🐛(backend) allow all printable ASCII in the user sub field

The user `sub` field was rejecting some ASCII characters that are
actually valid according to the OIDC spec.

Loosen the validation to accept the full ASCII range except control
characters, so the field is compliant with the RFC and works with
any spec-compliant identity provider.

Based on the Stack Overflow discussion in question 279832.

Closes #1609.

CHANGELOG.md

@@ -8,11 +8,22 @@ and this project adheres to
 
 ## [Unreleased]
 
-## [1.30.0] - 2026-09-01
+### Added
+
+- ✨(frontend) add 1080p sending resolution option #1660
+- ✨(backend) add Traefik support via configurable media-auth url header #1649
+- ✨(backend) update a room's attributes from the external API
 
 ### Changed
 
-- ♿️(frontend) close side panel with Escape key #1507
+- ⬆️(dev) pin LiveKit server to v1.13.6
+
+### Fixed
+
+- 🐛(backend) allow any printable ASCII characters in user sub field #1673
+- 🐛(frontend) keep the sending resolution picked while the camera is off #1667
+
+## [1.30.0] - 2026-09-01
 
 ### Added
 
@@ -29,6 +40,7 @@ and this project adheres to
 - ⬆️(frontend) upgrade @fontsource/opendyslexic from 5.2.5 to 5.3.0
 - ⬆️(addons) upgrade core-js from 3.49.0 to 3.50.0
 - ♻️(backend) factorize s3 client creation in utils
+- ♿️(frontend) close side panel with Escape key #1507
 
 ### Fixed
 

UPGRADE.md

@@ -16,6 +16,8 @@ the following command inside your docker container:
 
 ## [Unreleased]
 
+## v1.30.0
+
 ### Removing S3 storage-event webhooks for recordings
 
 Recordings were previously confirmed as saved by an S3 storage-event webhook posting to `/api/v1.0/recordings/storage-hook/`. That endpoint has been removed: recordings are now always finalized from LiveKit's own `egress_ended` webhook, which has been the default path since v1.22.0.

compose.yml

@@ -207,12 +207,14 @@ services:
       - kc_postgresql
 
   livekit:
-    image: livekit/livekit-server
+    image: livekit/livekit-server:v1.13.6
     entrypoint: /livekit-server --dev --bind 0.0.0.0 --config ./config.yaml
     ports:
       - "7880:7880"
       - "7881:7881"
       - "7882:7882/udp"
+      - "3478:3478/udp"
+      - "30000-30100:30000-30100/udp"
     volumes:
       - ./docker/livekit/config/livekit-server.yaml:/config.yaml
     depends_on:

docker/dinum-frontend/Dockerfile

@@ -65,6 +65,7 @@ RUN apk update && apk upgrade  \
     musl \
     musl-utils \
     zlib>=1.3.2-r0 \
+    libexpat>=2.8.4-r0 \
     && apk del curl
 
 USER nginx

docker/livekit/Dockerfile

@@ -1,4 +1,4 @@
-FROM livekit/livekit-server:v1.9.4
+FROM livekit/livekit-server:v1.13.6
 
 # We inject the nip.io certificate manually because the livekit chart doesn't support volume mounting
 COPY rootCA.pem /etc/ssl/certs/

docker/livekit/config/livekit-server.yaml

@@ -8,3 +8,16 @@ webhook:
   api_key: devkey
   urls:
       - http://app-dev:8000/api/v1.0/rooms/webhooks-livekit/
+
+turn:
+  enabled: true
+  domain: turn.127.0.0.1.nip.io
+  udp_port: 3478
+  tls_port: 0
+  external_tls: false
+  relay_range_start: 30000
+  relay_range_end: 30100
+  allow_restricted_peer_cidrs:
+    - 192.168.0.0/16
+    - 172.16.0.0/12
+

docs/openapi.yaml

@@ -16,11 +16,11 @@ info:
     * `rooms:list` – List rooms accessible to the delegated user.
     * `rooms:retrieve` – Retrieve details of a specific room.
     * `rooms:create` – Create new rooms.
-    * `rooms:update` – **Coming soon** Update existing rooms, e.g., add attendees to a room.
+    * `rooms:update` – Update the access level and configuration of existing rooms.
     * `rooms:delete` – **Coming soon** Delete rooms generated by the application.
-    
+
     #### Upcoming Features
-    
+
     * **Add attendees to a room:** You will be able to update a room to include a list of attendees, allowing them to bypass the lobby system automatically.
     * **Delete application-generated rooms:** Rooms created via the application can be deleted when no longer needed.
 
@@ -310,6 +310,67 @@ paths:
         '404':
           $ref: '#/components/responses/RoomNotFoundError'
 
+    patch:
+      tags:
+        - Rooms
+      summary: Update a room
+      description: |
+        Partially updates a room. Only the delegated user's rooms where they are
+        administrator or owner can be updated; any other role gets a `403`.
+
+        **Updatable fields:** `access_level` and `configuration`. Every other field
+        (`id`, `name`, `slug`, `pin_code`) is read-only and silently ignored when sent.
+
+        `configuration` is replaced as a whole, it is not merged with the stored one.
+        Send the complete object you want the room to end up with.
+
+        Full replacement (`PUT`) is not supported. Use `PATCH` instead.
+      operationId: updateRoom
+      security:
+        - BearerAuth: [rooms:update]
+      parameters:
+        - name: id
+          in: path
+          required: true
+          description: Room UUID
+          schema:
+            type: string
+            format: uuid
+      requestBody:
+        required: true
+        content:
+          application/json:
+            schema:
+              $ref: '#/components/schemas/RoomUpdate'
+            examples:
+              accessLevelOnly:
+                summary: Change the access level
+                value:
+                  access_level: "restricted"
+              configurationOnly:
+                summary: Replace the room configuration
+                value:
+                  configuration:
+                    everyone_can_mute: true
+      responses:
+        '200':
+          description: Room updated successfully
+          content:
+            application/json:
+              schema:
+                $ref: '#/components/schemas/Room'
+        '400':
+          $ref: '#/components/responses/BadRequestError'
+        '401':
+          $ref: '#/components/responses/UnauthorizedError'
+        '403':
+          $ref: '#/components/responses/ForbiddenError'
+        '404':
+          $ref: '#/components/responses/RoomNotFoundError'
+        '405':
+          description: |
+            Method not allowed, `PUT` is not supported on this endpoint.
+
 components:
   securitySchemes:
     BearerAuth:
@@ -386,6 +447,17 @@ components:
         configuration:
           $ref: '#/components/schemas/RoomConfiguration'
 
+    RoomUpdate:
+      type: object
+      description: |
+        Fields that can be updated on an existing room. Both are optional, omitted
+        fields keep their current value.
+      properties:
+        access_level:
+          $ref: '#/components/schemas/RoomAccessLevel'
+        configuration:
+          $ref: '#/components/schemas/RoomConfiguration'
+
     RoomConfiguration:
       type: object
       description: |
@@ -427,6 +499,9 @@ components:
         - `public`: Anyone with the room link can join directly, no authentication required.
         - `trusted`: Authenticated users join directly. Unauthenticated users wait in the lobby for approval.
         - `restricted`: Only participants explicitly trusted by the owner bypass the lobby. Everyone else waits for approval regardless of authentication.
+
+        `public` is rejected with a `400` unless the deployment explicitly enables it
+        for this API. This applies both when creating a room and when updating one.
       example: "trusted"
 
     Room:

docs/resource_server.yaml

@@ -20,7 +20,7 @@ info:
     * `lasuite_visio:rooms:list` – List rooms accessible to the delegated user.
     * `lasuite_visio:rooms:retrieve` – Retrieve details of a specific room.
     * `lasuite_visio:rooms:create` – Create new rooms.
-    * `lasuite_visio:rooms:update` – **Coming soon** Update existing rooms, e.g., add attendees to a room.
+    * `lasuite_visio:rooms:update` – Update the access level and configuration of existing rooms.
     * `lasuite_visio:rooms:delete` – **Coming soon** Delete rooms generated by the application.
     
     #### Upcoming Features
@@ -206,6 +206,67 @@ paths:
         '404':
           $ref: '#/components/responses/RoomNotFoundError'
 
+    patch:
+      tags:
+        - Rooms
+      summary: Update a room
+      description: |
+        Partially updates a room. Only rooms where the user is administrator or
+        owner can be updated; any other role gets a `403`.
+
+        **Updatable fields:** `access_level` and `configuration`. Every other field
+        (`id`, `name`, `slug`, `pin_code`) is read-only and silently ignored when sent.
+
+        `configuration` is replaced as a whole, it is not merged with the stored one.
+        Send the complete object you want the room to end up with.
+
+        Full replacement (`PUT`) is not supported. Use `PATCH` instead.
+      operationId: updateRoom
+      security:
+        - BearerAuth: [rooms:update]
+      parameters:
+        - name: id
+          in: path
+          required: true
+          description: Room UUID
+          schema:
+            type: string
+            format: uuid
+      requestBody:
+        required: true
+        content:
+          application/json:
+            schema:
+              $ref: '#/components/schemas/RoomUpdate'
+            examples:
+              accessLevelOnly:
+                summary: Change the access level
+                value:
+                  access_level: "restricted"
+              configurationOnly:
+                summary: Replace the room configuration
+                value:
+                  configuration:
+                    everyone_can_mute: true
+      responses:
+        '200':
+          description: Room updated successfully
+          content:
+            application/json:
+              schema:
+                $ref: '#/components/schemas/Room'
+        '400':
+          $ref: '#/components/responses/BadRequestError'
+        '401':
+          $ref: '#/components/responses/UnauthorizedError'
+        '403':
+          $ref: '#/components/responses/ForbiddenError'
+        '404':
+          $ref: '#/components/responses/RoomNotFoundError'
+        '405':
+          description: |
+            Method not allowed, `PUT` is not supported on this endpoint.
+
 components:
   securitySchemes:
     BearerAuth:
@@ -227,6 +288,17 @@ components:
         configuration:
           $ref: '#/components/schemas/RoomConfiguration'
 
+    RoomUpdate:
+      type: object
+      description: |
+        Fields that can be updated on an existing room. Both are optional, omitted
+        fields keep their current value.
+      properties:
+        access_level:
+          $ref: '#/components/schemas/RoomAccessLevel'
+        configuration:
+          $ref: '#/components/schemas/RoomConfiguration'
+
     RoomConfiguration:
       type: object
       description: |
@@ -268,6 +340,9 @@ components:
         - `public`: Anyone with the room link can join directly, no authentication required.
         - `trusted`: Authenticated users join directly. Unauthenticated users wait in the lobby for approval.
         - `restricted`: Only participants explicitly trusted by the owner bypass the lobby. Everyone else waits for approval regardless of authentication.
+
+        `public` is rejected with a `400` unless the deployment explicitly enables it
+        for this API. This applies both when creating a room and when updating one.
       example: "trusted"
 
     Room:

src/backend/core/analytics/events.py

@@ -8,6 +8,7 @@ class AnalyticsEvent(StrEnum):
 
     # Rooms
     ROOM_CREATED = "room_created"
+    ROOM_UPDATED = "room_updated"
 
     # Roomkit (meeting-room SIP devices)
     ROOMKIT_JOINED = "roomkit_joined"

src/backend/core/api/viewsets.py

@@ -75,11 +75,7 @@ from core.services.participants_management import (
     ParticipantsManagementException,
 )
 from core.services.room_creation import RoomCreation
-from core.services.room_management import (
-    RoomManagement,
-    RoomManagementException,
-    RoomNotFoundException,
-)
+from core.services.room_management import RoomManagement
 from core.services.room_roles import (
     RoomRoleError,
     RoomRoleService,
@@ -356,26 +352,7 @@ class RoomViewSet(
         ):
             return
 
-        metadata = {
-            "configuration": room.configuration,
-            "access_level": room.access_level,
-        }
-
-        try:
-            RoomManagement().update_metadata(
-                room_name=str(room.id),
-                metadata=metadata,
-            )
-        except RoomNotFoundException:
-            logger.info(
-                "LiveKit room %s does not exist yet, skipping metadata sync",
-                room.id,
-            )
-        except RoomManagementException:
-            logger.warning(
-                "Failed to sync metadata to LiveKit for room %s",
-                room.id,
-            )
+        RoomManagement.sync_room_metadata(room)
 
     @decorators.action(
         detail=True,
@@ -1076,9 +1053,10 @@ class RecordingViewSet(
 
     def _auth_get_original_url(self, request):
         """
-        Extracts and parses the original URL from the "HTTP_X_ORIGINAL_URL" header.
+        Extracts and parses the original URL from the configured header.
         Raises PermissionDenied if the header is missing.
-        The original url is passed by nginx in the "HTTP_X_ORIGINAL_URL" header.
+        The original url is passed by the reverse proxy in the header named by the
+        MEDIA_AUTH_ORIGINAL_URL_HEADER setting, which defaults to "HTTP_X_ORIGINAL_URL".
         See corresponding ingress configuration in Helm chart and read about the
         nginx.ingress.kubernetes.io/auth-url annotation to understand how the Nginx ingress
         is configured to do this.
@@ -1088,9 +1066,13 @@ class RecordingViewSet(
         reasons.
         """
         # Extract the original URL from the request header
-        original_url = request.META.get("HTTP_X_ORIGINAL_URL")
+        original_url = request.META.get(settings.MEDIA_AUTH_ORIGINAL_URL_HEADER)
         if not original_url:
-            logger.warning("Missing HTTP_X_ORIGINAL_URL header in subrequest")
+            logger.warning(
+                "Missing %s header in subrequest. Set MEDIA_AUTH_ORIGINAL_URL_HEADER "
+                "to the header your reverse proxy sends.",
+                settings.MEDIA_AUTH_ORIGINAL_URL_HEADER,
+            )
             raise drf_exceptions.PermissionDenied()
 
         logger.debug("Original url: '%s'", original_url)
@@ -1415,7 +1397,8 @@ class FileViewSet(
         Authorize access based on the original URL of an Nginx subrequest
         and user permissions. Returns a dictionary of URL parameters if authorized.
 
-        The original url is passed by nginx in the "HTTP_X_ORIGINAL_URL" header.
+        The original url is passed by the reverse proxy in the header named by the
+        MEDIA_AUTH_ORIGINAL_URL_HEADER setting, which defaults to "HTTP_X_ORIGINAL_URL".
         See corresponding ingress configuration in Helm chart and read about the
         nginx.ingress.kubernetes.io/auth-url annotation to understand how the Nginx ingress
         is configured to do this.
@@ -1434,9 +1417,13 @@ class FileViewSet(
         - PermissionDenied if authorization fails.
         """
         # Extract the original URL from the request header
-        original_url = request.META.get("HTTP_X_ORIGINAL_URL")
+        original_url = request.META.get(settings.MEDIA_AUTH_ORIGINAL_URL_HEADER)
         if not original_url:
-            logger.warning("Missing HTTP_X_ORIGINAL_URL header in subrequest")
+            logger.warning(
+                "Missing %s header in subrequest. Set MEDIA_AUTH_ORIGINAL_URL_HEADER "
+                "to the header your reverse proxy sends.",
+                settings.MEDIA_AUTH_ORIGINAL_URL_HEADER,
+            )
             raise drf_exceptions.PermissionDenied()
 
         parsed_url = urlparse(original_url)

src/backend/core/authentication/backends.py

@@ -3,7 +3,11 @@
 import contextlib
 
 from django.conf import settings
-from django.core.exceptions import ImproperlyConfigured, SuspiciousOperation
+from django.core.exceptions import (
+    ImproperlyConfigured,
+    SuspiciousOperation,
+    ValidationError,
+)
 from django.utils.translation import gettext_lazy as _
 
 from lasuite.oidc_login.backends import (
@@ -17,6 +21,7 @@ from core.services.marketing import (
     ContactData,
     get_marketing_service,
 )
+from core.validators import sub_validator
 
 
 class OIDCAuthenticationBackend(LaSuiteOIDCAuthenticationBackend):
@@ -84,6 +89,19 @@ class OIDCAuthenticationBackend(LaSuiteOIDCAuthenticationBackend):
 
     def get_existing_user(self, sub, email):
         """Fetch existing user by sub or email."""
+
+        sub = str(sub)
+
+        try:
+            sub_validator(sub)
+        except ValidationError as err:
+            raise SuspiciousOperation(
+                "User info contained an invalid sub claim"
+            ) from err
+
+        if len(sub) > 255:
+            raise SuspiciousOperation("User info contained an invalid sub claim")
+
         try:
             return User.objects.get(sub=sub)
         except User.DoesNotExist:

src/backend/core/external_api/viewsets.py

@@ -1,5 +1,6 @@
 """External API endpoints"""
 
+import copy
 from logging import getLogger
 
 from django.conf import settings
@@ -25,6 +26,7 @@ from rest_framework import (
 from core import analytics, api, models
 from core.api.feature_flag import FeatureFlag
 from core.services.jwt_token import JwtTokenService
+from core.services.room_management import RoomManagement
 
 from ..services.provisional_user_service import (
     ProvisionalUserCreationDisabledError,
@@ -142,6 +144,7 @@ class RoomViewSet(
     mixins.CreateModelMixin,
     mixins.RetrieveModelMixin,
     mixins.ListModelMixin,
+    mixins.UpdateModelMixin,
     viewsets.GenericViewSet,
 ):
     """Application-delegated API for room management.
@@ -154,8 +157,12 @@ class RoomViewSet(
     - list: List rooms the user has access to (requires 'rooms:list' scope)
     - retrieve: Get room details (requires 'rooms:retrieve' scope)
     - create: Create a new room owned by the user (requires 'rooms:create' scope)
+    - partial_update: Update a room's access level and configuration, for
+      administrators and owners only (requires 'rooms:update' scope)
     """
 
+    http_method_names = ["get", "post", "patch", "head", "options"]
+
     authentication_classes = [
         authentication.ApplicationJWTAuthentication,
         authentication.AddonsJWTAuthentication,
@@ -189,7 +196,39 @@ class RoomViewSet(
         serializer = self.get_serializer(queryset, many=True)
         return drf_response.Response(serializer.data)
 
-    def perform_create(self, serializer):
+    def _track_room_event(self, room, event, **extra_properties):
+        """Log a room operation for auditing and forward it to analytics."""
+
+        auth_method = type(self.request.successful_authenticator).__name__
+        client_id = (self.request.auth or {}).get("client_id", "unknown")
+
+        # Log for auditing
+        details = "".join(f", {key}={value}" for key, value in extra_properties.items())
+        logger.info(
+            "Room %s via application: room_id=%s, user_id=%s, client_id=%s, auth_method=%s%s",
+            event.removeprefix("room_"),
+            room.id,
+            self.request.user.id,
+            client_id,
+            auth_method,
+            details,
+        )
+
+        analytics.capture(
+            self.request.user,
+            event,
+            {
+                "room_id": str(room.pk),
+                "access_level": room.access_level,
+                "client_id": client_id,
+                "external_api": True,
+                "auth_method": auth_method,
+                **extra_properties,
+                "$set": {"email": self.request.user.email},
+            },
+        )
+
+    def perform_create(self, serializer: serializers.RoomSerializer):
         """Set the current user as owner of the newly created room."""
         room = serializer.save()
         models.ResourceAccess.objects.create(
@@ -198,27 +237,31 @@ class RoomViewSet(
             role=models.RoleChoices.OWNER,
         )
 
-        auth_method = type(self.request.successful_authenticator).__name__
-        client_id = (self.request.auth or {}).get("client_id", "unknown")
+        self._track_room_event(room, analytics.AnalyticsEvent.ROOM_CREATED)
 
-        # Log for auditing
-        logger.info(
-            "Room created via application: room_id=%s, user_id=%s, client_id=%s, auth_method=%s",
-            room.id,
-            self.request.user.id,
-            client_id,
-            auth_method,
+    def perform_update(self, serializer: serializers.RoomSerializer):
+        """Persist the room update, sync it to LiveKit, then log and track it."""
+
+        previous_values = {
+            "access_level": serializer.instance.access_level,
+            "configuration": copy.deepcopy(serializer.instance.configuration),
+        }
+
+        room = serializer.save()
+
+        # Report the fields that actually changed, not the ones that were submitted.
+        updated_fields = sorted(
+            field
+            for field, previous_value in previous_values.items()
+            if getattr(room, field) != previous_value
         )
 
-        analytics.capture(
-            self.request.user,
-            analytics.AnalyticsEvent.ROOM_CREATED,
-            {
-                "room_id": str(room.pk),
-                "access_level": room.access_level,
-                "client_id": client_id,
-                "external_api": True,
-                "auth_method": auth_method,
-                "$set": {"email": self.request.user.email},
-            },
+        if updated_fields:
+            RoomManagement.sync_room_metadata(room)
+
+        self._track_room_event(
+            room,
+            analytics.AnalyticsEvent.ROOM_UPDATED,
+            updated_fields=updated_fields,
+            previous_access_level=previous_values["access_level"],
         )

src/backend/core/factories.py

@@ -48,8 +48,6 @@ class ResourceFactory(factory.django.DjangoModelFactory):
                 else:
                     UserResourceAccessFactory(resource=self, user=item[0], role=item[1])
 
-        self.save()
-
 
 class UserResourceAccessFactory(factory.django.DjangoModelFactory):
     """Create fake resource user accesses for testing."""
@@ -97,8 +95,6 @@ class RecordingFactory(factory.django.DjangoModelFactory):
                         recording=self, user=item[0], role=item[1]
                     )
 
-            self.save()
-
 
 class UserRecordingAccessFactory(factory.django.DjangoModelFactory):
     """Create fake recording user accesses for testing."""

src/backend/core/migrations/0001_initial.py

@@ -8,6 +8,8 @@ import uuid
 from django.conf import settings
 from django.db import migrations, models
 
+import core.validators
+
 
 class Migration(migrations.Migration):
 
@@ -41,7 +43,7 @@ class Migration(migrations.Migration):
                 ('id', models.UUIDField(default=uuid.uuid4, editable=False, help_text='primary key for the record as UUID', primary_key=True, serialize=False, verbose_name='id')),
                 ('created_at', models.DateTimeField(auto_now_add=True, help_text='date and time at which a record was created', verbose_name='created on')),
                 ('updated_at', models.DateTimeField(auto_now=True, help_text='date and time at which a record was last updated', verbose_name='updated on')),
-                ('sub', models.CharField(blank=True, help_text='Optional for pending users; required upon account activation. 255 characters or fewer. Letters, numbers, and @/./+/-/_ characters only.', max_length=255, null=True, unique=True, validators=[django.core.validators.RegexValidator(message='Enter a valid sub. This value may contain only letters, numbers, and @/./+/-/_ characters.', regex='^[\\w.@+-]+\\Z')], verbose_name='sub')),
+                ('sub', models.CharField(blank=True, help_text='Optional for pending users; required upon account activation. 255 characters or fewer. Printable ASCII characters only.', max_length=255, null=True, unique=True, validators=[core.validators.sub_validator], verbose_name='sub')),
                 ('email', models.EmailField(blank=True, max_length=254, null=True, verbose_name='identity email address')),
                 ('admin_email', models.EmailField(blank=True, max_length=254, null=True, unique=True, verbose_name='admin email address')),
                 ('language', models.CharField(choices=settings.LANGUAGES, default=settings.LANGUAGE_CODE, help_text='The language in which the user wants to see the interface.', max_length=10, verbose_name='language')),

src/backend/core/models.py

@@ -27,6 +27,7 @@ from timezone_field import TimeZoneField
 
 from . import fields, utils
 from .recording.enums import FileExtension
+from .validators import sub_validator
 
 logger = getLogger(__name__)
 
@@ -145,19 +146,11 @@ class BaseModel(models.Model):
 class User(AbstractBaseUser, BaseModel, auth_models.PermissionsMixin):
     """User model to work with OIDC only authentication."""
 
-    sub_validator = validators.RegexValidator(
-        regex=r"^[\w.@+-]+\Z",
-        message=_(
-            "Enter a valid sub. This value may contain only letters, "
-            "numbers, and @/./+/-/_ characters."
-        ),
-    )
-
     sub = models.CharField(
         _("sub"),
         help_text=_(
             "Optional for pending users; required upon account activation. "
-            "255 characters or fewer. Letters, numbers, and @/./+/-/_ characters only."
+            "255 characters or fewer. Printable ASCII characters only."
         ),
         max_length=255,
         unique=True,

src/backend/core/recording/services/recording_events.py

@@ -44,7 +44,7 @@ class RecordingEventsService:
         recording_status = status_mapping.get(egress_status)
         if recording_status:
             try:
-                RoomManagement().update_metadata(
+                RoomManagement.update_metadata(
                     room_name, {"recording_status": recording_status}
                 )
             except RoomNotFoundException:

src/backend/core/recording/worker/mediator.py

@@ -68,7 +68,7 @@ class WorkerServiceMediator:
         mode = recording.options.get("original_mode", None) or recording.mode
 
         try:
-            RoomManagement().update_metadata(
+            RoomManagement.update_metadata(
                 room_name, {"recording_mode": mode, "recording_status": "starting"}
             )
         except RoomNotFoundException:

src/backend/core/services/livekit_events.py

@@ -192,7 +192,7 @@ class LiveKitEventsService:
 
         try:
             room_name = str(recording.room.id)
-            RoomManagement().update_metadata(
+            RoomManagement.update_metadata(
                 room_name, remove_keys=["recording_mode", "recording_status"]
             )
         except RoomNotFoundException:

src/backend/core/services/room_management.py

@@ -30,9 +30,10 @@ class RoomNotFoundException(RoomManagementException):
 class RoomManagement:
     """Service for managing LiveKit rooms."""
 
+    @classmethod
     @async_to_sync
     async def update_metadata(
-        self,
+        cls,
         room_name: str,
         metadata: Optional[Dict] = None,
         remove_keys: Optional[list[str]] = None,
@@ -90,8 +91,9 @@ class RoomManagement:
         finally:
             await lkapi.aclose()
 
+    @classmethod
     @async_to_sync
-    async def delete_room(self, room_name: str):
+    async def delete_room(cls, room_name: str):
         """Delete a LiveKit room and disconnect all participants.
 
