wip hint if the user is authenticated or not in attributes

Enhance getting the caller's identity to prevent None.

CHANGELOG.md

@@ -8,6 +8,16 @@ and this project adheres to
 
 ## [Unreleased]
 
+### Added
+
+- ✨(fullstack)  allow participants to mute others based on room configuration
+- ✨(frontend) add synchronizer for room metadata updates
+
+### Changed 
+
+- ♻️(fullstack) simplify source serialization
+- ✨(backend) expose room configuration to all API consumers
+
 ## [1.16.0] - 2026-05-13
 
 ### Added

src/backend/core/api/permissions.py

@@ -136,3 +136,33 @@ class FilePermission(IsAuthenticated):
             raise Http404
 
         return obj.get_abilities(request.user).get(view.action, False)
+
+
+class CanMuteParticipant(permissions.BasePermission):
+    """
+    Grant muting rights based on role or room configuration.
+
+    - Admins and owners can always mute.
+    - When `everyone_can_mute` is enabled on the room, any participant
+      currently in the room (proven by a valid LiveKit token for that room)
+      can mute.
+    """
+
+    def has_object_permission(self, request, view, obj):
+        """Check if the requesting user is allowed to mute a participant in the given room."""
+
+        is_livekit_token_auth = request.auth and hasattr(request.auth, "video")
+
+        # Always allow admins/owners when authenticated with session cookie
+        if not is_livekit_token_auth and obj.is_administrator_or_owner(request.user):
+            return True
+
+        everyone_can_mute = obj.configuration.get("everyone_can_mute", True)
+        if not everyone_can_mute:
+            return False
+
+        if not is_livekit_token_auth:
+            return False
+
+        # LiveKit token scoped to this room
+        return request.auth.video.room == str(obj.id)

src/backend/core/api/serializers.py

@@ -13,7 +13,7 @@ from django.core.exceptions import SuspiciousOperation
 from django.utils.translation import gettext_lazy as _
 
 from django_pydantic_field.rest_framework import SchemaField
-from pydantic import BaseModel, Field
+from pydantic import BaseModel, Field, field_serializer
 from pydantic import ValidationError as PydanticValidationError
 from rest_framework import serializers
 from rest_framework.exceptions import PermissionDenied
@@ -166,11 +166,6 @@ class RoomSerializer(serializers.ModelSerializer):
             )
             output["accesses"] = access_serializer.data
 
-        configuration = output["configuration"]
-
-        if not is_admin_or_owner:
-            del output["configuration"]
-
         should_access_room = (
             (
                 instance.access_level == models.RoomAccessLevel.TRUSTED
@@ -187,7 +182,7 @@ class RoomSerializer(serializers.ModelSerializer):
                 room_id=room_id,
                 user=request.user,
                 username=username,
-                configuration=configuration,
+                configuration=output["configuration"],
                 is_admin_or_owner=is_admin_or_owner,
             )
         else:
@@ -317,9 +312,7 @@ class MuteParticipantSerializer(BaseParticipantsManagementSerializer):
     )
 
 
-RoomConfigurationTrackSource = Literal[
-    "camera", "microphone", "screen_share", "screen_share_audio"
-]
+TrackSource = Literal["camera", "microphone", "screen_share", "screen_share_audio"]
 
 
 class RoomConfiguration(BaseModel):
@@ -328,14 +321,12 @@ class RoomConfiguration(BaseModel):
     Unknown fields are rejected.
     """
 
-    can_publish_sources: list[RoomConfigurationTrackSource] | None = None
+    can_publish_sources: list[TrackSource] | None = None
+    everyone_can_mute: bool | None = None
 
     model_config = {"extra": "forbid"}
 
 
-TrackSource = Literal["SCREEN_SHARE", "SCREEN_SHARE_AUDIO", "CAMERA", "MICROPHONE"]
-
-
 class ParticipantPermission(BaseModel):
     """Mirror the LiveKit ParticipantPermission protobuf.
 
@@ -355,6 +346,10 @@ class ParticipantPermission(BaseModel):
 
     model_config = {"extra": "forbid"}
 
+    @field_serializer("can_publish_sources")
+    def _serialize_sources(self, sources: list[str]) -> list[str]:
+        return [s.upper() for s in sources]
+
 
 class UpdateParticipantSerializer(BaseParticipantsManagementSerializer):
     """Validate participant update data."""

src/backend/core/api/viewsets.py

@@ -33,6 +33,7 @@ from rest_framework import (
 from rest_framework import (
     status as drf_status,
 )
+from rest_framework.settings import api_settings
 
 from core import enums, models, utils
 from core.api.filters import ListFileFilter
@@ -76,6 +77,11 @@ from core.services.participants_management import (
     ParticipantsManagementException,
 )
 from core.services.room_creation import RoomCreation
+from core.services.room_management import (
+    RoomManagement,
+    RoomManagementException,
+    RoomNotFoundException,
+)
 from core.services.subtitle import SubtitleException, SubtitleService
 from core.tasks.file import process_file_deletion
 
@@ -299,6 +305,41 @@ class RoomViewSet(
         if callback_id := self.request.data.get("callback_id"):
             RoomCreation().persist_callback_state(callback_id, room)
 
+    def perform_update(self, serializer):
+        """Persist the room update, then sync metadata to LiveKit."""
+
+        old_configuration = serializer.instance.configuration
+        old_access_level = serializer.instance.access_level
+
+        room = serializer.save()
+
+        if (
+            room.configuration == old_configuration
+            and room.access_level == old_access_level
+        ):
+            return
+
+        metadata = {
+            "configuration": room.configuration,
+            "access_level": room.access_level,
+        }
+
+        try:
+            RoomManagement().update_metadata(
+                room_name=str(room.id),
+                metadata=metadata,
+            )
+        except RoomNotFoundException:
+            logger.info(
+                "LiveKit room %s does not exist yet, skipping metadata sync",
+                room.id,
+            )
+        except RoomManagementException:
+            logger.warning(
+                "Failed to sync metadata to LiveKit for room %s",
+                room.id,
+            )
+
     @decorators.action(
         detail=True,
         methods=["post"],
@@ -614,7 +655,11 @@ class RoomViewSet(
         methods=["post"],
         url_path="mute-participant",
         url_name="mute-participant",
-        permission_classes=[permissions.HasPrivilegesOnRoom],
+        permission_classes=[permissions.CanMuteParticipant],
+        authentication_classes=[
+            LiveKitTokenAuthentication,
+            *api_settings.DEFAULT_AUTHENTICATION_CLASSES,
+        ],
     )
     def mute_participant(self, request, pk=None):  # pylint: disable=unused-argument
         """Mute a specific track for a participant in the room."""
@@ -623,6 +668,26 @@ class RoomViewSet(
         serializer = serializers.MuteParticipantSerializer(data=request.data)
         serializer.is_valid(raise_exception=True)
 
+        # TEMPORARY: a LiveKit token proves access was granted, not that the caller
+        # joined. Cross-check identity against the live participant list until auth
+        # is hardened. Skipped for non-LiveKit auth backends.
+        caller_identity = getattr(request.auth, "identity", None)
+        if caller_identity is not None:
+            try:
+                ParticipantsManagement().check_if_in_meeting(
+                    room_name=str(room.pk),
+                    identity=caller_identity,
+                )
+            except (ParticipantNotFoundException, ParticipantsManagementException):
+                logger.warning(
+                    "Failed to verify caller presence for mute in room %s; denying",
+                    room.pk,
+                )
+                return drf_response.Response(
+                    {"error": "Could not verify caller presence"},
+                    status=drf_status.HTTP_403_FORBIDDEN,
+                )
+
         try:
             ParticipantsManagement().mute(
                 room_name=str(room.pk),

src/backend/core/models.py

@@ -388,6 +388,7 @@ class Room(Resource):
         choices=RoomAccessLevel.choices,
         default=settings.RESOURCE_DEFAULT_ACCESS_LEVEL,
     )
+    # Public configuration exposed to any room participant via the API
     configuration = models.JSONField(
         blank=True,
         default=dict,

src/backend/core/services/participants_management.py

@@ -15,6 +15,7 @@ from livekit.api import (
     TwirpError,
     UpdateParticipantRequest,
 )
+from livekit.protocol.models import ParticipantInfo
 
