: core/models.py:767
+#: core/models.py:768
 msgid "Application"
 msgstr "Applicatie"
 
-#: core/models.py:768
+#: core/models.py:769
 msgid "Applications"
 msgstr "Applicaties"
 
-#: core/models.py:791
+#: core/models.py:792
 msgid "Enter a valid domain"
 msgstr "Voer een geldig domein in"
 
-#: core/models.py:794
+#: core/models.py:795
 msgid "Domain"
 msgstr "Domein"
 
-#: core/models.py:795
+#: core/models.py:796
 msgid "Email domain this application can act on behalf of."
 msgstr "E-maildomein namens welke deze applicatie kan handelen."
 
-#: core/models.py:807
+#: core/models.py:808
 msgid "Application domain"
 msgstr "Applicatiedomein"
 
-#: core/models.py:808
+#: core/models.py:809
 msgid "Application domains"
 msgstr "Applicatiedomeinen"
 
@@ -526,18 +528,18 @@ msgstr ""
 " Als je vragen hebt of hulp nodig hebt, neem dan contact op met ons support "
 "team via %(support_email)s. "
 
-#: meet/settings.py:167
+#: meet/settings.py:169
 msgid "English"
 msgstr "Engels"
 
-#: meet/settings.py:168
+#: meet/settings.py:170
 msgid "French"
 msgstr "Frans"
 
-#: meet/settings.py:169
+#: meet/settings.py:171
 msgid "Dutch"
 msgstr "Nederlands"
 
-#: meet/settings.py:170
+#: meet/settings.py:172
 msgid "German"
 msgstr "Duits"

src/backend/meet/settings.py

@@ -10,6 +10,8 @@ For the full list of settings and their values, see
 https://docs.djangoproject.com/en/3.1/ref/settings/
 """
 
+# pylint: disable=too-many-lines
+
 import json
 from os import path
 from socket import gethostbyname, gethostname
@@ -403,7 +405,15 @@ class Base(Configuration):
     OIDC_FALLBACK_TO_EMAIL_FOR_IDENTIFICATION = values.BooleanValue(
         default=False,
         environ_name="OIDC_FALLBACK_TO_EMAIL_FOR_IDENTIFICATION",
+        environ_prefix=None,
     )
+    OIDC_USER_SUB_FIELD_IMMUTABLE = values.BooleanValue(
+        default=True, environ_name="OIDC_USER_SUB_FIELD_IMMUTABLE", environ_prefix=None
+    )
+    OIDC_TIMEOUT = values.IntegerValue(
+        5, environ_name="OIDC_TIMEOUT", environ_prefix=None
+    )
+    OIDC_PROXY = values.Value(None, environ_name="OIDC_PROXY", environ_prefix=None)
     OIDC_RP_SIGN_ALGO = values.Value(
         "RS256", environ_name="OIDC_RP_SIGN_ALGO", environ_prefix=None
     )
@@ -427,12 +437,16 @@ class Base(Configuration):
     OIDC_OP_USER_ENDPOINT = values.Value(
         None, environ_name="OIDC_OP_USER_ENDPOINT", environ_prefix=None
     )
+    OIDC_OP_INTROSPECTION_ENDPOINT = values.Value(
+        None, environ_name="OIDC_OP_INTROSPECTION_ENDPOINT", environ_prefix=None
+    )
     OIDC_OP_USER_ENDPOINT_FORMAT = values.Value(
         "AUTO", environ_name="OIDC_OP_USER_ENDPOINT_FORMAT", environ_prefix=None
     )
     OIDC_OP_LOGOUT_ENDPOINT = values.Value(
         None, environ_name="OIDC_OP_LOGOUT_ENDPOINT", environ_prefix=None
     )
+    OIDC_OP_URL = values.Value(None, environ_name="OIDC_OP_URL", environ_prefix=None)
     OIDC_AUTH_REQUEST_EXTRA_PARAMS = values.DictValue(
         {}, environ_name="OIDC_AUTH_REQUEST_EXTRA_PARAMS", environ_prefix=None
     )
@@ -493,6 +507,45 @@ class Base(Configuration):
         environ_prefix=None,
     )
 
+    # OIDC Resource Server Backend
+    OIDC_RS_BACKEND_CLASS = "core.external_api.authentication.ResourceServerBackend"
+    OIDC_RS_CLIENT_ID = values.Value(
+        "meet", environ_name="OIDC_RS_CLIENT_ID", environ_prefix=None
+    )
+    OIDC_RS_CLIENT_SECRET = SecretFileValue(
+        None,
+        environ_name="OIDC_RS_CLIENT_SECRET",
+        environ_prefix=None,
+    )
+    OIDC_RS_AUDIENCE_CLAIM = values.Value(
+        default="client_id", environ_name="OIDC_RS_AUDIENCE_CLAIM", environ_prefix=None
+    )
+    OIDC_RS_ENCRYPTION_ENCODING = values.Value(
+        default="A256GCM",
+        environ_name="OIDC_RS_ENCRYPTION_ENCODING",
+        environ_prefix=None,
+    )
+    OIDC_RS_ENCRYPTION_ALGO = values.Value(
+        default="RSA-OAEP", environ_name="OIDC_RS_ENCRYPTION_ALGO", environ_prefix=None
+    )
+    OIDC_RS_SIGNING_ALGO = values.Value(
+        default="ES256", environ_name="OIDC_RS_SIGNING_ALGO", environ_prefix=None
+    )
+    OIDC_RS_SCOPES = values.ListValue(
+        default=["lasuite_meet"],
+        environ_name="OIDC_RS_SCOPES",
+        environ_prefix=None,
+    )
+    OIDC_RS_PRIVATE_KEY_STR = SecretFileValue(
+        environ_name="OIDC_RS_PRIVATE_KEY_STR", environ_prefix=None
+    )
+    OIDC_RS_ENCRYPTION_KEY_TYPE = values.Value(
+        default="RSA", environ_name="OIDC_RS_ENCRYPTION_KEY_TYPE", environ_prefix=None
+    )
+    OIDC_RS_SCOPES_PREFIX = values.Value(
+        default=None, environ_name="OIDC_RS_SCOPES_PREFIX", environ_prefix=None
+    )
+
     # Video conference configuration
     LIVEKIT_CONFIGURATION = {
         "api_key": SecretFileValue(environ_name="LIVEKIT_API_KEY", environ_prefix=None),
@@ -721,6 +774,14 @@ class Base(Configuration):
         environ_name="APPLICATION_BASE_URL",
         environ_prefix=None,
     )
+    # Allows third-party platforms to create users with email-only identification.
+    # Required for external integrations, but fragile due to deferred user reconciliation
+    # on sub. Enable it with care /!\
+    APPLICATION_ALLOW_USER_CREATION = values.BooleanValue(
+        False,
+        environ_name="APPLICATION_ALLOW_USER_CREATION",
+        environ_prefix=None,
+    )
 
     # pylint: disable=invalid-name
     @property

src/backend/meet/urls.py

@@ -15,6 +15,7 @@ from drf_spectacular.views import (
 urlpatterns = [
     path("admin/", admin.site.urls),
     path("", include("core.urls")),
+    path("", include("lasuite.oidc_resource_server.urls")),
 ]
 
 if settings.DEBUG:

src/backend/pyproject.toml

@@ -7,7 +7,7 @@ build-backend = "setuptools.build_meta"
 
 [project]
 name = "meet"
-version = "0.1.42"
+version = "1.0.1"
 authors = [{ "name" = "DINUM", "email" = "dev@mail.numerique.gouv.fr" }]
 classifiers = [
     "Development Status :: 5 - Production/Stable",
@@ -32,13 +32,13 @@ dependencies = [
     "django-configurations==2.5.1",
     "django-cors-headers==4.9.0",
     "django-countries==8.0.0",
-    "django-lasuite[all]==0.0.17",
+    "django-lasuite[all]==0.0.19",
     "django-parler==2.3",
     "redis==5.2.1",
     "django-redis==6.0.0",
     "django-storages[s3]==1.14.6",
     "django-timezone-field>=5.1",
-    "django==5.2.8",
+    "django==5.2.9",
     "djangorestframework==3.16.1",
     "drf_spectacular==0.29.0",
     "dockerflow==2024.4.2",

src/frontend/Dockerfile

@@ -38,7 +38,12 @@ RUN npm run build
 FROM nginxinc/nginx-unprivileged:alpine3.21 AS frontend-production
 