         Raises:
@@ -116,3 +118,32 @@ class RoomManagement:
             raise RoomManagementException("Could not delete room") from e
         finally:
             await lkapi.aclose()
+
+    @classmethod
+    def sync_room_metadata(cls, room):
+        """Push a room's configuration and access level to its LiveKit room metadata.
+
+        Failures are swallowed: a room that is not live yet, or a LiveKit hiccup,
+        should never fail the request that triggered the update.
+        """
+
+        metadata = {
+            "configuration": room.configuration,
+            "access_level": room.access_level,
+        }
+
+        try:
+            cls.update_metadata(
+                room_name=str(room.id),
+                metadata=metadata,
+            )
+        except RoomNotFoundException:
+            logger.info(
+                "LiveKit room %s does not exist yet, skipping metadata sync",
+                room.id,
+            )
+        except RoomManagementException:
+            logger.warning(
+                "Failed to sync metadata to LiveKit for room %s",
+                room.id,
+            )

src/backend/core/tasks/connection_test.py

@@ -31,7 +31,7 @@ def delete_connection_test_room(room_name: str):
         return
 
     try:
-        RoomManagement().delete_room(room_name)
+        RoomManagement.delete_room(room_name)
     except RoomNotFoundException:
         # Room may already be gone after empty/departure timeout.
         logger.info("Connection test room '%s' already gone.", room_name)

src/backend/core/tests/authentication/test_backends.py

@@ -40,6 +40,111 @@ def test_authentication_getter_existing_user(monkeypatch):
     assert user == db_user
 
 
+@pytest.mark.parametrize(
+    "sub",
+    [
+        # NUL (U+0000) passes str.isascii() but PostgreSQL text fields
+        # cannot store or compare it (DataError)
+        "auth0|abc\x00def",
+        # lone surrogates cannot be encoded to UTF-8 for the DB lookup
+        # (UnicodeEncodeError), which runs before any model validation
+        "bad\ud800sub",
+        # plainly invalid subs would otherwise escape as ValidationError
+        # on user creation, which mozilla-django-oidc does not catch
+        "\u00e9milie",
+        "a" * 256,
+        # ASCII control characters are rejected by policy
+        "tab\tsub",
+        "del\x7fsub",
+    ],
+)
+def test_authentication_getter_invalid_sub_rejected_cleanly(monkeypatch, sub):
+    """
+    Subs that can never be persisted should be rejected with
+    SuspiciousOperation (turned into a clean authentication failure by
+    mozilla-django-oidc) instead of leaking DataError, UnicodeEncodeError
+    or ValidationError as a server error.
+    """
+    klass = OIDCAuthenticationBackend()
+
+    def get_userinfo_mocked(*args):
+        return {"sub": sub, "email": "john@example.com"}
+
+    monkeypatch.setattr(OIDCAuthenticationBackend, "get_userinfo", get_userinfo_mocked)
+
+    with pytest.raises(
+        SuspiciousOperation,
+        match="User info contained an invalid sub claim",
+    ):
+        klass.get_or_create_user(access_token="test-token", id_token=None, payload=None)
+
+    assert models.User.objects.exists() is False
+
+
+def test_authentication_getter_numeric_sub(monkeypatch):
+    """
+    Some providers serialize the sub as a JSON number. It should keep working
+    (CharField coerces it to a string on save) and must not crash the early
+    sub checks in get_existing_user.
+    """
+    klass = OIDCAuthenticationBackend()
+
+    def get_userinfo_mocked(*args):
+        return {"sub": 12345, "email": "john@example.com"}
+
+    monkeypatch.setattr(OIDCAuthenticationBackend, "get_userinfo", get_userinfo_mocked)
+
+    user = klass.get_or_create_user(
+        access_token="test-token", id_token=None, payload=None
+    )
+
+    assert user.sub == "12345"
+    assert models.User.objects.count() == 1
+
+
+def test_authentication_getter_new_user_auth0_pipe_sub(monkeypatch):
+    """
+    A first login with an Auth0-style sub containing a pipe ("provider|user-id")
+    should create the user instead of raising a ValidationError.
+    Regression test for https://github.com/suitenumerique/meet/issues/[XXX].
+    """
+    klass = OIDCAuthenticationBackend()
+
+    def get_userinfo_mocked(*args):
+        return {"sub": "auth0|644c0bc8f1874ef6d339fb34", "email": "john@example.com"}
+
+    monkeypatch.setattr(OIDCAuthenticationBackend, "get_userinfo", get_userinfo_mocked)
+
+    user = klass.get_or_create_user(
+        access_token="test-token", id_token=None, payload=None
+    )
+
+    assert user.sub == "auth0|644c0bc8f1874ef6d339fb34"
+    assert user.email == "john@example.com"
+    assert models.User.objects.count() == 1
+
+
+def test_authentication_getter_existing_user_auth0_pipe_sub(monkeypatch):
+    """
+    A returning user with an Auth0-style pipe sub should be matched by sub,
+    not duplicated or rejected.
+    """
+    klass = OIDCAuthenticationBackend()
+    db_user = UserFactory(sub="auth0|644c0bc8f1874ef6d339fb34")
+
+    def get_userinfo_mocked(*args):
+        return {"sub": db_user.sub}
+
+    monkeypatch.setattr(OIDCAuthenticationBackend, "get_userinfo", get_userinfo_mocked)
+
+    user = klass.get_or_create_user(
+        access_token="test-token", id_token=None, payload=None
+    )
+
+    assert user == db_user
+    assert models.User.objects.count() == 1
+
+
 def test_authentication_getter_new_user_no_email(monkeypatch):
     """
     If no user matches, a user should be created.

src/backend/core/tests/files/test_api_files_media_auth.py

@@ -7,6 +7,7 @@ from urllib.parse import quote, urlparse
 
 from django.conf import settings
 from django.core.files.storage import default_storage
+from django.test import override_settings
 from django.utils import timezone
 
 import pytest
@@ -143,3 +144,59 @@ def test_api_files_media_auth_own_file_deleted():
     )
 
     assert response.status_code == 403
+
+
+@override_settings(MEDIA_AUTH_ORIGINAL_URL_HEADER="HTTP_X_FORWARDED_URI")
+def test_api_files_media_auth_custom_original_url_header():
+    """
+    Authorization should honour the configured original-url header.
+
+    Covers the attachment subrequest path, which resolves the header separately
+    from the recording one. Reverse proxies other than nginx-ingress use
+    different headers: Traefik's ForwardAuth sends X-Forwarded-Uri and cannot
+    emit X-Original-URL at all.
+    """
+    user = factories.UserFactory()
+
+    file = factories.FileFactory(
+        type=models.FileTypeChoices.BACKGROUND_IMAGE,
+        update_upload_state=models.FileUploadStateChoices.READY,
+        creator=user,
+    )
+
+    client = APIClient()
+    client.force_login(user)
+
+    default_storage.save(file.file_key, BytesIO(b"my prose"))
+
+    original_url = f"http://localhost/media/{file.file_key:s}"
+    response = client.get(
+        "/api/v1.0/files/media-auth/", HTTP_X_FORWARDED_URI=original_url
+    )
+
+    assert response.status_code == 200
+    assert "AWS4-HMAC-SHA256 Credential=" in response["Authorization"]
+
+
+@override_settings(MEDIA_AUTH_ORIGINAL_URL_HEADER="HTTP_X_FORWARDED_URI")
+def test_api_files_media_auth_default_header_ignored_when_reconfigured():
+    """
+    Only the configured header should be honoured, never a hardcoded fallback.
+    """
+    user = factories.UserFactory()
+
+    file = factories.FileFactory(
+        type=models.FileTypeChoices.BACKGROUND_IMAGE,
+        update_upload_state=models.FileUploadStateChoices.READY,
+        creator=user,
+    )
+
+    client = APIClient()
+    client.force_login(user)
+
+    original_url = f"http://localhost/media/{file.file_key:s}"
+    response = client.get(
+        "/api/v1.0/files/media-auth/", HTTP_X_ORIGINAL_URL=original_url
+    )
+
+    assert response.status_code == 403

src/backend/core/tests/recording/test_api_recordings_media_auth.py

@@ -8,6 +8,7 @@ from uuid import uuid4
 
 from django.conf import settings
 from django.core.files.storage import default_storage
+from django.test import override_settings
 from django.utils import timezone
 
 import pytest
@@ -282,3 +283,63 @@ def test_api_recordings_media_auth_success_administrator(mode):
         timeout=1,
     )
     assert response.content.decode("utf-8") == "my prose"
+
+
+def test_api_recordings_media_auth_missing_header():
+    """
+    Test that a subrequest without the configured original-url header is rejected.
+    """
+    user = UserFactory()
+
+    client = APIClient()
+    client.force_login(user)
+
+    response = client.get("/api/v1.0/recordings/media-auth/")
+
+    assert response.status_code == 403
+
+
+@override_settings(MEDIA_AUTH_ORIGINAL_URL_HEADER="HTTP_X_FORWARDED_URI")
+def test_api_recordings_media_auth_custom_original_url_header():
+    """
+    Test that the header carrying the original URL can be configured.
+
+    Reverse proxies other than nginx-ingress use different headers: Traefik's
+    ForwardAuth sends X-Forwarded-Uri and cannot emit X-Original-URL at all.
+    """
+    user = UserFactory()
+
+    client = APIClient()
+    client.force_login(user)
+
+    original_url = f"http://localhost/media/recordings/{uuid4()!s}.mp4"
+
+    response = client.get(
+        "/api/v1.0/recordings/media-auth/", HTTP_X_FORWARDED_URI=original_url
+    )
+
+    # The header was read and parsed: we get as far as looking the recording up,
+    # rather than being rejected for a missing header.
+    assert response.status_code == 404
+
+
+@override_settings(MEDIA_AUTH_ORIGINAL_URL_HEADER="HTTP_X_FORWARDED_URI")
+def test_api_recordings_media_auth_default_header_ignored_when_reconfigured():
+    """
+    Test that only the configured header is honoured.
+
+    Guards against the header being read from a hardcoded name in parallel with
+    the setting.
+    """
+    user = UserFactory()
+
+    client = APIClient()
+    client.force_login(user)
+
+    original_url = f"http://localhost/media/recordings/{uuid4()!s}.mp4"
+
+    response = client.get(
+        "/api/v1.0/recordings/media-auth/", HTTP_X_ORIGINAL_URL=original_url
+    )
+
+    assert response.status_code == 403

src/backend/core/tests/rooms/test_api_rooms_update.py

@@ -381,38 +381,11 @@ def test_api_rooms_update_administrators_of_another():
     assert other_room.slug == "old-name"
 
 
-@patch.object(RoomManagement, "update_metadata", side_effect=RoomNotFoundException)
-def test_api_rooms_update_livekit_room_not_found(mock_update_metadata):
-    """Should not fail the API request when the LiveKit room does not exist yet."""
-    user = UserFactory()
-    room = RoomFactory(
-        users=[(user, random.choice(["administrator", "owner"]))],
-        configuration={},
-    )
-    client = APIClient()
-    client.force_login(user)
-
-    response = client.patch(
-        f"/api/v1.0/rooms/{room.id!s}/",
-        {"configuration": {"can_publish_sources": ["camera"]}},
-        format="json",
-    )
-    assert response.status_code == 200
-    room.refresh_from_db()
-    assert room.configuration == {"can_publish_sources": ["camera"]}
-
-    mock_update_metadata.assert_called_once_with(
-        room_name=str(room.id),
-        metadata={
-            "access_level": room.access_level,
-            "configuration": {"can_publish_sources": ["camera"]},
-        },
-    )
-
-
-@patch.object(RoomManagement, "update_metadata", side_effect=RoomManagementException)
-def test_api_rooms_update_livekit_sync_failure(mock_update_metadata):
+@pytest.mark.parametrize("exception", [RoomNotFoundException, RoomManagementException])
+@patch.object(RoomManagement, "update_metadata")
+def test_api_rooms_update_livekit_sync_failure(mock_update_metadata, exception):
     """Should not fail the API request when the LiveKit metadata sync fails."""
+    mock_update_metadata.side_effect = exception
     user = UserFactory()
     room = RoomFactory(
         users=[(user, random.choice(["administrator", "owner"]))],

src/backend/core/tests/services/test_room_management.py

@@ -5,6 +5,8 @@ from unittest import mock
 import pytest
 from livekit.api import TwirpError
 
+from core.factories import RoomFactory
+from core.models import RoomAccessLevel
 from core.services.room_management import (
     RoomManagement,
     RoomManagementException,
@@ -20,7 +22,7 @@ def test_delete_room_calls_livekit(mock_create_livekit_client):
     mock_api.aclose = mock.AsyncMock()
     mock_create_livekit_client.return_value = mock_api
 
-    RoomManagement().delete_room("room-abc")
+    RoomManagement.delete_room("room-abc")
 
     mock_api.room.delete_room.assert_awaited_once()
     request = mock_api.room.delete_room.await_args.args[0]
@@ -39,7 +41,7 @@ def test_delete_room_raises_not_found(mock_create_livekit_client):
     mock_create_livekit_client.return_value = mock_api
 
     with pytest.raises(RoomNotFoundException):
-        RoomManagement().delete_room("missing-room")
+        RoomManagement.delete_room("missing-room")
 
     mock_api.aclose.assert_awaited_once()
 
@@ -55,6 +57,25 @@ def test_delete_room_raises_management_exception(mock_create_livekit_client):
     mock_create_livekit_client.return_value = mock_api
 
     with pytest.raises(RoomManagementException):
-        RoomManagement().delete_room("room-abc")
+        RoomManagement.delete_room("room-abc")
 
     mock_api.aclose.assert_awaited_once()
+
+
+@mock.patch.object(RoomManagement, "update_metadata")
+def test_sync_room_metadata_pushes_configuration_and_access_level(mock_update_metadata):
+    """The room's configuration and access level are forwarded to LiveKit."""
+    room = RoomFactory.build(
+        access_level=RoomAccessLevel.RESTRICTED,
+        configuration={"everyone_can_mute": True},
+    )
+
+    RoomManagement.sync_room_metadata(room)
+
+    mock_update_metadata.assert_called_once_with(
+        room_name=str(room.id),
+        metadata={
+            "configuration": {"everyone_can_mute": True},
+            "access_level": RoomAccessLevel.RESTRICTED,
+        },
+    )

src/backend/core/tests/test_external_api_rooms.py

@@ -16,8 +16,17 @@ import responses
 from lasuite.oidc_resource_server.authentication import ResourceServerAuthentication
 from rest_framework.test import APIClient
 
+from core.analytics import AnalyticsEvent
 from core.factories import ApplicationFactory, RoomFactory, UserFactory
-from core.models import ApplicationScope, RoleChoices, Room, RoomAccessLevel, User
+from core.models import (
+    Application,
+    ApplicationScope,
+    RoleChoices,
+    Room,
+    RoomAccessLevel,
+    User,
+)
+from core.services.room_management import RoomManagement
 
 pytestmark = pytest.mark.django_db
 
@@ -880,6 +889,509 @@ def test_api_rooms_create_public_access_level_when_default_is_public(settings):
     assert response.data["access_level"] == RoomAccessLevel.PUBLIC
 
 
+@mock.patch("core.external_api.viewsets.analytics.capture")
+def test_api_rooms_create_tracks_analytics(mock_capture):
+    """Creating a room should emit a ROOM_CREATED analytics event."""
+
+    user = UserFactory()
+    token = generate_test_token(user, [ApplicationScope.ROOMS_CREATE])
+    application = Application.objects.get()
+
+    client = APIClient()
+    client.credentials(HTTP_AUTHORIZATION=f"Bearer {token}")
+    response = client.post(
+        "/external-api/v1.0/rooms/",
+        {"access_level": RoomAccessLevel.RESTRICTED},
+        format="json",
+    )
+
+    assert response.status_code == 201
+
+    mock_capture.assert_called_once()
+    captured_user, event, properties = mock_capture.call_args[0]
+
+    assert captured_user == user
+    assert event == AnalyticsEvent.ROOM_CREATED
+    assert properties == {
+        "room_id": response.data["id"],
+        "access_level": RoomAccessLevel.RESTRICTED,
+        "client_id": str(application.client_id),
+        "external_api": True,
+        "auth_method": "ApplicationJWTAuthentication",
+        "$set": {"email": user.email},
+    }
+
+
+def test_api_rooms_update_requires_authentication():
+    """Updating a room without authentication should return 401."""
+
+    room = RoomFactory(users=[(UserFactory(), RoleChoices.OWNER)])
+
+    client = APIClient()
+    response = client.patch(
+        f"/external-api/v1.0/rooms/{room.id}/",
+        {"access_level": RoomAccessLevel.RESTRICTED},
+        format="json",
+    )
+
+    assert response.status_code == 401
+
+
+def test_api_rooms_update_requires_scope():
+    """Updating a room requires the ROOMS_UPDATE scope."""
+
+    user = UserFactory()
+    room = RoomFactory(users=[(user, RoleChoices.OWNER)])
+
+    # Token without ROOMS_UPDATE scope
+    token = generate_test_token(user, [ApplicationScope.ROOMS_RETRIEVE])
+
+    client = APIClient()
+    client.credentials(HTTP_AUTHORIZATION=f"Bearer {token}")
+    response = client.patch(
+        f"/external-api/v1.0/rooms/{room.id}/",
+        {"access_level": RoomAccessLevel.RESTRICTED},
+        format="json",
+    )
+
+    assert response.status_code == 403
+    assert (
+        "insufficient permissions. required scope: rooms:update"
+        in str(response.data).lower()
+    )
+
+
+def test_api_rooms_update_no_scope():
+    """Updating a room without any scope should return 403."""
+
+    user = UserFactory()
+    room = RoomFactory(users=[(user, RoleChoices.OWNER)])
+
+    token = generate_test_token(user, [])
+
+    client = APIClient()
+    client.credentials(HTTP_AUTHORIZATION=f"Bearer {token}")
+    response = client.patch(
+        f"/external-api/v1.0/rooms/{room.id}/",
+        {"access_level": RoomAccessLevel.RESTRICTED},
+        format="json",
+    )
+
+    assert response.status_code == 403
+    assert "insufficient permissions." in str(response.data).lower()
+
+
+@mock.patch.object(RoomManagement, "update_metadata")
+def test_api_rooms_update_owner_success(mock_update_metadata, settings):
+    """An owner should be able to update the access level and the configuration."""
+
+    settings.APPLICATION_BASE_URL = "http://your-application.com"
+
+    user = UserFactory()
+    room = RoomFactory(
+        users=[(user, RoleChoices.OWNER)],
+        access_level=RoomAccessLevel.TRUSTED,
+        configuration={},
+    )
+
+    token = generate_test_token(user, [ApplicationScope.ROOMS_UPDATE])
+
+    client = APIClient()
+    client.credentials(HTTP_AUTHORIZATION=f"Bearer {token}")
+    response = client.patch(
+        f"/external-api/v1.0/rooms/{room.id}/",
+        {
+            "access_level": RoomAccessLevel.RESTRICTED,
+            "configuration": {"everyone_can_mute": True},
+        },
+        format="json",
+    )
+
+    assert response.status_code == 200
+    assert response.data["id"] == str(room.id)
+    assert response.data["access_level"] == RoomAccessLevel.RESTRICTED
+    assert response.data["configuration"] == {"everyone_can_mute": True}
+    assert response.data["url"] == f"http://your-application.com/{room.slug}"
+
+    room.refresh_from_db()
+    assert room.access_level == RoomAccessLevel.RESTRICTED
+    assert room.configuration == {"everyone_can_mute": True}
+
+    mock_update_metadata.assert_called_once_with(
+        room_name=str(room.id),
+        metadata={
+            "configuration": {"everyone_can_mute": True},
+            "access_level": RoomAccessLevel.RESTRICTED,
+        },
+    )
+
+
+@mock.patch.object(RoomManagement, "update_metadata")
+def test_api_rooms_update_replaces_configuration(mock_update_metadata):
+    """The configuration is replaced as a whole, it is not merged with the stored one."""
+
+    user = UserFactory()
+    room = RoomFactory(
+        users=[(user, RoleChoices.OWNER)],
+        configuration={"can_publish_sources": ["camera"], "everyone_can_mute": True},
+    )
+
+    token = generate_test_token(user, [ApplicationScope.ROOMS_UPDATE])
+
+    client = APIClient()
+    client.credentials(HTTP_AUTHORIZATION=f"Bearer {token}")
+    response = client.patch(
+        f"/external-api/v1.0/rooms/{room.id}/",
+        {"configuration": {"everyone_can_mute": False}},
+        format="json",
+    )
+
+    assert response.status_code == 200
+
+    # The keys missing from the payload are dropped, not kept.
+    assert response.data["configuration"] == {"everyone_can_mute": False}
+
+    room.refresh_from_db()
+    assert room.configuration == {"everyone_can_mute": False}
+
+    mock_update_metadata.assert_called_once_with(
+        room_name=str(room.id),
+        metadata={
+            "configuration": {"everyone_can_mute": False},
+            "access_level": room.access_level,
+        },
+    )
+
+
+@mock.patch.object(RoomManagement, "update_metadata")
+def test_api_rooms_update_administrator_success(mock_update_metadata):
+    """An administrator should be able to update a room."""
+
+    user = UserFactory()
+    room = RoomFactory(
+        users=[(user, RoleChoices.ADMIN)],
+        access_level=RoomAccessLevel.TRUSTED,
+    )
+
+    token = generate_test_token(user, [ApplicationScope.ROOMS_UPDATE])
+
+    client = APIClient()
+    client.credentials(HTTP_AUTHORIZATION=f"Bearer {token}")
+    response = client.patch(
+        f"/external-api/v1.0/rooms/{room.id}/",
+        {"access_level": RoomAccessLevel.RESTRICTED},
+        format="json",
+    )
+
+    assert response.status_code == 200
+
+    room.refresh_from_db()
+    assert room.access_level == RoomAccessLevel.RESTRICTED
+    mock_update_metadata.assert_called_once()
+
+
+@mock.patch.object(RoomManagement, "update_metadata")
+def test_api_rooms_update_put_not_allowed(mock_update_metadata):
+    """PUT is not exposed: full replacement is not supported, only PATCH is."""
+
+    user = UserFactory()
+    room = RoomFactory(
+        users=[(user, RoleChoices.OWNER)],
+        access_level=RoomAccessLevel.TRUSTED,
+        configuration={},
+    )
+
+    token = generate_test_token(user, [ApplicationScope.ROOMS_UPDATE])
+
+    client = APIClient()
+    client.credentials(HTTP_AUTHORIZATION=f"Bearer {token}")
+    response = client.put(
+        f"/external-api/v1.0/rooms/{room.id}/",
+        {
+            "access_level": RoomAccessLevel.RESTRICTED,
+            "configuration": {"everyone_can_mute": True},
+        },
+        format="json",
+    )
+
+    assert response.status_code == 405
+
+    room.refresh_from_db()
+    assert room.access_level == RoomAccessLevel.TRUSTED
+    assert room.configuration == {}
+    mock_update_metadata.assert_not_called()
+
+
+@pytest.mark.parametrize("role", [RoleChoices.MEMBER, None])
+@mock.patch.object(RoomManagement, "update_metadata")
+def test_api_rooms_update_without_privileges(mock_update_metadata, role):
+    """Members and users without any role should not be able to update a room."""
+
+    user = UserFactory()
+    users = [(user, role)] if role else []
+    room = RoomFactory(users=users, access_level=RoomAccessLevel.TRUSTED)
+
+    token = generate_test_token(user, [ApplicationScope.ROOMS_UPDATE])
+
+    client = APIClient()
+    client.credentials(HTTP_AUTHORIZATION=f"Bearer {token}")
+    response = client.patch(
+        f"/external-api/v1.0/rooms/{room.id}/",
+        {"access_level": RoomAccessLevel.RESTRICTED},
+        format="json",
+    )
+
+    assert response.status_code == 403
+
+    room.refresh_from_db()
+    assert room.access_level == RoomAccessLevel.TRUSTED
+    mock_update_metadata.assert_not_called()
+
+
+@mock.patch.object(RoomManagement, "update_metadata")
+def test_api_rooms_update_readonly_enforcement(mock_update_metadata):
+    """Read-only fields provided on update should be ignored, the slug stays immutable."""
+
+    user = UserFactory()
+    room = RoomFactory(
+        users=[(user, RoleChoices.OWNER)],
+        access_level=RoomAccessLevel.TRUSTED,
+    )
+    expected_id, expected_name = str(room.id), room.name
+    expected_slug, expected_pin_code = room.slug, room.pin_code
+
+    token = generate_test_token(user, [ApplicationScope.ROOMS_UPDATE])
+
+    client = APIClient()
+    client.credentials(HTTP_AUTHORIZATION=f"Bearer {token}")
+    response = client.patch(
+        f"/external-api/v1.0/rooms/{room.id}/",
+        {
+            "id": str(uuid.uuid4()),
+            "name": "fake-name",
+            "slug": "fake-slug",
+            "pin_code": "000000",
+            "access_level": RoomAccessLevel.RESTRICTED,
+        },
+        format="json",
+    )
+
+    assert response.status_code == 200
+    assert response.data["id"] == expected_id
+    assert response.data["name"] == expected_name
+    assert response.data["slug"] == expected_slug
+
+    room.refresh_from_db()
+    assert str(room.id) == expected_id
+    assert room.name == expected_name
+    assert room.slug == expected_slug
+    assert room.pin_code == expected_pin_code
+
+    # The one writable field in the payload was applied
+    assert room.access_level == RoomAccessLevel.RESTRICTED
+    mock_update_metadata.assert_called_once()
+
+
+@mock.patch.object(RoomManagement, "update_metadata")
+def test_api_rooms_update_rejects_invalid_configuration(mock_update_metadata):
+    """Updating a room with unsupported configuration keys should fail."""
+
+    user = UserFactory()
+    room = RoomFactory(users=[(user, RoleChoices.OWNER)], configuration={})
+
+    token = generate_test_token(user, [ApplicationScope.ROOMS_UPDATE])
+
+    client = APIClient()
+    client.credentials(HTTP_AUTHORIZATION=f"Bearer {token}")
+    response = client.patch(
+        f"/external-api/v1.0/rooms/{room.id}/",
+        {"configuration": {"unsupported_flag": True}},
+        format="json",
+    )
+
+    assert response.status_code == 400
+    assert "extra inputs are not permitted" in str(response.data).lower()
+
+    room.refresh_from_db()
+    assert room.configuration == {}
+    mock_update_metadata.assert_not_called()
+
+
+@pytest.mark.parametrize(
+    "invalid_configuration",
+    [
+        {"can_publish_sources": ["invalid-source"]},
+        {"everyone_can_mute": "invalid-value"},
+    ],
+)
+@mock.patch.object(RoomManagement, "update_metadata")
+def test_api_rooms_update_rejects_invalid_configuration_values(
+    mock_update_metadata, invalid_configuration
+):
+    """Updating a room with invalid configuration values should fail."""
+
+    user = UserFactory()
+    room = RoomFactory(users=[(user, RoleChoices.OWNER)], configuration={})
+
+    token = generate_test_token(user, [ApplicationScope.ROOMS_UPDATE])
+
+    client = APIClient()
+    client.credentials(HTTP_AUTHORIZATION=f"Bearer {token}")
+    response = client.patch(
+        f"/external-api/v1.0/rooms/{room.id}/",
+        {"configuration": invalid_configuration},
+        format="json",
+    )
+
+    assert response.status_code == 400
+
+    room.refresh_from_db()
+    assert room.configuration == {}
+    mock_update_metadata.assert_not_called()
+
+
+@mock.patch.object(RoomManagement, "update_metadata")
+def test_api_rooms_update_public_access_disabled_by_default(mock_update_metadata):
+    """Switching a room to public should be disabled for the external API by default."""
+
+    user = UserFactory()
+    room = RoomFactory(
+        users=[(user, RoleChoices.OWNER)],
+        access_level=RoomAccessLevel.TRUSTED,
+    )
+
+    token = generate_test_token(user, [ApplicationScope.ROOMS_UPDATE])
+
+    client = APIClient()
+    client.credentials(HTTP_AUTHORIZATION=f"Bearer {token}")
+    response = client.patch(
+        f"/external-api/v1.0/rooms/{room.id}/",
+        {"access_level": RoomAccessLevel.PUBLIC},
+        format="json",
+    )
+
+    assert response.status_code == 400
+    assert "public rooms are disabled" in str(response.data).lower()
+
+    room.refresh_from_db()
+    assert room.access_level == RoomAccessLevel.TRUSTED
+    mock_update_metadata.assert_not_called()
+
+
+@mock.patch.object(RoomManagement, "update_metadata")
+def test_api_rooms_update_public_access_enabled_with_settings(
+    mock_update_metadata, settings
+):
+    """Switching a room to public should be allowed when explicitly enabled."""
+
+    settings.EXTERNAL_API_ALLOW_PUBLIC_ACCESS = True
+
+    user = UserFactory()
+    room = RoomFactory(
+        users=[(user, RoleChoices.OWNER)],
+        access_level=RoomAccessLevel.TRUSTED,
+    )
+
+    token = generate_test_token(user, [ApplicationScope.ROOMS_UPDATE])
+
+    client = APIClient()
+    client.credentials(HTTP_AUTHORIZATION=f"Bearer {token}")
+    response = client.patch(
+        f"/external-api/v1.0/rooms/{room.id}/",
+        {"access_level": RoomAccessLevel.PUBLIC},
+        format="json",
+    )
+
+    assert response.status_code == 200
+    assert response.data["access_level"] == RoomAccessLevel.PUBLIC
+
+    room.refresh_from_db()
+    assert room.access_level == RoomAccessLevel.PUBLIC
+    mock_update_metadata.assert_called_once()
+
+
+@mock.patch("core.external_api.viewsets.analytics.capture")
+@mock.patch.object(RoomManagement, "update_metadata")
+def test_api_rooms_update_unchanged_skips_livekit_sync(
+    mock_update_metadata, mock_capture
+):
+    """An update that changes nothing should not sync metadata nor report changes."""
+
+    user = UserFactory()
+    room = RoomFactory(
+        users=[(user, RoleChoices.OWNER)],
+        access_level=RoomAccessLevel.TRUSTED,
+        configuration={"everyone_can_mute": True},
+    )
+
+    token = generate_test_token(user, [ApplicationScope.ROOMS_UPDATE])
+
+    client = APIClient()
+    client.credentials(HTTP_AUTHORIZATION=f"Bearer {token}")
+    response = client.patch(
+        f"/external-api/v1.0/rooms/{room.id}/",
+        {
+            "access_level": RoomAccessLevel.TRUSTED,
+            "configuration": {"everyone_can_mute": True},
+        },
+        format="json",
+    )
+
+    assert response.status_code == 200
+    mock_update_metadata.assert_not_called()
+
+    # The event is still emitted for auditing, but reports an empty delta.
+    _, _, properties = mock_capture.call_args[0]
+    assert properties["updated_fields"] == []
+
+
+@mock.patch("core.external_api.viewsets.analytics.capture")
+@mock.patch.object(RoomManagement, "update_metadata")
+def test_api_rooms_update_tracks_analytics(mock_update_metadata, mock_capture):
+    """Updating a room should emit a ROOM_UPDATED analytics event."""
+
+    user = UserFactory()
+    room = RoomFactory(
+        users=[(user, RoleChoices.OWNER)],
+        access_level=RoomAccessLevel.TRUSTED,
+        configuration={},
+    )
+
+    token = generate_test_token(user, [ApplicationScope.ROOMS_UPDATE])
+    application = Application.objects.get()
+
+    client = APIClient()
+    client.credentials(HTTP_AUTHORIZATION=f"Bearer {token}")
+    response = client.patch(
+        f"/external-api/v1.0/rooms/{room.id}/",
+        {
+            "access_level": RoomAccessLevel.RESTRICTED,
+            "configuration": {"everyone_can_mute": True},
+        },
+        format="json",
+    )
+
+    assert response.status_code == 200
+
+    mock_capture.assert_called_once()
+    captured_user, event, properties = mock_capture.call_args[0]
+
+    assert captured_user == user
+    assert event == AnalyticsEvent.ROOM_UPDATED
+    assert properties == {
+        "room_id": str(room.pk),
+        "access_level": RoomAccessLevel.RESTRICTED,
+        "updated_fields": ["access_level", "configuration"],
+        "previous_access_level": RoomAccessLevel.TRUSTED,
+        "client_id": str(application.client_id),
+        "external_api": True,
+        "auth_method": "ApplicationJWTAuthentication",
+        "$set": {"email": user.email},
+    }
+
+    mock_update_metadata.assert_called_once()
+
+
 def test_api_rooms_response_no_url(settings):
     """Response should not include url field when APPLICATION_BASE_URL is None."""
     settings.APPLICATION_BASE_URL = None
@@ -1497,6 +2009,106 @@ def test_resource_server_denies_access_with_insufficient_scopes(settings):
     assert response.status_code == 403
 