 from core import utils
 
@@ -154,3 +155,44 @@ class ParticipantsManagement:
 
         finally:
             await lkapi.aclose()
+
+    @async_to_sync
+    async def check_if_in_meeting(self, room_name: str, identity: str) -> bool:
+        """Check whether `identity` is currently a participant in `room_name`.
+
+        Raises ParticipantsManagementException for unexpected LiveKit errors
+        so callers can fail closed rather than silently allowing the action.
+        """
+
+        if not room_name or not identity:
+            return False
+
+        lkapi = utils.create_livekit_client()
+
+        try:
+            participant = await lkapi.room.get_participant(
+                RoomParticipantIdentity(
+                    room=room_name,
+                    identity=identity,
+                )
+            )
+        except TwirpError as e:
+            if e.code == "not_found":
+                raise ParticipantNotFoundException("Participant does not exist") from e
+
+            logger.exception(
+                "Unexpected error checking participant %s in room %s",
+                identity,
+                room_name,
+            )
+            raise ParticipantsManagementException(
+                "Could not verify participant presence"
+            ) from e
+
+        finally:
+            await lkapi.aclose()
+
+        return (
+            participant is not None
+            and participant.state != ParticipantInfo.State.DISCONNECTED
+        )

src/backend/core/services/room_management.py

@@ -0,0 +1,64 @@
+"""Room management service for LiveKit rooms."""
+
+# pylint: disable=no-name-in-module
+
+import json
+from logging import getLogger
+from typing import Dict, Optional
+
+from asgiref.sync import async_to_sync
+from livekit.api import (
+    TwirpError,
+    UpdateRoomMetadataRequest,
+)
+
+from core import utils
+
+logger = getLogger(__name__)
+
+
+class RoomManagementException(Exception):
+    """Exception raised when a room management operation fails."""
+
+
+class RoomNotFoundException(RoomManagementException):
+    """Raised when the target room does not exist in LiveKit."""
+
+
+class RoomManagement:
+    """Service for managing LiveKit rooms."""
+
+    @async_to_sync
+    async def update_metadata(self, room_name: str, metadata: Optional[Dict] = None):
+        """Update a LiveKit room's metadata.
+
+        The `room_name` corresponds to the LiveKit room identifier
+        (i.e. the Room model's UUID as a string).
+        """
+
+        lkapi = utils.create_livekit_client()
+
+        try:
+            await lkapi.room.update_room_metadata(
+                UpdateRoomMetadataRequest(
+                    room=room_name,
+                    metadata=json.dumps(metadata) if metadata is not None else "",
+                )
+            )
+
+        except TwirpError as e:
+            if e.code == "not_found":
+                logger.warning(
+                    "Room %s not found in LiveKit, skipping metadata update",
+                    room_name,
+                )
+                raise RoomNotFoundException("Room does not exist") from e
+
+            logger.exception(
+                "Unexpected error updating metadata for room %s",
+                room_name,
+            )
+            raise RoomManagementException("Could not update room metadata") from e
+
+        finally:
+            await lkapi.aclose()

src/backend/core/tests/rooms/test_api_rooms_participants_management.py

@@ -2,20 +2,23 @@
 Test rooms API endpoints in the Meet core app: participants management.
 """
 
-# pylint: disable=redefined-outer-name,unused-argument,protected-access
+# pylint: disable=redefined-outer-name,unused-argument,protected-access,no-name-in-module,too-many-lines
 
 import random
 from unittest import mock
 from uuid import uuid4
 
+from django.contrib.auth.models import AnonymousUser
 from django.core.exceptions import SuspiciousOperation
 from django.urls import reverse
 
 import pytest
-from livekit.api import TwirpError
+from livekit.api import TwirpError, UpdateParticipantRequest
+from livekit.protocol.models import ParticipantInfo
 from rest_framework import status
 from rest_framework.test import APIClient
 
+from core import utils
 from core.factories import RoomFactory, UserFactory, UserResourceAccessFactory
 from core.services.lobby import LobbyService
 
@@ -31,8 +34,8 @@ def mock_livekit_client():
         yield mock_client
 
 
-def test_mute_participant_success(mock_livekit_client):
-    """Test successful participant muting."""
+def test_mute_participant_success_as_admin(mock_livekit_client):
+    """Admins and owners should be able to mute without a LiveKit token."""
     client = APIClient()
     room = RoomFactory()
     user = UserFactory()
@@ -41,10 +44,12 @@ def test_mute_participant_success(mock_livekit_client):
     )
     client.force_authenticate(user=user)
 
-    payload = {"participant_identity": str(uuid4()), "track_sid": "test-track-sid"}
-
     url = reverse("rooms-mute-participant", kwargs={"pk": room.id})
-    response = client.post(url, payload, format="json")
+    response = client.post(
+        url,
+        {"participant_identity": str(uuid4()), "track_sid": "test-track-sid"},
+        format="json",
+    )
 
     assert response.status_code == status.HTTP_200_OK
     assert response.data == {"status": "success"}
@@ -53,23 +58,131 @@ def test_mute_participant_success(mock_livekit_client):
     mock_livekit_client.aclose.assert_called_once()
 
 
-def test_mute_participant_forbidden_without_access():
-    """Test mute participant returns 403 when user lacks room privileges."""
+def test_mute_participant_anonymous_no_token_forbidden(mock_livekit_client):
+    """Should forbid muting when user is anonymous and no LiveKit token."""
     client = APIClient()
     room = RoomFactory()
-    user = UserFactory()  # User without UserResourceAccess
-    client.force_authenticate(user=user)
-
-    payload = {"participant_identity": str(uuid4()), "track_sid": "test-track-sid"}
 
     url = reverse("rooms-mute-participant", kwargs={"pk": room.id})
-    response = client.post(url, payload, format="json")
+    response = client.post(
+        url,
+        {"participant_identity": str(uuid4()), "track_sid": "test-track-sid"},
+        format="json",
+    )
 
     assert response.status_code == status.HTTP_403_FORBIDDEN
+    mock_livekit_client.room.mute_published_track.assert_not_called()
+
+
+def test_mute_participant_with_livekit_token_for_this_room(mock_livekit_client):
+    """Should allow muting when the LiveKit token is scoped to this room."""
+    client = APIClient()
+    room = RoomFactory()
+
+    user = AnonymousUser()
+    token = utils.generate_token(str(room.id), user, is_admin_or_owner=False)
+
+    url = reverse("rooms-mute-participant", kwargs={"pk": room.id})
+    response = client.post(
+        url,
+        {"participant_identity": str(uuid4()), "track_sid": "test-track-sid"},
+        format="json",
+        HTTP_AUTHORIZATION=f"Bearer {token}",
+    )
+
+    assert response.status_code == status.HTTP_200_OK
+    assert response.data == {"status": "success"}
+
+    mock_livekit_client.room.mute_published_track.assert_called_once()
+
+
+def test_mute_participant_with_livekit_token_for_another_room_forbidden(
+    mock_livekit_client,
+):
+    """Should forbid muting when the LiveKit token is scoped to a different room."""
+
+    client = APIClient()
+    target_room = RoomFactory()
+    other_room = RoomFactory()
+
+    user = AnonymousUser()
+    token = utils.generate_token(str(other_room.id), user, is_admin_or_owner=False)
+
+    url = reverse("rooms-mute-participant", kwargs={"pk": target_room.id})
+    response = client.post(
+        url,
+        {"participant_identity": str(uuid4()), "track_sid": "test-track-sid"},
+        format="json",
+        HTTP_AUTHORIZATION=f"Bearer {token}",
+    )
+
+    assert response.status_code == status.HTTP_403_FORBIDDEN
+    mock_livekit_client.room.mute_published_track.assert_not_called()
+
+
+def test_mute_participant_authenticated_no_role_no_token_forbidden(mock_livekit_client):
+    """Should forbid muting when user has no room role and no LiveKit token."""
+    client = APIClient()
+    room = RoomFactory()  # everyone_can_mute defaults to True
+    user = UserFactory()  # no UserResourceAccess for this room
+    client.force_authenticate(user=user)
+
+    url = reverse("rooms-mute-participant", kwargs={"pk": room.id})
+    response = client.post(
+        url,
+        {"participant_identity": str(uuid4()), "track_sid": "test-track-sid"},
+        format="json",
+    )
+
+    assert response.status_code == status.HTTP_403_FORBIDDEN
+    mock_livekit_client.room.mute_published_track.assert_not_called()
+
+
+def test_mute_participant_everyone_can_mute_disabled_blocks_non_admin(
+    mock_livekit_client,
+):
+    """Should forbid muting when everyone_can_mute is False, even with a LiveKit token."""
+    client = APIClient()
+    room = RoomFactory(configuration={"everyone_can_mute": False})
+
+    user = AnonymousUser()
+    token = utils.generate_token(str(room.id), user, is_admin_or_owner=False)
+
+    url = reverse("rooms-mute-participant", kwargs={"pk": room.id})
+    response = client.post(
+        url,
+        {"participant_identity": str(uuid4()), "track_sid": "test-track-sid"},
+        format="json",
+        HTTP_AUTHORIZATION=f"Bearer {token}",
+    )
+
+    assert response.status_code == status.HTTP_403_FORBIDDEN
+    mock_livekit_client.room.mute_published_track.assert_not_called()
+
+
+def test_mute_participant_everyone_can_mute_disabled_allows_admin(mock_livekit_client):
+    """Should allow admins and owners to mute when everyone_can_mute is False."""
+    client = APIClient()
+    room = RoomFactory(configuration={"everyone_can_mute": False})
+    user = UserFactory()
+    UserResourceAccessFactory(
+        resource=room, user=user, role=random.choice(["administrator", "owner"])
+    )
+    client.force_authenticate(user=user)
+
+    url = reverse("rooms-mute-participant", kwargs={"pk": room.id})
+    response = client.post(
+        url,
+        {"participant_identity": str(uuid4()), "track_sid": "test-track-sid"},
+        format="json",
+    )
+
+    assert response.status_code == status.HTTP_200_OK
+    mock_livekit_client.room.mute_published_track.assert_called_once()
 