 USER root
-RUN apk update && apk upgrade libssl3 libcrypto3 libxml2>=2.12.7-r2 libxslt>=1.1.39-r2 libexpat>=2.7.2-r0
+RUN apk update && apk upgrade libssl3 \
+    libcrypto3 \
+    libxml2>=2.12.7-r2 \
+    libxslt>=1.1.39-r2 \
+    libexpat>=2.7.2-r0 \
+    libpng>=1.6.53-r0
 
 USER nginx
 

src/frontend/package-lock.json

@@ -1,12 +1,12 @@
 {
   "name": "meet",
-  "version": "0.1.42",
+  "version": "1.0.1",
   "lockfileVersion": 3,
   "requires": true,
   "packages": {
     "": {
       "name": "meet",
-      "version": "0.1.42",
+      "version": "1.0.1",
       "dependencies": {
         "@livekit/components-react": "2.9.13",
         "@livekit/components-styles": "1.1.6",
@@ -55,7 +55,7 @@
         "postcss": "8.5.6",
         "prettier": "3.6.2",
         "typescript": "5.8.3",
-        "vite": "7.0.2",
+        "vite": "7.0.8",
         "vite-tsconfig-paths": "5.1.4"
       }
     },
@@ -104,6 +104,7 @@
       "integrity": "sha512-UlLAnTPrFdNGoFtbSXwcGFQBtQZJCNjaN6hQNP3UPvuNXT1i82N26KL3dZeIpNalWywr9IuQuncaAfUaS1g6sQ==",
       "dev": true,
       "license": "MIT",
+      "peer": true,
       "dependencies": {
         "@ampproject/remapping": "^2.2.0",
         "@babel/code-frame": "^7.27.1",
@@ -3818,17 +3819,6 @@
         "win32"
       ]
     },
-    "node_modules/@rrweb/types": {
-      "version": "2.0.0-alpha.17",
-      "resolved": "https://registry.npmjs.org/@rrweb/types/-/types-2.0.0-alpha.17.tgz",
-      "integrity": "sha512-AfDTVUuCyCaIG0lTSqYtrZqJX39ZEYzs4fYKnexhQ+id+kbZIpIJtaut5cto6dWZbB3SEe4fW0o90Po3LvTmfg==",
-      "license": "MIT",
-      "optional": true,
-      "peer": true,
-      "dependencies": {
-        "rrweb-snapshot": "^2.0.0-alpha.17"
-      }
-    },
     "node_modules/@swc/helpers": {
       "version": "0.5.13",
       "resolved": "https://registry.npmjs.org/@swc/helpers/-/helpers-0.5.13.tgz",
@@ -3880,6 +3870,7 @@
       "resolved": "https://registry.npmjs.org/@tanstack/react-query/-/react-query-5.81.5.tgz",
       "integrity": "sha512-lOf2KqRRiYWpQT86eeeftAGnjuTR35myTP8MXyvHa81VlomoAWNEd8x5vkcAfQefu0qtYCvyqLropFZqgI2EQw==",
       "license": "MIT",
+      "peer": true,
       "dependencies": {
         "@tanstack/query-core": "5.81.5"
       },
@@ -3971,8 +3962,7 @@
       "version": "1.0.22",
       "resolved": "https://registry.npmjs.org/@types/dom-mediacapture-record/-/dom-mediacapture-record-1.0.22.tgz",
       "integrity": "sha512-mUMZLK3NvwRLcAAT9qmcK+9p7tpU2FHdDsntR3YI4+GY88XrgG4XiE7u1Q2LAN2/FZOz/tdMDC3GQCR4T8nFuw==",
-      "license": "MIT",
-      "peer": true
+      "license": "MIT"
     },
     "node_modules/@types/dom-mediacapture-transform": {
       "version": "0.1.11",
@@ -3988,8 +3978,7 @@
       "version": "0.1.15",
       "resolved": "https://registry.npmjs.org/@types/dom-webcodecs/-/dom-webcodecs-0.1.15.tgz",
       "integrity": "sha512-omOlCPvTWyPm4ZE5bZUhlSvnHM2ZWM2U+1cPiYFL/e8aV5O9MouELp+L4dMKNTON0nTeHqEg+KWDfFQMY5Wkaw==",
-      "license": "MIT",
-      "peer": true
+      "license": "MIT"
     },
     "node_modules/@types/estree": {
       "version": "1.0.8",
@@ -4016,6 +4005,7 @@
       "integrity": "sha512-B2egV9wALML1JCpv3VQoQ+yesQKAmNMBIAY7OteVrikcOcAkWm+dGL6qpeCktPjAv6N1JLnhbNiqS35UpFyBsQ==",
       "dev": true,
       "license": "MIT",
+      "peer": true,
       "dependencies": {
         "undici-types": "~6.21.0"
       }
@@ -4033,6 +4023,7 @@
       "integrity": "sha512-D2wOSq/d6Agt28q7rSI3jhU7G6aiuzljDGZ2hTZHIkrTLUI+AF3WMeKkEZ9nN2fkBAlcktT6vcZjDFiIhMYEQw==",
       "devOptional": true,
       "license": "MIT",
+      "peer": true,
       "dependencies": {
         "@types/prop-types": "*",
         "csstype": "^3.0.2"
@@ -4099,6 +4090,7 @@
       "integrity": "sha512-3MyiDfrfLeK06bi/g9DqJxP5pV74LNv4rFTyvGDmT3x2p1yp1lOd+qYZfiRPIOf/oON+WRZR5wxxuF85qOar+w==",
       "dev": true,
       "license": "MIT",
+      "peer": true,
       "dependencies": {
         "@typescript-eslint/scope-manager": "8.35.1",
         "@typescript-eslint/types": "8.35.1",
@@ -4390,6 +4382,7 @@
       "resolved": "https://registry.npmjs.org/acorn/-/acorn-8.12.1.tgz",
       "integrity": "sha512-tcpGyI9zbizT9JbV6oYE477V6mTlXvvi0T0G3SNIYE2apm/G5huBa1+K89VGeovbg+jycCrfhl3ADxErOuO6Jg==",
       "dev": true,
+      "peer": true,
       "bin": {
         "acorn": "bin/acorn"
       },
@@ -4804,6 +4797,7 @@
           "url": "https://github.com/sponsors/ai"
         }
       ],
+      "peer": true,
       "dependencies": {
         "caniuse-lite": "^1.0.30001646",
         "electron-to-chromium": "^1.5.4",
@@ -5613,6 +5607,7 @@
       "resolved": "https://registry.npmjs.org/eslint/-/eslint-8.57.0.tgz",
       "integrity": "sha512-dZ6+mexnaTIbSBZWgou51U6OmzIhYM2VcNdtiTtI7qPNZm35Akpr0f6vtw3w1Kmn5PYo+tZVfh13WrhpS6oLqQ==",
       "dev": true,
+      "peer": true,
       "dependencies": {
         "@eslint-community/eslint-utils": "^4.2.0",
         "@eslint-community/regexpp": "^4.6.1",
@@ -6580,6 +6575,7 @@
         }
       ],
       "license": "MIT",
+      "peer": true,
       "dependencies": {
         "@babel/runtime": "^7.27.6"
       },
@@ -7464,6 +7460,7 @@
       "resolved": "https://registry.npmjs.org/livekit-client/-/livekit-client-2.15.7.tgz",
       "integrity": "sha512-19m8Q1cvRl5PslRawDUgWXeP8vL8584tX8kiZEJaPZo83U/L6VPS/O7pP06phfJaBWeeV8sAOVtEPlQiZEHtpg==",
       "license": "Apache-2.0",
+      "peer": true,
       "dependencies": {
         "@livekit/mutex": "1.1.1",
         "@livekit/protocol": "1.39.3",
@@ -8123,6 +8120,7 @@
         }
       ],
       "license": "MIT",
+      "peer": true,
       "dependencies": {
         "nanoid": "^3.3.11",
         "picocolors": "^1.1.1",
@@ -8236,6 +8234,7 @@
       "integrity": "sha512-Q8qQfPiZ+THO/3ZrOrO0cJJKfpYCagtMUkXbnEfmgUjwXg6z/WBeOyS9APBBPCTSiDV+s4SwQGu8yFsiMRIudg==",
       "dev": true,
       "license": "MIT",
+      "peer": true,
       "dependencies": {
         "cssesc": "^3.0.0",
         "util-deprecate": "^1.0.2"
@@ -8389,6 +8388,7 @@
       "resolved": "https://registry.npmjs.org/react/-/react-18.3.1.tgz",
       "integrity": "sha512-wS+hAgJShR0KhEvPJArfuPVN1+Hz1t0Y6n5jLrGQbkb4urgPE/0Rve+1kMB1v/oWgHgm4WIcV+i7F2pTVj+2iQ==",
       "license": "MIT",
+      "peer": true,
       "dependencies": {
         "loose-envify": "^1.1.0"
       },
@@ -8495,6 +8495,7 @@
       "resolved": "https://registry.npmjs.org/react-dom/-/react-dom-18.3.1.tgz",
       "integrity": "sha512-5m4nQKp+rZRb09LNH59GM4BxTh9251/ylbKIbpe7TpGxfJ+9kv6BLkLBXIjjspbgbnIBNqlI23tRnTWT0snUIw==",
       "license": "MIT",
+      "peer": true,
       "dependencies": {
         "loose-envify": "^1.1.0",
         "scheduler": "^0.23.2"
@@ -8744,7 +8745,6 @@
       "integrity": "sha512-GBg5pV8LHOTbeVmH2VHLEFR0mc2QpQMzAvcoxEGfPNWgWHc8UvKCyq7pqN1vA+fDZ+yXXbixeO0kB2pzVvFCBw==",
       "license": "MIT",
       "optional": true,
-      "peer": true,
       "dependencies": {
         "postcss": "^8.4.38"
       }
@@ -9248,6 +9248,7 @@
       "integrity": "sha512-M7BAV6Rlcy5u+m6oPhAPFgJTzAioX/6B0DxyvDlo9l8+T3nLKbrczg2WLUyzd45L8RqfUMyGPzekbMvX2Ldkwg==",
       "dev": true,
       "license": "MIT",
+      "peer": true,
       "engines": {
         "node": ">=12"
       },
@@ -9366,7 +9367,8 @@
       "version": "2.8.1",
       "resolved": "https://registry.npmjs.org/tslib/-/tslib-2.8.1.tgz",
       "integrity": "sha512-oJFu94HQb+KVduSUQL7wnpmqnfmLsOA/nAh6b6EH0wCEoK0/mPeXU6c3wKDV83MkOuHPRHtSXKKU99IBazS/2w==",
-      "license": "0BSD"
+      "license": "0BSD",
+      "peer": true
     },
     "node_modules/type-check": {
       "version": "0.4.0",
@@ -9478,6 +9480,7 @@
       "resolved": "https://registry.npmjs.org/typescript/-/typescript-5.8.3.tgz",
       "integrity": "sha512-p1diW6TqL9L07nNxvRMM7hMMw4c5XOo/1ibL4aAIGmSAt9slTE1Xgw5KWuof2uTOvCg9BY7ZRi+GaF+7sfgPeQ==",
       "license": "Apache-2.0",
+      "peer": true,
       "bin": {
         "tsc": "bin/tsc",
         "tsserver": "bin/tsserver"
@@ -9638,6 +9641,7 @@
       "resolved": "https://registry.npmjs.org/valtio/-/valtio-2.1.5.tgz",
       "integrity": "sha512-vsh1Ixu5mT0pJFZm+Jspvhga5GzHUTYv0/+Th203pLfh3/wbHwxhu/Z2OkZDXIgHfjnjBns7SN9HNcbDvPmaGw==",
       "license": "MIT",
+      "peer": true,
       "dependencies": {
         "proxy-compare": "^3.0.1"
       },
@@ -9733,15 +9737,16 @@
       }
     },
     "node_modules/vite": {
-      "version": "7.0.2",
-      "resolved": "https://registry.npmjs.org/vite/-/vite-7.0.2.tgz",
-      "integrity": "sha512-hxdyZDY1CM6SNpKI4w4lcUc3Mtkd9ej4ECWVHSMrOdSinVc2zYOAppHeGc/hzmRo3pxM5blMzkuWHOJA/3NiFw==",
+      "version": "7.0.8",
+      "resolved": "https://registry.npmjs.org/vite/-/vite-7.0.8.tgz",
+      "integrity": "sha512-cJBdq0/u+8rgstg9t7UkBilf8ipLmeXJO30NxD5HAHOivnj10ocV8YtR/XBvd2wQpN3TmcaxNKaHX3tN7o5F5A==",
       "dev": true,
       "license": "MIT",
+      "peer": true,
       "dependencies": {
         "esbuild": "^0.25.0",
         "fdir": "^6.4.6",
-        "picomatch": "^4.0.2",
+        "picomatch": "^4.0.3",
         "postcss": "^8.5.6",
         "rollup": "^4.40.0",
         "tinyglobby": "^0.2.14"
@@ -9849,11 +9854,14 @@
       }
     },
     "node_modules/vite/node_modules/fdir": {
-      "version": "6.4.6",
-      "resolved": "https://registry.npmjs.org/fdir/-/fdir-6.4.6.tgz",
-      "integrity": "sha512-hiFoqpyZcfNm1yc4u8oWCf9A2c4D3QjCrks3zmoVKVxpQRzmPNar1hUJcBG2RQHvEVGDN+Jm81ZheVLAQMK6+w==",
+      "version": "6.5.0",
+      "resolved": "https://registry.npmjs.org/fdir/-/fdir-6.5.0.tgz",
+      "integrity": "sha512-tIbYtZbucOs0BRGqPJkshJUYdL+SDH7dVM8gjy+ERp3WAUjLEFJE+02kanyHtwjWOnwrKYBiwAmM0p4kLJAnXg==",
       "dev": true,
       "license": "MIT",
+      "engines": {
+        "node": ">=12.0.0"
+      },
       "peerDependencies": {
         "picomatch": "^3 || ^4"
       },
@@ -9864,11 +9872,12 @@
       }
     },
     "node_modules/vite/node_modules/picomatch": {
-      "version": "4.0.2",
-      "resolved": "https://registry.npmjs.org/picomatch/-/picomatch-4.0.2.tgz",
-      "integrity": "sha512-M7BAV6Rlcy5u+m6oPhAPFgJTzAioX/6B0DxyvDlo9l8+T3nLKbrczg2WLUyzd45L8RqfUMyGPzekbMvX2Ldkwg==",
+      "version": "4.0.3",
+      "resolved": "https://registry.npmjs.org/picomatch/-/picomatch-4.0.3.tgz",
+      "integrity": "sha512-5gTmgEY/sqK6gFXLIsQNH19lWb4ebPDLA4SdLP7dsWkIXHWlG66oPuVvXSGFPppYZz8ZDZq0dYYrbHfBCVUb1Q==",
       "dev": true,
       "license": "MIT",
+      "peer": true,
       "engines": {
         "node": ">=12"
       },