 
+@responses.activate
+@mock.patch.object(RoomManagement, "update_metadata")
+def test_resource_server_updates_room_with_prefixed_scope(
+    mock_update_metadata, settings
+):
+    """A resource server token carrying the prefixed update scope should be accepted."""
+
+    user = UserFactory(sub="very-specific-sub")
+    room = RoomFactory(
+        users=[(user, RoleChoices.OWNER)],
+        access_level=RoomAccessLevel.TRUSTED,
+    )
+
+    settings.OIDC_RS_CLIENT_ID = "some_client_id"
+    settings.OIDC_RS_CLIENT_SECRET = "some_client_secret"
+    settings.OIDC_RS_SCOPES_PREFIX = "lasuite_meet"
+
+    settings.OIDC_OP_URL = "https://oidc.example.com"
+    settings.OIDC_VERIFY_SSL = False
+    settings.OIDC_TIMEOUT = 5
+    settings.OIDC_PROXY = None
+    settings.OIDC_OP_JWKS_ENDPOINT = "https://oidc.example.com/jwks"
+    settings.OIDC_OP_INTROSPECTION_ENDPOINT = "https://oidc.example.com/introspect"
+
+    responses.add(
+        responses.POST,
+        "https://oidc.example.com/introspect",
+        json={
+            "iss": "https://oidc.example.com",
+            "aud": "some_client_id",  # settings.OIDC_RS_CLIENT_ID
+            "sub": "very-specific-sub",
+            "client_id": "some_service_provider",
+            "scope": "openid lasuite_meet lasuite_meet:rooms:update",
+            "active": True,
+        },
+    )
+
+    client = APIClient()
+    client.credentials(HTTP_AUTHORIZATION="Bearer some_token")
+    response = client.patch(
+        f"/external-api/v1.0/rooms/{room.id}/",
+        {"access_level": RoomAccessLevel.RESTRICTED},
+        format="json",
+    )
+
+    assert response.status_code == 200
+
+    room.refresh_from_db()
+    assert room.access_level == RoomAccessLevel.RESTRICTED
+    mock_update_metadata.assert_called_once()
+
+
+@responses.activate
+def test_resource_server_denies_room_update_without_update_scope(settings):
+    """A resource server token without the update scope should be denied."""
+
+    user = UserFactory(sub="very-specific-sub")
+    room = RoomFactory(
+        users=[(user, RoleChoices.OWNER)],
+        access_level=RoomAccessLevel.TRUSTED,
+    )
+
+    settings.OIDC_RS_CLIENT_ID = "some_client_id"
+    settings.OIDC_RS_CLIENT_SECRET = "some_client_secret"
+    settings.OIDC_RS_SCOPES_PREFIX = "lasuite_meet"
+
+    settings.OIDC_OP_URL = "https://oidc.example.com"
+    settings.OIDC_VERIFY_SSL = False
+    settings.OIDC_TIMEOUT = 5
+    settings.OIDC_PROXY = None
+    settings.OIDC_OP_JWKS_ENDPOINT = "https://oidc.example.com/jwks"
+    settings.OIDC_OP_INTROSPECTION_ENDPOINT = "https://oidc.example.com/introspect"
+
+    responses.add(
+        responses.POST,
+        "https://oidc.example.com/introspect",
+        json={
+            "iss": "https://oidc.example.com",
+            "aud": "some_client_id",  # settings.OIDC_RS_CLIENT_ID
+            "sub": "very-specific-sub",
+            "client_id": "some_service_provider",
+            "scope": "openid lasuite_meet lasuite_meet:rooms:retrieve",
+            "active": True,
+        },
+    )
+
+    client = APIClient()
+    client.credentials(HTTP_AUTHORIZATION="Bearer some_token")
+    response = client.patch(
+        f"/external-api/v1.0/rooms/{room.id}/",
+        {"access_level": RoomAccessLevel.RESTRICTED},
+        format="json",
+    )
+
+    assert response.status_code == 403
+
+    room.refresh_from_db()
+    assert room.access_level == RoomAccessLevel.TRUSTED
+
+
 # ==============================
 # Addons
 # ==============================
@@ -1548,6 +2160,32 @@ def test_api_rooms_create_with_valid_addons_token():
     assert room.get_role(user) == RoleChoices.OWNER
 
 
+@mock.patch.object(RoomManagement, "update_metadata")
+def test_api_rooms_update_with_valid_addons_token(mock_update_metadata):
+    """Updating a room with a valid addons token should succeed."""
+    user = UserFactory()
+    room = RoomFactory(
+        users=[(user, RoleChoices.OWNER)],
+        access_level=RoomAccessLevel.TRUSTED,
+    )
+
+    token = generate_addons_test_token(user, [ApplicationScope.ROOMS_UPDATE])
+
+    client = APIClient()
+    client.credentials(HTTP_AUTHORIZATION=f"Bearer {token}")
+    response = client.patch(
+        f"/external-api/v1.0/rooms/{room.id}/",
+        {"access_level": RoomAccessLevel.RESTRICTED},
+        format="json",
+    )
+
+    assert response.status_code == 200
+
+    room.refresh_from_db()
+    assert room.access_level == RoomAccessLevel.RESTRICTED
+    mock_update_metadata.assert_called_once()
+
+
 def test_api_rooms_addons_token_inactive_user():
     """Addons token for an inactive user should return 401."""
     user = UserFactory(is_active=False)

src/backend/core/tests/test_models_users.py

@@ -26,6 +26,64 @@ def test_models_users_id_unique():
         factories.UserFactory(id=user.id)
 
 
+@pytest.mark.parametrize(
+    "sub,is_valid",
+    [
+        # cases from suitenumerique/docs PR #1295 (same validator)
+        ("valid_sub.@+-:=/", True),
+        ("invalid süb", False),
+        (12345, True),
+        # Auth0 emits "provider|user-id" subject identifiers
+        ("auth0|644c0bc8f1874ef6d339fb34", True),
+        ("google-oauth2|103547991597142817347", True),
+        # Keycloak-style UUID
+        ("f:550e8400-e29b-41d4-a716-446655440000:jdoe", True),
+        # base64/URN-style identifiers
+        ("dGVzdC1zdWItdmFsdWU=", True),
+        ("urn:example:user/42", True),
+        # legacy format still accepted
+        ("user@example.com", True),
+        # space (U+0020) is printable ASCII and remains allowed
+        ("sub with space", True),
+        # non-ASCII values are rejected
+        ("émilie", False),
+        # ASCII control characters (U+0000-U+001F, U+007F) are rejected:
+        # NUL passes isascii() but cannot be stored in PostgreSQL text
+        # fields, and the others invite log injection and interop issues
+        ("nul\x00sub", False),
+        ("\x00", False),
+        ("tab\tsub", False),
+        ("newline\nsub", False),
+        ("del\x7fsub", False),
+    ],
+)
+def test_models_users_sub_validator(sub, is_valid):
+    """
+    The "sub" field should accept any ASCII string as required by
+    OpenID Connect Core 1.0 §2 and RFC 7519 §4.1.2, and reject non-ASCII values.
+    """
+    user = factories.UserFactory()
+    user.sub = sub
+    if is_valid:
+        user.full_clean()
+    else:
+        with pytest.raises(
+            ValidationError,
+            match="Enter a valid sub. This value should be printable ASCII only.",
+        ):
+            user.full_clean()
+
+
+def test_models_users_sub_max_length():
+    """The "sub" field should enforce the 255 ASCII characters limit of OIDC Core 1.0 §2."""
+    user = factories.UserFactory(sub="a" * 255)
+    assert user.sub == "a" * 255
+
+    user.sub = "a" * 256
+    with pytest.raises(ValidationError, match="at most 255 characters"):
+        user.full_clean()
+
+
 def test_models_users_send_mail_main_existing():
     """The "email_user' method should send mail to the user's email address."""
     user = factories.UserFactory()

src/backend/core/validators.py

@@ -0,0 +1,23 @@
+"""Custom validators for the core app."""
+
+from django.core.exceptions import ValidationError
+from django.utils.translation import gettext_lazy as _
+
+
+def sub_validator(value):
+    """Validate that the sub is printable ASCII only.
+
+    OpenID Connect Core 1.0 (section 2) allows any ASCII (RFC 20) string of
+    at most 255 characters, so no character whitelist is applied: providers
+    legitimately emit "|" (Auth0), ":" (Keycloak), "=", "/", etc. As a
+    deliberate hardening beyond the spec, ASCII control characters
+    (U+0000-U+001F and U+007F) are rejected: no known provider emits them,
+    NUL cannot be stored in PostgreSQL text fields, and the others invite
+    log-injection and interoperability issues. For str values,
+    ``isprintable()`` is false exactly for those control characters, while
+    space (U+0020) remains allowed.
+    """
+    if not value.isascii() or not value.isprintable():
+        raise ValidationError(
+            _("Enter a valid sub. This value should be printable ASCII only.")
+        )

src/backend/locale/de_DE/LC_MESSAGES/django.po

@@ -8,7 +8,7 @@ msgid ""
 msgstr ""
 "Project-Id-Version: PACKAGE VERSION\n"
 "Report-Msgid-Bugs-To: \n"
-"POT-Creation-Date: 2026-07-02 10:47+0000\n"
+"POT-Creation-Date: 2026-09-02 22:52+0000\n"
 "PO-Revision-Date: YEAR-MO-DA HO:MI+ZONE\n"
 "Last-Translator: FULL NAME <EMAIL@ADDRESS>\n"
 "Language-Team: LANGUAGE <LL@li.org>\n"
@@ -51,11 +51,11 @@ msgstr ""
 msgid "File preview"
 msgstr ""
 
-#: core/admin.py:300 core/admin.py:443
+#: core/admin.py:300 core/admin.py:450
 msgid "No owner"
 msgstr "Kein Eigentümer"
 
-#: core/admin.py:303 core/admin.py:446
+#: core/admin.py:303 core/admin.py:453
 msgid "Multiple owners"
 msgstr "Mehrere Eigentümer"
 
@@ -98,11 +98,11 @@ msgstr "%(count)s Aufnahme(n) erfolgreich als ‚Fehler beim Stoppen‘ markiert
 msgid "Skipped %(count)s recording(s) with an ineligible status."
 msgstr "%(count)s abgelaufene Aufnahme(n) übersprungen."
 
-#: core/admin.py:510
+#: core/admin.py:517
 msgid "No scopes"
 msgstr "Keine Scopes"
 
-#: core/admin.py:512
+#: core/admin.py:519
 msgid "Scopes"
 msgstr "Scopes"
 
@@ -110,185 +110,201 @@ msgstr "Scopes"
 msgid "Creator is me"
 msgstr "Ersteller bin ich"
 
-#: core/api/serializers.py:89
+#: core/api/serializers.py:108
 msgid "You must be administrator or owner of a room to add accesses to it."
 msgstr ""
 "Sie müssen Administrator oder Eigentümer eines Raums sein, um Zugriffe "
 "hinzuzufügen."
 
-#: core/api/serializers.py:534
+#: core/api/serializers.py:560
 msgid "This file extension is not allowed."
 msgstr "Diese Dateiendung ist nicht erlaubt."
 
-#: core/api/viewsets.py:1222
+#: core/api/viewsets.py:1268
 msgid "You have reached the maximum number of files for this type."
 msgstr "Sie haben die maximale Anzahl an Dateien dieses Typs erreicht."
 
-#: core/models.py:37
+#: core/models.py:38
 msgid "Member"
 msgstr "Mitglied"
 
-#: core/models.py:38
+#: core/models.py:39
 msgid "Administrator"
 msgstr "Administrator"
 
-#: core/models.py:39
+#: core/models.py:40
 msgid "Owner"
 msgstr "Eigentümer"
 
-#: core/models.py:55
+#: core/models.py:56
 msgid "Initiated"
 msgstr "Gestartet"
 
-#: core/models.py:56
+#: core/models.py:57
 msgid "Active"
 msgstr "Aktiv"
 
-#: core/models.py:57
+#: core/models.py:58
 msgid "Stopped"
 msgstr "Beendet"
 
-#: core/models.py:58
+#: core/models.py:59
 msgid "Saved"
 msgstr "Gespeichert"
 
-#: core/models.py:59
+#: core/models.py:60
 msgid "Aborted"
 msgstr "Abgebrochen"
 
-#: core/models.py:60
+#: core/models.py:61
 msgid "Failed to Start"
 msgstr "Start fehlgeschlagen"
 
-#: core/models.py:61
+#: core/models.py:62
 msgid "Failed to Stop"
 msgstr "Stopp fehlgeschlagen"
 
-#: core/models.py:62
+#: core/models.py:63
 msgid "Notification succeeded"
 msgstr "Benachrichtigung erfolgreich"
 
-#: core/models.py:65
+#: core/models.py:66
 msgid "External process successful"
 msgstr "Externer Prozess erfolgreich"
 
-#: core/models.py:67
+#: core/models.py:68
 msgid "External process failed"
 msgstr "Externer Prozess fehlgeschlagen"
 
-#: core/models.py:96
+#: core/models.py:97
 msgid "SCREEN_RECORDING"
 msgstr "BILDSCHIRMAUFZEICHNUNG"
 
-#: core/models.py:97
+#: core/models.py:98
 msgid "TRANSCRIPT"
 msgstr "TRANSKRIPT"
 
-#: core/models.py:103
+#: core/models.py:104
 msgid "Public Access"
 msgstr "Öffentlicher Zugriff"
 
-#: core/models.py:104
+#: core/models.py:105
 msgid "Trusted Access"
 msgstr "Vertrauenswürdiger Zugriff"
 
-#: core/models.py:105
+#: core/models.py:106
 msgid "Restricted Access"
 msgstr "Eingeschränkter Zugriff"
 
-#: core/models.py:117
+#: core/models.py:118
 msgid "id"
 msgstr "ID"
 
-#: core/models.py:118
+#: core/models.py:119
 msgid "primary key for the record as UUID"
 msgstr "Primärschlüssel des Eintrags als UUID"
 
-#: core/models.py:124
+#: core/models.py:125
 msgid "created on"
 msgstr "erstellt am"
 
-#: core/models.py:125
+#: core/models.py:126
 msgid "date and time at which a record was created"
 msgstr "Datum und Uhrzeit der Erstellung eines Eintrags"
 
-#: core/models.py:130
+#: core/models.py:131
 msgid "updated on"
 msgstr "aktualisiert am"
 
-#: core/models.py:131
+#: core/models.py:132
 msgid "date and time at which a record was last updated"
 msgstr "Datum und Uhrzeit der letzten Aktualisierung eines Eintrags"
 
-#: core/models.py:151
-msgid ""
-"Enter a valid sub. This value may contain only letters, numbers, and @/./+/-/"
-"_ characters."
-msgstr ""
-"Geben Sie einen gültigen Sub ein. Dieser Wert darf nur Buchstaben, Zahlen "
-"und die Zeichen @/./+/-/_ enthalten."
-
-#: core/models.py:157
+#: core/models.py:150
 msgid "sub"
 msgstr "Sub"
 
-#: core/models.py:159
+#: core/models.py:152
 msgid ""
 "Optional for pending users; required upon account activation. 255 characters "
-"or fewer. Letters, numbers, and @/./+/-/_ characters only."
+"or fewer. Printable ASCII characters only."
 msgstr ""
 "Optional für ausstehende Benutzer; erforderlich nach Kontoaktivierung. "
-"Maximal 255 Zeichen. Nur Buchstaben, Zahlen und @/./+/-/_ Zeichen erlaubt."
+"Maximal 255 Zeichen. Nur druckbare ASCII-Zeichen erlaubt."
 
-#: core/models.py:168
+#: core/validators.py:22
+msgid "Enter a valid sub. This value should be printable ASCII only."
+msgstr "Geben Sie einen gültigen sub ein. Dieser Wert darf nur druckbare ASCII-Zeichen enthalten."
+
+#: core/models.py:161
 msgid "identity email address"
 msgstr "Identitäts-E-Mail-Adresse"
 
-#: core/models.py:173
+#: core/models.py:166
 msgid "admin email address"
 msgstr "Administrator-E-Mail-Adresse"
 
-#: core/models.py:175
+#: core/models.py:168
 msgid "full name"
 msgstr "Vollständiger Name"
 
-#: core/models.py:177
+#: core/models.py:170
 msgid "short name"
 msgstr "Kurzname"
 
-#: core/models.py:183
+#: core/models.py:176
 msgid "language"
 msgstr "Sprache"
 
-#: core/models.py:184
+#: core/models.py:177
 msgid "The language in which the user wants to see the interface."
 msgstr "Die Sprache, in der der Benutzer die Oberfläche sehen möchte."
 
-#: core/models.py:190
+#: core/models.py:183
 msgid "The timezone in which the user wants to see times."
 msgstr "Die Zeitzone, in der der Benutzer die Zeiten sehen möchte."
 
-#: core/models.py:193
+#: core/models.py:190
+msgid "default room access level"
+msgstr ""
+
+#: core/models.py:192
+msgid ""
+"Access level applied by default to new rooms created by this user. When "
+"empty, the instance default is used."
+msgstr ""
+
+#: core/models.py:199
+#, fuzzy
+#| msgid "Visio room configuration"
+msgid "default room configuration"
+msgstr "Visio-Raumkonfiguration"
+
+#: core/models.py:201
+msgid "Configurations applied by default to new rooms created by this user."
+msgstr ""
+
+#: core/models.py:205
 msgid "device"
 msgstr "Gerät"
 
-#: core/models.py:195
+#: core/models.py:207
 msgid "Whether the user is a device or a real user."
 msgstr "Ob es sich um ein Gerät oder einen echten Benutzer handelt."
 
-#: core/models.py:198
+#: core/models.py:210
 msgid "staff status"
 msgstr "Mitarbeiterstatus"
 
-#: core/models.py:200
+#: core/models.py:212
 msgid "Whether the user can log into this admin site."
 msgstr "Ob der Benutzer sich bei dieser Admin-Seite anmelden kann."
 
-#: core/models.py:203
+#: core/models.py:215
 msgid "active"
 msgstr "aktiv"
 
-#: core/models.py:206
+#: core/models.py:218
 msgid ""
 "Whether this user should be treated as active. Unselect this instead of "
 "deleting accounts."
@@ -296,66 +312,66 @@ msgstr ""
 "Ob dieser Benutzer als aktiv behandelt werden soll. Deaktivieren Sie dies "
 "anstelle des Löschens des Kontos."
 
-#: core/models.py:219
+#: core/models.py:231
 msgid "user"
 msgstr "Benutzer"
 
-#: core/models.py:220
+#: core/models.py:232
 msgid "users"
 msgstr "Benutzer"
 
-#: core/models.py:286
+#: core/models.py:298
 msgid "Resource"
 msgstr "Ressource"
 
-#: core/models.py:287
+#: core/models.py:299
 msgid "Resources"
 msgstr "Ressourcen"
 
-#: core/models.py:345
+#: core/models.py:357
 msgid "Resource access"
 msgstr "Ressourcenzugriff"
 
-#: core/models.py:346
+#: core/models.py:358
 msgid "Resource accesses"
 msgstr "Ressourcenzugriffe"
 
-#: core/models.py:352
+#: core/models.py:364
 msgid "Resource access with this User and Resource already exists."
 msgstr ""
 "Ein Ressourcenzugriff mit diesem Benutzer und dieser Ressource existiert "
 "bereits."
 
-#: core/models.py:409
+#: core/models.py:421
 msgid "Visio room configuration"
 msgstr "Visio-Raumkonfiguration"
 
-#: core/models.py:410
+#: core/models.py:422
 msgid "Values for Visio parameters to configure the room."
 msgstr "Werte für Visio-Parameter zur Konfiguration des Raums."
 
-#: core/models.py:417
+#: core/models.py:429
 msgid "Room PIN code"
 msgstr "PIN-Code für den Raum"
 
-#: core/models.py:418
+#: core/models.py:430
 msgid "Unique n-digit code that identifies this room in telephony mode."
 msgstr ""
 "Eindeutiger n-stelliger Code, der diesen Raum im Telephonmodus identifiziert."
 
-#: core/models.py:424 core/models.py:578
+#: core/models.py:436 core/models.py:597
 msgid "Room"
 msgstr "Raum"
 
-#: core/models.py:425
+#: core/models.py:437
 msgid "Rooms"
 msgstr "Räume"
 
-#: core/models.py:589
+#: core/models.py:608
 msgid "Worker ID"
 msgstr "Worker-ID"
 
-#: core/models.py:591
+#: core/models.py:610
 msgid ""
 "Enter an identifier for the worker recording.This ID is retained even when "
 "the worker stops, allowing for easy tracking."
@@ -364,153 +380,153 @@ msgstr ""
 "erhalten, auch wenn der Worker stoppt, was ein einfaches Nachverfolgen "
 "ermöglicht."
 
-#: core/models.py:599
+#: core/models.py:618
 msgid "Recording mode"
 msgstr "Aufzeichnungsmodus"
 
-#: core/models.py:600
+#: core/models.py:619
 msgid "Defines the mode of recording being called."
 msgstr "Definiert den aufgerufenen Aufzeichnungsmodus."
 
-#: core/models.py:605 core/models.py:606
+#: core/models.py:624 core/models.py:625
 msgid "Recording options"
 msgstr "Aufnahmeoptionen"
 
-#: core/models.py:613
+#: core/models.py:632
 msgid "External Process ID"
 msgstr "External Process ID"
 
-#: core/models.py:614
+#: core/models.py:633
 msgid "ID of the external process associated with the recording."
 msgstr "ID des externen Prozesses, der mit der Aufzeichnung verknüpft ist"
 
-#: core/models.py:620
+#: core/models.py:639
 msgid "Recording"
 msgstr "Aufzeichnung"
 
-#: core/models.py:621
+#: core/models.py:640
 msgid "Recordings"
 msgstr "Aufzeichnungen"
 
-#: core/models.py:731
+#: core/models.py:750
 msgid "Recording/user relation"
 msgstr "Beziehung Aufzeichnung/Benutzer"
 
-#: core/models.py:732
+#: core/models.py:751
 msgid "Recording/user relations"
 msgstr "Beziehungen Aufzeichnung/Benutzer"
 
-#: core/models.py:738
+#: core/models.py:757
 msgid "This user is already in this recording."
 msgstr "Dieser Benutzer ist bereits Teil dieser Aufzeichnung."
 
-#: core/models.py:744
+#: core/models.py:763
 msgid "This team is already in this recording."
 msgstr "Dieses Team ist bereits Teil dieser Aufzeichnung."
 
-#: core/models.py:750
+#: core/models.py:769
 msgid "Either user or team must be set, not both."
 msgstr "Entweder Benutzer oder Team muss festgelegt werden, nicht beides."
 
-#: core/models.py:767
+#: core/models.py:786
 msgid "Create rooms"
 msgstr "Räume erstellen"
 
-#: core/models.py:768
+#: core/models.py:787
 msgid "List rooms"
 msgstr "Räume auflisten"
 
-#: core/models.py:769
+#: core/models.py:788
 msgid "Retrieve room details"
 msgstr "Raumdetails abrufen"
 
-#: core/models.py:770
+#: core/models.py:789
 msgid "Update rooms"
 msgstr "Räume aktualisieren"
 
-#: core/models.py:771
+#: core/models.py:790
 msgid "Delete rooms"
 msgstr "Räume löschen"
 
-#: core/models.py:784
+#: core/models.py:803
 msgid "Application name"
 msgstr "Anwendungsname"
 
-#: core/models.py:785
+#: core/models.py:804
 msgid "Descriptive name for this application."
 msgstr "Beschreibender Name für diese Anwendung."
 
-#: core/models.py:795
+#: core/models.py:814
 msgid "Hashed on Save. Copy it now if this is a new secret."
 msgstr ""
 "Beim Speichern gehasht. Jetzt kopieren, wenn dies ein neues Geheimnis ist."
 
-#: core/models.py:806
+#: core/models.py:825
 msgid "Application"
 msgstr "Anwendung"
 
-#: core/models.py:807
+#: core/models.py:826
 msgid "Applications"
 msgstr "Anwendungen"
 
-#: core/models.py:830
+#: core/models.py:849
 msgid "Enter a valid domain"
 msgstr "Geben Sie eine gültige Domain ein"
 
-#: core/models.py:833
+#: core/models.py:852
 msgid "Domain"
 msgstr "Domain"
 
-#: core/models.py:834
+#: core/models.py:853
 msgid "Email domain this application can act on behalf of."
 msgstr "E-Mail-Domain, im Namen der diese Anwendung handeln kann."
 
-#: core/models.py:846
+#: core/models.py:865
 msgid "Application domain"
 msgstr "Anwendungsdomain"
 
-#: core/models.py:847
+#: core/models.py:866
 msgid "Application domains"
 msgstr "Anwendungsdomains"
 
-#: core/models.py:865
+#: core/models.py:884
 msgid "Pending"
 msgstr "Ausstehend"
 
-#: core/models.py:866
+#: core/models.py:885
 msgid "Analyzing"
 msgstr ""
 
-#: core/models.py:873
+#: core/models.py:892
 msgid "Ready"
 msgstr "Bereit"
 
-#: core/models.py:879
+#: core/models.py:898
 msgid "Background image"
 msgstr "Hintergrundbild"
 
-#: core/models.py:891
+#: core/models.py:910
 msgid "title"
 msgstr "Titel"
 
-#: core/models.py:915
+#: core/models.py:934
 msgid "Malware detection info when the analysis status is unsafe."
 msgstr ""
 "Informationen zur Malware-Erkennung, wenn der Analyse-Status unsicher ist."
 