 
 def test_mute_participant_invalid_payload():
-    """Test mute participant with invalid payload."""
+    """Should reject muting when the payload is invalid."""
     client = APIClient()
     room = RoomFactory()
     user = UserFactory()
@@ -78,16 +191,16 @@ def test_mute_participant_invalid_payload():
     )
     client.force_authenticate(user=user)
 
-    payload = {"participant_identity": "invalid-uuid", "track_sid": ""}
-
     url = reverse("rooms-mute-participant", kwargs={"pk": room.id})
-    response = client.post(url, payload, format="json")
+    response = client.post(
+        url, {"participant_identity": "invalid-uuid", "track_sid": ""}, format="json"
+    )
 
     assert response.status_code == status.HTTP_400_BAD_REQUEST
 
 
 def test_mute_participant_unexpected_twirp_error(mock_livekit_client):
-    """Test mute participant when LiveKit API raises TwirpError."""
+    """Should return 500 when the LiveKit API raises a TwirpError."""
     client = APIClient()
 
     mock_livekit_client.room.mute_published_track.side_effect = TwirpError(
@@ -101,10 +214,12 @@ def test_mute_participant_unexpected_twirp_error(mock_livekit_client):
     )
     client.force_authenticate(user=user)
 
-    payload = {"participant_identity": str(uuid4()), "track_sid": "test-track-sid"}
-
     url = reverse("rooms-mute-participant", kwargs={"pk": room.id})
-    response = client.post(url, payload, format="json")
+    response = client.post(
+        url,
+        {"participant_identity": str(uuid4()), "track_sid": "test-track-sid"},
+        format="json",
+    )
 
     assert response.status_code == status.HTTP_500_INTERNAL_SERVER_ERROR
     assert response.data == {"error": "Failed to mute participant"}
@@ -112,6 +227,282 @@ def test_mute_participant_unexpected_twirp_error(mock_livekit_client):
     mock_livekit_client.aclose.assert_called_once()
 