src/frontend/package.json

@@ -1,7 +1,7 @@
 {
   "name": "meet",
   "private": true,
-  "version": "0.1.42",
+  "version": "1.0.1",
   "type": "module",
   "scripts": {
     "dev": "panda codegen && vite",
@@ -60,7 +60,7 @@
     "postcss": "8.5.6",
     "prettier": "3.6.2",
     "typescript": "5.8.3",
-    "vite": "7.0.2",
+    "vite": "7.0.8",
     "vite-tsconfig-paths": "5.1.4"
   }
 }

src/frontend/src/components/Avatar.tsx

@@ -68,6 +68,7 @@ export const Avatar = ({
       {...props}
     >
       <span
+        aria-hidden="true"
         className={css({
           marginTop: '-0.3rem',
         })}

src/frontend/src/features/auth/utils/authUrl.ts

@@ -5,6 +5,6 @@ export const authUrl = ({
   returnTo = window.location.href,
 } = {}) => {
   return apiUrl(
-    `/authenticate?silent=${encodeURIComponent(silent)}&returnTo=${encodeURIComponent(returnTo)}`
+    `/authenticate/?silent=${encodeURIComponent(silent)}&returnTo=${encodeURIComponent(returnTo)}`
   )
 }

src/frontend/src/features/rooms/components/Conference.tsx

@@ -30,6 +30,7 @@ import { MediaDeviceErrorAlert } from './MediaDeviceErrorAlert'
 import { usePostHog } from 'posthog-js/react'
 import { useConfig } from '@/api/useConfig'
 import { isFireFox } from '@/utils/livekit'
+import { useIsMobile } from '@/utils/useIsMobile'
 
 export const Conference = ({
   roomId,
@@ -169,6 +170,8 @@ export const Conference = ({
     kind: null,
   })
 