-#: core/models.py:920
+#: core/models.py:939
 msgid "File"
 msgstr "Datei"
 
-#: core/models.py:921
+#: core/models.py:940
 msgid "Files"
 msgstr "Dateien"
 
-#: core/models.py:1041
+#: core/models.py:1060
 msgid "This file is already hard deleted."
 msgstr "Diese Datei wurde bereits endgültig gelöscht."
 
-#: core/models.py:1051
+#: core/models.py:1070
 #, fuzzy
 #| msgid "To hard delete a file, it must first be soft deleted."
 msgid "To hard delete a file, it must first be soft deleted."
@@ -518,15 +534,15 @@ msgstr ""
 "Um eine Datei endgültig zu löschen, muss sie zuvor weich gelöscht worden "
 "sein."
 
-#: core/recording/event/notification.py:123
+#: core/recording/event/notification.py:124
 msgid "Your recording is ready"
 msgstr "Ihre Aufzeichnung ist bereit"
 
-#: core/recording/event/notification.py:194
+#: core/recording/event/notification.py:195
 msgid "Transcription"
 msgstr "Transkription"
 
-#: core/recording/event/notification.py:204
+#: core/recording/event/notification.py:206
 #, python-brace-format
 msgid "Meeting \"{room}\" on {room_recording_date} at {room_recording_time}"
 msgstr ""
@@ -537,25 +553,25 @@ msgstr ""
 msgid "Video call in progress: {sender.email} is waiting for you to connect"
 msgstr "Videoanruf läuft: {sender.email} wartet auf Ihre Teilnahme"
 
-#: core/templates/mail/html/invitation.html:159
-#: core/templates/mail/html/screen_recording.html:159
-#: core/templates/mail/text/invitation.txt:3
-#: core/templates/mail/text/screen_recording.txt:3
+#: core/templates/mail/html/invitation.html:151
+#: core/templates/mail/html/screen_recording.html:151
+#: core/templates/mail/text/invitation.txt:4
+#: core/templates/mail/text/screen_recording.txt:4
 msgid "Logo email"
 msgstr "Logo-E-Mail"
 
-#: core/templates/mail/html/invitation.html:189
-#: core/templates/mail/text/invitation.txt:5
+#: core/templates/mail/html/invitation.html:181
+#: core/templates/mail/text/invitation.txt:6
 msgid "invites you to join an ongoing video call"
 msgstr "lädt Sie zu einem laufenden Videoanruf ein"
 
-#: core/templates/mail/html/invitation.html:200
-#: core/templates/mail/text/invitation.txt:7
+#: core/templates/mail/html/invitation.html:192
+#: core/templates/mail/text/invitation.txt:8
 msgid "JOIN THE CALL"
 msgstr "AM ANRUF TEILNEHMEN"
 
-#: core/templates/mail/html/invitation.html:227
-#: core/templates/mail/text/invitation.txt:13
+#: core/templates/mail/html/invitation.html:219
+#: core/templates/mail/text/invitation.txt:14
 msgid ""
 "If you can't click the button, copy and paste the URL into your browser to "
 "join the call."
@@ -563,41 +579,47 @@ msgstr ""
 "Wenn Sie den Button nicht anklicken können, kopieren Sie die URL und fügen "
 "Sie sie in Ihren Browser ein, um am Anruf teilzunehmen."
 
-#: core/templates/mail/html/invitation.html:235
-#: core/templates/mail/text/invitation.txt:15
+#: core/templates/mail/html/invitation.html:227
+#: core/templates/mail/text/invitation.txt:16
 msgid "Tips for a better experience:"
 msgstr "Tipps für ein besseres Erlebnis:"
 
-#: core/templates/mail/html/invitation.html:237
-#: core/templates/mail/text/invitation.txt:17
+#: core/templates/mail/html/invitation.html:229
+#: core/templates/mail/text/invitation.txt:18
 msgid "Use Chrome or Firefox for better call quality"
 msgstr "Verwenden Sie Chrome oder Firefox für eine bessere Anrufqualität"
 
-#: core/templates/mail/html/invitation.html:238
-#: core/templates/mail/text/invitation.txt:18
+#: core/templates/mail/html/invitation.html:230
+#: core/templates/mail/text/invitation.txt:19
 msgid "Test your microphone and camera before joining"
 msgstr "Testen Sie Ihr Mikrofon und Ihre Kamera vor dem Beitritt"
 
-#: core/templates/mail/html/invitation.html:239
-#: core/templates/mail/text/invitation.txt:19
+#: core/templates/mail/html/invitation.html:231
+#: core/templates/mail/text/invitation.txt:20
 msgid "Make sure you have a stable internet connection"
 msgstr "Stellen Sie sicher, dass Sie eine stabile Internetverbindung haben"
 
-#: core/templates/mail/html/invitation.html:248
-#: core/templates/mail/html/screen_recording.html:245
-#: core/templates/mail/text/invitation.txt:21
-#: core/templates/mail/text/screen_recording.txt:23
+#: core/templates/mail/html/invitation.html:240
+#: core/templates/mail/html/screen_recording.html:237
+#: core/templates/mail/text/invitation.txt:22
+#: core/templates/mail/text/screen_recording.txt:24
 #, python-format
 msgid " Thank you for using %(brandname)s. "
 msgstr " Vielen Dank für die Nutzung von %(brandname)s. "
 
-#: core/templates/mail/html/screen_recording.html:188
-#: core/templates/mail/text/screen_recording.txt:6
+#: core/templates/mail/html/invitation.html:271
+#, python-format
+msgid ""
+"This mail has been sent to %(email)s by <a href=\"%(href)s\">%(name)s</a>"
+msgstr ""
+
+#: core/templates/mail/html/screen_recording.html:180
+#: core/templates/mail/text/screen_recording.txt:7
 msgid "Your recording is ready!"
 msgstr "Ihre Aufzeichnung ist fertig!"
 
-#: core/templates/mail/html/screen_recording.html:195
-#: core/templates/mail/text/screen_recording.txt:8
+#: core/templates/mail/html/screen_recording.html:187
+#: core/templates/mail/text/screen_recording.txt:9
 #, python-format
 msgid ""
 " Your recording of \"%(room_name)s\" on %(recording_date)s at "
@@ -606,14 +628,14 @@ msgstr ""
 " Ihre Aufzeichnung von \"%(room_name)s\" am %(recording_date)s um "
 "%(recording_time)s steht nun zum Herunterladen bereit. "
 
-#: core/templates/mail/html/screen_recording.html:195
-#: core/templates/mail/text/screen_recording.txt:8
+#: core/templates/mail/html/screen_recording.html:187
+#: core/templates/mail/text/screen_recording.txt:9
 #, python-format
 msgid " The recording will expire in %(days)s days. "
 msgstr " Die Aufzeichnung wird in %(days)s Tagen ablaufen. "
 
-#: core/templates/mail/html/screen_recording.html:200
-#: core/templates/mail/text/screen_recording.txt:9
+#: core/templates/mail/html/screen_recording.html:192
+#: core/templates/mail/text/screen_recording.txt:10
 msgid ""
 " Sharing the recording via link is not yet available. Only organizers can "
 "download it. "
@@ -621,33 +643,33 @@ msgstr ""
 " Die Freigabe der Aufzeichnung per Link ist noch nicht verfügbar. Nur "
 "Organisatoren können sie herunterladen. "
 
-#: core/templates/mail/html/screen_recording.html:206
-#: core/templates/mail/text/screen_recording.txt:11
+#: core/templates/mail/html/screen_recording.html:198
+#: core/templates/mail/text/screen_recording.txt:12
 msgid "To keep this recording permanently:"
 msgstr "So speichern Sie diese Aufzeichnung dauerhaft:"
 
-#: core/templates/mail/html/screen_recording.html:208
+#: core/templates/mail/html/screen_recording.html:200
 #, python-format
 msgid "Click the \"<a href=\"%(link)s\">Open</a>\" link below "
 msgstr "Klicken Sie auf den Link „<a href=\"%(link)s\">Öffnen</a>\" unten "
 
-#: core/templates/mail/html/screen_recording.html:209
-#: core/templates/mail/text/screen_recording.txt:14
+#: core/templates/mail/html/screen_recording.html:201
+#: core/templates/mail/text/screen_recording.txt:15
 msgid "Use the \"Download\" button in the interface "
 msgstr "Verwenden Sie den Button „Herunterladen“ in der Oberfläche "
 
-#: core/templates/mail/html/screen_recording.html:210
-#: core/templates/mail/text/screen_recording.txt:15
+#: core/templates/mail/html/screen_recording.html:202
+#: core/templates/mail/text/screen_recording.txt:16
 msgid "Save the file to your preferred location"
 msgstr "Speichern Sie die Datei an einem gewünschten Ort"
 
-#: core/templates/mail/html/screen_recording.html:221
-#: core/templates/mail/text/screen_recording.txt:17
+#: core/templates/mail/html/screen_recording.html:213
+#: core/templates/mail/text/screen_recording.txt:18
 msgid "Open"
 msgstr "Öffnen"
 
-#: core/templates/mail/html/screen_recording.html:230
-#: core/templates/mail/text/screen_recording.txt:19
+#: core/templates/mail/html/screen_recording.html:222
+#: core/templates/mail/text/screen_recording.txt:20
 #, python-format
 msgid ""
 " If you have any questions or need assistance, please contact our support "
@@ -656,28 +678,33 @@ msgstr ""
 " Wenn Sie Fragen haben oder Unterstützung benötigen, wenden Sie sich bitte "
 "an unser Support-Team unter %(support_email)s. "
 
-#: core/templates/mail/text/screen_recording.txt:13
+#: core/templates/mail/text/invitation.txt:24
+#, python-format
+msgid "This mail has been sent to %(email)s by %(name)s [%(href)s]"
+msgstr ""
+
+#: core/templates/mail/text/screen_recording.txt:14
 #, fuzzy, python-format
 #| msgid "Click the \"<a href=\"%(link)s\">Open</a>\" link below "
 msgid "Click the \"Open [%(link)s]\" link below "
 msgstr "Klicken Sie auf den Link „<a href=\"%(link)s\">Öffnen</a>\" unten "
 
-#: meet/settings.py:228
+#: meet/settings.py:238
 msgid "English"
 msgstr "Englisch"
 
-#: meet/settings.py:229
+#: meet/settings.py:239
 msgid "French"
 msgstr "Französisch"
 
-#: meet/settings.py:230
+#: meet/settings.py:240
 msgid "Dutch"
 msgstr "Niederländisch"
 
-#: meet/settings.py:231
+#: meet/settings.py:241
 msgid "German"
 msgstr "Deutsch"
 
-#: meet/settings.py:233
+#: meet/settings.py:242
 msgid "Spanish"
 msgstr "Spanisch"

src/backend/locale/en_US/LC_MESSAGES/django.po

@@ -8,7 +8,7 @@ msgid ""
 msgstr ""
 "Project-Id-Version: PACKAGE VERSION\n"
 "Report-Msgid-Bugs-To: \n"
-"POT-Creation-Date: 2026-07-02 10:47+0000\n"
+"POT-Creation-Date: 2026-09-02 22:52+0000\n"
 "PO-Revision-Date: YEAR-MO-DA HO:MI+ZONE\n"
 "Last-Translator: FULL NAME <EMAIL@ADDRESS>\n"
 "Language-Team: LANGUAGE <LL@li.org>\n"
@@ -51,11 +51,11 @@ msgstr ""
 msgid "File preview"
 msgstr ""
 
-#: core/admin.py:300 core/admin.py:443
+#: core/admin.py:300 core/admin.py:450
 msgid "No owner"
 msgstr "No owner"
 
-#: core/admin.py:303 core/admin.py:446
+#: core/admin.py:303 core/admin.py:453
 msgid "Multiple owners"
 msgstr "Multiple owners"
 
@@ -98,11 +98,11 @@ msgstr "%(count)s recording(s) successfully marked as 'Failed to Stop'."
 msgid "Skipped %(count)s recording(s) with an ineligible status."
 msgstr "Skipped %(count)s expired recording(s)."
 
-#: core/admin.py:510
+#: core/admin.py:517
 msgid "No scopes"
 msgstr "No scopes"
 
-#: core/admin.py:512
+#: core/admin.py:519
 msgid "Scopes"
 msgstr "Scopes"
 
@@ -110,183 +110,199 @@ msgstr "Scopes"
 msgid "Creator is me"
 msgstr "Creator is me"
 
-#: core/api/serializers.py:89
+#: core/api/serializers.py:108
 msgid "You must be administrator or owner of a room to add accesses to it."
 msgstr "You must be administrator or owner of a room to add accesses to it."
 
-#: core/api/serializers.py:534
+#: core/api/serializers.py:560
 msgid "This file extension is not allowed."
 msgstr "This file extension is not allowed."
 
-#: core/api/viewsets.py:1222
+#: core/api/viewsets.py:1268
 msgid "You have reached the maximum number of files for this type."
 msgstr "You have reached the maximum number of files for this type."
 
-#: core/models.py:37
+#: core/models.py:38
 msgid "Member"
 msgstr "Member"
 
-#: core/models.py:38
+#: core/models.py:39
 msgid "Administrator"
 msgstr "Administrator"
 
-#: core/models.py:39
+#: core/models.py:40
 msgid "Owner"
 msgstr "Owner"
 
-#: core/models.py:55
+#: core/models.py:56
 msgid "Initiated"
 msgstr "Initiated"
 
-#: core/models.py:56
+#: core/models.py:57
 msgid "Active"
 msgstr "Active"
 
-#: core/models.py:57
+#: core/models.py:58
 msgid "Stopped"
 msgstr "Stopped"
 
-#: core/models.py:58
+#: core/models.py:59
 msgid "Saved"
 msgstr "Saved"
 
-#: core/models.py:59
+#: core/models.py:60
 msgid "Aborted"
 msgstr "Aborted"
 
-#: core/models.py:60
+#: core/models.py:61
 msgid "Failed to Start"
 msgstr "Failed to Start"
 
-#: core/models.py:61
+#: core/models.py:62
 msgid "Failed to Stop"
 msgstr "Failed to Stop"
 
-#: core/models.py:62
+#: core/models.py:63
 msgid "Notification succeeded"
 msgstr "Notification succeeded"
 
-#: core/models.py:65
+#: core/models.py:66
 msgid "External process successful"
 msgstr "External process successful"
 
-#: core/models.py:67
+#: core/models.py:68
 msgid "External process failed"
 msgstr "External process failed"
 
-#: core/models.py:96
+#: core/models.py:97
 msgid "SCREEN_RECORDING"
 msgstr "SCREEN_RECORDING"
 
-#: core/models.py:97
+#: core/models.py:98
 msgid "TRANSCRIPT"
 msgstr "TRANSCRIPT"
 
-#: core/models.py:103
+#: core/models.py:104
 msgid "Public Access"
 msgstr "Public Access"
 
-#: core/models.py:104
+#: core/models.py:105
 msgid "Trusted Access"
 msgstr "Trusted Access"
 
-#: core/models.py:105
+#: core/models.py:106
 msgid "Restricted Access"
 msgstr "Restricted Access"
 
-#: core/models.py:117
+#: core/models.py:118
 msgid "id"
 msgstr "id"
 
-#: core/models.py:118
+#: core/models.py:119
 msgid "primary key for the record as UUID"
 msgstr "primary key for the record as UUID"
 
-#: core/models.py:124
+#: core/models.py:125
 msgid "created on"
 msgstr "created on"
 
-#: core/models.py:125
+#: core/models.py:126
 msgid "date and time at which a record was created"
 msgstr "date and time at which a record was created"
 
-#: core/models.py:130
+#: core/models.py:131
 msgid "updated on"
 msgstr "updated on"
 
-#: core/models.py:131
+#: core/models.py:132
 msgid "date and time at which a record was last updated"
 msgstr "date and time at which a record was last updated"
 
-#: core/models.py:151
-msgid ""
-"Enter a valid sub. This value may contain only letters, numbers, and @/./+/-/"
-"_ characters."
-msgstr ""
-"Enter a valid sub. This value may contain only letters, numbers, and @/./+/-/"
-"_ characters."
-
-#: core/models.py:157
+#: core/models.py:150
 msgid "sub"
 msgstr "sub"
 
-#: core/models.py:159
+#: core/models.py:152
 msgid ""
 "Optional for pending users; required upon account activation. 255 characters "
-"or fewer. Letters, numbers, and @/./+/-/_ characters only."
+"or fewer. Printable ASCII characters only."
 msgstr ""
-"Required. 255 characters or fewer. Letters, numbers, and @/./+/-/_ "
-"characters only."
+"Optional for pending users; required upon account activation. 255 characters "
+"or fewer. Printable ASCII characters only."
 
-#: core/models.py:168
+#: core/validators.py:22
+msgid "Enter a valid sub. This value should be printable ASCII only."
+msgstr "Enter a valid sub. This value should be printable ASCII only."
+
+#: core/models.py:161
 msgid "identity email address"
 msgstr "identity email address"
 
-#: core/models.py:173
+#: core/models.py:166
 msgid "admin email address"
 msgstr "admin email address"
 
-#: core/models.py:175
+#: core/models.py:168
 msgid "full name"
 msgstr "full name"
 
-#: core/models.py:177
+#: core/models.py:170
 msgid "short name"
 msgstr "short name"
 
-#: core/models.py:183
+#: core/models.py:176
 msgid "language"
 msgstr "language"
 
-#: core/models.py:184
+#: core/models.py:177
 msgid "The language in which the user wants to see the interface."
 msgstr "The language in which the user wants to see the interface."
 
-#: core/models.py:190
+#: core/models.py:183
 msgid "The timezone in which the user wants to see times."
 msgstr "The timezone in which the user wants to see times."
 
-#: core/models.py:193
+#: core/models.py:190
+msgid "default room access level"
+msgstr ""
+
+#: core/models.py:192
+msgid ""
+"Access level applied by default to new rooms created by this user. When "
+"empty, the instance default is used."
+msgstr ""
+
+#: core/models.py:199
+#, fuzzy
+#| msgid "Visio room configuration"
+msgid "default room configuration"
+msgstr "Visio room configuration"
+
+#: core/models.py:201
+msgid "Configurations applied by default to new rooms created by this user."
+msgstr ""
+
+#: core/models.py:205
 msgid "device"
 msgstr "device"
 
-#: core/models.py:195
+#: core/models.py:207
 msgid "Whether the user is a device or a real user."
 msgstr "Whether the user is a device or a real user."
 
-#: core/models.py:198
+#: core/models.py:210
 msgid "staff status"
 msgstr "staff status"
 
-#: core/models.py:200
+#: core/models.py:212
 msgid "Whether the user can log into this admin site."
 msgstr "Whether the user can log into this admin site."
 
-#: core/models.py:203
+#: core/models.py:215
 msgid "active"
 msgstr "active"
 
-#: core/models.py:206
+#: core/models.py:218
 msgid ""
 "Whether this user should be treated as active. Unselect this instead of "
 "deleting accounts."
@@ -294,63 +310,63 @@ msgstr ""
 "Whether this user should be treated as active. Unselect this instead of "
 "deleting accounts."
 
-#: core/models.py:219
+#: core/models.py:231
 msgid "user"
 msgstr "user"
 
-#: core/models.py:220
+#: core/models.py:232
 msgid "users"
 msgstr "users"
 
-#: core/models.py:286
+#: core/models.py:298
 msgid "Resource"
 msgstr "Resource"
 
-#: core/models.py:287
+#: core/models.py:299
 msgid "Resources"
 msgstr "Resources"
 
-#: core/models.py:345
+#: core/models.py:357
 msgid "Resource access"
 msgstr "Resource access"
 
-#: core/models.py:346
+#: core/models.py:358
 msgid "Resource accesses"
 msgstr "Resource accesses"
 
-#: core/models.py:352
+#: core/models.py:364
 msgid "Resource access with this User and Resource already exists."
 msgstr "Resource access with this User and Resource already exists."
 
-#: core/models.py:409
+#: core/models.py:421
 msgid "Visio room configuration"
 msgstr "Visio room configuration"
 
-#: core/models.py:410
+#: core/models.py:422
 msgid "Values for Visio parameters to configure the room."
 msgstr "Values for Visio parameters to configure the room."
 
-#: core/models.py:417
+#: core/models.py:429
 msgid "Room PIN code"
 msgstr "Room PIN code"
 
-#: core/models.py:418
+#: core/models.py:430
 msgid "Unique n-digit code that identifies this room in telephony mode."
 msgstr "Unique n-digit code that identifies this room in telephony mode."
 
-#: core/models.py:424 core/models.py:578
+#: core/models.py:436 core/models.py:597
 msgid "Room"
 msgstr "Room"
 
-#: core/models.py:425
+#: core/models.py:437
 msgid "Rooms"
 msgstr "Rooms"
 
-#: core/models.py:589
+#: core/models.py:608
 msgid "Worker ID"
 msgstr "Worker ID"
 
-#: core/models.py:591
+#: core/models.py:610
 msgid ""
 "Enter an identifier for the worker recording.This ID is retained even when "
 "the worker stops, allowing for easy tracking."
@@ -358,171 +374,171 @@ msgstr ""
 "Enter an identifier for the worker recording.This ID is retained even when "
 "the worker stops, allowing for easy tracking."
 
-#: core/models.py:599
+#: core/models.py:618
 msgid "Recording mode"
 msgstr "Recording mode"
 
-#: core/models.py:600
+#: core/models.py:619
 msgid "Defines the mode of recording being called."
 msgstr "Defines the mode of recording being called."
 
-#: core/models.py:605 core/models.py:606
+#: core/models.py:624 core/models.py:625
 msgid "Recording options"
 msgstr "Recording options"
 
-#: core/models.py:613
+#: core/models.py:632
 msgid "External Process ID"
 msgstr "External Process ID"
 
-#: core/models.py:614
+#: core/models.py:633
 msgid "ID of the external process associated with the recording."
 msgstr "ID of the external process associated with the recording."
 
-#: core/models.py:620
+#: core/models.py:639
 msgid "Recording"
 msgstr "Recording"
 
-#: core/models.py:621
+#: core/models.py:640
 msgid "Recordings"
 msgstr "Recordings"
 
-#: core/models.py:731
+#: core/models.py:750
 msgid "Recording/user relation"
 msgstr "Recording/user relation"
 
-#: core/models.py:732
+#: core/models.py:751
 msgid "Recording/user relations"
 msgstr "Recording/user relations"
 
-#: core/models.py:738
+#: core/models.py:757
 msgid "This user is already in this recording."
 msgstr "This user is already in this recording."
 
-#: core/models.py:744
+#: core/models.py:763
 msgid "This team is already in this recording."
 msgstr "This team is already in this recording."
 
-#: core/models.py:750
+#: core/models.py:769
 msgid "Either user or team must be set, not both."
 msgstr "Either user or team must be set, not both."
 
-#: core/models.py:767
+#: core/models.py:786
 #, fuzzy
 #| msgid "created on"
 msgid "Create rooms"
 msgstr "Create rooms"
 
-#: core/models.py:768
+#: core/models.py:787
 msgid "List rooms"
 msgstr "List rooms"
 
-#: core/models.py:769
+#: core/models.py:788
 msgid "Retrieve room details"
 msgstr "Retrieve room details"
 
-#: core/models.py:770
+#: core/models.py:789
 #, fuzzy
 #| msgid "updated on"
 msgid "Update rooms"
 msgstr "Update rooms"
 
-#: core/models.py:771
+#: core/models.py:790
 msgid "Delete rooms"
 msgstr "Delete rooms"
 
-#: core/models.py:784
+#: core/models.py:803
 msgid "Application name"
 msgstr "Application name"
 
-#: core/models.py:785
+#: core/models.py:804
 msgid "Descriptive name for this application."
 msgstr "Descriptive name for this application."
 
-#: core/models.py:795
+#: core/models.py:814
 msgid "Hashed on Save. Copy it now if this is a new secret."
 msgstr "Hashed on Save. Copy it now if this is a new secret."
 
-#: core/models.py:806
+#: core/models.py:825
 msgid "Application"
 msgstr "Application"
 
-#: core/models.py:807
+#: core/models.py:826
 msgid "Applications"
 msgstr "Applications"
 
-#: core/models.py:830
+#: core/models.py:849
 msgid "Enter a valid domain"
 msgstr "Enter a valid domain"
 
-#: core/models.py:833
+#: core/models.py:852
 msgid "Domain"
 msgstr "Domain"
 
-#: core/models.py:834
+#: core/models.py:853
 msgid "Email domain this application can act on behalf of."
 msgstr "Email domain this application can act on behalf of."
 
-#: core/models.py:846
+#: core/models.py:865
 msgid "Application domain"
 msgstr "Application domain"
 
-#: core/models.py:847
+#: core/models.py:866
 msgid "Application domains"
 msgstr "Application domains"
 
-#: core/models.py:865
+#: core/models.py:884
 #, fuzzy
 #| msgid "Recording"
 msgid "Pending"
 msgstr "Pending"
 
-#: core/models.py:866
+#: core/models.py:885
 msgid "Analyzing"
 msgstr ""
 
-#: core/models.py:873
+#: core/models.py:892
 msgid "Ready"
 msgstr "Ready"
 
-#: core/models.py:879
+#: core/models.py:898
 msgid "Background image"
 msgstr "Background image"
 
-#: core/models.py:891
+#: core/models.py:910
 msgid "title"
 msgstr "title"
 
-#: core/models.py:915
+#: core/models.py:934
 msgid "Malware detection info when the analysis status is unsafe."
 msgstr "Malware detection info when the analysis status is unsafe."
 
-#: core/models.py:920
+#: core/models.py:939
 msgid "File"
 msgstr "File"
 
-#: core/models.py:921
+#: core/models.py:940
 msgid "Files"
 msgstr "Files"
 
-#: core/models.py:1041
+#: core/models.py:1060
 #, fuzzy
 #| msgid "This user is already in this recording."
 msgid "This file is already hard deleted."
 msgstr "This file is already hard deleted."
 
-#: core/models.py:1051
+#: core/models.py:1070
 msgid "To hard delete a file, it must first be soft deleted."
 msgstr "To hard delete a file, it must first be soft deleted."
 
-#: core/recording/event/notification.py:123
+#: core/recording/event/notification.py:124
 msgid "Your recording is ready"
 msgstr "Your recording is ready"
 
-#: core/recording/event/notification.py:194
+#: core/recording/event/notification.py:195
 msgid "Transcription"
 msgstr "Transcription"
 
-#: core/recording/event/notification.py:204
+#: core/recording/event/notification.py:206
 #, python-brace-format
 msgid "Meeting \"{room}\" on {room_recording_date} at {room_recording_time}"
 msgstr "Meeting \"{room}\" on {room_recording_date} at {room_recording_time}"
@@ -532,25 +548,25 @@ msgstr "Meeting \"{room}\" on {room_recording_date} at {room_recording_time}"
 msgid "Video call in progress: {sender.email} is waiting for you to connect"
 msgstr "Video call in progress: {sender.email} is waiting for you to connect"
 
-#: core/templates/mail/html/invitation.html:159
-#: core/templates/mail/html/screen_recording.html:159
-#: core/templates/mail/text/invitation.txt:3
-#: core/templates/mail/text/screen_recording.txt:3
+#: core/templates/mail/html/invitation.html:151
+#: core/templates/mail/html/screen_recording.html:151
+#: core/templates/mail/text/invitation.txt:4
+#: core/templates/mail/text/screen_recording.txt:4
 msgid "Logo email"
 msgstr "Logo email"
 
-#: core/templates/mail/html/invitation.html:189
-#: core/templates/mail/text/invitation.txt:5
+#: core/templates/mail/html/invitation.html:181
+#: core/templates/mail/text/invitation.txt:6
 msgid "invites you to join an ongoing video call"
 msgstr "invites you to join an ongoing video call"
 
-#: core/templates/mail/html/invitation.html:200
-#: core/templates/mail/text/invitation.txt:7
+#: core/templates/mail/html/invitation.html:192
+#: core/templates/mail/text/invitation.txt:8
 msgid "JOIN THE CALL"
 msgstr "JOIN THE CALL"
 
-#: core/templates/mail/html/invitation.html:227
-#: core/templates/mail/text/invitation.txt:13
+#: core/templates/mail/html/invitation.html:219
+#: core/templates/mail/text/invitation.txt:14
 msgid ""
 "If you can't click the button, copy and paste the URL into your browser to "
 "join the call."
@@ -558,41 +574,47 @@ msgstr ""
 "If you can't click the button, copy and paste the URL into your browser to "
 "join the call."
 