 
+def test_mute_participant_participant_not_found(mock_livekit_client):
+    """Should return 404 when the participant does not exist in the room."""
+    client = APIClient()
+
+    mock_livekit_client.room.mute_published_track.side_effect = TwirpError(
+        msg="participant does not exist", code="not_found", status=404
+    )
+
+    room = RoomFactory()
+    user = UserFactory()
+    UserResourceAccessFactory(
+        resource=room, user=user, role=random.choice(["administrator", "owner"])
+    )
+    client.force_authenticate(user=user)
+
+    url = reverse("rooms-mute-participant", kwargs={"pk": room.id})
+    response = client.post(
+        url,
+        {"participant_identity": str(uuid4()), "track_sid": "test-track-sid"},
+        format="json",
+    )
+
+    assert response.status_code == status.HTTP_404_NOT_FOUND
+    assert response.data == {"error": "Participant not found"}
+
+    mock_livekit_client.aclose.assert_called_once()
+
+
+def test_mute_participant_management_exception(mock_livekit_client):
+    """Should return 500 when ParticipantsManagement raises an unexpected error."""
+    client = APIClient()
+
+    mock_livekit_client.room.mute_published_track.side_effect = TwirpError(
+        msg="boom", code="internal", status=503
+    )
+
+    room = RoomFactory()
+    user = UserFactory()
+    UserResourceAccessFactory(
+        resource=room, user=user, role=random.choice(["administrator", "owner"])
+    )
+    client.force_authenticate(user=user)
+
+    url = reverse("rooms-mute-participant", kwargs={"pk": room.id})
+    response = client.post(
+        url,
+        {"participant_identity": str(uuid4()), "track_sid": "test-track-sid"},
+        format="json",
+    )
+
+    assert response.status_code == status.HTTP_500_INTERNAL_SERVER_ERROR
+    assert response.data == {"error": "Failed to mute participant"}
+
+    mock_livekit_client.aclose.assert_called_once()
+
+
+def test_mute_participant_admin_with_token_for_this_room(mock_livekit_client):
+    """Should allow muting when user is admin and LiveKit token is scoped to this room."""
+    client = APIClient()
+    room = RoomFactory()
+    user = UserFactory()
+    UserResourceAccessFactory(
+        resource=room, user=user, role=random.choice(["administrator", "owner"])
+    )
+    # Token identity matches the admin user so LiveKitTokenAuthentication
+    # resolves request.user back to the admin.
+    token = utils.generate_token(str(room.id), user, is_admin_or_owner=True)
+
+    url = reverse("rooms-mute-participant", kwargs={"pk": room.id})
+    response = client.post(
+        url,
+        {"participant_identity": str(uuid4()), "track_sid": "test-track-sid"},
+        format="json",
+        HTTP_AUTHORIZATION=f"Bearer {token}",
+    )
+
+    assert response.status_code == status.HTTP_200_OK
+    assert response.data == {"status": "success"}
+
+    mock_livekit_client.room.mute_published_track.assert_called_once()
+
+
+def test_mute_participant_admin_with_token_for_another_room(mock_livekit_client):
+    """Should not allow muting when user is admin and the LiveKit token is for another room."""
+    client = APIClient()
+    target_room = RoomFactory()
+    other_room = RoomFactory()
+    user = UserFactory()
+    UserResourceAccessFactory(
+        resource=target_room,
+        user=user,
+        role=random.choice(["administrator", "owner"]),
+    )
+    # Token is scoped to a DIFFERENT room, and admin status must only be
+    # honored when established via session, never via a LiveKit
+    # token, which can be replayed off-host.
+    token = utils.generate_token(str(other_room.id), user, is_admin_or_owner=True)
+
+    url = reverse("rooms-mute-participant", kwargs={"pk": target_room.id})
+    response = client.post(
+        url,
+        {"participant_identity": str(uuid4()), "track_sid": "test-track-sid"},
+        format="json",
+        HTTP_AUTHORIZATION=f"Bearer {token}",
+    )
+
+    assert response.status_code == status.HTTP_403_FORBIDDEN
+    assert response.data == {
+        "detail": "You do not have permission to perform this action."
+    }
+
+    mock_livekit_client.room.mute_published_track.assert_not_called()
+
+
+def test_mute_participant_admin_token_replayed_does_not_grant_admin(
+    mock_livekit_client,
+):
+    """Should forbid muting when a LiveKit token issued for an admin is passed without a session."""
+    client = APIClient()
+    room = RoomFactory(configuration={"everyone_can_mute": False})
+    admin_user = UserFactory()
+    UserResourceAccessFactory(
+        resource=room,
+        user=admin_user,
+        role=random.choice(["administrator", "owner"]),
+    )
+    # The token is the only credential.
+    token = utils.generate_token(str(room.id), admin_user, is_admin_or_owner=True)
+
+    url = reverse("rooms-mute-participant", kwargs={"pk": room.id})
+    response = client.post(
+        url,
+        {"participant_identity": str(uuid4()), "track_sid": "test-track-sid"},
+        format="json",
+        HTTP_AUTHORIZATION=f"Bearer {token}",
+    )
+
+    assert response.status_code == status.HTTP_403_FORBIDDEN
+    mock_livekit_client.room.mute_published_track.assert_not_called()
+
+
+def test_mute_participant_livekit_token_triggers_presence_check(mock_livekit_client):
+    """Should check participant presence when authenticated via LiveKit token only."""
+    client = APIClient()
+    room = RoomFactory()
+
+    user = AnonymousUser()
+    token = utils.generate_token(str(room.id), user, is_admin_or_owner=False)
+
+    url = reverse("rooms-mute-participant", kwargs={"pk": room.id})
+    response = client.post(
+        url,
+        {"participant_identity": str(uuid4()), "track_sid": "test-track-sid"},
+        format="json",
+        HTTP_AUTHORIZATION=f"Bearer {token}",
+    )
+
+    assert response.status_code == status.HTTP_200_OK
+    # Presence is verified against LiveKit before the mute is issued.
+    mock_livekit_client.room.get_participant.assert_called_once()
+    mock_livekit_client.room.mute_published_track.assert_called_once()
+
+
+def test_mute_participant_livekit_token_presence_check_returns_participant(
+    mock_livekit_client,
+):
+    """Should mute when the authentified participant is currently in the room."""
+    client = APIClient()
+    room = RoomFactory()
+
+    # Simulate LiveKit confirming the caller is currently in the room.
+    # State != DISCONNECTED (3) means present.
+    mock_livekit_client.room.get_participant.return_value = ParticipantInfo(
+        identity="caller-identity",
+        state=ParticipantInfo.State.ACTIVE,
+    )
+
+    user = AnonymousUser()
+    token = utils.generate_token(str(room.id), user, is_admin_or_owner=False)
+
+    url = reverse("rooms-mute-participant", kwargs={"pk": room.id})
+    response = client.post(
+        url,
+        {"participant_identity": str(uuid4()), "track_sid": "test-track-sid"},
+        format="json",
+        HTTP_AUTHORIZATION=f"Bearer {token}",
+    )
+
+    assert response.status_code == status.HTTP_200_OK
+    assert response.data == {"status": "success"}
+    mock_livekit_client.room.get_participant.assert_called_once()
+    mock_livekit_client.room.mute_published_track.assert_called_once()
+
+
+def test_mute_participant_livekit_token_presence_check_participant_not_found(
+    mock_livekit_client,
+):
+    """Should not mute when the authentified participant is not found."""
+    client = APIClient()
+    room = RoomFactory()
+
+    mock_livekit_client.room.get_participant.side_effect = TwirpError(
+        msg="participant does not exist", code="not_found", status=404
+    )
+
+    user = AnonymousUser()
+    token = utils.generate_token(str(room.id), user, is_admin_or_owner=False)
+
+    url = reverse("rooms-mute-participant", kwargs={"pk": room.id})
+    response = client.post(
+        url,
+        {"participant_identity": str(uuid4()), "track_sid": "test-track-sid"},
+        format="json",
+        HTTP_AUTHORIZATION=f"Bearer {token}",
+    )
+
+    assert response.status_code == status.HTTP_403_FORBIDDEN
+    assert response.data == {"error": "Could not verify caller presence"}
+    mock_livekit_client.room.get_participant.assert_called_once()
+    # The presence check failed, so we never reach the mute call.
+    mock_livekit_client.room.mute_published_track.assert_not_called()
+
+
+def test_mute_participant_livekit_token_presence_check_twirp_error_forbidden(
+    mock_livekit_client,
+):
+    """Should not mute when the presence check fail."""
+    client = APIClient()
+    room = RoomFactory()
+
+    mock_livekit_client.room.get_participant.side_effect = TwirpError(
+        msg="an error occured", code="not_found", status=500
+    )
+
+    user = AnonymousUser()
+    token = utils.generate_token(str(room.id), user, is_admin_or_owner=False)
+
+    url = reverse("rooms-mute-participant", kwargs={"pk": room.id})
+    response = client.post(
+        url,
+        {"participant_identity": str(uuid4()), "track_sid": "test-track-sid"},
+        format="json",
+        HTTP_AUTHORIZATION=f"Bearer {token}",
+    )
+
+    assert response.status_code == status.HTTP_403_FORBIDDEN
+    assert response.data == {"error": "Could not verify caller presence"}
+    mock_livekit_client.room.get_participant.assert_called_once()
+    # The presence check failed, so we never reach the mute call.
+    mock_livekit_client.room.mute_published_track.assert_not_called()
+
+
+def test_mute_participant_session_auth_skips_presence_check(mock_livekit_client):
+    """Should not check presence of the participant when authentified with a session cookie."""
+    client = APIClient()
+    room = RoomFactory()
+    user = UserFactory()
+    UserResourceAccessFactory(
+        resource=room, user=user, role=random.choice(["administrator", "owner"])
+    )
+    client.force_authenticate(user=user)
+
+    url = reverse("rooms-mute-participant", kwargs={"pk": room.id})
+    response = client.post(
+        url,
+        {"participant_identity": str(uuid4()), "track_sid": "test-track-sid"},
+        format="json",
+    )
+
+    assert response.status_code == status.HTTP_200_OK
+    # Session auth has no LiveKit identity to verify against, so the
+    # stop-gap presence check is skipped.
+    mock_livekit_client.room.get_participant.assert_not_called()
+    mock_livekit_client.room.mute_published_track.assert_called_once()
+
+
 def test_update_participant_success(mock_livekit_client):
     """Test successful participant update."""
     client = APIClient()
@@ -130,8 +521,8 @@ def test_update_participant_success(mock_livekit_client):
             "can_publish": True,
             "can_publish_data": True,
             "can_publish_sources": [
-                "CAMERA",
-                "MICROPHONE",
+                "camera",
+                "microphone",
             ],
             "can_update_metadata": True,
             "can_subscribe_metrics": True,
@@ -158,8 +549,8 @@ def test_update_participant_success(mock_livekit_client):
         {"can_publish_data": True},
         {
             "can_publish_sources": [
-                "CAMERA",
-                "MICROPHONE",
+                "camera",
+                "microphone",
             ]
         },
         {"can_update_metadata": True},
@@ -190,9 +581,41 @@ def test_update_participant_permission_fields_are_optional(
     assert response.data == {"status": "success"}
 
     mock_livekit_client.room.update_participant.assert_called_once()
+
+    (request_arg,), _ = mock_livekit_client.room.update_participant.call_args
+    assert isinstance(request_arg, UpdateParticipantRequest)
+
     mock_livekit_client.aclose.assert_called_once()
 
 
+def test_update_participant_permission_fields_invalid_case(mock_livekit_client):
+    """Should raise bad request when can_publish_sources is uppercase."""
+    client = APIClient()
+    room = RoomFactory()
+    user = UserFactory()
+    UserResourceAccessFactory(
+        resource=room, user=user, role=random.choice(["administrator", "owner"])
+    )
+    client.force_authenticate(user=user)
+
+    payload = {
+        "participant_identity": str(uuid4()),
+        "permission": {
+            "can_publish_sources": [
+                "CAMERA",
+                "microphone",
+            ]
+        },
+    }
+
+    url = reverse("rooms-update-participant", kwargs={"pk": room.id})
+    response = client.post(url, payload, format="json")
+
+    assert response.status_code == status.HTTP_400_BAD_REQUEST
+    mock_livekit_client.room.update_participant.assert_not_called()
+    mock_livekit_client.aclose.assert_not_called()
+
+
 @pytest.mark.parametrize(
     "value,permission_key",
     [

src/backend/core/tests/rooms/test_api_rooms_retrieve.py

@@ -28,6 +28,7 @@ def test_api_rooms_retrieve_anonymous_private_pk():
 