+  const isMobile = useIsMobile()
+
   /*
    * Ensure stable WebSocket connection URL. This is critical for legacy browser compatibility
    * (Firefox <124, Chrome <125, Edge <125) where HTTPS URLs in WebSocket() constructor
@@ -238,7 +241,7 @@ export const Conference = ({
           }}
         >
           <VideoConference />
-          {showInviteDialog && (
+          {showInviteDialog && !isMobile && (
             <InviteDialog
               isOpen={showInviteDialog}
               onOpenChange={setShowInviteDialog}

src/frontend/src/features/rooms/components/InviteDialog.tsx

@@ -67,7 +67,7 @@ export const InviteDialog = (props: Omit<DialogProps, 'title'>) => {
           gap={0}
           style={{ maxWidth: '100%', overflow: 'hidden' }}
         >
-          <Heading slot="title" level={3} className={text({ variant: 'h2' })}>
+          <Heading slot="title" level={2} className={text({ variant: 'h2' })}>
             {t('heading')}
           </Heading>
           <Div position="absolute" top="5" right="5">

src/frontend/src/features/rooms/livekit/components/FullScreenShareWarning.tsx

@@ -113,6 +113,7 @@ export const FullScreenShareWarning = ({
                 display: 'flex',
                 flexDirection: 'row',
                 gap: '1rem',
+                zIndex: '1000',
               })}
             >
               <Button

src/frontend/src/features/rooms/livekit/components/KeyboardShortcutHint.tsx

@@ -0,0 +1,32 @@
+import React, { ReactNode } from 'react'
+import { css } from '@/styled-system/css'
+
+export interface KeyboardShortcutHintProps {
+  children: ReactNode
+}
+
+/**
+ * Small reusable bubble used to display and announce keyboard shortcuts,
+ * typically when an element receives keyboard focus.
+ */
+export const KeyboardShortcutHint: React.FC<KeyboardShortcutHintProps> = ({
+  children,
+}) => {
+  return (
+    <div
+      className={css({
+        position: 'absolute',
+        top: '0.75rem',
+        right: '0.75rem',
+        backgroundColor: 'rgba(0,0,0,0.5)',
+        color: 'white',
+        borderRadius: 'calc(var(--lk-border-radius) / 2)',
+        paddingInline: '0.5rem',
+        paddingBlock: '0.1rem',
+        fontSize: '0.875rem',
+      })}
+    >
+      {children}
+    </div>
+  )
+}

src/frontend/src/features/rooms/livekit/components/ParticipantName.tsx

@@ -35,6 +35,7 @@ export const ParticipantName = ({
       style={{
         paddingBottom: '0.1rem',
       }}
+      aria-hidden="true"
     >
       {displayedName}
     </Text>

src/frontend/src/features/rooms/livekit/components/ParticipantTile.tsx

@@ -29,6 +29,9 @@ import { ParticipantPlaceholder } from './ParticipantPlaceholder'
 import { ParticipantTileFocus } from './ParticipantTileFocus'
 import { FullScreenShareWarning } from './FullScreenShareWarning'
 import { ParticipantName } from './ParticipantName'
+import { getParticipantName } from '@/features/rooms/utils/getParticipantName'
+import { useTranslation } from 'react-i18next'
+import { KeyboardShortcutHint } from './KeyboardShortcutHint'
 
 export function TrackRefContextIfNeeded(
   props: React.PropsWithChildren<{
@@ -102,9 +105,31 @@ export const ParticipantTile: (
   })
 
   const isScreenShare = trackReference.source != Track.Source.Camera
+  const [hasKeyboardFocus, setHasKeyboardFocus] = React.useState(false)
+
+  const participantName = getParticipantName(trackReference.participant)
+  const { t } = useTranslation('rooms', { keyPrefix: 'participantTileFocus' })
+
+  const interactiveProps = {
+    ...elementProps,
+    // Ensure the tile is focusable to expose contextual controls to keyboard users.
+    tabIndex: 0,
+    'aria-label': t('containerLabel', { name: participantName }),
+    onFocus: (event: React.FocusEvent<HTMLDivElement>) => {
+      elementProps.onFocus?.(event)
+      setHasKeyboardFocus(true)
+    },
+    onBlur: (event: React.FocusEvent<HTMLDivElement>) => {
+      elementProps.onBlur?.(event)
+      const nextTarget = event.relatedTarget as Node | null
+      if (!event.currentTarget.contains(nextTarget)) {
+        setHasKeyboardFocus(false)
+      }
+    },
+  }
 
   return (
-    <div ref={ref} style={{ position: 'relative' }} {...elementProps}>
+    <div ref={ref} style={{ position: 'relative' }} {...interactiveProps}>
       <TrackRefContextIfNeeded trackRef={trackReference}>
         <ParticipantContextIfNeeded participant={trackReference.participant}>
           <FullScreenShareWarning trackReference={trackReference} />
@@ -195,10 +220,16 @@ export const ParticipantTile: (
             </>
           )}
           {!disableMetadata && (
-            <ParticipantTileFocus trackRef={trackReference} />
+            <ParticipantTileFocus
+              trackRef={trackReference}
+              hasKeyboardFocus={hasKeyboardFocus}
+            />
           )}
         </ParticipantContextIfNeeded>
       </TrackRefContextIfNeeded>
+      {hasKeyboardFocus && (
+        <KeyboardShortcutHint>{t('toolbarHint')}</KeyboardShortcutHint>
+      )}
     </div>
   )
 })

src/frontend/src/features/rooms/livekit/components/ParticipantTileFocus.tsx

@@ -131,8 +131,10 @@ const MOUSE_IDLE_TIME = 3000
 
 export const ParticipantTileFocus = ({
   trackRef,
+  hasKeyboardFocus,
 }: {
   trackRef: TrackReferenceOrPlaceholder
+  hasKeyboardFocus: boolean
 }) => {
   const [hovered, setHovered] = useState(false)
   const [opacity, setOpacity] = useState(0)
@@ -140,8 +142,10 @@ export const ParticipantTileFocus = ({
   const idleTimerRef = useRef<number | null>(null)
   const [isIdleRef, setIsIdleRef] = useState(false)
 
+  const isVisible = hasKeyboardFocus || (hovered && !isIdleRef)
+
   useEffect(() => {
-    if (hovered && !isIdleRef) {
+    if (isVisible) {
       // Wait for next frame to ensure element is mounted
       requestAnimationFrame(() => {
         setOpacity(0.6)
@@ -149,7 +153,7 @@ export const ParticipantTileFocus = ({
     } else {
       setOpacity(0)
     }
-  }, [hovered, isIdleRef])
+  }, [isVisible])
 
   const handleMouseMove = () => {
     if (idleTimerRef.current) {
@@ -180,11 +184,12 @@ export const ParticipantTileFocus = ({
         width: '100%',
         height: '100%',
       })}
+      aria-hidden={!isVisible}
       onMouseEnter={() => setHovered(true)}
       onMouseLeave={() => setHovered(false)}
       onMouseMove={handleMouseMove}
     >
-      {hovered && (
+      {isVisible && (
         <div
           className={css({
             backgroundColor: 'primaryDark.50',

src/frontend/src/features/rooms/livekit/components/controls/Device/ToggleDevice.tsx

@@ -93,7 +93,7 @@ export const ToggleDevice = <T extends ToggleSource>({
     isDisabled: cannotUseDevice,
   })
   useLongPress({
-    keyCode: kind === 'audioinput' ? 'Space' : undefined,
+    keyCode: kind === 'audioinput' ? 'KeyV' : undefined,
     onKeyDown,
     onKeyUp,
     isDisabled: cannotUseDevice,

src/frontend/src/features/rooms/livekit/prefabs/Chat.tsx

@@ -1,5 +1,5 @@
 import type { ChatMessage, ChatOptions } from '@livekit/components-core'
-import * as React from 'react'
+import React, { useEffect } from 'react'
 import {
   formatChatMessageLinks,
   useChat,
@@ -36,6 +36,36 @@ export function Chat({ ...props }: ChatProps) {
   const { isChatOpen } = useSidePanel()
   const chatSnap = useSnapshot(chatStore)
 