-#: core/templates/mail/html/invitation.html:235
-#: core/templates/mail/text/invitation.txt:15
+#: core/templates/mail/html/invitation.html:227
+#: core/templates/mail/text/invitation.txt:16
 msgid "Tips for a better experience:"
 msgstr "Tips for a better experience:"
 
-#: core/templates/mail/html/invitation.html:237
-#: core/templates/mail/text/invitation.txt:17
+#: core/templates/mail/html/invitation.html:229
+#: core/templates/mail/text/invitation.txt:18
 msgid "Use Chrome or Firefox for better call quality"
 msgstr "Use Chrome or Firefox for better call quality"
 
-#: core/templates/mail/html/invitation.html:238
-#: core/templates/mail/text/invitation.txt:18
+#: core/templates/mail/html/invitation.html:230
+#: core/templates/mail/text/invitation.txt:19
 msgid "Test your microphone and camera before joining"
 msgstr "Test your microphone and camera before joining"
 
-#: core/templates/mail/html/invitation.html:239
-#: core/templates/mail/text/invitation.txt:19
+#: core/templates/mail/html/invitation.html:231
+#: core/templates/mail/text/invitation.txt:20
 msgid "Make sure you have a stable internet connection"
 msgstr "Make sure you have a stable internet connection"
 
-#: core/templates/mail/html/invitation.html:248
-#: core/templates/mail/html/screen_recording.html:245
-#: core/templates/mail/text/invitation.txt:21
-#: core/templates/mail/text/screen_recording.txt:23
+#: core/templates/mail/html/invitation.html:240
+#: core/templates/mail/html/screen_recording.html:237
+#: core/templates/mail/text/invitation.txt:22
+#: core/templates/mail/text/screen_recording.txt:24
 #, python-format
 msgid " Thank you for using %(brandname)s. "
 msgstr " Thank you for using %(brandname)s. "
 
-#: core/templates/mail/html/screen_recording.html:188
-#: core/templates/mail/text/screen_recording.txt:6
+#: core/templates/mail/html/invitation.html:271
+#, python-format
+msgid ""
+"This mail has been sent to %(email)s by <a href=\"%(href)s\">%(name)s</a>"
+msgstr ""
+
+#: core/templates/mail/html/screen_recording.html:180
+#: core/templates/mail/text/screen_recording.txt:7
 msgid "Your recording is ready!"
 msgstr "Your recording is ready!"
 
-#: core/templates/mail/html/screen_recording.html:195
-#: core/templates/mail/text/screen_recording.txt:8
+#: core/templates/mail/html/screen_recording.html:187
+#: core/templates/mail/text/screen_recording.txt:9
 #, python-format
 msgid ""
 " Your recording of \"%(room_name)s\" on %(recording_date)s at "
@@ -601,14 +623,14 @@ msgstr ""
 " Your recording of \"%(room_name)s\" on %(recording_date)s at "
 "%(recording_time)s is now ready to download. "
 
-#: core/templates/mail/html/screen_recording.html:195
-#: core/templates/mail/text/screen_recording.txt:8
+#: core/templates/mail/html/screen_recording.html:187
+#: core/templates/mail/text/screen_recording.txt:9
 #, python-format
 msgid " The recording will expire in %(days)s days. "
 msgstr " The recording will expire in %(days)s days. "
 
-#: core/templates/mail/html/screen_recording.html:200
-#: core/templates/mail/text/screen_recording.txt:9
+#: core/templates/mail/html/screen_recording.html:192
+#: core/templates/mail/text/screen_recording.txt:10
 msgid ""
 " Sharing the recording via link is not yet available. Only organizers can "
 "download it. "
@@ -616,33 +638,33 @@ msgstr ""
 " Sharing the recording via link is not yet available. Only organizers can "
 "download it. "
 
-#: core/templates/mail/html/screen_recording.html:206
-#: core/templates/mail/text/screen_recording.txt:11
+#: core/templates/mail/html/screen_recording.html:198
+#: core/templates/mail/text/screen_recording.txt:12
 msgid "To keep this recording permanently:"
 msgstr "To keep this recording permanently:"
 
-#: core/templates/mail/html/screen_recording.html:208
+#: core/templates/mail/html/screen_recording.html:200
 #, python-format
 msgid "Click the \"<a href=\"%(link)s\">Open</a>\" link below "
 msgstr "Click the \"<a href=\"%(link)s\">Open</a>\" link below "
 
-#: core/templates/mail/html/screen_recording.html:209
-#: core/templates/mail/text/screen_recording.txt:14
+#: core/templates/mail/html/screen_recording.html:201
+#: core/templates/mail/text/screen_recording.txt:15
 msgid "Use the \"Download\" button in the interface "
 msgstr "Use the \"Download\" button in the interface "
 
-#: core/templates/mail/html/screen_recording.html:210
-#: core/templates/mail/text/screen_recording.txt:15
+#: core/templates/mail/html/screen_recording.html:202
+#: core/templates/mail/text/screen_recording.txt:16
 msgid "Save the file to your preferred location"
 msgstr "Save the file to your preferred location"
 
-#: core/templates/mail/html/screen_recording.html:221
-#: core/templates/mail/text/screen_recording.txt:17
+#: core/templates/mail/html/screen_recording.html:213
+#: core/templates/mail/text/screen_recording.txt:18
 msgid "Open"
 msgstr "Open"
 
-#: core/templates/mail/html/screen_recording.html:230
-#: core/templates/mail/text/screen_recording.txt:19
+#: core/templates/mail/html/screen_recording.html:222
+#: core/templates/mail/text/screen_recording.txt:20
 #, python-format
 msgid ""
 " If you have any questions or need assistance, please contact our support "
@@ -651,28 +673,33 @@ msgstr ""
 " If you have any questions or need assistance, please contact our support "
 "team at %(support_email)s. "
 
-#: core/templates/mail/text/screen_recording.txt:13
+#: core/templates/mail/text/invitation.txt:24
+#, python-format
+msgid "This mail has been sent to %(email)s by %(name)s [%(href)s]"
+msgstr ""
+
+#: core/templates/mail/text/screen_recording.txt:14
 #, fuzzy, python-format
 #| msgid "Click the \"<a href=\"%(link)s\">Open</a>\" link below "
 msgid "Click the \"Open [%(link)s]\" link below "
 msgstr "Click the \"<a href=\"%(link)s\">Open</a>\" link below "
 
-#: meet/settings.py:228
+#: meet/settings.py:238
 msgid "English"
 msgstr "English"
 
-#: meet/settings.py:229
+#: meet/settings.py:239
 msgid "French"
 msgstr "French"
 
-#: meet/settings.py:230
+#: meet/settings.py:240
 msgid "Dutch"
 msgstr "Dutch"
 
-#: meet/settings.py:231
+#: meet/settings.py:241
 msgid "German"
 msgstr "German"
 
-#: meet/settings.py:233
+#: meet/settings.py:242
 msgid "Spanish"
 msgstr "Spanish"

src/backend/locale/es_ES/LC_MESSAGES/django.po

@@ -8,7 +8,7 @@ msgid ""
 msgstr ""
 "Project-Id-Version: PACKAGE VERSION\n"
 "Report-Msgid-Bugs-To: \n"
-"POT-Creation-Date: 2026-07-02 10:47+0000\n"
+"POT-Creation-Date: 2026-09-02 22:52+0000\n"
 "PO-Revision-Date: YEAR-MO-DA HO:MI+ZONE\n"
 "Last-Translator: FULL NAME <EMAIL@ADDRESS>\n"
 "Language-Team: LANGUAGE <LL@li.org>\n"
@@ -41,20 +41,20 @@ msgstr "Eliminar Salas"
 msgid "Derived info"
 msgstr ""
 
-#: core/admin.py:237
 # 'Marcas de tiempo' is a bad translation for spanish
+#: core/admin.py:237
 msgid "Timestamps"
-msgstr "" 
+msgstr ""
 
 #: core/admin.py:240
 msgid "File preview"
 msgstr "Vista previa"
 
-#: core/admin.py:300 core/admin.py:443
+#: core/admin.py:300 core/admin.py:450
 msgid "No owner"
 msgstr "Sin propietario"
 
-#: core/admin.py:303 core/admin.py:446
+#: core/admin.py:303 core/admin.py:453
 msgid "Multiple owners"
 msgstr "Varios propietarios"
 
@@ -89,18 +89,19 @@ msgstr "Marcar las grabaciones seleccionadas como «Error al detener»"
 #: core/admin.py:386
 #, python-format
 msgid "%(count)s recording(s) successfully marked as 'Failed to Stop'."
-msgstr "%(count)s grabación(es) marcada(s) correctamente como «Error al detener»."
+msgstr ""
+"%(count)s grabación(es) marcada(s) correctamente como «Error al detener»."
 
 #: core/admin.py:394
 #, python-format
 msgid "Skipped %(count)s recording(s) with an ineligible status."
 msgstr "Se han omitido %(count)s grabación(es) con un estado no elegible."
 
-#: core/admin.py:510
+#: core/admin.py:517
 msgid "No scopes"
 msgstr ""
 
-#: core/admin.py:512
+#: core/admin.py:519
 msgid "Scopes"
 msgstr "Ámbitos"
 
@@ -108,545 +109,599 @@ msgstr "Ámbitos"
 msgid "Creator is me"
 msgstr "Yo soy el creador"
 
-#: core/api/serializers.py:89
+#: core/api/serializers.py:108
 msgid "You must be administrator or owner of a room to add accesses to it."
-msgstr "Debes ser administrador o propietario de una reunión para añadirle accesos."
+msgstr ""
+"Debes ser administrador o propietario de una reunión para añadirle accesos."
 
-#: core/api/serializers.py:534
+#: core/api/serializers.py:560
 msgid "This file extension is not allowed."
 msgstr "Esta extensión de archivo no está permitida."
 
-#: core/api/viewsets.py:1222
+#: core/api/viewsets.py:1268
 msgid "You have reached the maximum number of files for this type."
 msgstr "Has alcanzado el número máximo de archivos de este tipo."
 
-#: core/models.py:37
+#: core/models.py:38
 msgid "Member"
 msgstr "Miembro"
 
-#: core/models.py:38
+#: core/models.py:39
 msgid "Administrator"
 msgstr "Administrador"
 
-#: core/models.py:39
+#: core/models.py:40
 msgid "Owner"
 msgstr "Propietario"
 
-#: core/models.py:55
 # To check here and following lines for gender agreement (Masculine/Feminine)
+#: core/models.py:56
 msgid "Initiated"
 msgstr "Iniciada"
 
-#: core/models.py:56
+#: core/models.py:57
 msgid "Active"
 msgstr "Activa"
 
-#: core/models.py:57
+#: core/models.py:58
 msgid "Stopped"
 msgstr "Detenida"
 
-#: core/models.py:58
+#: core/models.py:59
 msgid "Saved"
 msgstr "Guardada"
 
-#: core/models.py:59
+#: core/models.py:60
 msgid "Aborted"
 msgstr "Cancelada"
 
-#: core/models.py:60
+#: core/models.py:61
 msgid "Failed to Start"
 msgstr "Error al iniciar"
 
-#: core/models.py:61
+#: core/models.py:62
 msgid "Failed to Stop"
 msgstr "Error al detener"
 
-#: core/models.py:62
+#: core/models.py:63
 msgid "Notification succeeded"
 msgstr "Notificado correctamente"
 
-#: core/models.py:65
+#: core/models.py:66
 msgid "External process successful"
 msgstr "Proceso externo finalizado correctamente"
 
-#: core/models.py:67
+#: core/models.py:68
 msgid "External process failed"
 msgstr "Error en el Proceso externo"
 
-#: core/models.py:96
+#: core/models.py:97
 msgid "SCREEN_RECORDING"
 msgstr "GRABACIÓN_DE_PANTALLA"
 
-#: core/models.py:97
+#: core/models.py:98
 msgid "TRANSCRIPT"
 msgstr "TRANSCRIPCIÓN"
 
-#: core/models.py:103
+#: core/models.py:104
 msgid "Public Access"
 msgstr "Acceso público"
 
-#: core/models.py:104
+#: core/models.py:105
 msgid "Trusted Access"
 msgstr "Acceso usuarios autorizados"
 
-#: core/models.py:105
+#: core/models.py:106
 msgid "Restricted Access"
 msgstr "Acceso restringido"
 
-#: core/models.py:117
+#: core/models.py:118
 msgid "id"
 msgstr "id"
 
-#: core/models.py:118
+#: core/models.py:119
 msgid "primary key for the record as UUID"
 msgstr "clave primaria del registro en forma de UUID"
 
-#: core/models.py:124
+#: core/models.py:125
 msgid "created on"
 msgstr "creado el"
 
-#: core/models.py:125
+#: core/models.py:126
 msgid "date and time at which a record was created"
 msgstr "fecha y hora en que se creó un registro"
 
-#: core/models.py:130
+#: core/models.py:131
 msgid "updated on"
 msgstr "actualizado el"
 
-#: core/models.py:131
+#: core/models.py:132
 msgid "date and time at which a record was last updated"
 msgstr "fecha y hora de la última actualización de un registro"
 
-#: core/models.py:151
-msgid ""
-"Enter a valid sub. This value may contain only letters, numbers, and @/./+/-/"
-"_ characters."
-msgstr "Introduce un sub válido. Este valor solo puede contener letras, números y los caracteres @/./+/-/_."
-
-#: core/models.py:157
+#: core/models.py:150
 msgid "sub"
 msgstr "sub"
 
-#: core/models.py:159
+#: core/models.py:152
 msgid ""
 "Optional for pending users; required upon account activation. 255 characters "
-"or fewer. Letters, numbers, and @/./+/-/_ characters only."
-msgstr "Opcional para los usuarios pendientes; obligatorio al activar la cuenta. 255 caracteres como máximo. Solo letras, números y los caracteres @/./+/-/_."
+"or fewer. Printable ASCII characters only."
+msgstr ""
+"Opcional para los usuarios pendientes; obligatorio al activar la cuenta. "
+"255 caracteres como máximo. Solo caracteres ASCII imprimibles."
 
-#: core/models.py:168
+#: core/validators.py:22
+msgid "Enter a valid sub. This value should be printable ASCII only."
+msgstr "Introduzca un sub válido. Este valor solo debe contener caracteres ASCII imprimibles."
+
+#: core/models.py:161
 msgid "identity email address"
 msgstr "dirección de correo electrónico"
 
-#: core/models.py:173
+#: core/models.py:166
 msgid "admin email address"
 msgstr "dirección de correo electrónico de administrador"
 
-#: core/models.py:175
+#: core/models.py:168
 msgid "full name"
 msgstr "nombre completo"
 
-#: core/models.py:177
+#: core/models.py:170
 msgid "short name"
 msgstr "nombre corto"
 
-#: core/models.py:183
+#: core/models.py:176
 msgid "language"
 msgstr "idioma"
 
-#: core/models.py:184
+#: core/models.py:177
 msgid "The language in which the user wants to see the interface."
 msgstr "El idioma preferido de interfaz."
 
-#: core/models.py:190
+#: core/models.py:183
 msgid "The timezone in which the user wants to see times."
 msgstr "La zona horaria en la que el usuario quiere ver las horas."
 
-#: core/models.py:193
+#: core/models.py:190
+msgid "default room access level"
+msgstr ""
+
+#: core/models.py:192
+msgid ""
+"Access level applied by default to new rooms created by this user. When "
+"empty, the instance default is used."
+msgstr ""
+
+#: core/models.py:199
+#, fuzzy
+#| msgid "Visio room configuration"
+msgid "default room configuration"
+msgstr "Configuración de la videoconferencia"
+
+#: core/models.py:201
+msgid "Configurations applied by default to new rooms created by this user."
+msgstr ""
+
+#: core/models.py:205
 msgid "device"
 msgstr "dispositivo"
 
-#: core/models.py:195
+#: core/models.py:207
 msgid "Whether the user is a device or a real user."
 msgstr "Si el usuario es un dispositivo o un usuario real."
 
-#: core/models.py:198
+#: core/models.py:210
 msgid "staff status"
 msgstr "estado del personal"
 
-#: core/models.py:200
+#: core/models.py:212
 msgid "Whether the user can log into this admin site."
 msgstr "Si el usuario puede acceder a este sitio de administración."
 
-#: core/models.py:203
+#: core/models.py:215
 msgid "active"
 msgstr "activo"
 
-#: core/models.py:206
+#: core/models.py:218
 msgid ""
 "Whether this user should be treated as active. Unselect this instead of "
 "deleting accounts."
-msgstr "Si este usuario debe considerarse activo. Desmarca esta opción en lugar de eliminar cuentas."
+msgstr ""
+"Si este usuario debe considerarse activo. Desmarca esta opción en lugar de "
+"eliminar cuentas."
 
-#: core/models.py:219
+#: core/models.py:231
 msgid "user"
 msgstr "usuario"
 
-#: core/models.py:220
+#: core/models.py:232
 msgid "users"
 msgstr "usuarios"
 
-#: core/models.py:286
+#: core/models.py:298
 msgid "Resource"
 msgstr "Recurso"
 
-#: core/models.py:287
+#: core/models.py:299
 msgid "Resources"
 msgstr "Recursos"
 
-#: core/models.py:345
+#: core/models.py:357
 msgid "Resource access"
 msgstr "Acceso a recursos"
 
-#: core/models.py:346
+#: core/models.py:358
 msgid "Resource accesses"
 msgstr "Accesos a recursos"
 
-#: core/models.py:352
+#: core/models.py:364
 msgid "Resource access with this User and Resource already exists."
 msgstr "Ya existe un acceso al recurso con este usuario y este recurso."
 
-#: core/models.py:409
+#: core/models.py:421
 msgid "Visio room configuration"
 msgstr "Configuración de la videoconferencia"
 
-#: core/models.py:410
+#: core/models.py:422
 msgid "Values for Visio parameters to configure the room."
-msgstr "Valores de los parámetros de videoconferencia para configurar la reunión."
+msgstr ""
+"Valores de los parámetros de videoconferencia para configurar la reunión."
 
-#: core/models.py:417
+#: core/models.py:429
 msgid "Room PIN code"
 msgstr "Código PIN de la reunión"
 
-#: core/models.py:418
+#: core/models.py:430
 msgid "Unique n-digit code that identifies this room in telephony mode."
-msgstr "Código único de n dígitos que identifica esta reunión en modo telefónico."
+msgstr ""
+"Código único de n dígitos que identifica esta reunión en modo telefónico."
 
-#: core/models.py:424 core/models.py:578
+#: core/models.py:436 core/models.py:597
 msgid "Room"
 msgstr "Reunión"
 
-#: core/models.py:425
+#: core/models.py:437
 msgid "Rooms"
 msgstr "Reuniones"
 
-#: core/models.py:589
+#: core/models.py:608
 msgid "Worker ID"
 msgstr "ID del worker"
 
-#: core/models.py:591
+#: core/models.py:610
 msgid ""
 "Enter an identifier for the worker recording.This ID is retained even when "
 "the worker stops, allowing for easy tracking."
-msgstr "Introduce un identificador para la grabación del worker. Este identificador se conserva incluso cuando el worker se detiene, lo que permite un seguimiento sencillo."
+msgstr ""
+"Introduce un identificador para la grabación del worker. Este identificador "
+"se conserva incluso cuando el worker se detiene, lo que permite un "
+"seguimiento sencillo."
 
-#: core/models.py:599
+#: core/models.py:618
 msgid "Recording mode"
 msgstr "Modo de grabación"
 
-#: core/models.py:600
+#: core/models.py:619
 msgid "Defines the mode of recording being called."
 msgstr "Define el modo de grabación a utilizar."
 
-#: core/models.py:605 core/models.py:606
+#: core/models.py:624 core/models.py:625
 msgid "Recording options"
 msgstr "Opciones de grabación"
 
-#: core/models.py:613
+#: core/models.py:632
 msgid "External Process ID"
 msgstr "ID del proceso externo"
 
-#: core/models.py:614
+#: core/models.py:633
 msgid "ID of the external process associated with the recording."
 msgstr "ID del proceso externo asociado a la grabación."
 
-#: core/models.py:620
+#: core/models.py:639
 msgid "Recording"
 msgstr "Grabación"
 
-#: core/models.py:621
+#: core/models.py:640
 msgid "Recordings"
 msgstr "Grabaciones"
 
-#: core/models.py:731
+#: core/models.py:750
 msgid "Recording/user relation"
 msgstr "Relación grabación/usuario"
 
-#: core/models.py:732
+#: core/models.py:751
 msgid "Recording/user relations"
 msgstr "Relaciones grabación/usuario"
 
-#: core/models.py:738
+#: core/models.py:757
 msgid "This user is already in this recording."
 msgstr "Este usuario ya está en esta grabación."
 
-#: core/models.py:744
+#: core/models.py:763
 msgid "This team is already in this recording."
 msgstr "Este equipo ya está en esta grabación."
 
-#: core/models.py:750
+#: core/models.py:769
 msgid "Either user or team must be set, not both."
 msgstr "Debe definirse el usuario o el equipo, pero no ambos."
 
-#: core/models.py:767
+#: core/models.py:786
 msgid "Create rooms"
 msgstr "Crear reunión"
 
-#: core/models.py:768
+#: core/models.py:787
 msgid "List rooms"
 msgstr "Listar reuniones"
 
-#: core/models.py:769
+#: core/models.py:788
 msgid "Retrieve room details"
 msgstr "Ver los detalles de una reunión"
 
-#: core/models.py:770
+#: core/models.py:789
 msgid "Update rooms"
 msgstr "Actualizar las reuniones"
 
-#: core/models.py:771
+#: core/models.py:790
 msgid "Delete rooms"
 msgstr "Eliminar las reuniones"
 
-#: core/models.py:784
+#: core/models.py:803
 msgid "Application name"
 msgstr "Nombre de la aplicación"
 
-#: core/models.py:785
+#: core/models.py:804
 msgid "Descriptive name for this application."
 msgstr "Nombre descriptivo de esta aplicación."
 
-#: core/models.py:795
+#: core/models.py:814
 msgid "Hashed on Save. Copy it now if this is a new secret."
 msgstr "Se cifra al guardar. Cópialo ahora si se trata de un secreto nuevo."
 
-#: core/models.py:806
+#: core/models.py:825
 msgid "Application"
 msgstr "Aplicación"
 
-#: core/models.py:807
+#: core/models.py:826
 msgid "Applications"
 msgstr "Aplicaciones"
 
-#: core/models.py:830
+#: core/models.py:849
 msgid "Enter a valid domain"
 msgstr "Introduce un dominio válido"
 
-#: core/models.py:833
+#: core/models.py:852
 msgid "Domain"
 msgstr "Dominio"
 
-#: core/models.py:834
+#: core/models.py:853
 msgid "Email domain this application can act on behalf of."
-msgstr "Dominio de correo electrónico en cuyo nombre puede actuar esta aplicación."
+msgstr ""
+"Dominio de correo electrónico en cuyo nombre puede actuar esta aplicación."
 
-#: core/models.py:846
+#: core/models.py:865
 msgid "Application domain"
 msgstr "Dominio de aplicación"
 
-#: core/models.py:847
+#: core/models.py:866
 msgid "Application domains"
 msgstr "Dominios de aplicación"
 
-#: core/models.py:865
+#: core/models.py:884
 msgid "Pending"
 msgstr "Pendiente"
 
-#: core/models.py:866
+#: core/models.py:885
 msgid "Analyzing"
 msgstr "Analizando"
 
-#: core/models.py:873
+#: core/models.py:892
 msgid "Ready"
 msgstr "Listo"
 
-#: core/models.py:879
+#: core/models.py:898
 msgid "Background image"
 msgstr "Imagen de fondo"
 
-#: core/models.py:891
+#: core/models.py:910
 msgid "title"
 msgstr "título"
 
-#: core/models.py:915
+#: core/models.py:934
 msgid "Malware detection info when the analysis status is unsafe."
-msgstr "Información sobre la detección de malware cuando el estado del análisis no es seguro."
+msgstr ""
+"Información sobre la detección de malware cuando el estado del análisis no "
+"es seguro."
 
-#: core/models.py:920
+#: core/models.py:939
 msgid "File"
 msgstr "Archivo"
 
-#: core/models.py:921
+#: core/models.py:940
 msgid "Files"
 msgstr "Archivos"
 
-#: core/models.py:1041
+#: core/models.py:1060
 msgid "This file is already hard deleted."
 msgstr "Este archivo ya se ha eliminado definitivamente."
 
-#: core/models.py:1051
+#: core/models.py:1070
 msgid "To hard delete a file, it must first be soft deleted."
-msgstr "Para eliminar definitivamente un archivo, primero debe haberse marcado como eliminado."
+msgstr ""
+"Para eliminar definitivamente un archivo, primero debe haberse marcado como "
+"eliminado."
 
-#: core/recording/event/notification.py:123
+#: core/recording/event/notification.py:124
 msgid "Your recording is ready"
 msgstr "Tu grabación está lista"
 
-#: core/recording/event/notification.py:194
+#: core/recording/event/notification.py:195
 msgid "Transcription"
 msgstr "Transcripción"
 
-#: core/recording/event/notification.py:204
+#: core/recording/event/notification.py:206
 #, python-brace-format
 msgid "Meeting \"{room}\" on {room_recording_date} at {room_recording_time}"
-msgstr "Reunión \"{room}\" del {room_recording_date} a las {room_recording_time}"
+msgstr ""
+"Reunión \"{room}\" del {room_recording_date} a las {room_recording_time}"
 
 #: core/services/invitation.py:44
 #, python-brace-format
 msgid "Video call in progress: {sender.email} is waiting for you to connect"
 msgstr "Videollamada en curso: {sender.email} está esperando a que te conectes"
 
-#: core/templates/mail/html/invitation.html:159
-#: core/templates/mail/html/screen_recording.html:159
-#: core/templates/mail/text/invitation.txt:3
-#: core/templates/mail/text/screen_recording.txt:3
+#: core/templates/mail/html/invitation.html:151
+#: core/templates/mail/html/screen_recording.html:151
+#: core/templates/mail/text/invitation.txt:4
+#: core/templates/mail/text/screen_recording.txt:4
 msgid "Logo email"
 msgstr "Logotipo del correo"
 
-#: core/templates/mail/html/invitation.html:189
-#: core/templates/mail/text/invitation.txt:5
+#: core/templates/mail/html/invitation.html:181
+#: core/templates/mail/text/invitation.txt:6
 msgid "invites you to join an ongoing video call"
 msgstr "te invita a unirte a una videollamada en curso"
 
-#: core/templates/mail/html/invitation.html:200
-#: core/templates/mail/text/invitation.txt:7
+#: core/templates/mail/html/invitation.html:192
+#: core/templates/mail/text/invitation.txt:8
 msgid "JOIN THE CALL"
 msgstr "UNIRSE A LA LLAMADA"
 
-#: core/templates/mail/html/invitation.html:227
-#: core/templates/mail/text/invitation.txt:13
+#: core/templates/mail/html/invitation.html:219
+#: core/templates/mail/text/invitation.txt:14
 msgid ""
 "If you can't click the button, copy and paste the URL into your browser to "
 "join the call."
-msgstr "Si no puedes hacer clic en el botón, copia y pega la URL en tu navegador para unirte a la llamada."
+msgstr ""
+"Si no puedes hacer clic en el botón, copia y pega la URL en tu navegador "
+"para unirte a la llamada."
 