     assert response.status_code == 200
     assert response.json() == {
+        "configuration": {},
         "access_level": "restricted",
         "id": str(room.id),
         "is_administrable": False,
@@ -47,6 +48,7 @@ def test_api_rooms_retrieve_anonymous_trusted_pk():
 
     assert response.status_code == 200
     assert response.json() == {
+        "configuration": {},
         "access_level": "trusted",
         "id": str(room.id),
         "is_administrable": False,
@@ -65,6 +67,7 @@ def test_api_rooms_retrieve_anonymous_private_pk_no_dashes():
 
     assert response.status_code == 200
     assert response.json() == {
+        "configuration": {},
         "access_level": "restricted",
         "id": str(room.id),
         "is_administrable": False,
@@ -81,6 +84,7 @@ def test_api_rooms_retrieve_anonymous_private_slug():
 
     assert response.status_code == 200
     assert response.json() == {
+        "configuration": {},
         "access_level": "restricted",
         "id": str(room.id),
         "is_administrable": False,
@@ -97,6 +101,7 @@ def test_api_rooms_retrieve_anonymous_private_slug_not_normalized():
 
     assert response.status_code == 200
     assert response.json() == {
+        "configuration": {},
         "access_level": "restricted",
         "id": str(room.id),
         "is_administrable": False,
@@ -200,6 +205,7 @@ def test_api_rooms_retrieve_anonymous_public(mock_token):
     assert response.status_code == 200
     expected_name = f"{room.id!s}"
     assert response.json() == {
+        "configuration": {},
         "access_level": str(room.access_level),
         "id": str(room.id),
         "is_administrable": False,
@@ -246,6 +252,7 @@ def test_api_rooms_retrieve_authenticated_public(mock_token):
 
     expected_name = f"{room.id!s}"
     assert response.json() == {
+        "configuration": {"can_publish_sources": ["camera"]},
         "access_level": str(room.access_level),
         "id": str(room.id),
         "is_administrable": False,
@@ -297,6 +304,7 @@ def test_api_rooms_retrieve_authenticated_trusted(mock_token):
 
     expected_name = f"{room.id!s}"
     assert response.json() == {
+        "configuration": {},
         "access_level": str(room.access_level),
         "id": str(room.id),
         "is_administrable": False,
@@ -338,6 +346,7 @@ def test_api_rooms_retrieve_authenticated():
     assert response.status_code == 200
 
     assert response.json() == {
+        "configuration": {},
         "access_level": "restricted",
         "id": str(room.id),
         "is_administrable": False,
@@ -383,6 +392,7 @@ def test_api_rooms_retrieve_members(mock_token, django_assert_num_queries, setti
 
     expected_name = str(room.id)
     assert content_dict == {
+        "configuration": {"can_publish_sources": ["camera"]},
         "access_level": str(room.access_level),
         "id": str(room.id),
         "is_administrable": False,

src/backend/core/tests/rooms/test_api_rooms_update.py

@@ -3,12 +3,18 @@ Test rooms API endpoints in the Meet core app: update.
 """
 
 import random
+from unittest.mock import patch
 
 import pytest
 from rest_framework.test import APIClient
 
 from ...factories import RoomFactory, UserFactory
 from ...models import RoomAccessLevel
+from ...services.room_management import (
+    RoomManagement,
+    RoomManagementException,
+    RoomNotFoundException,
+)
 
 pytestmark = pytest.mark.django_db
 
@@ -79,12 +85,14 @@ def test_api_rooms_update_members():
     assert room.configuration == {}
 
 
-def test_api_rooms_update_administrators():
-    """Administrators or owners of a room should be allowed to update it."""
+@patch.object(RoomManagement, "update_metadata")
+def test_api_rooms_update_administrators(mock_update_metadata):
+    """Should sync LiveKit metadata when both configuration and access level change."""
     user = UserFactory()
     room = RoomFactory(
         access_level=RoomAccessLevel.RESTRICTED,
         users=[(user, random.choice(["administrator", "owner"]))],
+        configuration={"can_publish_sources": ["camera"]},
     )
     client = APIClient()
     client.force_login(user)
@@ -106,11 +114,120 @@ def test_api_rooms_update_administrators():
     assert room.access_level == RoomAccessLevel.PUBLIC
     assert room.configuration == {"can_publish_sources": ["camera", "microphone"]}
 
+    mock_update_metadata.assert_called_once_with(
+        room_name=str(room.id),
+        metadata={
+            "access_level": "public",
+            "configuration": {"can_publish_sources": ["camera", "microphone"]},
+        },
+    )
+
+
+@patch.object(RoomManagement, "update_metadata")
+def test_api_rooms_update_administrators_configuration_only(mock_update_metadata):
+    """Should sync LiveKit metadata when only configuration changes."""
+    user = UserFactory()
+    room = RoomFactory(
+        access_level=RoomAccessLevel.RESTRICTED,
+        users=[(user, random.choice(["administrator", "owner"]))],
+        configuration={},
+    )
+    client = APIClient()
+    client.force_login(user)
+
+    response = client.put(
+        f"/api/v1.0/rooms/{room.id!s}/",
+        {
+            "name": "New name",
+            "slug": "should-be-ignored",
+            "configuration": {"can_publish_sources": ["camera", "microphone"]},
+        },
+        format="json",
+    )
+    assert response.status_code == 200
+    room.refresh_from_db()
+    assert room.name == "New name"
+    assert room.slug == "new-name"
+    assert room.access_level == RoomAccessLevel.RESTRICTED
+    assert room.configuration == {"can_publish_sources": ["camera", "microphone"]}
+
+    mock_update_metadata.assert_called_once_with(
+        room_name=str(room.id),
+        metadata={
+            "access_level": "restricted",
+            "configuration": {"can_publish_sources": ["camera", "microphone"]},
+        },
+    )
+
+
+@patch.object(RoomManagement, "update_metadata")
+def test_api_rooms_update_administrators_access_level_only(mock_update_metadata):
+    """Should sync LiveKit metadata when only access level changes."""
+    user = UserFactory()
+    room = RoomFactory(
+        access_level=RoomAccessLevel.RESTRICTED,
+        users=[(user, random.choice(["administrator", "owner"]))],
+        configuration={"can_publish_sources": ["camera"]},
+    )
+    client = APIClient()
+    client.force_login(user)
+
+    response = client.put(
+        f"/api/v1.0/rooms/{room.id!s}/",
+        {
+            "name": "New name",
+            "access_level": RoomAccessLevel.PUBLIC,
+        },
+        format="json",
+    )
+    assert response.status_code == 200
+    room.refresh_from_db()
+    assert room.name == "New name"
+    assert room.slug == "new-name"
+    assert room.access_level == RoomAccessLevel.PUBLIC
+    assert room.configuration == {"can_publish_sources": ["camera"]}
+
+    mock_update_metadata.assert_called_once_with(
+        room_name=str(room.id),
+        metadata={
+            "access_level": "public",
+            "configuration": {"can_publish_sources": ["camera"]},
+        },
+    )
+
+
+@patch.object(RoomManagement, "update_metadata")
+def test_api_rooms_update_administrators_name_only(mock_update_metadata):
+    """Should not sync LiveKit metadata when neither configuration nor access level changes."""
+    user = UserFactory()
+    room = RoomFactory(
+        name="Old name",
+        access_level=RoomAccessLevel.PUBLIC,
+        configuration={"can_publish_sources": ["camera"]},
+        users=[(user, random.choice(["administrator", "owner"]))],
+    )
+    client = APIClient()
+    client.force_login(user)
+
+    response = client.patch(
+        f"/api/v1.0/rooms/{room.id!s}/",
+        {"name": "New name"},
+        format="json",
+    )
+    assert response.status_code == 200
+    room.refresh_from_db()
+    assert room.name == "New name"
+    assert room.slug == "new-name"
+    # Unrelated fields untouched
+    assert room.access_level == RoomAccessLevel.PUBLIC
+    assert room.configuration == {"can_publish_sources": ["camera"]}
+
+    mock_update_metadata.assert_not_called()
+
 