+  // Keep track of the element that opened the chat so we can restore focus
+  // when the chat panel is closed.
+  const prevIsChatOpenRef = React.useRef(false)
+  const chatTriggerRef = React.useRef<HTMLElement | null>(null)
+
+  useEffect(() => {
+    const wasChatOpen = prevIsChatOpenRef.current
+    const isChatPanelOpen = isChatOpen
+
+    // Chat just opened
+    if (!wasChatOpen && isChatPanelOpen) {
+      chatTriggerRef.current = document.activeElement as HTMLElement | null
+      // Avoid layout "jump" during the side panel slide-in animation.
+      // Focusing can trigger scroll into view; preventScroll keeps the animation smooth.
+      requestAnimationFrame(() => {
+        inputRef.current?.focus({ preventScroll: true })
+      })
+    }
+    // Chat just closed
+    if (wasChatOpen && !isChatPanelOpen) {
+      const trigger = chatTriggerRef.current
+      if (trigger && document.contains(trigger)) {
+        trigger.focus({ preventScroll: true })
+      }
+      chatTriggerRef.current = null
+    }
+
+    prevIsChatOpenRef.current = isChatPanelOpen
+  }, [isChatOpen])
+
   // Use useParticipants hook to trigger a re-render when the participant list changes.
   const participants = useParticipants()
 
@@ -45,7 +75,7 @@ export function Chat({ ...props }: ChatProps) {
   async function handleSubmit(text: string) {
     if (!send || !text) return
     await send(text)
-    inputRef?.current?.focus()
+    inputRef?.current?.focus({ preventScroll: true })
   }
 
   // TEMPORARY: This is a brittle workaround that relies on message count tracking

src/frontend/src/features/rooms/livekit/prefabs/ControlBar/DesktopControlBar.tsx

@@ -11,6 +11,7 @@ import { OptionsButton } from '../../components/controls/Options/OptionsButton'
 import { StartMediaButton } from '../../components/controls/StartMediaButton'
 import { MoreOptions } from './MoreOptions'
 import { useRef } from 'react'
+import { useRegisterKeyboardShortcut } from '@/features/shortcuts/useRegisterKeyboardShortcut'
 import { VideoDeviceControl } from '../../components/controls/Device/VideoDeviceControl'
 import { AudioDevicesControl } from '../../components/controls/Device/AudioDevicesControl'
 
@@ -19,6 +20,18 @@ export function DesktopControlBar({
 }: Readonly<ControlBarAuxProps>) {
   const browserSupportsScreenSharing = supportsScreenSharing()
   const desktopControlBarEl = useRef<HTMLDivElement>(null)
+
+  useRegisterKeyboardShortcut({
+    shortcut: { key: 'F2' },
+    handler: () => {
+      const root = desktopControlBarEl.current
+      if (!root) return
+      const firstButton = root.querySelector<HTMLButtonElement>(
+        'button, [role="button"], [tabindex="0"]'
+      )
+      firstButton?.focus()
+    },
+  })
   return (
     <div
       ref={desktopControlBarEl}

src/frontend/src/locales/de/global.json

@@ -7,7 +7,7 @@
   },
   "feedback": {
     "context": "Produkt in Entwicklung — Ihr Feedback ist wichtig!",
-    "cta": "Teilen Sie uns Ihre Meinung mit"
+    "cta": "Teilen Sie uns Ihre Meinung mit - neues Fenster"
   },
   "forbidden": {
     "heading": "Zugriff verweigert"

src/frontend/src/locales/de/rooms.json

@@ -512,6 +512,8 @@
     }
   },
   "participantTileFocus": {
+    "containerLabel": "Optionen für {{name}}",
+    "toolbarHint": "F2: zur Symbolleiste unten.",
     "pin": {
       "enable": "Anheften",
       "disable": "Lösen"

src/frontend/src/locales/en/global.json

@@ -7,7 +7,7 @@
   },
   "feedback": {
     "context": "Product under development — your input matters!",
-    "cta": "Share your feedback"
+    "cta": "Share your feedback - new tab"
   },
   "forbidden": {
     "heading": "You don't have the permission to view this page"

src/frontend/src/locales/en/rooms.json

@@ -512,6 +512,8 @@
     }
   },
   "participantTileFocus": {
+    "containerLabel": "Options for {{name}}",
+    "toolbarHint": "F2: go to the bottom toolbar.",
     "pin": {
       "enable": "Pin",
       "disable": "Unpin"

src/frontend/src/locales/fr/global.json

@@ -7,7 +7,7 @@
   },
   "feedback": {
     "context": "Produit en cours de développement — votre avis compte !",
-    "cta": "Partagez votre avis"
+    "cta": "Partagez votre avis - nouvelle fenêtre"
   },
   "forbidden": {
     "heading": "Accès interdit"

src/frontend/src/locales/fr/rooms.json

@@ -512,6 +512,8 @@
     }
   },
   "participantTileFocus": {
+    "containerLabel": "Options pour {{name}}",
+    "toolbarHint": "F2 : raccourci barre d'outils en bas.",
     "pin": {
       "enable": "Épingler",
       "disable": "Annuler l'épinglage"

src/frontend/src/locales/nl/global.json

@@ -7,7 +7,7 @@
   },
   "feedback": {
     "context": "Product in ontwikkeling - uw input is belangrijk!",
-    "cta": "Deel uw feedback"
+    "cta": "Deel uw feedback - nieuw tabblad"
   },
   "forbidden": {
     "heading": "U hebt geen toestemming om deze pagina te bekijken"

src/frontend/src/locales/nl/rooms.json

@@ -512,6 +512,8 @@
     }
   },
   "participantTileFocus": {
+    "containerLabel": "Opties voor {{name}}",
+    "toolbarHint": "F2: naar de werkbalk onderaan.",
     "pin": {
       "enable": "Pinnen",
       "disable": "Losmaken"

src/mail/package-lock.json

@@ -1,12 +1,12 @@
 {
   "name": "mail_mjml",
-  "version": "0.1.42",
+  "version": "1.0.1",
   "lockfileVersion": 3,
   "requires": true,
   "packages": {
     "": {
       "name": "mail_mjml",
-      "version": "0.1.42",
+      "version": "1.0.1",
       "license": "MIT",
       "dependencies": {
         "@html-to/text-cli": "0.5.4",

src/mail/package.json

@@ -1,6 +1,6 @@
 {
   "name": "mail_mjml",
-  "version": "0.1.42",
+  "version": "1.0.1",
   "description": "An util to generate html and text django's templates from mjml templates",
   "type": "module",
   "dependencies": {

src/sdk/consumer/package.json

@@ -24,6 +24,6 @@
     "globals": "16.3.0",
     "typescript": "5.8.3",
     "typescript-eslint": "8.35.1",
-    "vite": "7.0.2"
+    "vite": "7.0.8"
   }
 }

src/sdk/library/package.json

@@ -46,7 +46,7 @@
     "sass": "1.89.2",
     "prettier": "3.6.2",
     "typescript": "5.8.3",
-    "vite": "7.0.2",
+    "vite": "7.0.8",
     "vite-plugin-dts": "4.5.4"
   }
 }