-#: core/templates/mail/html/invitation.html:235
-#: core/templates/mail/text/invitation.txt:15
+#: core/templates/mail/html/invitation.html:227
+#: core/templates/mail/text/invitation.txt:16
 msgid "Tips for a better experience:"
 msgstr "Consejos para una mejor experiencia:"
 
-#: core/templates/mail/html/invitation.html:237
-#: core/templates/mail/text/invitation.txt:17
+#: core/templates/mail/html/invitation.html:229
+#: core/templates/mail/text/invitation.txt:18
 msgid "Use Chrome or Firefox for better call quality"
 msgstr "Usa Chrome o Firefox para una mejor calidad de llamada"
 
-#: core/templates/mail/html/invitation.html:238
-#: core/templates/mail/text/invitation.txt:18
+#: core/templates/mail/html/invitation.html:230
+#: core/templates/mail/text/invitation.txt:19
 msgid "Test your microphone and camera before joining"
 msgstr "Prueba tu micrófono y tu cámara antes de unirte"
 
-#: core/templates/mail/html/invitation.html:239
-#: core/templates/mail/text/invitation.txt:19
+#: core/templates/mail/html/invitation.html:231
+#: core/templates/mail/text/invitation.txt:20
 msgid "Make sure you have a stable internet connection"
 msgstr "Asegúrate de tener una conexión a internet estable"
 
-#: core/templates/mail/html/invitation.html:248
-#: core/templates/mail/html/screen_recording.html:245
-#: core/templates/mail/text/invitation.txt:21
-#: core/templates/mail/text/screen_recording.txt:23
+#: core/templates/mail/html/invitation.html:240
+#: core/templates/mail/html/screen_recording.html:237
+#: core/templates/mail/text/invitation.txt:22
+#: core/templates/mail/text/screen_recording.txt:24
 #, python-format
 msgid " Thank you for using %(brandname)s. "
 msgstr " Gracias por usar %(brandname)s. "
 
-#: core/templates/mail/html/screen_recording.html:188
-#: core/templates/mail/text/screen_recording.txt:6
+#: core/templates/mail/html/invitation.html:271
+#, python-format
+msgid ""
+"This mail has been sent to %(email)s by <a href=\"%(href)s\">%(name)s</a>"
+msgstr ""
+
+#: core/templates/mail/html/screen_recording.html:180
+#: core/templates/mail/text/screen_recording.txt:7
 msgid "Your recording is ready!"
 msgstr "¡Tu grabación está lista!"
 
-#: core/templates/mail/html/screen_recording.html:195
-#: core/templates/mail/text/screen_recording.txt:8
+#: core/templates/mail/html/screen_recording.html:187
+#: core/templates/mail/text/screen_recording.txt:9
 #, python-format
 msgid ""
 " Your recording of \"%(room_name)s\" on %(recording_date)s at "
 "%(recording_time)s is now ready to download. "
-msgstr " Tu grabación de \"%(room_name)s\" del %(recording_date)s a las %(recording_time)s ya está lista para descargar. "
+msgstr ""
+" Tu grabación de \"%(room_name)s\" del %(recording_date)s a las "
+"%(recording_time)s ya está lista para descargar. "
 
-#: core/templates/mail/html/screen_recording.html:195
-#: core/templates/mail/text/screen_recording.txt:8
+#: core/templates/mail/html/screen_recording.html:187
+#: core/templates/mail/text/screen_recording.txt:9
 #, python-format
 msgid " The recording will expire in %(days)s days. "
 msgstr " La grabación caducará dentro de %(days)s días. "
 
-#: core/templates/mail/html/screen_recording.html:200
-#: core/templates/mail/text/screen_recording.txt:9
+#: core/templates/mail/html/screen_recording.html:192
+#: core/templates/mail/text/screen_recording.txt:10
 msgid ""
 " Sharing the recording via link is not yet available. Only organizers can "
 "download it. "
-msgstr " Compartir la grabación mediante un enlace todavía no está disponible. Solo los organizadores pueden descargarla. "
+msgstr ""
+" Compartir la grabación mediante un enlace todavía no está disponible. Solo "
+"los organizadores pueden descargarla. "
 
-#: core/templates/mail/html/screen_recording.html:206
-#: core/templates/mail/text/screen_recording.txt:11
+#: core/templates/mail/html/screen_recording.html:198
+#: core/templates/mail/text/screen_recording.txt:12
 msgid "To keep this recording permanently:"
 msgstr "Para conservar esta grabación de forma permanente:"
 
-#: core/templates/mail/html/screen_recording.html:208
+#: core/templates/mail/html/screen_recording.html:200
 #, python-format
 msgid "Click the \"<a href=\"%(link)s\">Open</a>\" link below "
-msgstr "Haz clic en el enlace \"<a href=\"%(link)s\">Abrir</a>\" que aparece abajo "
+msgstr ""
+"Haz clic en el enlace \"<a href=\"%(link)s\">Abrir</a>\" que aparece abajo "
 
-#: core/templates/mail/html/screen_recording.html:209
-#: core/templates/mail/text/screen_recording.txt:14
+#: core/templates/mail/html/screen_recording.html:201
+#: core/templates/mail/text/screen_recording.txt:15
 msgid "Use the \"Download\" button in the interface "
 msgstr "Usa el botón \"Descargar\" de la interfaz "
 
-#: core/templates/mail/html/screen_recording.html:210
-#: core/templates/mail/text/screen_recording.txt:15
+#: core/templates/mail/html/screen_recording.html:202
+#: core/templates/mail/text/screen_recording.txt:16
 msgid "Save the file to your preferred location"
 msgstr "Guarda el archivo en la ubicación que prefieras"
 
-#: core/templates/mail/html/screen_recording.html:221
-#: core/templates/mail/text/screen_recording.txt:17
+#: core/templates/mail/html/screen_recording.html:213
+#: core/templates/mail/text/screen_recording.txt:18
 msgid "Open"
 msgstr "Abrir"
 
-#: core/templates/mail/html/screen_recording.html:230
-#: core/templates/mail/text/screen_recording.txt:19
+#: core/templates/mail/html/screen_recording.html:222
+#: core/templates/mail/text/screen_recording.txt:20
 #, python-format
 msgid ""
 " If you have any questions or need assistance, please contact our support "
 "team at %(support_email)s. "
-msgstr " Si tienes alguna pregunta o necesitas ayuda, ponte en contacto con nuestro equipo de soporte en %(support_email)s. "
+msgstr ""
+" Si tienes alguna pregunta o necesitas ayuda, ponte en contacto con nuestro "
+"equipo de soporte en %(support_email)s. "
 
-#: core/templates/mail/text/screen_recording.txt:13
+#: core/templates/mail/text/invitation.txt:24
+#, python-format
+msgid "This mail has been sent to %(email)s by %(name)s [%(href)s]"
+msgstr ""
+
+#: core/templates/mail/text/screen_recording.txt:14
 #, python-format
 msgid "Click the \"Open [%(link)s]\" link below "
 msgstr "Haz clic en el enlace \"Abrir [%(link)s]\" que aparece abajo "
 
-#: meet/settings.py:228
+#: meet/settings.py:238
 msgid "English"
 msgstr "Inglés"
 
-#: meet/settings.py:229
+#: meet/settings.py:239
 msgid "French"
 msgstr "Francés"
 
-#: meet/settings.py:230
+#: meet/settings.py:240
 msgid "Dutch"
 msgstr "Neerlandés"
 
-#: meet/settings.py:231
+#: meet/settings.py:241
 msgid "German"
 msgstr "Alemán"
 
-#: meet/settings.py:233
+#: meet/settings.py:242
 msgid "Spanish"
 msgstr "Español"

src/backend/locale/fr_FR/LC_MESSAGES/django.po

@@ -8,7 +8,7 @@ msgid ""
 msgstr ""
 "Project-Id-Version: PACKAGE VERSION\n"
 "Report-Msgid-Bugs-To: \n"
-"POT-Creation-Date: 2026-07-02 10:47+0000\n"
+"POT-Creation-Date: 2026-09-02 22:52+0000\n"
 "PO-Revision-Date: YEAR-MO-DA HO:MI+ZONE\n"
 "Last-Translator: antoine.lebaud@mail.numerique.gouv.fr\n"
 "Language-Team: LANGUAGE <LL@li.org>\n"
@@ -51,11 +51,11 @@ msgstr ""
 msgid "File preview"
 msgstr ""
 
-#: core/admin.py:300 core/admin.py:443
+#: core/admin.py:300 core/admin.py:450
 msgid "No owner"
 msgstr "Pas de propriétaire"
 
-#: core/admin.py:303 core/admin.py:446
+#: core/admin.py:303 core/admin.py:453
 msgid "Multiple owners"
 msgstr "Plusieurs propriétaires"
 
@@ -99,11 +99,11 @@ msgstr ""
 msgid "Skipped %(count)s recording(s) with an ineligible status."
 msgstr "%(count)s enregistrement(s) avec un statut inéligible ignoré(s)."
 
-#: core/admin.py:510
+#: core/admin.py:517
 msgid "No scopes"
 msgstr "Aucun scopes"
 
-#: core/admin.py:512
+#: core/admin.py:519
 msgid "Scopes"
 msgstr "Scopes"
 
@@ -111,187 +111,203 @@ msgstr "Scopes"
 msgid "Creator is me"
 msgstr "Je suis le créateur"
 
-#: core/api/serializers.py:89
+#: core/api/serializers.py:108
 msgid "You must be administrator or owner of a room to add accesses to it."
 msgstr ""
 "Vous devez être administrateur ou propriétaire d'une salle pour y ajouter "
 "des accès."
 
-#: core/api/serializers.py:534
+#: core/api/serializers.py:560
 msgid "This file extension is not allowed."
 msgstr "Cette extension n'est pas autorisée"
 
-#: core/api/viewsets.py:1222
+#: core/api/viewsets.py:1268
 msgid "You have reached the maximum number of files for this type."
 msgstr "Vous avez atteint le nombre maximum de fichiers de ce type"
 
-#: core/models.py:37
+#: core/models.py:38
 msgid "Member"
 msgstr "Membre"
 
-#: core/models.py:38
+#: core/models.py:39
 msgid "Administrator"
 msgstr "Administrateur"
 
-#: core/models.py:39
+#: core/models.py:40
 msgid "Owner"
 msgstr "Propriétaire"
 
-#: core/models.py:55
+#: core/models.py:56
 msgid "Initiated"
 msgstr "Initié"
 
-#: core/models.py:56
+#: core/models.py:57
 msgid "Active"
 msgstr "Actif"
 
-#: core/models.py:57
+#: core/models.py:58
 msgid "Stopped"
 msgstr "Arrêté"
 
-#: core/models.py:58
+#: core/models.py:59
 msgid "Saved"
 msgstr "Enregistré"
 
-#: core/models.py:59
+#: core/models.py:60
 msgid "Aborted"
 msgstr "Abandonné"
 
-#: core/models.py:60
+#: core/models.py:61
 msgid "Failed to Start"
 msgstr "Échec au démarrage"
 
-#: core/models.py:61
+#: core/models.py:62
 msgid "Failed to Stop"
 msgstr "Échec à l'arrêt"
 
-#: core/models.py:62
+#: core/models.py:63
 msgid "Notification succeeded"
 msgstr "Notification réussie"
 
-#: core/models.py:65
+#: core/models.py:66
 msgid "External process successful"
 msgstr "Traitement externe : succès"
 
-#: core/models.py:67
+#: core/models.py:68
 msgid "External process failed"
 msgstr "Traitement externe : erreur"
 
-#: core/models.py:96
+#: core/models.py:97
 msgid "SCREEN_RECORDING"
 msgstr "ENREGISTREMENT_ÉCRAN"
 
-#: core/models.py:97
+#: core/models.py:98
 msgid "TRANSCRIPT"
 msgstr "TRANSCRIPTION"
 
-#: core/models.py:103
+#: core/models.py:104
 msgid "Public Access"
 msgstr "Accès public"
 
-#: core/models.py:104
+#: core/models.py:105
 msgid "Trusted Access"
 msgstr "Accès de confiance"
 
-#: core/models.py:105
+#: core/models.py:106
 msgid "Restricted Access"
 msgstr "Accès restreint"
 
-#: core/models.py:117
+#: core/models.py:118
 msgid "id"
 msgstr "id"
 
-#: core/models.py:118
+#: core/models.py:119
 msgid "primary key for the record as UUID"
 msgstr "clé primaire pour l'enregistrement sous forme d'UUID"
 
-#: core/models.py:124
+#: core/models.py:125
 msgid "created on"
 msgstr "créé le"
 
-#: core/models.py:125
+#: core/models.py:126
 msgid "date and time at which a record was created"
 msgstr "date et heure auxquelles un enregistrement a été créé"
 
-#: core/models.py:130
+#: core/models.py:131
 msgid "updated on"
 msgstr "mis à jour le"
 
-#: core/models.py:131
+#: core/models.py:132
 msgid "date and time at which a record was last updated"
 msgstr ""
 "date et heure auxquelles un enregistrement a été mis à jour pour la dernière "
 "fois"
 
-#: core/models.py:151
-msgid ""
-"Enter a valid sub. This value may contain only letters, numbers, and @/./+/-/"
-"_ characters."
-msgstr ""
-"Entrez un sub valide. Cette valeur ne peut contenir que des lettres, des "
-"chiffres et les caractères @/./+/-/_."
-
-#: core/models.py:157
+#: core/models.py:150
 msgid "sub"
 msgstr "sub"
 
-#: core/models.py:159
+#: core/models.py:152
 msgid ""
 "Optional for pending users; required upon account activation. 255 characters "
-"or fewer. Letters, numbers, and @/./+/-/_ characters only."
+"or fewer. Printable ASCII characters only."
 msgstr ""
-"Optionnel pour les utilisateurs en attente ; requis lors de l'activation du "
-"compte. 255 caractères maximum. Lettres, chiffres et @/./+/-/_ uniquement."
+"Facultatif pour les utilisateurs en attente ; obligatoire lors de l’activation "
+"du compte. 255 caractères maximum. Caractères ASCII imprimables uniquement."
 
-#: core/models.py:168
+#: core/validators.py:22
+msgid "Enter a valid sub. This value should be printable ASCII only."
+msgstr "Saisissez un sub valide. Cette valeur ne doit contenir que des caractères ASCII imprimables."
+
+#: core/models.py:161
 msgid "identity email address"
 msgstr "adresse e-mail d'identité"
 
-#: core/models.py:173
+#: core/models.py:166
 msgid "admin email address"
 msgstr "adresse e-mail d'administrateur"
 
-#: core/models.py:175
+#: core/models.py:168
 msgid "full name"
 msgstr "nom complet"
 
-#: core/models.py:177
+#: core/models.py:170
 msgid "short name"
 msgstr "nom court"
 
-#: core/models.py:183
+#: core/models.py:176
 msgid "language"
 msgstr "langue"
 
-#: core/models.py:184
+#: core/models.py:177
 msgid "The language in which the user wants to see the interface."
 msgstr "La langue dans laquelle l'utilisateur souhaite voir l'interface."
 
-#: core/models.py:190
+#: core/models.py:183
 msgid "The timezone in which the user wants to see times."
 msgstr "Le fuseau horaire dans lequel l'utilisateur souhaite voir les heures."
 
-#: core/models.py:193
+#: core/models.py:190
+msgid "default room access level"
+msgstr ""
+
+#: core/models.py:192
+msgid ""
+"Access level applied by default to new rooms created by this user. When "
+"empty, the instance default is used."
+msgstr ""
+
+#: core/models.py:199
+#, fuzzy
+#| msgid "Visio room configuration"
+msgid "default room configuration"
+msgstr "Configuration de la salle de visioconférence"
+
+#: core/models.py:201
+msgid "Configurations applied by default to new rooms created by this user."
+msgstr ""
+
+#: core/models.py:205
 msgid "device"
 msgstr "appareil"
 
-#: core/models.py:195
+#: core/models.py:207
 msgid "Whether the user is a device or a real user."
 msgstr "Si l'utilisateur est un appareil ou un utilisateur réel."
 
-#: core/models.py:198
+#: core/models.py:210
 msgid "staff status"
 msgstr "statut du personnel"
 
-#: core/models.py:200
+#: core/models.py:212
 msgid "Whether the user can log into this admin site."
 msgstr "Si l'utilisateur peut se connecter à ce site d'administration."
 
-#: core/models.py:203
+#: core/models.py:215
 msgid "active"
 msgstr "actif"
 
-#: core/models.py:206
+#: core/models.py:218
 msgid ""
 "Whether this user should be treated as active. Unselect this instead of "
 "deleting accounts."
@@ -299,65 +315,65 @@ msgstr ""
 "Si cet utilisateur doit être traité comme actif. Désélectionnez cette option "
 "au lieu de supprimer des comptes."
 
-#: core/models.py:219
+#: core/models.py:231
 msgid "user"
 msgstr "utilisateur"
 
-#: core/models.py:220
+#: core/models.py:232
 msgid "users"
 msgstr "utilisateurs"
 
-#: core/models.py:286
+#: core/models.py:298
 msgid "Resource"
 msgstr "Ressource"
 
-#: core/models.py:287
+#: core/models.py:299
 msgid "Resources"
 msgstr "Ressources"
 
-#: core/models.py:345
+#: core/models.py:357
 msgid "Resource access"
 msgstr "Accès aux ressources"
 
-#: core/models.py:346
+#: core/models.py:358
 msgid "Resource accesses"
 msgstr "Accès aux ressources"
 
-#: core/models.py:352
+#: core/models.py:364
 msgid "Resource access with this User and Resource already exists."
 msgstr ""
 "L'accès à la ressource avec cet utilisateur et cette ressource existe déjà."
 
-#: core/models.py:409
+#: core/models.py:421
 msgid "Visio room configuration"
 msgstr "Configuration de la salle de visioconférence"
 
-#: core/models.py:410
+#: core/models.py:422
 msgid "Values for Visio parameters to configure the room."
 msgstr "Valeurs des paramètres de visioconférence pour configurer la salle."
 
-#: core/models.py:417
+#: core/models.py:429
 msgid "Room PIN code"
 msgstr "Code PIN de la salle"
 
-#: core/models.py:418
+#: core/models.py:430
 msgid "Unique n-digit code that identifies this room in telephony mode."
 msgstr ""
 "Code unique à n chiffres qui identifie cette salle en mode téléphonique."
 
-#: core/models.py:424 core/models.py:578
+#: core/models.py:436 core/models.py:597
 msgid "Room"
 msgstr "Salle"
 
-#: core/models.py:425
+#: core/models.py:437
 msgid "Rooms"
 msgstr "Salles"
 
-#: core/models.py:589
+#: core/models.py:608
 msgid "Worker ID"
 msgstr "ID du Worker"
 
-#: core/models.py:591
+#: core/models.py:610
 msgid ""
 "Enter an identifier for the worker recording.This ID is retained even when "
 "the worker stops, allowing for easy tracking."
@@ -365,170 +381,170 @@ msgstr ""
 "Entrez un identifiant pour l'enregistrement du Worker. Cet identifiant est "
 "conservé même lorsque le Worker s'arrête, permettant un suivi facile."
 
-#: core/models.py:599
+#: core/models.py:618
 msgid "Recording mode"
 msgstr "Mode d'enregistrement"
 
-#: core/models.py:600
+#: core/models.py:619
 msgid "Defines the mode of recording being called."
 msgstr "Définit le mode d'enregistrement appelé."
 
-#: core/models.py:605 core/models.py:606
+#: core/models.py:624 core/models.py:625
 msgid "Recording options"
 msgstr "Options d'enregistrement"
 
-#: core/models.py:613
+#: core/models.py:632
 msgid "External Process ID"
 msgstr "ID Traitement externe"
 
-#: core/models.py:614
+#: core/models.py:633
 msgid "ID of the external process associated with the recording."
 msgstr "ID du traitement externe associé avec l'enregistrement."
 
-#: core/models.py:620
+#: core/models.py:639
 msgid "Recording"
 msgstr "Enregistrement"
 
-#: core/models.py:621
+#: core/models.py:640
 msgid "Recordings"
 msgstr "Enregistrements"
 
-#: core/models.py:731
+#: core/models.py:750
 msgid "Recording/user relation"
 msgstr "Relation enregistrement/utilisateur"
 
-#: core/models.py:732
+#: core/models.py:751
 msgid "Recording/user relations"
 msgstr "Relations enregistrement/utilisateur"
 
-#: core/models.py:738
+#: core/models.py:757
 msgid "This user is already in this recording."
 msgstr "Cet utilisateur est déjà dans cet enregistrement."
 
-#: core/models.py:744
+#: core/models.py:763
 msgid "This team is already in this recording."
 msgstr "Cette équipe est déjà dans cet enregistrement."
 
-#: core/models.py:750
+#: core/models.py:769
 msgid "Either user or team must be set, not both."
 msgstr "Soit l'utilisateur, soit l'équipe doit être défini, pas les deux."
 
-#: core/models.py:767
+#: core/models.py:786
 msgid "Create rooms"
 msgstr "Créer des salles"
 
-#: core/models.py:768
+#: core/models.py:787
 msgid "List rooms"
 msgstr "Lister les salles"
 
-#: core/models.py:769
+#: core/models.py:788
 msgid "Retrieve room details"
 msgstr "Afficher les détails d’une salle"
 
-#: core/models.py:770
+#: core/models.py:789
 msgid "Update rooms"
 msgstr "Mettre à jour les salles"
 
-#: core/models.py:771
+#: core/models.py:790
 msgid "Delete rooms"
 msgstr "Supprimer les salles"
 
-#: core/models.py:784
+#: core/models.py:803
 msgid "Application name"
 msgstr "Nom de l’application"
 
-#: core/models.py:785
+#: core/models.py:804
 msgid "Descriptive name for this application."
 msgstr "Nom descriptif de cette application."
 
-#: core/models.py:795
+#: core/models.py:814
 msgid "Hashed on Save. Copy it now if this is a new secret."
 msgstr ""
 "Haché lors de l’enregistrement. Copiez-le maintenant s’il s’agit d’un "
 "nouveau secret."
 
-#: core/models.py:806
+#: core/models.py:825
 msgid "Application"
 msgstr "Application"
 
-#: core/models.py:807
+#: core/models.py:826
 msgid "Applications"
 msgstr "Applications"
 
-#: core/models.py:830
+#: core/models.py:849
 msgid "Enter a valid domain"
 msgstr "Saisissez un domaine valide"
 
-#: core/models.py:833
+#: core/models.py:852
 msgid "Domain"
 msgstr "Domaine"
 
-#: core/models.py:834
+#: core/models.py:853
 msgid "Email domain this application can act on behalf of."
 msgstr "Domaine de messagerie au nom duquel cette application peut agir."
 
-#: core/models.py:846
+#: core/models.py:865
 msgid "Application domain"
 msgstr "Domaine d’application"
 
-#: core/models.py:847
+#: core/models.py:866
 msgid "Application domains"
 msgstr "Domaines d’application"
 
-#: core/models.py:865
+#: core/models.py:884
 msgid "Pending"
 msgstr "En attente"
 
-#: core/models.py:866
+#: core/models.py:885
 msgid "Analyzing"
 msgstr ""
 
-#: core/models.py:873
+#: core/models.py:892
 msgid "Ready"
 msgstr "Prêt"
 
-#: core/models.py:879
+#: core/models.py:898
 msgid "Background image"
 msgstr "Image de fond"
 
-#: core/models.py:891
+#: core/models.py:910
 msgid "title"
 msgstr "Titre"
 
-#: core/models.py:915
+#: core/models.py:934
 msgid "Malware detection info when the analysis status is unsafe."
 msgstr ""
 "Information concernant la détection de Malware cand le statut n'est pas sain"
 
-#: core/models.py:920
+#: core/models.py:939
 msgid "File"
 msgstr "Fichier"
 
-#: core/models.py:921
+#: core/models.py:940
 msgid "Files"
 msgstr "Fichiers"
 
-#: core/models.py:1041
+#: core/models.py:1060
 #, fuzzy
 #| msgid "This user is already in this recording."
 msgid "This file is already hard deleted."
 msgstr "Ce fichier a été supprimé."
 
-#: core/models.py:1051
+#: core/models.py:1070
 msgid "To hard delete a file, it must first be soft deleted."
 msgstr ""
 "Pour supprimer définitivement un fichier il doit d'abord avoir été marqué "
 "comme supprimé (soft delete)"
 
-#: core/recording/event/notification.py:123
+#: core/recording/event/notification.py:124
 msgid "Your recording is ready"
 msgstr "Votre enregistrement est prêt"
 
-#: core/recording/event/notification.py:194
+#: core/recording/event/notification.py:195
 msgid "Transcription"
 msgstr "Transcription"
 
-#: core/recording/event/notification.py:204
+#: core/recording/event/notification.py:206
 #, python-brace-format
 msgid "Meeting \"{room}\" on {room_recording_date} at {room_recording_time}"
 msgstr "Réunion \"{room}\" du {room_recording_date} à {room_recording_time}"
@@ -538,25 +554,25 @@ msgstr "Réunion \"{room}\" du {room_recording_date} à {room_recording_time}"
 msgid "Video call in progress: {sender.email} is waiting for you to connect"
 msgstr "Appel vidéo en cours : {sender.email} attend que vous vous connectiez"
 
-#: core/templates/mail/html/invitation.html:159
-#: core/templates/mail/html/screen_recording.html:159
-#: core/templates/mail/text/invitation.txt:3
-#: core/templates/mail/text/screen_recording.txt:3
+#: core/templates/mail/html/invitation.html:151
+#: core/templates/mail/html/screen_recording.html:151
+#: core/templates/mail/text/invitation.txt:4
+#: core/templates/mail/text/screen_recording.txt:4
 msgid "Logo email"
 msgstr "Logo email"
 
-#: core/templates/mail/html/invitation.html:189
-#: core/templates/mail/text/invitation.txt:5
+#: core/templates/mail/html/invitation.html:181
+#: core/templates/mail/text/invitation.txt:6
 msgid "invites you to join an ongoing video call"
 msgstr "vous invite à rejoindre un appel vidéo en cours"
 
-#: core/templates/mail/html/invitation.html:200
-#: core/templates/mail/text/invitation.txt:7
+#: core/templates/mail/html/invitation.html:192
+#: core/templates/mail/text/invitation.txt:8
 msgid "JOIN THE CALL"
 msgstr "REJOINDRE L'APPEL"
 
-#: core/templates/mail/html/invitation.html:227
-#: core/templates/mail/text/invitation.txt:13
+#: core/templates/mail/html/invitation.html:219
+#: core/templates/mail/text/invitation.txt:14
 msgid ""
 "If you can't click the button, copy and paste the URL into your browser to "
 "join the call."
@@ -564,41 +580,47 @@ msgstr ""
 "Si vous ne pouvez pas cliquer sur le bouton, copiez et collez l'URL dans "
 "votre navigateur pour rejoindre l'appel."
 
-#: core/templates/mail/html/invitation.html:235
-#: core/templates/mail/text/invitation.txt:15
+#: core/templates/mail/html/invitation.html:227
+#: core/templates/mail/text/invitation.txt:16
 msgid "Tips for a better experience:"
 msgstr "Conseils pour une meilleure expérience :"
 
-#: core/templates/mail/html/invitation.html:237
-#: core/templates/mail/text/invitation.txt:17
+#: core/templates/mail/html/invitation.html:229
+#: core/templates/mail/text/invitation.txt:18
 msgid "Use Chrome or Firefox for better call quality"
 msgstr "Utilisez Chrome ou Firefox pour une meilleure qualité d'appel"
 
-#: core/templates/mail/html/invitation.html:238
-#: core/templates/mail/text/invitation.txt:18
+#: core/templates/mail/html/invitation.html:230
+#: core/templates/mail/text/invitation.txt:19
 msgid "Test your microphone and camera before joining"
 msgstr "Testez votre microphone et votre caméra avant de rejoindre"
 
-#: core/templates/mail/html/invitation.html:239
-#: core/templates/mail/text/invitation.txt:19
+#: core/templates/mail/html/invitation.html:231
+#: core/templates/mail/text/invitation.txt:20
 msgid "Make sure you have a stable internet connection"
 msgstr "Assurez-vous d'avoir une connexion Internet stable"
 
-#: core/templates/mail/html/invitation.html:248
-#: core/templates/mail/html/screen_recording.html:245
-#: core/templates/mail/text/invitation.txt:21
-#: core/templates/mail/text/screen_recording.txt:23
+#: core/templates/mail/html/invitation.html:240
+#: core/templates/mail/html/screen_recording.html:237
+#: core/templates/mail/text/invitation.txt:22
+#: core/templates/mail/text/screen_recording.txt:24
 #, python-format
 msgid " Thank you for using %(brandname)s. "
 msgstr " Merci d'utiliser %(brandname)s. "
 
-#: core/templates/mail/html/screen_recording.html:188
-#: core/templates/mail/text/screen_recording.txt:6
+#: core/templates/mail/html/invitation.html:271
+#, python-format
+msgid ""
+"This mail has been sent to %(email)s by <a href=\"%(href)s\">%(name)s</a>"
+msgstr ""
+
+#: core/templates/mail/html/screen_recording.html:180
+#: core/templates/mail/text/screen_recording.txt:7
 msgid "Your recording is ready!"
 msgstr "Votre enregistrement est prêt !"
 