 @pytest.mark.parametrize(
     "configuration",
     [
-        {},
         {"can_publish_sources": ["camera", "microphone"]},
         {
             "can_publish_sources": [
@@ -122,12 +239,17 @@ def test_api_rooms_update_administrators():
         },
         {"can_publish_sources": []},
         {"can_publish_sources": None},
+        {"can_publish_sources": None, "everyone_can_mute": True},
+        {"can_publish_sources": None, "everyone_can_mute": False},
+        {"can_publish_sources": None, "everyone_can_mute": "yes"},
+        {"can_publish_sources": None, "everyone_can_mute": "1"},
     ],
 )
-def test_api_rooms_update_configuration_valid(configuration):
+@patch.object(RoomManagement, "update_metadata")
+def test_api_rooms_update_configuration_valid(mock_update_metadata, configuration):
     """Administrators should be allowed to set valid configurations."""
     user = UserFactory()
-    room = RoomFactory(users=[(user, "owner")])
+    room = RoomFactory(users=[(user, "owner")], configuration={})
     client = APIClient()
     client.force_login(user)
 
@@ -140,6 +262,28 @@ def test_api_rooms_update_configuration_valid(configuration):
     room.refresh_from_db()
     assert room.configuration == configuration
 
+    mock_update_metadata.assert_called_once()
+
+
+@patch.object(RoomManagement, "update_metadata")
+def test_api_rooms_update_configuration_unchanged_empty(mock_update_metadata):
+    """Should not sync LiveKit metadata when patching an already empty configuration."""
+    user = UserFactory()
+    room = RoomFactory(users=[(user, "owner")], configuration={})
+    client = APIClient()
+    client.force_login(user)
+
+    response = client.patch(
+        f"/api/v1.0/rooms/{room.id!s}/",
+        {"configuration": {}},
+        format="json",
+    )
+    assert response.status_code == 200
+    room.refresh_from_db()
+    assert room.configuration == {}
+
+    mock_update_metadata.assert_not_called()
+
 
 def test_api_rooms_update_configuration_extra_keys_rejected():
     """Extra keys in configuration should be rejected."""
@@ -198,6 +342,24 @@ def test_api_rooms_update_configuration_wrong_type():
     assert room.configuration == {}
 
 
+@pytest.mark.parametrize("invalid_value", ["test", [], {}])
+def test_api_rooms_update_configuration_everyone_can_mute_wrong_type(invalid_value):
+    """everyone_can_mute values with wrong types should be rejected."""
+    user = UserFactory()
+    room = RoomFactory(users=[(user, "owner")])
+    client = APIClient()
+    client.force_login(user)
+
+    response = client.patch(
+        f"/api/v1.0/rooms/{room.id!s}/",
+        {"configuration": {"everyone_can_mute": invalid_value}},
+        format="json",
+    )
+    assert response.status_code == 400
+    room.refresh_from_db()
+    assert room.configuration == {}
+
+
 def test_api_rooms_update_administrators_of_another():
     """
     Being administrator or owner of a room should not grant authorization to update
@@ -217,3 +379,61 @@ def test_api_rooms_update_administrators_of_another():
     other_room.refresh_from_db()
     assert other_room.name == "Old name"
     assert other_room.slug == "old-name"
+
+
+@patch.object(RoomManagement, "update_metadata", side_effect=RoomNotFoundException)
+def test_api_rooms_update_livekit_room_not_found(mock_update_metadata):
+    """Should not fail the API request when the LiveKit room does not exist yet."""
+    user = UserFactory()
+    room = RoomFactory(
+        users=[(user, random.choice(["administrator", "owner"]))],
+        configuration={},
+    )
+    client = APIClient()
+    client.force_login(user)
+
+    response = client.patch(
+        f"/api/v1.0/rooms/{room.id!s}/",
+        {"configuration": {"can_publish_sources": ["camera"]}},
+        format="json",
+    )
+    assert response.status_code == 200
+    room.refresh_from_db()
+    assert room.configuration == {"can_publish_sources": ["camera"]}
+
+    mock_update_metadata.assert_called_once_with(
+        room_name=str(room.id),
+        metadata={
+            "access_level": room.access_level,
+            "configuration": {"can_publish_sources": ["camera"]},
+        },
+    )
+
+
+@patch.object(RoomManagement, "update_metadata", side_effect=RoomManagementException)
+def test_api_rooms_update_livekit_sync_failure(mock_update_metadata):
+    """Should not fail the API request when the LiveKit metadata sync fails."""
+    user = UserFactory()
+    room = RoomFactory(
+        users=[(user, random.choice(["administrator", "owner"]))],
+        configuration={},
+    )
+    client = APIClient()
+    client.force_login(user)
+
+    response = client.patch(
+        f"/api/v1.0/rooms/{room.id!s}/",
+        {"configuration": {"can_publish_sources": ["camera"]}},
+        format="json",
+    )
+    assert response.status_code == 200
+    room.refresh_from_db()
+    assert room.configuration == {"can_publish_sources": ["camera"]}
+
+    mock_update_metadata.assert_called_once_with(
+        room_name=str(room.id),
+        metadata={
+            "access_level": room.access_level,
+            "configuration": {"can_publish_sources": ["camera"]},
+        },
+    )

src/backend/core/utils.py

@@ -121,7 +121,11 @@ def generate_token(
         .with_identity(identity)
         .with_name(username or default_username)
         .with_attributes(
-            {"color": color, "room_admin": "true" if is_admin_or_owner else "false"}
+            {
+                "color": color,
+                "room_admin": "true" if is_admin_or_owner else "false",
+                "is_authenticated": not user.is_anonymous,
+            }
         )
     )
 

src/frontend/src/api/useConfig.ts

@@ -2,6 +2,8 @@ import { fetchApi } from './fetchApi'
 import { keys } from './queryKeys'
 import { useQuery } from '@tanstack/react-query'
 import { RecordingMode } from '@/features/recording'
+import { Track } from 'livekit-client'
+import Source = Track.Source
 
 export interface ApiConfig {
   analytics?: {
@@ -50,7 +52,7 @@ export interface ApiConfig {
     url: string
     force_wss_protocol: boolean
     enable_firefox_proxy_workaround: boolean
-    default_sources: string[]
+    default_sources: Source[]
   }
   transcription_destination?: string
 }

src/frontend/src/features/rooms/api/ApiRoom.ts

@@ -1,3 +1,6 @@
+import { Track } from 'livekit-client'
+import Source = Track.Source
+
 export type ApiLiveKit = {
   url: string
   room: string
@@ -10,6 +13,11 @@ export enum ApiAccessLevel {
   RESTRICTED = 'restricted',
 }
 
+export type RoomConfiguration = {
+  can_publish_sources?: Source[] | null
+  everyone_can_mute?: boolean | null
+}
+
 export type ApiRoom = {
   id: string
   name: string
@@ -18,7 +26,5 @@ export type ApiRoom = {
   is_administrable: boolean
   access_level: ApiAccessLevel
   livekit?: ApiLiveKit
-  configuration?: {
-    [key: string]: string | number | boolean | string[]
-  }
+  configuration?: RoomConfiguration
 }

src/frontend/src/features/rooms/api/muteParticipant.ts

@@ -6,44 +6,74 @@ import {
   NotificationType,
 } from '@/features/notifications'
 import { fetchApi } from '@/api/fetchApi'
+import { useIsAdminOrOwner } from '../livekit/hooks/useIsAdminOrOwner'
+
+import { useCallback } from 'react'
 
 export const useMuteParticipant = () => {
-  const data = useRoomData()
-
+  const apiRoomData = useRoomData()
   const { notifyParticipants } = useNotifyParticipants()
+  const isAdminOrOwner = useIsAdminOrOwner()
 
-  const muteParticipant = async (participant: Participant) => {
-    if (!data?.id) {
-      throw new Error('Room id is not available')
-    }
-    const trackSid = participant.getTrackPublication(
-      Source.Microphone
-    )?.trackSid
+  const muteParticipant = useCallback(
+    async (participant: Participant) => {
+      if (!apiRoomData?.livekit?.room) {
+        throw new Error('Room id is not available')
+      }
 
-    if (!trackSid) {
-      return
-    }
+      const trackSid = participant.getTrackPublication(
+        Source.Microphone
+      )?.trackSid
 
-    try {
-      const response = await fetchApi(`rooms/${data.id}/mute-participant/`, {
-        method: 'POST',
-        body: JSON.stringify({
-          participant_identity: participant.identity,
-          track_sid: trackSid,
-        }),
-      })
+      if (!trackSid) {
+        return
+      }
 