src/sdk/package-lock.json

@@ -1,12 +1,12 @@
 {
   "name": "sdk",
-  "version": "0.1.42",
+  "version": "1.0.1",
   "lockfileVersion": 3,
   "requires": true,
   "packages": {
     "": {
       "name": "sdk",
-      "version": "0.1.42",
+      "version": "1.0.1",
       "license": "ISC",
       "workspaces": [
         "./library",
@@ -30,7 +30,7 @@
         "globals": "16.3.0",
         "typescript": "5.8.3",
         "typescript-eslint": "8.35.1",
-        "vite": "7.0.2"
+        "vite": "7.0.8"
       }
     },
     "consumer/node_modules/@eslint/js": {
@@ -103,7 +103,7 @@
         "prettier": "3.6.2",
         "sass": "1.89.2",
         "typescript": "5.8.3",
-        "vite": "7.0.2",
+        "vite": "7.0.8",
         "vite-plugin-dts": "4.5.4"
       }
     },
@@ -6677,15 +6677,15 @@
       }
     },
     "node_modules/vite": {
-      "version": "7.0.2",
-      "resolved": "https://registry.npmjs.org/vite/-/vite-7.0.2.tgz",
-      "integrity": "sha512-hxdyZDY1CM6SNpKI4w4lcUc3Mtkd9ej4ECWVHSMrOdSinVc2zYOAppHeGc/hzmRo3pxM5blMzkuWHOJA/3NiFw==",
+      "version": "7.0.8",
+      "resolved": "https://registry.npmjs.org/vite/-/vite-7.0.8.tgz",
+      "integrity": "sha512-cJBdq0/u+8rgstg9t7UkBilf8ipLmeXJO30NxD5HAHOivnj10ocV8YtR/XBvd2wQpN3TmcaxNKaHX3tN7o5F5A==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
         "esbuild": "^0.25.0",
         "fdir": "^6.4.6",
-        "picomatch": "^4.0.2",
+        "picomatch": "^4.0.3",
         "postcss": "^8.5.6",
         "rollup": "^4.40.0",
         "tinyglobby": "^0.2.14"
@@ -6779,11 +6779,14 @@
       }
     },
     "node_modules/vite/node_modules/fdir": {
-      "version": "6.4.6",
-      "resolved": "https://registry.npmjs.org/fdir/-/fdir-6.4.6.tgz",
-      "integrity": "sha512-hiFoqpyZcfNm1yc4u8oWCf9A2c4D3QjCrks3zmoVKVxpQRzmPNar1hUJcBG2RQHvEVGDN+Jm81ZheVLAQMK6+w==",
+      "version": "6.5.0",
+      "resolved": "https://registry.npmjs.org/fdir/-/fdir-6.5.0.tgz",
+      "integrity": "sha512-tIbYtZbucOs0BRGqPJkshJUYdL+SDH7dVM8gjy+ERp3WAUjLEFJE+02kanyHtwjWOnwrKYBiwAmM0p4kLJAnXg==",
       "dev": true,
       "license": "MIT",
+      "engines": {
+        "node": ">=12.0.0"
+      },
       "peerDependencies": {
         "picomatch": "^3 || ^4"
       },
@@ -6794,9 +6797,9 @@
       }
     },
     "node_modules/vite/node_modules/picomatch": {
-      "version": "4.0.2",
-      "resolved": "https://registry.npmjs.org/picomatch/-/picomatch-4.0.2.tgz",
-      "integrity": "sha512-M7BAV6Rlcy5u+m6oPhAPFgJTzAioX/6B0DxyvDlo9l8+T3nLKbrczg2WLUyzd45L8RqfUMyGPzekbMvX2Ldkwg==",
+      "version": "4.0.3",
+      "resolved": "https://registry.npmjs.org/picomatch/-/picomatch-4.0.3.tgz",
+      "integrity": "sha512-5gTmgEY/sqK6gFXLIsQNH19lWb4ebPDLA4SdLP7dsWkIXHWlG66oPuVvXSGFPppYZz8ZDZq0dYYrbHfBCVUb1Q==",
       "dev": true,
       "license": "MIT",
       "engines": {

src/sdk/package.json

@@ -1,6 +1,6 @@
 {
   "name": "sdk",
-  "version": "0.1.42",
+  "version": "1.0.1",
   "author": "",
   "license": "ISC",
   "description": "",

src/summary/pyproject.toml

@@ -1,7 +1,7 @@
 
 [project]
 name = "summary"
-version = "0.1.42"
+version = "1.0.1"
 dependencies = [
     "fastapi[standard]>=0.105.0",
     "uvicorn>=0.24.0",
@@ -15,6 +15,7 @@ dependencies = [
     "posthog==6.9.1",
     "requests==2.32.5",
     "sentry-sdk[fastapi, celery]==2.43.0",
+    "langfuse==3.10.6"
 ]
 
 [project.optional-dependencies]

src/summary/summary/core/celery_worker.py

@@ -7,7 +7,7 @@ import os
 import tempfile
 import time
 from pathlib import Path
-from typing import Any, Mapping, Optional
+from typing import Optional
 
 import openai
 import sentry_sdk
@@ -21,6 +21,7 @@ from urllib3.util import Retry
 
 from summary.core.analytics import MetadataManager, get_analytics
 from summary.core.config import get_settings
+from summary.core.llm_service import LLMException, LLMObservability, LLMService
 from summary.core.prompt import (
     FORMAT_NEXT_STEPS,
     FORMAT_PLAN,
@@ -31,6 +32,7 @@ from summary.core.prompt import (
     PROMPT_SYSTEM_TLDR,
     PROMPT_USER_PART,
 )
+from summary.core.transcript_formatter import TranscriptFormatter
 
 settings = get_settings()
 analytics = get_analytics()
@@ -39,6 +41,7 @@ metadata_manager = MetadataManager()
 
 logger = get_task_logger(__name__)
 
+
 celery = Celery(
     __name__,
     broker=settings.celery_broker_url,
@@ -56,28 +59,6 @@ if settings.sentry_dsn and settings.sentry_is_enabled:
         sentry_sdk.init(dsn=settings.sentry_dsn, enable_tracing=True)
 
 
-DEFAULT_EMPTY_TRANSCRIPTION = """
-**Aucun contenu audio n’a été détecté dans votre transcription.**
-
-
-*Si vous pensez qu’il s’agit d’une erreur, n’hésitez pas à contacter
-notre support technique : visio@numerique.gouv.fr*
-
-.
-
-.
-
-.
-
-Quelques points que nous vous conseillons de vérifier :
-- Un micro était-il activé ?
-- Étiez-vous suffisamment proche ?
-- Le micro est-il de bonne qualité ?
-- L’enregistrement dure-t-il plus de 30 secondes ?
-
-"""
-
-
 class AudioValidationError(Exception):
     """Custom exception for audio validation errors."""
 
@@ -104,50 +85,6 @@ def create_retry_session():
     return session
 
 
-class LLMException(Exception):
-    """LLM call failed."""
-
-
-class LLMService:
-    """Service for performing calls to the LLM configured in the settings."""
-
-    def __init__(self):
-        """Init the LLMService once."""
-        self._client = openai.OpenAI(
-            base_url=settings.llm_base_url, api_key=settings.llm_api_key
-        )
-
-    def call(
-        self,
-        system_prompt: str,
-        user_prompt: str,
-        response_format: Optional[Mapping[str, Any]] = None,
-    ):
-        """Call the LLM service.
-
-        Takes a system prompt and a user prompt, and returns the LLM's response
-        Returns None if the call fails.
-        """
-        try:
-            params: dict[str, Any] = {
-                "model": settings.llm_model,
-                "messages": [
-                    {"role": "system", "content": system_prompt},
-                    {"role": "user", "content": user_prompt},
-                ],
-            }
-            if response_format is not None:
-                params["response_format"] = response_format
-
-            response = self._client.chat.completions.create(**params)
-
-            return response.choices[0].message.content
-
-        except Exception as e:
-            logger.exception("LLM call failed: %s", e)
-            raise LLMException("LLM call failed: {e}") from e
-
-
 def format_actions(llm_output: dict) -> str:
     """Format the actions from the LLM output into a markdown list.
 
@@ -166,40 +103,12 @@ def format_actions(llm_output: dict) -> str:
     return ""
 
 
-def format_segments(transcription_data):
-    """Format transcription segments from WhisperX into a readable conversation format.
-
-    Processes transcription data with segments containing speaker information and text,
-    combining consecutive segments from the same speaker and formatting them as a
-    conversation with speaker labels.
-    """
-    formatted_output = ""
-    if not transcription_data or not hasattr(transcription_data, "segments"):
-        if isinstance(transcription_data, dict) and "segments" in transcription_data:
-            segments = transcription_data["segments"]
-        else:
-            return "Error: Invalid transcription data format"
-    else:
-        segments = transcription_data.segments
-
-    previous_speaker = None
-
-    for segment in segments:
-        speaker = segment.get("speaker", "UNKNOWN_SPEAKER")
-        text = segment.get("text", "")
-        if text:
-            if speaker != previous_speaker:
-                formatted_output += f"\n\n **{speaker}**: {text}"
-            else:
-                formatted_output += f" {text}"
-            previous_speaker = speaker
-    return formatted_output
-
-
 def post_with_retries(url, data):
     """Send POST request with automatic retries."""
     session = create_retry_session()
-    session.headers.update({"Authorization": f"Bearer {settings.webhook_api_token}"})
+    session.headers.update(
+        {"Authorization": f"Bearer {settings.webhook_api_token.get_secret_value()}"}
+    )
     try:
         response = session.post(url, json=data)
         response.raise_for_status()
@@ -246,7 +155,7 @@ def process_audio_transcribe_summarize_v2(
     minio_client = Minio(
         settings.aws_s3_endpoint_url,
         access_key=settings.aws_s3_access_key_id,
-        secret_key=settings.aws_s3_secret_access_key,
+        secret_key=settings.aws_s3_secret_access_key.get_secret_value(),
         secure=settings.aws_s3_secure_access,
     )
 