-#: core/templates/mail/html/screen_recording.html:195
-#: core/templates/mail/text/screen_recording.txt:8
+#: core/templates/mail/html/screen_recording.html:187
+#: core/templates/mail/text/screen_recording.txt:9
 #, python-format
 msgid ""
 " Your recording of \"%(room_name)s\" on %(recording_date)s at "
@@ -607,14 +629,14 @@ msgstr ""
 " Votre enregistrement de \"%(room_name)s\" du %(recording_date)s à "
 "%(recording_time)s est maintenant prêt à être téléchargé. "
 
-#: core/templates/mail/html/screen_recording.html:195
-#: core/templates/mail/text/screen_recording.txt:8
+#: core/templates/mail/html/screen_recording.html:187
+#: core/templates/mail/text/screen_recording.txt:9
 #, python-format
 msgid " The recording will expire in %(days)s days. "
 msgstr " L'enregistrement expirera dans %(days)s jours. "
 
-#: core/templates/mail/html/screen_recording.html:200
-#: core/templates/mail/text/screen_recording.txt:9
+#: core/templates/mail/html/screen_recording.html:192
+#: core/templates/mail/text/screen_recording.txt:10
 msgid ""
 " Sharing the recording via link is not yet available. Only organizers can "
 "download it. "
@@ -622,33 +644,33 @@ msgstr ""
 "Le partage de l'enregistrement via lien n'est pas encore disponible. Seuls "
 "les organisateurs peuvent le télécharger."
 
-#: core/templates/mail/html/screen_recording.html:206
-#: core/templates/mail/text/screen_recording.txt:11
+#: core/templates/mail/html/screen_recording.html:198
+#: core/templates/mail/text/screen_recording.txt:12
 msgid "To keep this recording permanently:"
 msgstr "Pour conserver cet enregistrement de façon permanente :"
 
-#: core/templates/mail/html/screen_recording.html:208
+#: core/templates/mail/html/screen_recording.html:200
 #, python-format
 msgid "Click the \"<a href=\"%(link)s\">Open</a>\" link below "
 msgstr "Cliquez sur le lien \"<a href=\"%(link)s\">Ouvrir</a>\" ci-dessous "
 
-#: core/templates/mail/html/screen_recording.html:209
-#: core/templates/mail/text/screen_recording.txt:14
+#: core/templates/mail/html/screen_recording.html:201
+#: core/templates/mail/text/screen_recording.txt:15
 msgid "Use the \"Download\" button in the interface "
 msgstr "Utilisez le bouton \"Télécharger\" dans l'interface "
 
-#: core/templates/mail/html/screen_recording.html:210
-#: core/templates/mail/text/screen_recording.txt:15
+#: core/templates/mail/html/screen_recording.html:202
+#: core/templates/mail/text/screen_recording.txt:16
 msgid "Save the file to your preferred location"
 msgstr "Enregistrez le fichier à l'emplacement de votre choix"
 
-#: core/templates/mail/html/screen_recording.html:221
-#: core/templates/mail/text/screen_recording.txt:17
+#: core/templates/mail/html/screen_recording.html:213
+#: core/templates/mail/text/screen_recording.txt:18
 msgid "Open"
 msgstr "Ouvrir"
 
-#: core/templates/mail/html/screen_recording.html:230
-#: core/templates/mail/text/screen_recording.txt:19
+#: core/templates/mail/html/screen_recording.html:222
+#: core/templates/mail/text/screen_recording.txt:20
 #, python-format
 msgid ""
 " If you have any questions or need assistance, please contact our support "
@@ -657,28 +679,33 @@ msgstr ""
 " Si vous avez des questions ou besoin d'assistance, veuillez contacter notre "
 "équipe d'assistance à %(support_email)s. "
 
-#: core/templates/mail/text/screen_recording.txt:13
+#: core/templates/mail/text/invitation.txt:24
+#, python-format
+msgid "This mail has been sent to %(email)s by %(name)s [%(href)s]"
+msgstr ""
+
+#: core/templates/mail/text/screen_recording.txt:14
 #, fuzzy, python-format
 #| msgid "Click the \"<a href=\"%(link)s\">Open</a>\" link below "
 msgid "Click the \"Open [%(link)s]\" link below "
 msgstr "Cliquez sur le lien \"<a href=\"%(link)s\">Ouvrir</a>\" ci-dessous "
 
-#: meet/settings.py:228
+#: meet/settings.py:238
 msgid "English"
 msgstr "Anglais"
 
-#: meet/settings.py:229
+#: meet/settings.py:239
 msgid "French"
 msgstr "Français"
 
-#: meet/settings.py:230
+#: meet/settings.py:240
 msgid "Dutch"
 msgstr "Néerlandais"
 
-#: meet/settings.py:231
+#: meet/settings.py:241
 msgid "German"
 msgstr "Allemand"
 
-#: meet/settings.py:233
+#: meet/settings.py:242
 msgid "Spanish"
 msgstr "Espagnol"

src/backend/locale/nl_NL/LC_MESSAGES/django.po

@@ -8,7 +8,7 @@ msgid ""
 msgstr ""
 "Project-Id-Version: PACKAGE VERSION\n"
 "Report-Msgid-Bugs-To: \n"
-"POT-Creation-Date: 2026-07-02 10:47+0000\n"
+"POT-Creation-Date: 2026-09-02 22:52+0000\n"
 "PO-Revision-Date: YEAR-MO-DA HO:MI+ZONE\n"
 "Last-Translator: FULL NAME <EMAIL@ADDRESS>\n"
 "Language-Team: LANGUAGE <LL@li.org>\n"
@@ -51,11 +51,11 @@ msgstr ""
 msgid "File preview"
 msgstr ""
 
-#: core/admin.py:300 core/admin.py:443
+#: core/admin.py:300 core/admin.py:450
 msgid "No owner"
 msgstr "Geen eigenaar"
 
-#: core/admin.py:303 core/admin.py:446
+#: core/admin.py:303 core/admin.py:453
 msgid "Multiple owners"
 msgstr "Meerdere eigenaren"
 
@@ -98,11 +98,11 @@ msgstr "%(count)s opname(s) succesvol gemarkeerd als 'Mislukt bij stoppen'."
 msgid "Skipped %(count)s recording(s) with an ineligible status."
 msgstr "%(count)s opname(s) met een niet-toegestane status overgeslagen."
 
-#: core/admin.py:510
+#: core/admin.py:517
 msgid "No scopes"
 msgstr "Geen scopes"
 
-#: core/admin.py:512
+#: core/admin.py:519
 msgid "Scopes"
 msgstr "Scopes"
 
@@ -110,184 +110,200 @@ msgstr "Scopes"
 msgid "Creator is me"
 msgstr "Maker ben ik"
 
-#: core/api/serializers.py:89
+#: core/api/serializers.py:108
 msgid "You must be administrator or owner of a room to add accesses to it."
 msgstr ""
 "Je moet beheerder of eigenaar van een ruimte zijn om toegang toe te voegen."
 
-#: core/api/serializers.py:534
+#: core/api/serializers.py:560
 msgid "This file extension is not allowed."
 msgstr "Deze bestandsextensie is niet toegestaan."
 
-#: core/api/viewsets.py:1222
+#: core/api/viewsets.py:1268
 msgid "You have reached the maximum number of files for this type."
 msgstr "Het maximale aantal bestanden voor dit type is bereikt."
 
-#: core/models.py:37
+#: core/models.py:38
 msgid "Member"
 msgstr "Lid"
 
-#: core/models.py:38
+#: core/models.py:39
 msgid "Administrator"
 msgstr "Beheerder"
 
-#: core/models.py:39
+#: core/models.py:40
 msgid "Owner"
 msgstr "Eigenaar"
 
-#: core/models.py:55
+#: core/models.py:56
 msgid "Initiated"
 msgstr "Gestart"
 
-#: core/models.py:56
+#: core/models.py:57
 msgid "Active"
 msgstr "Actief"
 
-#: core/models.py:57
+#: core/models.py:58
 msgid "Stopped"
 msgstr "Gestopt"
 
-#: core/models.py:58
+#: core/models.py:59
 msgid "Saved"
 msgstr "Opgeslagen"
 
-#: core/models.py:59
+#: core/models.py:60
 msgid "Aborted"
 msgstr "Afgebroken"
 
-#: core/models.py:60
+#: core/models.py:61
 msgid "Failed to Start"
 msgstr "Starten mislukt"
 
-#: core/models.py:61
+#: core/models.py:62
 msgid "Failed to Stop"
 msgstr "Stoppen mislukt"
 
-#: core/models.py:62
+#: core/models.py:63
 msgid "Notification succeeded"
 msgstr "Notificatie geslaagd"
 
-#: core/models.py:65
+#: core/models.py:66
 msgid "External process successful"
 msgstr "Externe procedure succesvol"
 
-#: core/models.py:67
+#: core/models.py:68
 msgid "External process failed"
 msgstr "Het externe proces is mislukt."
 
-#: core/models.py:96
+#: core/models.py:97
 msgid "SCREEN_RECORDING"
 msgstr "SCHERM_OPNAME"
 
-#: core/models.py:97
+#: core/models.py:98
 msgid "TRANSCRIPT"
 msgstr "TRANSCRIPT"
 
-#: core/models.py:103
+#: core/models.py:104
 msgid "Public Access"
 msgstr "Openbare toegang"
 
-#: core/models.py:104
+#: core/models.py:105
 msgid "Trusted Access"
 msgstr "Vertrouwde toegang"
 
-#: core/models.py:105
+#: core/models.py:106
 msgid "Restricted Access"
 msgstr "Beperkte toegang"
 
-#: core/models.py:117
+#: core/models.py:118
 msgid "id"
 msgstr "id"
 
-#: core/models.py:118
+#: core/models.py:119
 msgid "primary key for the record as UUID"
 msgstr "primaire sleutel voor het record als UUID"
 
-#: core/models.py:124
+#: core/models.py:125
 msgid "created on"
 msgstr "aangemaakt op"
 
-#: core/models.py:125
+#: core/models.py:126
 msgid "date and time at which a record was created"
 msgstr "datum en tijd waarop een record werd aangemaakt"
 
-#: core/models.py:130
+#: core/models.py:131
 msgid "updated on"
 msgstr "bijgewerkt op"
 
-#: core/models.py:131
+#: core/models.py:132
 msgid "date and time at which a record was last updated"
 msgstr "datum en tijd waarop een record voor het laatst werd bijgewerkt"
 
-#: core/models.py:151
-msgid ""
-"Enter a valid sub. This value may contain only letters, numbers, and @/./+/-/"
-"_ characters."
-msgstr ""
-"Voer een geldige sub in. Deze waarde mag alleen letters, cijfers en @/./+/-/"
-"_ tekens bevatten."
-
-#: core/models.py:157
+#: core/models.py:150
 msgid "sub"
 msgstr "sub"
 
-#: core/models.py:159
+#: core/models.py:152
 msgid ""
 "Optional for pending users; required upon account activation. 255 characters "
-"or fewer. Letters, numbers, and @/./+/-/_ characters only."
+"or fewer. Printable ASCII characters only."
 msgstr ""
-"Optioneel voor gebruikers in afwachting; vereist bij accountactivering. "
-"Maximum 255 tekens. Alleen letters, cijfers en @/./+/-/_ toegestaan."
+"Optioneel voor gebruikers in afwachting; verplicht bij het activeren van het "
+"account. Maximaal 255 tekens. Alleen afdrukbare ASCII-tekens."
 
-#: core/models.py:168
+#: core/validators.py:22
+msgid "Enter a valid sub. This value should be printable ASCII only."
+msgstr "Voer een geldige sub in. Deze waarde mag alleen afdrukbare ASCII-tekens bevatten."
+
+#: core/models.py:161
 msgid "identity email address"
 msgstr "identiteit e-mailadres"
 
-#: core/models.py:173
+#: core/models.py:166
 msgid "admin email address"
 msgstr "beheerder e-mailadres"
 
-#: core/models.py:175
+#: core/models.py:168
 msgid "full name"
 msgstr "volledige naam"
 
-#: core/models.py:177
+#: core/models.py:170
 msgid "short name"
 msgstr "korte naam"
 
-#: core/models.py:183
+#: core/models.py:176
 msgid "language"
 msgstr "taal"
 
-#: core/models.py:184
+#: core/models.py:177
 msgid "The language in which the user wants to see the interface."
 msgstr "De taal waarin de gebruiker de interface wil zien."
 
-#: core/models.py:190
+#: core/models.py:183
 msgid "The timezone in which the user wants to see times."
 msgstr "De tijdzone waarin de gebruiker tijden wil zien."
 
-#: core/models.py:193
+#: core/models.py:190
+msgid "default room access level"
+msgstr ""
+
+#: core/models.py:192
+msgid ""
+"Access level applied by default to new rooms created by this user. When "
+"empty, the instance default is used."
+msgstr ""
+
+#: core/models.py:199
+#, fuzzy
+#| msgid "Visio room configuration"
+msgid "default room configuration"
+msgstr "Visio-ruimteconfiguratie"
+
+#: core/models.py:201
+msgid "Configurations applied by default to new rooms created by this user."
+msgstr ""
+
+#: core/models.py:205
 msgid "device"
 msgstr "apparaat"
 
-#: core/models.py:195
+#: core/models.py:207
 msgid "Whether the user is a device or a real user."
 msgstr "Of de gebruiker een apparaat is of een echte gebruiker."
 
-#: core/models.py:198
+#: core/models.py:210
 msgid "staff status"
 msgstr "personeelsstatus"
 
-#: core/models.py:200
+#: core/models.py:212
 msgid "Whether the user can log into this admin site."
 msgstr "Of de gebruiker kan inloggen op deze beheersite."
 
-#: core/models.py:203
+#: core/models.py:215
 msgid "active"
 msgstr "actief"
 
-#: core/models.py:206
+#: core/models.py:218
 msgid ""
 "Whether this user should be treated as active. Unselect this instead of "
 "deleting accounts."
@@ -295,64 +311,64 @@ msgstr ""
 "Of deze gebruiker als actief moet worden behandeld. Deselecteer dit in "
 "plaats van accounts te verwijderen."
 
-#: core/models.py:219
+#: core/models.py:231
 msgid "user"
 msgstr "gebruiker"
 
-#: core/models.py:220
+#: core/models.py:232
 msgid "users"
 msgstr "gebruikers"
 
-#: core/models.py:286
+#: core/models.py:298
 msgid "Resource"
 msgstr "Bron"
 
-#: core/models.py:287
+#: core/models.py:299
 msgid "Resources"
 msgstr "Bronnen"
 
-#: core/models.py:345
+#: core/models.py:357
 msgid "Resource access"
 msgstr "Brontoegang"
 
-#: core/models.py:346
+#: core/models.py:358
 msgid "Resource accesses"
 msgstr "Brontoegangsrechten"
 
-#: core/models.py:352
+#: core/models.py:364
 msgid "Resource access with this User and Resource already exists."
 msgstr "Brontoegang met deze gebruiker en bron bestaat al."
 
-#: core/models.py:409
+#: core/models.py:421
 msgid "Visio room configuration"
 msgstr "Visio-ruimteconfiguratie"
 
-#: core/models.py:410
+#: core/models.py:422
 msgid "Values for Visio parameters to configure the room."
 msgstr "Waarden voor Visio-parameters om de ruimte te configureren."
 
-#: core/models.py:417
+#: core/models.py:429
 msgid "Room PIN code"
 msgstr "Pincode van de kamer"
 
-#: core/models.py:418
+#: core/models.py:430
 msgid "Unique n-digit code that identifies this room in telephony mode."
 msgstr ""
 "Unieke n-cijferige code die deze kamer identificeert in telefonie-modus."
 
-#: core/models.py:424 core/models.py:578
+#: core/models.py:436 core/models.py:597
 msgid "Room"
 msgstr "Ruimte"
 
-#: core/models.py:425
+#: core/models.py:437
 msgid "Rooms"
 msgstr "Ruimtes"
 
-#: core/models.py:589
+#: core/models.py:608
 msgid "Worker ID"
 msgstr "Worker ID"
 
-#: core/models.py:591
+#: core/models.py:610
 msgid ""
 "Enter an identifier for the worker recording.This ID is retained even when "
 "the worker stops, allowing for easy tracking."
@@ -360,152 +376,152 @@ msgstr ""
 "Voer een identificatie in voor de worker-opname. Deze ID blijft behouden, "
 "zelfs wanneer de worker stopt, waardoor eenvoudige tracking mogelijk is."
 
-#: core/models.py:599
+#: core/models.py:618
 msgid "Recording mode"
 msgstr "Opnamemodus"
 
-#: core/models.py:600
+#: core/models.py:619
 msgid "Defines the mode of recording being called."
 msgstr "Definieert de modus van opname die wordt aangeroepen."
 
-#: core/models.py:605 core/models.py:606
+#: core/models.py:624 core/models.py:625
 msgid "Recording options"
 msgstr "Opnameopties"
 
-#: core/models.py:613
+#: core/models.py:632
 msgid "External Process ID"
 msgstr "Externe proces-ID"
 
-#: core/models.py:614
+#: core/models.py:633
 msgid "ID of the external process associated with the recording."
 msgstr "ID van het externe proces dat aan de opname is gekoppeld."
 
-#: core/models.py:620
+#: core/models.py:639
 msgid "Recording"
 msgstr "Opname"
 
-#: core/models.py:621
+#: core/models.py:640
 msgid "Recordings"
 msgstr "Opnames"
 
-#: core/models.py:731
+#: core/models.py:750
 msgid "Recording/user relation"
 msgstr "Opname/gebruiker-relatie"
 
-#: core/models.py:732
+#: core/models.py:751
 msgid "Recording/user relations"
 msgstr "Opname/gebruiker-relaties"
 
-#: core/models.py:738
+#: core/models.py:757
 msgid "This user is already in this recording."
 msgstr "Deze gebruiker is al in deze opname."
 
-#: core/models.py:744
+#: core/models.py:763
 msgid "This team is already in this recording."
 msgstr "Dit team is al in deze opname."
 
-#: core/models.py:750
+#: core/models.py:769
 msgid "Either user or team must be set, not both."
 msgstr "Ofwel gebruiker of team moet worden ingesteld, niet beide."
 
-#: core/models.py:767
+#: core/models.py:786
 msgid "Create rooms"
 msgstr "Ruimtes aanmaken"
 
-#: core/models.py:768
+#: core/models.py:787
 msgid "List rooms"
 msgstr "Ruimtes weergeven"
 
-#: core/models.py:769
+#: core/models.py:788
 msgid "Retrieve room details"
 msgstr "Details van een ruimte ophalen"
 
-#: core/models.py:770
+#: core/models.py:789
 msgid "Update rooms"
 msgstr "Ruimtes bijwerken"
 
-#: core/models.py:771
+#: core/models.py:790
 msgid "Delete rooms"
 msgstr "Ruimtes verwijderen"
 
-#: core/models.py:784
+#: core/models.py:803
 msgid "Application name"
 msgstr "Naam van de applicatie"
 
-#: core/models.py:785
+#: core/models.py:804
 msgid "Descriptive name for this application."
 msgstr "Beschrijvende naam voor deze applicatie."
 
-#: core/models.py:795
+#: core/models.py:814
 msgid "Hashed on Save. Copy it now if this is a new secret."
 msgstr ""
 "Wordt gehasht bij het opslaan. Kopieer het nu als dit een nieuw geheim is."
 
-#: core/models.py:806
+#: core/models.py:825
 msgid "Application"
 msgstr "Applicatie"
 
-#: core/models.py:807
+#: core/models.py:826
 msgid "Applications"
 msgstr "Applicaties"
 
-#: core/models.py:830
+#: core/models.py:849
 msgid "Enter a valid domain"
 msgstr "Voer een geldig domein in"
 
-#: core/models.py:833
+#: core/models.py:852
 msgid "Domain"
 msgstr "Domein"
 
-#: core/models.py:834
+#: core/models.py:853
 msgid "Email domain this application can act on behalf of."
 msgstr "E-maildomein namens welke deze applicatie kan handelen."
 
-#: core/models.py:846
+#: core/models.py:865
 msgid "Application domain"
 msgstr "Applicatiedomein"
 
-#: core/models.py:847
+#: core/models.py:866
 msgid "Application domains"
 msgstr "Applicatiedomeinen"
 
-#: core/models.py:865
+#: core/models.py:884
 msgid "Pending"
 msgstr "In afwachting"
 
-#: core/models.py:866
+#: core/models.py:885
 msgid "Analyzing"
 msgstr ""
 
-#: core/models.py:873
+#: core/models.py:892
 msgid "Ready"
 msgstr "Klaar"
 
-#: core/models.py:879
+#: core/models.py:898
 msgid "Background image"
 msgstr "Achtergrondafbeelding"
 
-#: core/models.py:891
+#: core/models.py:910
 msgid "title"
 msgstr "Titel"
 
-#: core/models.py:915
+#: core/models.py:934
 msgid "Malware detection info when the analysis status is unsafe."
 msgstr "Informatie over malwaredetectie wanneer de analysestatus onveilig is."
 
-#: core/models.py:920
+#: core/models.py:939
 msgid "File"
 msgstr "Bestand"
 
-#: core/models.py:921
+#: core/models.py:940
 msgid "Files"
 msgstr "Bestanden"
 
-#: core/models.py:1041
+#: core/models.py:1060
 msgid "This file is already hard deleted."
 msgstr "Dit bestand is al definitief verwijderd."
 
-#: core/models.py:1051
+#: core/models.py:1070
 #, fuzzy
 #| msgid "To hard delete a file, it must first be soft deleted."
 msgid "To hard delete a file, it must first be soft deleted."
@@ -513,15 +529,15 @@ msgstr ""
 "Om een bestand definitief te verwijderen, moet het eerst zacht verwijderd "
 "zijn."
 
-#: core/recording/event/notification.py:123
+#: core/recording/event/notification.py:124
 msgid "Your recording is ready"
 msgstr "Je opname is klaar"
 
-#: core/recording/event/notification.py:194
+#: core/recording/event/notification.py:195
 msgid "Transcription"
 msgstr "Transcriptie"
 
-#: core/recording/event/notification.py:204
+#: core/recording/event/notification.py:206
 #, python-brace-format
 msgid "Meeting \"{room}\" on {room_recording_date} at {room_recording_time}"
 msgstr ""
@@ -532,25 +548,25 @@ msgstr ""
 msgid "Video call in progress: {sender.email} is waiting for you to connect"
 msgstr "Video-oproep bezig: {sender.email} wacht op je verbinding"
 
-#: core/templates/mail/html/invitation.html:159
-#: core/templates/mail/html/screen_recording.html:159
-#: core/templates/mail/text/invitation.txt:3
-#: core/templates/mail/text/screen_recording.txt:3
+#: core/templates/mail/html/invitation.html:151
+#: core/templates/mail/html/screen_recording.html:151
+#: core/templates/mail/text/invitation.txt:4
+#: core/templates/mail/text/screen_recording.txt:4
 msgid "Logo email"
 msgstr "Logo e-mail"
 
-#: core/templates/mail/html/invitation.html:189
-#: core/templates/mail/text/invitation.txt:5
+#: core/templates/mail/html/invitation.html:181
+#: core/templates/mail/text/invitation.txt:6
 msgid "invites you to join an ongoing video call"
 msgstr "nodigt je uit om deel te nemen aan een lopende video-oproep"
 
-#: core/templates/mail/html/invitation.html:200
-#: core/templates/mail/text/invitation.txt:7
+#: core/templates/mail/html/invitation.html:192
+#: core/templates/mail/text/invitation.txt:8
 msgid "JOIN THE CALL"
 msgstr "NEEM DEEL AAN DE OPROEP"
 
-#: core/templates/mail/html/invitation.html:227
-#: core/templates/mail/text/invitation.txt:13
+#: core/templates/mail/html/invitation.html:219
+#: core/templates/mail/text/invitation.txt:14
 msgid ""
 "If you can't click the button, copy and paste the URL into your browser to "
 "join the call."
@@ -558,41 +574,47 @@ msgstr ""
 "Als je niet op de knop kunt klikken, kopieer en plak dan de URL in je "
 "browser om deel te nemen aan de oproep."
 
-#: core/templates/mail/html/invitation.html:235
-#: core/templates/mail/text/invitation.txt:15
+#: core/templates/mail/html/invitation.html:227
+#: core/templates/mail/text/invitation.txt:16
 msgid "Tips for a better experience:"
 msgstr "Tips voor een betere ervaring:"
 
-#: core/templates/mail/html/invitation.html:237
-#: core/templates/mail/text/invitation.txt:17
+#: core/templates/mail/html/invitation.html:229
+#: core/templates/mail/text/invitation.txt:18
 msgid "Use Chrome or Firefox for better call quality"
 msgstr "Gebruik Chrome of Firefox voor betere gesprekskwaliteit"
 
-#: core/templates/mail/html/invitation.html:238
-#: core/templates/mail/text/invitation.txt:18
+#: core/templates/mail/html/invitation.html:230
+#: core/templates/mail/text/invitation.txt:19
 msgid "Test your microphone and camera before joining"
 msgstr "Test je microfoon en camera voordat je deelneemt"
 
-#: core/templates/mail/html/invitation.html:239
-#: core/templates/mail/text/invitation.txt:19
+#: core/templates/mail/html/invitation.html:231
+#: core/templates/mail/text/invitation.txt:20
 msgid "Make sure you have a stable internet connection"
 msgstr "Zorg ervoor dat je een stabiele internetverbinding hebt"
 
-#: core/templates/mail/html/invitation.html:248
-#: core/templates/mail/html/screen_recording.html:245
-#: core/templates/mail/text/invitation.txt:21
-#: core/templates/mail/text/screen_recording.txt:23
+#: core/templates/mail/html/invitation.html:240
+#: core/templates/mail/html/screen_recording.html:237
+#: core/templates/mail/text/invitation.txt:22
+#: core/templates/mail/text/screen_recording.txt:24
 #, python-format
 msgid " Thank you for using %(brandname)s. "
 msgstr " Bedankt voor het gebruik van %(brandname)s. "
 
-#: core/templates/mail/html/screen_recording.html:188
-#: core/templates/mail/text/screen_recording.txt:6
+#: core/templates/mail/html/invitation.html:271
+#, python-format
+msgid ""
+"This mail has been sent to %(email)s by <a href=\"%(href)s\">%(name)s</a>"
+msgstr ""
+
+#: core/templates/mail/html/screen_recording.html:180
+#: core/templates/mail/text/screen_recording.txt:7
 msgid "Your recording is ready!"
 msgstr "Je opname is klaar!"
 