-      await notifyParticipants({
-        type: NotificationType.ParticipantMuted,
-        destinationIdentities: [participant.identity],
-      })
+      // Guard against undefined token for non-admin users
+      if (!isAdminOrOwner && !apiRoomData.livekit.token) {
+        console.error('Cannot mute participant: missing auth token')
+        return
+      }
+
+      const headers = !isAdminOrOwner
+        ? { Authorization: `Bearer ${apiRoomData.livekit.token}` }
+        : undefined
+
+      let response
+      try {
+        response = await fetchApi(
+          `rooms/${apiRoomData.livekit.room}/mute-participant/`,
+          {
+            method: 'POST',
+            headers,
+            body: JSON.stringify({
+              participant_identity: participant.identity,
+              track_sid: trackSid,
+            }),
+          }
+        )
+      } catch (error) {
+        console.error(
+          `Failed to mute participant ${participant.identity}: ${error instanceof Error ? error.message : 'Unknown error'}`
+        )
+        return
+      }
+
+      try {
+        await notifyParticipants({
+          type: NotificationType.ParticipantMuted,
+          destinationIdentities: [participant.identity],
+        })
+      } catch (e) {
+        console.error(
+          `Failed to notify muted participant ${participant.identity}: ${e}`
+        )
+      }
 
       return response
-    } catch (error) {
-      console.error(
-        `Failed to mute participant ${participant.identity}: ${error instanceof Error ? error.message : 'Unknown error'}`
-      )
-    }
-  }
+    },
+    [apiRoomData, isAdminOrOwner, notifyParticipants]
+  )
+
   return { muteParticipant }
 }

src/frontend/src/features/rooms/api/updateParticipantPermissions.ts

@@ -8,7 +8,7 @@ export const useParticipantPermissions = () => {
 
   const updateParticipantPermissions = async (
     participant: Participant,
-    sources: Array<Source>
+    sources: Source[]
   ) => {
     if (!data?.id) {
       throw new Error('Room id is not available')
@@ -20,7 +20,7 @@ export const useParticipantPermissions = () => {
       can_update_metadata: participant.permissions?.canUpdateMetadata,
       can_subscribe_metrics: participant.permissions?.canSubscribeMetrics,
       can_publish: sources.length > 0,
-      can_publish_sources: sources.map((source) => source.toUpperCase()),
+      can_publish_sources: sources,
     }
 
     try {

src/frontend/src/features/rooms/livekit/components/Admin.tsx

@@ -9,7 +9,8 @@ import { queryClient } from '@/api/queryClient'
 import { keys } from '@/api/queryKeys'
 import { useQuery } from '@tanstack/react-query'
 import { useParams } from 'wouter'
-import { usePublishSourcesManager } from '@/features/rooms/livekit/hooks/usePublishSourcesManager'
+import { usePublishSourcesManager } from '../hooks/usePublishSourcesManager'
+import { usePermissionsManager } from '../hooks/usePermissionsManager'
 
 export const Admin = () => {
   const { t } = useTranslation('rooms', { keyPrefix: 'admin' })
@@ -38,6 +39,8 @@ export const Admin = () => {
     isScreenShareEnabled,
   } = usePublishSourcesManager()
 
+  const { toggleMuting, isMutingEnabled } = usePermissionsManager()
+
   return (
     <Div
       display="flex"
@@ -130,6 +133,17 @@ export const Admin = () => {
               fullWidth: true,
             }}
           />
+          <Field
+            type="switch"
+            label={t('moderation.mute.label')}
+            description={t('moderation.mute.description')}
+            isSelected={isMutingEnabled}
+            onChange={toggleMuting}
+            wrapperProps={{
+              noMargin: true,
+              fullWidth: true,
+            }}
+          />
         </div>
       </div>
       <div

src/frontend/src/features/rooms/livekit/hooks/useCanMute.ts

@@ -1,7 +1,13 @@
 import { useIsAdminOrOwner } from './useIsAdminOrOwner'
 import { Participant } from 'livekit-client'
+import { useRoomData } from '@/features/rooms/livekit/hooks/useRoomData'
 
 export const useCanMute = (participant: Participant) => {
+  const apiRoomData = useRoomData()
   const isAdminOrOwner = useIsAdminOrOwner()
-  return participant.isLocal || isAdminOrOwner
+  return (
+    participant.isLocal ||
+    isAdminOrOwner ||
+    apiRoomData?.configuration?.everyone_can_mute !== false
+  )
 }

src/frontend/src/features/rooms/livekit/hooks/usePermissionsManager.ts

@@ -0,0 +1,46 @@
+import { usePatchRoom } from '@/features/rooms/api/patchRoom'
+import { useRoomData } from '@/features/rooms/livekit/hooks/useRoomData'
+import { useCallback } from 'react'
+import { queryClient } from '@/api/queryClient'
+import { keys } from '@/api/queryKeys'
+
+export const usePermissionsManager = () => {
+  const { mutateAsync: patchRoom } = usePatchRoom()
+
+  const data = useRoomData()
+  const configuration = data?.configuration
+  const roomId = data?.slug
+
+  const isMutingEnabled = configuration?.everyone_can_mute ?? true
+
+  const toggleMuting = useCallback(
+    async (enabled: boolean) => {
+      if (!roomId) return
+
+      try {
+        const newConfiguration = {
+          ...configuration,
+          everyone_can_mute: enabled,
+        }
+
+        const room = await patchRoom({
+          roomId,
+          room: { configuration: newConfiguration },
+        })
+
+        queryClient.setQueryData([keys.room, roomId], room)
+
+        return { configuration: newConfiguration }
+      } catch (error) {
+        console.error('Failed to update muting permission:', error)
+        return { success: false, error }
+      }
+    },
+    [configuration, roomId, patchRoom]
+  )
+
+  return {
+    toggleMuting,
+    isMutingEnabled,
+  }
+}

src/frontend/src/features/rooms/livekit/hooks/usePublishSourcesManager.ts

@@ -39,10 +39,6 @@ export const usePublishSourcesManager = () => {
 
   const { notifyParticipants } = useNotifyParticipants()
 
-  const defaultSources = configData?.livekit?.default_sources?.map((source) => {
-    return source as Source
-  })
-
   // The name can be misleading—use the slug instead to ensure the correct React Query key is updated.
   const roomId = data?.slug
 
@@ -54,16 +50,16 @@ export const usePublishSourcesManager = () => {
   )
 
   const currentSources = useMemo(() => {
+    const defaultSources = configData?.livekit?.default_sources ?? []
+
     if (
       configuration?.can_publish_sources == undefined ||
       !Array.isArray(configuration?.can_publish_sources)
     ) {
       return defaultSources
     }
-    return configuration.can_publish_sources.map((source) => {
-      return source as Source
-    })
-  }, [defaultSources, configuration?.can_publish_sources])
+    return configuration.can_publish_sources
+  }, [configData, configuration?.can_publish_sources])
 
   const updateSource = useCallback(
     async (sources: Source[], enabled: boolean) => {
@@ -78,7 +74,7 @@ export const usePublishSourcesManager = () => {
 
         const newConfiguration = {
           ...configuration,
-          can_publish_sources: newSources as string[],
+          can_publish_sources: newSources,
         }
 