@@ -277,7 +186,7 @@ def process_audio_transcribe_summarize_v2(
 
     logger.info("Initiating WhisperX client")
     whisperx_client = openai.OpenAI(
-        api_key=settings.whisperx_api_key,
+        api_key=settings.whisperx_api_key.get_secret_value(),
         base_url=settings.whisperx_base_url,
         max_retries=settings.whisperx_max_retries,
     )
@@ -306,25 +215,20 @@ def process_audio_transcribe_summarize_v2(
             os.remove(temp_file_path)
             logger.debug("Temporary file removed: %s", temp_file_path)
 
-    formatted_transcription = (
-        DEFAULT_EMPTY_TRANSCRIPTION
-        if not transcription.segments
-        else format_segments(transcription)
-    )
-
     metadata_manager.track_transcription_metadata(task_id, transcription)
 
-    if not room or not recording_date or not recording_time:
-        title = settings.document_default_title
-    else:
-        title = settings.document_title_template.format(
-            room=room,
-            room_recording_date=recording_date,
-            room_recording_time=recording_time,
-        )
+    formatter = TranscriptFormatter()
+
+    content, title = formatter.format(
+        transcription,
+        room=room,
+        recording_date=recording_date,
+        recording_time=recording_time,
+    )
+
     data = {
         "title": title,
-        "content": formatted_transcription,
+        "content": content,
         "email": email,
         "sub": sub,
     }
@@ -356,7 +260,7 @@ def process_audio_transcribe_summarize_v2(
     ):
         logger.info("Queuing summary generation task.")
         summarize_transcription.apply_async(
-            args=[formatted_transcription, email, sub, title],
+            args=[owner_id, content, email, sub, title],
             queue=settings.summarize_queue,
         )
     else:
@@ -388,7 +292,9 @@ def task_failure_handler(task_id, exception=None, **kwargs):
     max_retries=settings.celery_max_retries,
     queue=settings.summarize_queue,
 )
-def summarize_transcription(self, transcript: str, email: str, sub: str, title: str):
+def summarize_transcription(
+    self, owner_id: str, transcript: str, email: str, sub: str, title: str
+):
     """Generate a summary from the provided transcription text.
 
     This Celery task performs the following operations:
@@ -398,16 +304,34 @@ def summarize_transcription(self, transcript: str, email: str, sub: str, title:
     4. Generates next steps.
     5. Sends the final summary via webhook.
     """
-    logger.info("Starting summarization task")
+    logger.info(
+        "Starting summarization task | Owner: %s",
+        owner_id,
+    )
 
-    llm_service = LLMService()
+    user_has_tracing_consent = analytics.is_feature_enabled(
+        "summary-tracing-consent", distinct_id=owner_id
+    )
 
-    tldr = llm_service.call(PROMPT_SYSTEM_TLDR, transcript)
+    # NOTE: We must instantiate a new LLMObservability client for each task invocation
+    # because the masking function needs to be user-specific. The masking function is
+    # baked into the Langfuse client at initialization time, so we can't reuse
+    # a singleton client. This is a performance trade-off we accept to ensure per-user
+    # privacy controls in observability traces.
+    llm_observability = LLMObservability(
+        logger=logger,
+        user_has_tracing_consent=user_has_tracing_consent,
+        session_id=self.request.id,
+        user_id=owner_id,
+    )
+    llm_service = LLMService(llm_observability=llm_observability, logger=logger)
+
+    tldr = llm_service.call(PROMPT_SYSTEM_TLDR, transcript, name="tldr")
 
     logger.info("TLDR generated")
 
     parts = llm_service.call(
-        PROMPT_SYSTEM_PLAN, transcript, response_format=FORMAT_PLAN
+        PROMPT_SYSTEM_PLAN, transcript, name="parts", response_format=FORMAT_PLAN
     )
     logger.info("Plan generated")
 
@@ -418,21 +342,28 @@ def summarize_transcription(self, transcript: str, email: str, sub: str, title:
     for part in parts:
         prompt_user_part = PROMPT_USER_PART.format(part=part, transcript=transcript)
         logger.info("Summarizing part: %s", part)
-        parts_summarized.append(llm_service.call(PROMPT_SYSTEM_PART, prompt_user_part))
+        parts_summarized.append(
+            llm_service.call(PROMPT_SYSTEM_PART, prompt_user_part, name="part")
+        )
 
     logger.info("Parts summarized")
 
     raw_summary = "\n\n".join(parts_summarized)
 
     next_steps = llm_service.call(
-        PROMPT_SYSTEM_NEXT_STEP, transcript, response_format=FORMAT_NEXT_STEPS
+        PROMPT_SYSTEM_NEXT_STEP,
+        transcript,
+        name="next-steps",
+        response_format=FORMAT_NEXT_STEPS,
     )
 
     next_steps = format_actions(json.loads(next_steps))
 
     logger.info("Next steps generated")
 
-    cleaned_summary = llm_service.call(PROMPT_SYSTEM_CLEANING, raw_summary)
+    cleaned_summary = llm_service.call(
+        PROMPT_SYSTEM_CLEANING, raw_summary, name="cleaning"
+    )
     logger.info("Summary cleaned")
 
     summary = tldr + "\n\n" + cleaned_summary + "\n\n" + next_steps
@@ -452,3 +383,6 @@ def summarize_transcription(self, transcript: str, email: str, sub: str, title:
 
     logger.info("Webhook submitted successfully. Status: %s", response.status_code)
     logger.debug("Response body: %s", response.text)
+
+    llm_observability.flush()
+    logger.debug("LLM observability flushed")

src/summary/summary/core/config.py

@@ -4,6 +4,7 @@ from functools import lru_cache
 from typing import Annotated, List, Optional
 
 from fastapi import Depends
+from pydantic import SecretStr
 from pydantic_settings import BaseSettings, SettingsConfigDict
 
 
@@ -14,7 +15,7 @@ class Settings(BaseSettings):
 
     app_name: str = "app"
     app_api_v1_str: str = "/api/v1"
-    app_api_token: str
+    app_api_token: SecretStr
 
     # Audio recordings
     recording_max_duration: Optional[int] = None
@@ -31,25 +32,29 @@ class Settings(BaseSettings):
     aws_storage_bucket_name: str
     aws_s3_endpoint_url: str
     aws_s3_access_key_id: str
-    aws_s3_secret_access_key: str
+    aws_s3_secret_access_key: SecretStr
     aws_s3_secure_access: bool = True
 
     # AI-related settings
-    whisperx_api_key: str
+    whisperx_api_key: SecretStr
     whisperx_base_url: str = "https://api.openai.com/v1"
     whisperx_asr_model: str = "whisper-1"
     whisperx_max_retries: int = 0
     # ISO 639-1 language code (e.g., "en", "fr", "es")
     whisperx_default_language: Optional[str] = None
     llm_base_url: str
-    llm_api_key: str
+    llm_api_key: SecretStr
     llm_model: str
 
+    # Transcription processing
+    hallucination_patterns: List[str] = ["Vap'n'Roll Thierry"]
+    hallucination_replacement_text: str = "[Texte impossible à transcrire]"
+
     # Webhook-related settings
     webhook_max_retries: int = 2
     webhook_status_forcelist: List[int] = [502, 503, 504]
     webhook_backoff_factor: float = 0.1
-    webhook_api_token: str
+    webhook_api_token: SecretStr
     webhook_url: str
 
     # Output related settings
@@ -73,6 +78,13 @@ class Settings(BaseSettings):
     posthog_event_failure: str = "transcript-failure"
     posthog_event_success: str = "transcript-success"
 
+    # Langfuse (LLM Observability)
+    langfuse_enabled: bool = False
+    langfuse_host: Optional[str] = None
+    langfuse_public_key: Optional[str] = None
+    langfuse_secret_key: Optional[SecretStr] = None
+    langfuse_environment: Optional[str] = "development"
+
     # TaskTracker
     task_tracker_redis_url: str = "redis://redis/0"
     task_tracker_prefix: str = "task_metadata:"

src/summary/summary/core/llm_service.py

@@ -0,0 +1,144 @@
+"""LLM service to encapsulate LLM's calls."""
+
+from typing import Any, Mapping, Optional
+
+import openai
+from langfuse import Langfuse
+
+from summary.core.config import get_settings
+
+settings = get_settings()
+
+
+class LLMObservability:
+    """Manage observability and tracing for LLM calls using Langfuse.
+
+    Handles the initialization and configuration of the Langfuse client with
+    per-user masking rules to enforce privacy controls based on tracing consent.
+    Also provides an OpenAI client wrapper that integrates with Langfuse tracing
+    when observability is enabled.
+    """
+
+    def __init__(
+        self,
+        logger,
+        session_id: str,
+        user_id: str,
+        user_has_tracing_consent: bool = False,
+    ):
+        """Initialize the LLMObservability client."""
+        self._logger = logger
+        self._observability_client: Optional[Langfuse] = None
+        self.session_id = session_id
+        self.user_id = user_id
+
+        if settings.langfuse_enabled:
+
+            def masking_function(data, **kwargs):
+                if (
+                    user_has_tracing_consent
+                    or settings.langfuse_environment != "production"
+                ):
+                    return data
+
+                return "[REDACTED]"
+
+            if not settings.langfuse_secret_key:
+                raise ValueError(
+                    "langfuse_secret_key is not configured. "
+                    "Please set the secret key or disable Langfuse."
+                )
+
+            self._observability_client = Langfuse(
+                secret_key=settings.langfuse_secret_key.get_secret_value(),
+                public_key=settings.langfuse_public_key,
+                host=settings.langfuse_host,
+                environment=settings.langfuse_environment,
+                mask=masking_function,
+            )
+
+    @property
+    def is_enabled(self):
+        """Check if observability is enabled."""
+        return self._observability_client is not None
+
+    def get_openai_client(self):
+        """Get an OpenAI client configured for observability.
+
+        Returns a regular OpenAI client if observability is disabled, or a
+        Langfuse-wrapped OpenAI client that automatically traces all API calls
+        to Langfuse for observability when enabled.
+        """
+        base_args = {
+            "base_url": settings.llm_base_url,
+            "api_key": settings.llm_api_key.get_secret_value(),
+        }
+
+        if not self.is_enabled:
+            self._logger.debug("Using regular OpenAI client (observability disabled)")
+            return openai.OpenAI(**base_args)
+
+        # Langfuse's OpenAI wrapper is imported here to avoid triggering client
+        # init at module load, which would log a warning if LANGFUSE_PUBLIC_KEY
+        # is missing. Conditional import ensures Langfuse only initializes when enabled.
+        from langfuse.openai import openai as langfuse_openai  # noqa: PLC0415
+
+        self._logger.debug("Using LangfuseOpenAI client (observability enabled)")
+        return langfuse_openai.OpenAI(**base_args)
+
+    def flush(self):
+        """Flush pending observability traces to Langfuse."""
+        if self.is_enabled:
+            self._observability_client.flush()
+
+
+class LLMException(Exception):
+    """LLM call failed."""
+
+
+class LLMService:
+    """Service for performing calls to the LLM configured in the settings."""
+
+    def __init__(self, llm_observability, logger):
+        """Init the LLMService once."""
+        self._client = llm_observability.get_openai_client()
+        self._observability = llm_observability
+        self._logger = logger
+
+    def call(
+        self,
+        system_prompt: str,
+        user_prompt: str,
+        name: str,
+        response_format: Optional[Mapping[str, Any]] = None,
+    ):
+        """Call the LLM service.
+
+        Takes a system prompt and a user prompt, and returns the LLM's response
+        Returns None if the call fails.
+        """
+        try:
+            params: dict[str, Any] = {
+                "model": settings.llm_model,
+                "messages": [
+                    {"role": "system", "content": system_prompt},
+                    {"role": "user", "content": user_prompt},
+                ],
+            }
+            if response_format is not None:
+                params["response_format"] = response_format
+
+            if self._observability.is_enabled:
+                params["name"] = name
+                params["metadata"] = {
+                    "user_id": self._observability.user_id,
+                    "langfuse_tags": ["summary"],
+                    "langfuse_session_id": self._observability.session_id,
+                }
+
+            response = self._client.chat.completions.create(**params)
+            return response.choices[0].message.content
+
+        except Exception as e:
+            self._logger.exception("LLM call failed: %s", e)
+            raise LLMException(f"LLM call failed: {e}") from e

src/summary/summary/core/security.py

@@ -14,6 +14,6 @@ def verify_token(
 ):
     """Verify the bearer token from the Authorization header."""
     token = credentials.credentials
-    if token != settings.app_api_token:
+    if token != settings.app_api_token.get_secret_value():
         raise HTTPException(status_code=401, detail="Invalid token")
     return token

src/summary/summary/core/transcript_formatter.py

@@ -0,0 +1,121 @@
+"""Transcript formatting into readable conversation format with speaker labels."""
+
+import logging
+from typing import Optional, Tuple
+
+from summary.core.config import get_settings
+
+settings = get_settings()
+
+logger = logging.getLogger(__name__)
+
+
+DEFAULT_EMPTY_TRANSCRIPTION = """
+**Aucun contenu audio n’a été détecté dans votre transcription.**
+
+
+*Si vous pensez qu’il s’agit d’une erreur, n’hésitez pas à contacter
+notre support technique : visio@numerique.gouv.fr*
+
+.
+
+.
+
+.
+
+Quelques points que nous vous conseillons de vérifier :
+- Un micro était-il activé ?
+- Étiez-vous suffisamment proche ?
+- Le micro est-il de bonne qualité ?
+- L’enregistrement dure-t-il plus de 30 secondes ?
+
+"""
+
+
+class TranscriptFormatter:
+    """Formats WhisperX transcription output into readable conversation format.
+
+    Handles:
+    - Extracting segments from transcription objects or dictionaries
+    - Combining consecutive segments from the same speaker
+    - Removing hallucination patterns from content
+    - Generating descriptive titles from context
+    """
+
+    def __init__(self):
+        """Initialize formatter with settings."""
+        self.hallucination_patterns = settings.hallucination_patterns
+        self.hallucination_replacement_text = settings.hallucination_replacement_text
+        self.default_title = settings.document_default_title
+        self.default_empty_transcription = DEFAULT_EMPTY_TRANSCRIPTION
+
+    def _get_segments(self, transcription):
+        """Extract segments from transcription object or dictionary."""
+        if hasattr(transcription, "segments"):
+            return transcription.segments
+
+        if isinstance(transcription, dict):
+            return transcription.get("segments", None)
+
+        return None
+
+    def format(
+        self,
+        transcription,
+        room: Optional[str] = None,
+        recording_date: Optional[str] = None,
+        recording_time: Optional[str] = None,
+    ) -> Tuple[str, str]:
+        """Format transcription into the final document and its title."""
+        segments = self._get_segments(transcription)
+
+        if not segments:
+            content = self.default_empty_transcription
+        else:
+            content = self._format_speaker(segments)
+            content = self._remove_hallucinations(content)
+
+        title = self._generate_title(room, recording_date, recording_time)
+
+        return content, title
+
+    def _remove_hallucinations(self, content: str) -> str:
+        """Remove hallucination patterns from content."""
+        replacement = self.hallucination_replacement_text or ""
+
+        for pattern in self.hallucination_patterns:
+            content = content.replace(pattern, replacement)
+        return content
+
+    def _format_speaker(self, segments) -> str:
+        """Format segments with speaker labels, combining consecutive speakers."""
+        formatted_output = ""
+        previous_speaker = None
+
+        for segment in segments:
+            speaker = segment.get("speaker", "UNKNOWN_SPEAKER")
+            text = segment.get("text", "")
+            if text:
+                if speaker != previous_speaker:
+                    formatted_output += f"\n\n **{speaker}**: {text}"
+                else:
+                    formatted_output += f" {text}"
+                previous_speaker = speaker
+
+        return formatted_output
+
+    def _generate_title(
+        self,
+        room: Optional[str] = None,
+        recording_date: Optional[str] = None,
+        recording_time: Optional[str] = None,
+    ) -> str:
+        """Generate title from context or return default."""
+        if not room or not recording_date or not recording_time:
+            return self.default_title
+
+        return settings.document_title_template.format(
+            room=room,
+            room_recording_date=recording_date,
+            room_recording_time=recording_time,
+        )