         const room = await patchRoom({

src/frontend/src/features/rooms/livekit/hooks/useSyncLiveKitMetadata.ts

@@ -0,0 +1,86 @@
+// features/rooms/hooks/useSyncLiveKitMetadata.ts
+
+import { useEffect } from 'react'
+import { RoomEvent } from 'livekit-client'
+import { queryClient } from '@/api/queryClient'
+import { keys } from '@/api/queryKeys'
+import {
+  ApiAccessLevel,
+  ApiRoom,
+  RoomConfiguration,
+} from '@/features/rooms/api/ApiRoom'
+import { useRoomContext } from '@livekit/components-react'
+import { useRoomData } from './useRoomData'
+
+/**
+ * Shape of the LiveKit room metadata blob pushed by the backend.
+ * Matches RoomManagement.update_metadata → {"configuration": room.configuration}
+ */
+type RoomLiveKitMetadata = {
+  configuration?: RoomConfiguration
+  access_level?: ApiAccessLevel
+}
+
+const parseMetadata = (raw: string | undefined): RoomLiveKitMetadata | null => {
+  if (!raw) return null
+  try {
+    return JSON.parse(raw) as RoomLiveKitMetadata
+  } catch {
+    console.warn('useSyncLiveKitMetadata: failed to parse room metadata')
+    return null
+  }
+}
+
+/**
+ * Sync LiveKit room metadata into the React Query cache.
+ *
+ * The backend pushes room configuration into LiveKit's room metadata
+ * whenever it changes. This hook listens for those changes and patches
+ * the ApiRoom cache so every `useRoomData()`
+ * consumer sees the fresh value automatically.
+ *
+ * Mount once, at the level where the LiveKit Room instance lives.
+ */
+export const useSyncLiveKitMetadata = () => {
+  const room = useRoomContext()
+  const roomData = useRoomData()
+  const roomSlug = roomData?.slug
+
+  useEffect(() => {
+    if (!room || !roomSlug) return
+
+    const applyMetadata = (raw: string | undefined) => {
+      const parsed = parseMetadata(raw)
+      if (!parsed) return
+
+      queryClient.setQueryData<ApiRoom>([keys.room, roomSlug], (prev) => {
+        if (!prev) return prev
+        const nextConfiguration = parsed.configuration ?? prev.configuration
+        const nextAccessLevel = parsed.access_level ?? prev.access_level
+        if (
+          nextConfiguration === prev.configuration &&
+          nextAccessLevel === prev.access_level
+        ) {
+          return prev
+        }
+
+        return {
+          ...prev,
+          configuration: nextConfiguration,
+          access_level: nextAccessLevel,
+        }
+      })
+    }
+
+    // Apply whatever metadata is currently set (covers the case where we
+    // joined the room AFTER the last metadata change, so no event will fire).
+    applyMetadata(room.metadata)
+
+    const handler = (raw: string) => applyMetadata(raw)
+    room.on(RoomEvent.RoomMetadataChanged, handler)
+
+    return () => {
+      room.off(RoomEvent.RoomMetadataChanged, handler)
+    }
+  }, [room, roomSlug])
+}

src/frontend/src/features/rooms/livekit/prefabs/VideoConference.tsx

@@ -32,6 +32,7 @@ import { useRegisterKeyboardShortcut } from '@/features/shortcuts/useRegisterKey
 import { useSettingsDialog } from '@/features/settings'
 import { SettingsDialogExtendedKey } from '@/features/settings/type'
 import { useVideoResolutionSubscription } from '../hooks/useVideoResolutionSubscription'
+import { useSyncLiveKitMetadata } from '../hooks/useSyncLiveKitMetadata'
 import { SettingsDialogProvider } from '@/features/settings/components/SettingsDialogProvider'
 import { IsIdleDisconnectModal } from '../components/IsIdleDisconnectModal'
 import { getParticipantName } from '@/features/rooms/utils/getParticipantName'
@@ -90,6 +91,7 @@ export function VideoConference({ ...props }: VideoConferenceProps) {
   useConnectionObserver()
   useRoomPageTitle()
   useVideoResolutionSubscription()
+  useSyncLiveKitMetadata()
 
   useRegisterKeyboardShortcut({
     id: 'open-shortcuts',

src/frontend/src/locales/de/rooms.json

@@ -528,6 +528,10 @@
       "screenshare": {
         "label": "Bildschirm teilen",
         "description": "Wenn du diese Option deaktivierst, können Teilnehmende ihren Bildschirm nicht mehr teilen. Laufende Bildschirmfreigaben werden sofort beendet."
+      },
+      "mute": {
+        "label": "Andere stummschalten",
+        "description": "Wenn deaktiviert, können Teilnehmer andere Teilnehmer nicht mehr stummschalten."
       }
     }
   },

src/frontend/src/locales/en/rooms.json

@@ -527,6 +527,10 @@
       "screenshare": {
         "label": "Share their screen",
         "description": "Disabling this option will prevent participants from sharing their screen, and any ongoing screen sharing will be stopped immediately."
+      },
+      "mute": {
+        "label": "Mute others",
+        "description": "When disabled, participants will no longer be able to mute other participants."
       }
     }
   },

src/frontend/src/locales/fr/rooms.json

@@ -527,6 +527,10 @@
       "screenshare": {
         "label": "Partager leur écran",
         "description": "En désactivant cette option, les participants ne pourront plus partager leur écran et tout partage en cours sera immédiatement interrompu."
+      },
+      "mute": {
+        "label": "Muter les autres",
+        "description": "En désactivant cette option, les participants ne pourront plus muter d'autres participants."
       }
     }
   },

src/frontend/src/locales/nl/rooms.json

@@ -527,6 +527,10 @@
       "screenshare": {
         "label": "Hun scherm delen",
         "description": "Als u deze optie uitschakelt, kunnen deelnemers hun scherm niet meer delen en wordt elke lopende schermdeling onmiddellijk gestopt."
+      },
+      "mute": {
+        "label": "Anderen dempen",
+        "description": "Wanneer uitgeschakeld, kunnen deelnemers andere deelnemers niet meer dempen."
       }
     }
   },

src/frontend/src/stores/accessibility.ts

@@ -59,7 +59,7 @@ export const CAPTION_FONT_COLOR_VALUES: Record<CaptionColor, string> = {
 }
 
 export const CAPTION_BACKGROUND_COLOR_VALUES: Record<CaptionColor, string> = {
-  default: 'rgba(0, 0, 0, 0.75)',
+  default: 'transparent',
   black: 'rgba(0, 0, 0, 0.75)',
   white: 'rgba(255, 255, 255, 0.75)',
   blue: 'rgba(0, 0, 255, 0.75)',

src/summary/summary/core/user_assign.py

@@ -8,9 +8,10 @@ Multiple speakers can map to the same participant (e.g. two people sharing
 one microphone). A participant with no matching speaker gets no assignment.
 """
 
+import json
 import logging
 from collections import defaultdict
-from dataclasses import dataclass, field
+from dataclasses import asdict, dataclass, field, is_dataclass
 from datetime import datetime
 from typing import Any
 
@@ -318,6 +319,24 @@ def _build_speaker_timelines(transcription: Any) -> dict[str, list[Interval]]:
     return intervals
 
 
+def _json_default(obj: Any) -> Any:
+    """Encode datetimes, dataclasses, and pydantic models for `json.dumps`.
+
+    Intended to be used for logging of `resolve_speaker_identities` (input
+    and computed variables)
+    """
+    if isinstance(obj, datetime):
+        return obj.isoformat()
+    if is_dataclass(obj) and not isinstance(obj, type):
+        return asdict(obj)
+    if hasattr(obj, "segments") and hasattr(obj, "word_segments"):
+        return {"segments": obj.segments, "word_segments": obj.word_segments}
+    if hasattr(obj, "model_dump"):
+        return obj.model_dump(mode="json")
+
+    raise TypeError(f"Object of type {type(obj).__name__} is not JSON serializable")
+
+
 def resolve_speaker_identities(
     metadata: dict[str, Any],
     transcription: Any,
@@ -344,17 +363,6 @@ def resolve_speaker_identities(
     )
     speaker_timelines = _build_speaker_timelines(transcription)
 
-    logger.debug(
-        "Assignment inputs: %d participants, %d speakers\n%s\n%s\n%s",
-        len(participant_timelines),
-        len(speaker_timelines),
-        participant_timelines,
-        speaker_timelines,
-        _format_timelines_debug(
-            participant_timelines, participant_names, speaker_timelines
-        ),
-    )
-
     result = AssignmentResult()
 
     for speaker, speaker_intervals in speaker_timelines.items():
@@ -397,4 +405,30 @@ def resolve_speaker_identities(
                 overlap_threshold,
             )
 
+    logger.debug(
+        json.dumps(
+            {
+                "input": {
+                    "recording_start_datetime": recording_start_datetime.isoformat(),
+                    "recording_end_datetime": recording_end_datetime.isoformat(),
+                    "metadata": metadata,
+                    "transcription": transcription,
+                },
+                "computed": {
+                    "speaker_timelines": speaker_timelines,
+                    "participant_timelines": participant_timelines,
+                    "result": result,
+                },
+            },
+            default=_json_default,
+            indent=2,
+            ensure_ascii=False,
+        ),
+    )
+    logger.debug(
+        _format_timelines_debug(
+            participant_timelines, participant_names, speaker_timelines
+        ),
+    )
+
     return result