-#: core/templates/mail/html/screen_recording.html:195
-#: core/templates/mail/text/screen_recording.txt:8
+#: core/templates/mail/html/screen_recording.html:187
+#: core/templates/mail/text/screen_recording.txt:9
 #, python-format
 msgid ""
 " Your recording of \"%(room_name)s\" on %(recording_date)s at "
@@ -601,14 +623,14 @@ msgstr ""
 " Je opname van \"%(room_name)s\" op %(recording_date)s om %(recording_time)s "
 "is nu klaar om te downloaden. "
 
-#: core/templates/mail/html/screen_recording.html:195
-#: core/templates/mail/text/screen_recording.txt:8
+#: core/templates/mail/html/screen_recording.html:187
+#: core/templates/mail/text/screen_recording.txt:9
 #, python-format
 msgid " The recording will expire in %(days)s days. "
 msgstr " De opname verloopt over %(days)s dagen. "
 
-#: core/templates/mail/html/screen_recording.html:200
-#: core/templates/mail/text/screen_recording.txt:9
+#: core/templates/mail/html/screen_recording.html:192
+#: core/templates/mail/text/screen_recording.txt:10
 msgid ""
 " Sharing the recording via link is not yet available. Only organizers can "
 "download it. "
@@ -616,33 +638,33 @@ msgstr ""
 "Het delen van de opname via een link is nog niet beschikbaar. Alleen "
 "organisatoren kunnen deze downloaden."
 
-#: core/templates/mail/html/screen_recording.html:206
-#: core/templates/mail/text/screen_recording.txt:11
+#: core/templates/mail/html/screen_recording.html:198
+#: core/templates/mail/text/screen_recording.txt:12
 msgid "To keep this recording permanently:"
 msgstr "Om deze opname permanent te bewaren:"
 
-#: core/templates/mail/html/screen_recording.html:208
+#: core/templates/mail/html/screen_recording.html:200
 #, python-format
 msgid "Click the \"<a href=\"%(link)s\">Open</a>\" link below "
 msgstr "Klik op de \"<a href=\"%(link)s\">Openen</a>\"-link hieronder "
 
-#: core/templates/mail/html/screen_recording.html:209
-#: core/templates/mail/text/screen_recording.txt:14
+#: core/templates/mail/html/screen_recording.html:201
+#: core/templates/mail/text/screen_recording.txt:15
 msgid "Use the \"Download\" button in the interface "
 msgstr "Gebruik de \"Download\"-knop in de interface "
 
-#: core/templates/mail/html/screen_recording.html:210
-#: core/templates/mail/text/screen_recording.txt:15
+#: core/templates/mail/html/screen_recording.html:202
+#: core/templates/mail/text/screen_recording.txt:16
 msgid "Save the file to your preferred location"
 msgstr "Sla het bestand op naar je gewenste locatie"
 
-#: core/templates/mail/html/screen_recording.html:221
-#: core/templates/mail/text/screen_recording.txt:17
+#: core/templates/mail/html/screen_recording.html:213
+#: core/templates/mail/text/screen_recording.txt:18
 msgid "Open"
 msgstr "Openen"
 
-#: core/templates/mail/html/screen_recording.html:230
-#: core/templates/mail/text/screen_recording.txt:19
+#: core/templates/mail/html/screen_recording.html:222
+#: core/templates/mail/text/screen_recording.txt:20
 #, python-format
 msgid ""
 " If you have any questions or need assistance, please contact our support "
@@ -651,28 +673,33 @@ msgstr ""
 " Als je vragen hebt of hulp nodig hebt, neem dan contact op met ons support "
 "team via %(support_email)s. "
 
-#: core/templates/mail/text/screen_recording.txt:13
+#: core/templates/mail/text/invitation.txt:24
+#, python-format
+msgid "This mail has been sent to %(email)s by %(name)s [%(href)s]"
+msgstr ""
+
+#: core/templates/mail/text/screen_recording.txt:14
 #, fuzzy, python-format
 #| msgid "Click the \"<a href=\"%(link)s\">Open</a>\" link below "
 msgid "Click the \"Open [%(link)s]\" link below "
 msgstr "Klik op de \"<a href=\"%(link)s\">Openen</a>\"-link hieronder "
 
-#: meet/settings.py:228
+#: meet/settings.py:238
 msgid "English"
 msgstr "Engels"
 
-#: meet/settings.py:229
+#: meet/settings.py:239
 msgid "French"
 msgstr "Frans"
 
-#: meet/settings.py:230
+#: meet/settings.py:240
 msgid "Dutch"
 msgstr "Nederlands"
 
-#: meet/settings.py:231
+#: meet/settings.py:241
 msgid "German"
 msgstr "Duits"
 
-#: meet/settings.py:233
+#: meet/settings.py:242
 msgid "Spanish"
 msgstr "Spaans"

src/backend/meet/settings.py

@@ -129,6 +129,15 @@ class Base(Configuration):
     MEDIA_BASE_URL = values.Value(
         "", environ_name="MEDIA_BASE_URL", environ_prefix=None
     )
+    # Header the reverse proxy uses to pass the original request URL to the
+    # media-auth subrequest views. nginx-ingress sends X-Original-URL, which is
+    # the default. Other proxies use different headers -- Traefik's ForwardAuth,
+    # for instance, sends X-Forwarded-Uri and cannot emit X-Original-URL at all.
+    MEDIA_AUTH_ORIGINAL_URL_HEADER = values.Value(
+        default="HTTP_X_ORIGINAL_URL",
+        environ_name="MEDIA_AUTH_ORIGINAL_URL_HEADER",
+        environ_prefix=None,
+    )
 
     SITE_ID = 1
 

src/frontend/Dockerfile

@@ -53,6 +53,7 @@ RUN apk update && apk upgrade  \
     musl \
     musl-utils \
     zlib>=1.3.2-r0 \
+    libexpat>=2.8.4-r0 \
     && apk del curl
 
 USER nginx

src/frontend/src/features/devtools/MeetDevtools.tsx

@@ -0,0 +1,595 @@
+import { CSSProperties, useState } from 'react'
+import { useConnectionState, useRoomContext } from '@livekit/components-react'
+import { ConnectionState } from 'livekit-client'
+import { StatsSnapshot, TrackRow, useWebRTCStats } from './useWebRTCStats'
+import { readRoomConfig } from './roomConfig'
+import {
+  forceTransport,
+  releaseForcedTransport,
+  Scenario,
+  SCENARIOS,
+  setDownlinkCap,
+  setUplinkCap,
+  stepBitrate,
+  TransportMode,
+  transportModeFromRoute,
+} from './simulation'
+
+const SANS =
+  "-apple-system, BlinkMacSystemFont, 'Segoe UI', Roboto, Helvetica, Arial, sans-serif"
+const MONO = 'ui-monospace, SFMono-Regular, Menlo, Consolas, monospace'
+
+const COLOR = {
+  text: '#e8e8e8',
+  muted: '#9a9a9a',
+  faint: '#6f6f6f',
+  hairline: '#2c2d31',
+  border: '#3d3e44',
+  surface: '#1b1c1e',
+  chartBg: '#141517',
+  down: '#f6821f',
+  up: '#5a9cf8',
+  ok: '#10b981',
+  bad: '#f05a4a',
+  busy: '#e5a13c',
+}
+
+const stateColor = (state: ConnectionState): string => {
+  switch (state) {
+    case ConnectionState.Connected:
+      return COLOR.ok
+    case ConnectionState.Reconnecting:
+    case ConnectionState.SignalReconnecting:
+      return COLOR.busy
+    case ConnectionState.Connecting:
+      return COLOR.up
+    case ConnectionState.Disconnected:
+      return COLOR.bad
+  }
+}
+
+const styles: Record<string, CSSProperties> = {
+  toggle: {
+    position: 'fixed',
+    bottom: 12,
+    right: 12,
+    zIndex: 9999,
+    fontFamily: SANS,
+    fontSize: 12,
+    lineHeight: 1,
+    padding: '8px 12px',
+    borderRadius: 999,
+    borderWidth: 1,
+    borderStyle: 'solid',
+    borderColor: COLOR.border,
+    background: COLOR.surface,
+    color: COLOR.text,
+    cursor: 'pointer',
+    boxShadow: '0 2px 10px #0006',
+  },
+  panel: {
+    position: 'fixed',
+    bottom: 12,
+    right: 12,
+    zIndex: 9999,
+    width: 460,
+    maxWidth: 'calc(100vw - 24px)',
+    maxHeight: 'calc(100vh - 24px)',
+    overflowY: 'auto',
+    fontFamily: SANS,
+    fontSize: 11,
+    lineHeight: 1.5,
+    color: COLOR.text,
+    background: COLOR.surface,
+    borderWidth: 1,
+    borderStyle: 'solid',
+    borderColor: COLOR.border,
+    borderRadius: 10,
+    padding: 14,
+    boxShadow: '0 10px 34px #00000080',
+  },
+  sectionTitle: {
+    margin: '14px 0 5px',
+    color: COLOR.faint,
+    textTransform: 'uppercase',
+    letterSpacing: 1.2,
+    fontSize: 9,
+    fontWeight: 600,
+    display: 'flex',
+    justifyContent: 'space-between',
+  },
+  metricsLine: {
+    display: 'flex',
+    alignItems: 'center',
+    gap: 16,
+    margin: '0 0 10px',
+    paddingBottom: 10,
+    borderBottom: `1px solid ${COLOR.hairline}`,
+    fontVariantNumeric: 'tabular-nums',
+  },
+  legend: {
+    display: 'flex',
+    gap: 12,
+    marginTop: 3,
+    color: COLOR.faint,
+    fontSize: 10,
+  },
+  list: {
+    display: 'flex',
+    flexDirection: 'column',
+    maxHeight: '400px',
+    overflowY: 'auto',
+  },
+  configList: { display: 'flex', flexWrap: 'wrap' },
+  configRow: {
+    display: 'flex',
+    gap: 6,
+    flex: '0 0 50%',
+    minWidth: 0,
+    boxSizing: 'border-box',
+    padding: '1px 8px 1px 0',
+  },
+  configLabel: {
+    color: COLOR.muted,
+    flex: '0 0 45%',
+    whiteSpace: 'nowrap',
+    overflow: 'hidden',
+    textOverflow: 'ellipsis',
+  },
+  configValue: {
+    flex: 1,
+    minWidth: 0,
+    whiteSpace: 'nowrap',
+    overflow: 'hidden',
+    textOverflow: 'ellipsis',
+  },
+  trackRow: {
+    display: 'flex',
+    gap: 8,
+    padding: '3px 0',
+    borderBottom: `1px solid ${COLOR.hairline}`,
+    alignItems: 'baseline',
+  },
+  trackLabel: {
+    flex: '0 0 34%',
+    whiteSpace: 'nowrap',
+    overflow: 'hidden',
+    textOverflow: 'ellipsis',
+  },
+  trackCodec: {
+    flex: '0 0 11%',
+    fontFamily: MONO,
+    fontSize: 10,
+    color: COLOR.muted,
+  },
+  trackKbps: {
+    flex: '0 0 9%',
+    textAlign: 'right',
+    fontVariantNumeric: 'tabular-nums',
+  },
+  trackDetail: {
+    flex: 1,
+    minWidth: 0,
+    whiteSpace: 'nowrap',
+    overflow: 'hidden',
+    textOverflow: 'ellipsis',
+  },
+  mono: { fontFamily: MONO, fontSize: 10, color: COLOR.muted },
+  button: {
+    fontFamily: SANS,
+    fontSize: 11,
+    padding: '3px 9px',
+    borderRadius: 5,
+    borderWidth: 1,
+    borderStyle: 'solid',
+    borderColor: COLOR.border,
+    background: '#232428',
+    color: COLOR.text,
+    cursor: 'pointer',
+  },
+  buttonActive: { borderColor: COLOR.down, color: COLOR.down },
+  buttonDisabled: { color: COLOR.faint, cursor: 'not-allowed' },
+  row: { display: 'flex', alignItems: 'center', gap: 6, flexWrap: 'wrap' },
+  stepperValue: {
+    minWidth: 92,
+    textAlign: 'center',
+    borderWidth: 1,
+    borderStyle: 'solid',
+    borderColor: COLOR.hairline,
+    borderRadius: 4,
+    padding: '2px 6px',
+    background: COLOR.chartBg,
+    fontVariantNumeric: 'tabular-nums',
+  },
+  close: {
+    background: 'none',
+    border: 'none',
+    color: COLOR.faint,
+    cursor: 'pointer',
+    fontSize: 14,
+  },
+}
+
+const Sparkline = ({ history }: { history: StatsSnapshot[] }) => {
+  const width = 430
+  const height = 54
+  const max = Math.max(...history.map((s) => Math.max(s.upKbps, s.downKbps)), 1)
+  const points = (pick: (s: StatsSnapshot) => number) =>
+    history
+      .map(
+        (s, i) =>
+          `${((i / Math.max(history.length - 1, 1)) * width).toFixed(1)},${(
+            height -
+            (pick(s) / max) * (height - 6) -
+            3
+          ).toFixed(1)}`
+      )
+      .join(' ')
+  return (
+    <>
+      <svg
+        width={width}
+        height={height}
+        role="img"
+        aria-label="Bandwidth over the last minute"
+        style={{
+          display: 'block',
+          background: COLOR.chartBg,
+          borderRadius: 6,
+          border: `1px solid ${COLOR.hairline}`,
+        }}
+      >
+        {history.length >= 2 && (
+          <>
+            <polyline
+              points={points((s) => s.downKbps)}
+              fill="none"
+              stroke={COLOR.down}
+              strokeWidth="1.5"
+            />
+            <polyline
+              points={points((s) => s.upKbps)}
+              fill="none"
+              stroke={COLOR.up}
+              strokeWidth="1.5"
+            />
+          </>
+        )}
+      </svg>
+      {/* Legend outside the plot: text over the lines was unreadable. */}
+      <div style={styles.legend}>
+        <span>
+          <span style={{ color: COLOR.down }}>●</span> down
+        </span>
+        <span>
+          <span style={{ color: COLOR.up }}>●</span> up
+        </span>
+        <span>last 60s · max {Math.round(max)} kbps</span>
+      </div>
+    </>
+  )
+}
+
+const CapStepper = ({
+  label,
+  hint,
+  valueKbps,
+  onChange,
+}: {
+  label: string
+  hint: string
+  valueKbps: number | null
+  onChange: (kbps: number | null) => void
+}) => (
+  <div style={styles.row}>
+    <span style={{ flex: '0 0 70px' }}>{label}</span>
+    <button
+      type="button"
+      style={styles.button}
+      aria-label={`Decrease ${label} bandwidth`}
+      onClick={() => onChange(stepBitrate(valueKbps, 'decrease'))}
+    >
+      −
+    </button>
+    <span
+      style={{
+        ...styles.stepperValue,
+        ...(valueKbps !== null ? { color: COLOR.down } : {}),
+      }}
+    >
+      {valueKbps === null ? 'unlimited' : `≤ ${valueKbps} kbps`}
+    </span>
+    <button
+      type="button"
+      style={styles.button}
+      aria-label={`Increase ${label} bandwidth`}
+      onClick={() => onChange(stepBitrate(valueKbps, 'increase'))}
+    >
+      +
+    </button>
+    <span style={styles.mono}>{hint}</span>
+  </div>
+)
+
+const TrackList = ({ title, rows }: { title: string; rows: TrackRow[] }) => (
+  <>
+    <div style={styles.sectionTitle}>
+      <span>
+        {title} ({rows.length})
+      </span>
+      <span>
+        {Math.round(rows.reduce((sum, t) => sum + t.kbps, 0))} kbps media
+      </span>
+    </div>
+    <div style={styles.list}>
+      {rows.map((track) => (
+        <div key={track.key} style={styles.trackRow}>
+          <span style={styles.trackLabel}>{track.label}</span>
+          <span style={styles.trackCodec}>{track.codec ?? '–'}</span>
+          <span style={styles.trackKbps}>{Math.round(track.kbps)}</span>
+          <span style={styles.trackDetail}>
+            {[
+              track.res,
+              track.fps !== undefined && `${Math.round(track.fps)}fps`,
+            ]
+              .filter(Boolean)
+              .join(' · ')}
+          </span>
+        </div>
+      ))}
+      {rows.length === 0 && <span style={{ color: COLOR.faint }}>none</span>}
+    </div>
+  </>
+)
+
+const MeetDevtools = () => {
+  const room = useRoomContext()
+  const connState = useConnectionState(room)
+  const [open, setOpen] = useState(false)
+  const [firedScenario, setFiredScenario] = useState<string>()
+  const [uplinkCap, setUplinkCapState] = useState<number | null>(null)
+  const [downlinkCap, setDownlinkCapState] = useState<number | null>(null)
+  const { snapshot, history } = useWebRTCStats(room, open)
+
+  const transportMode: TransportMode = transportModeFromRoute(snapshot?.route)
+
+  const fireScenario = (scenario: Scenario) => {
+    setFiredScenario(scenario.id)
+    scenario.run(room).catch((e) => {
+      console.warn('[MeetDevtools] simulateScenario failed', e)
+    })
+    window.setTimeout(
+      () =>
+        setFiredScenario((current) =>
+          current === scenario.id ? undefined : current
+        ),
+      1200
+    )
+  }
+
+  if (!open) {
+    return (
+      <button
+        type="button"
+        style={styles.toggle}
+        onClick={() => setOpen(true)}
+        aria-label="Open WebRTC devtools"
+      >
+        <span style={{ color: stateColor(connState) }}>●</span> rtc
+      </button>
+    )
+  }
+
+  const config = readRoomConfig(room)
+  const published = snapshot?.tracks.filter((t) => t.dir === 'up') ?? []
+  const subscribed = snapshot?.tracks.filter((t) => t.dir === 'down') ?? []
+  const turnProtocols = snapshot?.turnProtocols ?? []
+  const transports: Array<{
+    mode: TransportMode
+    label: string
+    requires?: string
+    title: string
+  }> = [
+    {
+      mode: 'auto',
+      label: 'auto (udp)',
+      title:
+        'clears the server-cached transport preference and relay-only policy, then full reconnect',
+    },
+    {
+      mode: 'tcp',
+      label: 'tcp',
+      title: 'force-tcp — server prefers TCP candidates (ICE/TCP)',
+    },
+    {
+      mode: 'turn-udp',
+      label: 'turn:udp',
+      requires: 'udp',
+      title:
+        'client-side: iceTransportPolicy relay + full reconnect (no server hook exists)',
+    },
+    {
+      mode: 'turn-tcp',
+      label: 'turn:tcp',
+      requires: 'tcp',
+      title: 'force-tcp — lands on TURN/TCP when it is the TCP path',
+    },
+    {
+      mode: 'turn-tls',
+      label: 'turn:tls',
+      requires: 'tls',
+      title: 'force-tls — server switches you to TURN over TLS',
+    },
+  ]
+
+  return (
+    <section style={styles.panel} aria-label="WebRTC devtools">
+      <div style={styles.metricsLine}>
+        <span>
+          <span style={{ color: COLOR.down }}>↓</span> {snapshot?.downKbps ?? 0}{' '}
+          kbps
+        </span>
+        <span>
+          <span style={{ color: COLOR.up }}>↑</span> {snapshot?.upKbps ?? 0}{' '}
+          kbps
+        </span>
+        <span style={{ color: COLOR.muted }}>
+          rtt{' '}
+          <span style={{ color: COLOR.text }}>{snapshot?.rttMs ?? '–'}</span> ms
+        </span>
+        <span style={{ color: COLOR.muted }}>
+          jitter{' '}
+          <span style={{ color: COLOR.text }}>{snapshot?.jitterMs ?? '–'}</span>{' '}
+          ms
+        </span>
+        <span
+          style={{
+            color: stateColor(connState),
+            fontSize: 10,
+            marginLeft: 'auto',
+          }}
+        >
+          ● {connState}
+        </span>
+        <button
+          type="button"
+          style={styles.close}
+          onClick={() => setOpen(false)}
+          aria-label="Close WebRTC devtools"
+        >
+          ✕
+        </button>
+      </div>
+
+      <Sparkline history={history} />
+
+      <div style={styles.sectionTitle}>room configuration (live)</div>
+      <div style={styles.configList}>
+        {config.map((entry) => (
+          <div key={entry.label} style={styles.configRow}>
+            <span
+              style={{
+                color:
+                  entry.on === undefined
+                    ? COLOR.faint
+                    : entry.on
+                      ? COLOR.ok
+                      : COLOR.bad,
+              }}
+            >
+              ●
+            </span>
+            <span style={styles.configLabel}>{entry.label}</span>
+            <span style={styles.configValue} title={entry.value}>
+              {entry.value}
+            </span>
+          </div>
+        ))}
+      </div>
+
+      <TrackList title="published ↑" rows={published} />
+      <TrackList title="subscribed ↓" rows={subscribed} />
+
+      <div style={styles.sectionTitle}>bandwidth</div>
+      <div style={{ ...styles.list, gap: 4 }}>
+        <CapStepper
+          label="uplink"
+          hint="encoder cap (setParameters)"
+          valueKbps={uplinkCap}
+          onChange={(kbps) => {
+            setUplinkCapState(kbps)
+            void setUplinkCap(room, kbps)
+          }}
+        />
+        <CapStepper
+          label="downlink"
+          hint="SFU limit (subscriber-bandwidth)"
+          valueKbps={downlinkCap}
+          onChange={(kbps) => {
+            setDownlinkCapState(kbps)
+            void setDownlinkCap(room, kbps).catch((e) =>
+              console.warn('[MeetDevtools] downlink cap failed', e)
+            )
+          }}
+        />
+      </div>
+
+      <div style={styles.sectionTitle}>transport</div>
+      <div style={styles.row}>
+        {transports.map(({ mode, label, requires, title }) => {
+          const available = !requires || turnProtocols.includes(requires)
+          const active = transportMode === mode
+          const clickable = available && !active
+          return (
+            <button
+              key={mode}
+              type="button"
+              aria-pressed={active}
+              disabled={!clickable}
+              title={available ? title : `${title} — not configured`}
+              style={{
+                ...styles.button,
+                ...(clickable || active ? {} : styles.buttonDisabled),
+                ...(active ? styles.buttonActive : {}),
+              }}
+              onClick={() => {
+                if (!clickable) return
+                void (
+                  mode === 'auto'
+                    ? releaseForcedTransport(room)
+                    : forceTransport(
+                        room,
+                        mode as 'tcp' | 'turn-udp' | 'turn-tcp' | 'turn-tls'
+                      )
+                ).catch((e) =>
+                  console.warn('[MeetDevtools] transport change failed', e)
+                )
+              }}
+            >
+              {requires && (
+                <span style={{ color: available ? COLOR.ok : COLOR.faint }}>
+                  ●{' '}
+                </span>
+              )}
+              {label}
+            </button>
+          )
+        })}
+        <span style={styles.mono}>
+          route:{' '}
+          {snapshot?.route
+            ? [
+                snapshot.route.protocol,
+                snapshot.route.type,
+                snapshot.route.relayProtocol &&
+                  `relay:${snapshot.route.relayProtocol}`,
+              ]
+                .filter(Boolean)
+                .join('·')
+            : '–'}
+        </span>
+      </div>
+
+      <div style={styles.sectionTitle}>connection scenarios</div>
+      <div style={styles.row}>
+        {SCENARIOS.map((scenario) => (
+          <button
+            key={scenario.id}
+            type="button"
+            title={`${scenario.side}-side simulation — momentary, watch the state dot`}
+            style={{
+              ...styles.button,
+              ...(firedScenario === scenario.id ? styles.buttonActive : {}),
+            }}
+            onClick={() => fireScenario(scenario)}
+          >
+            {scenario.side === 'server' ? '☁ ' : ''}
+            {scenario.label}
+          </button>
+        ))}
+      </div>
+    </section>
+  )
+}
+
+export default MeetDevtools

src/frontend/src/features/devtools/index.tsx

@@ -0,0 +1,14 @@
+import { lazy, Suspense } from 'react'
+
+const LazyPanel = import.meta.env.DEV
+  ? lazy(() => import('./MeetDevtools'))
+  : null
+
+export const MeetDevtools = () => {
+  if (!LazyPanel) return null
+  return (
+    <Suspense fallback={null}>
+      <LazyPanel />
+    </Suspense>
+  )
+}

src/frontend/src/features/devtools/roomConfig.ts

@@ -0,0 +1,88 @@
+import { Room } from 'livekit-client'
+
+export type ConfigEntry = {
+  label: string
+  value: string
+  /** true = feature actively on, false = off, undefined = informational */
+  on?: boolean
+}
+
+const formatBackupCodec = (backup: unknown): string => {
+  if (backup === undefined || backup === true) return 'auto'
+  if (backup === false) return 'off'
+  if (typeof backup === 'object' && backup !== null && 'codec' in backup) {
+    return String((backup as { codec: unknown }).codec)
+  }
+  return String(backup)
+}
+
+export const readRoomConfig = (room: Room): ConfigEntry[] => {
+  const options = room.options
+  const publish = options.publishDefaults
+  const adaptive = options.adaptiveStream
+
+  const entries: ConfigEntry[] = [
+    {
+      label: 'adaptiveStream',
+      value:
+        typeof adaptive === 'object'
+          ? JSON.stringify(adaptive)
+          : String(!!adaptive),
+      on: !!adaptive,
+    },
+    {
+      label: 'dynacast',
+      value: String(!!options.dynacast),
+      on: !!options.dynacast,
+    },
+    {
+      label: 'e2ee',
+      value: String(room.isE2EEEnabled),
+      on: room.isE2EEEnabled,
+    },
+    {
+      label: 'videoCodec',
+      value: publish?.videoCodec ?? 'default',
+    },
+    {
+      label: 'backupCodec',
+      value: formatBackupCodec(publish?.backupCodec),
+    },
+    {
+      label: 'simulcast',
+      value: String(publish?.simulcast ?? true),
+      on: publish?.simulcast ?? true,
+    },
+    {
+      label: 'audio dtx',
+      value: String(publish?.dtx ?? true),
+      on: publish?.dtx ?? true,
+    },
+    {
+      label: 'audio red',
+      value: String(publish?.red ?? true),
+      on: publish?.red ?? true,
+    },
+    {
+      label: 'quality (local)',
+      value: room.localParticipant.connectionQuality,
+    },
+  ]
+
+  const server = room.serverInfo
+  if (server) {
+    entries.push({
+      label: 'server',
+      value: [
+        server.version && `v${server.version}`,
+        server.region,
+        server.protocol !== undefined && `proto ${server.protocol}`,
+        server.edition !== undefined && `edition ${server.edition}`,
+      ]
+        .filter(Boolean)
+        .join(' · '),
+    })
+  }
+
+  return entries
+}

src/frontend/src/features/devtools/simulation.ts

@@ -0,0 +1,192 @@
+import { Room, Track } from 'livekit-client'
+// Transitive dependency of livekit-client (pinned by it); used only to
+// build the one signal request room.simulateScenario cannot express.
+import { SimulateScenario } from '@livekit/protocol'
+
+/** Shared bandwidth ladder for the −/+ steppers; null = unlimited. */
+export const BITRATE_LADDER_KBPS: Array<number | null> = [
+  null,
+  2000,
+  1000,
+  600,
+  300,
+  150,
+]
+
+export const stepBitrate = (
+  current: number | null,
+  direction: 'decrease' | 'increase'
+): number | null => {
+  const index = BITRATE_LADDER_KBPS.indexOf(current)
+  const safeIndex = index === -1 ? 0 : index
+  const next =
+    direction === 'decrease'
+      ? Math.min(safeIndex + 1, BITRATE_LADDER_KBPS.length - 1)
+      : Math.max(safeIndex - 1, 0)
+  return BITRATE_LADDER_KBPS[next]
+}
+
+const savedEncodings = new WeakMap<RTCRtpSender, Array<number | undefined>>()
+
+export const setUplinkCap = async (
+  room: Room,
+  kbps: number | null
+): Promise<void> => {
+  const senders: RTCRtpSender[] = []
+  room.localParticipant.trackPublications.forEach((pub) => {
+    const track = pub.track
+    if (track?.kind === Track.Kind.Video && track.sender) {
+      senders.push(track.sender)
+    }
+  })
+
+  for (const sender of senders) {
+    const params = sender.getParameters()
+    if (!params.encodings || params.encodings.length === 0) continue
+
+    if (kbps === null) {
+      const original = savedEncodings.get(sender)
+      params.encodings.forEach((encoding, i) => {
+        encoding.maxBitrate = original?.[i]
+      })
+      savedEncodings.delete(sender)
+    } else {
+      if (!savedEncodings.has(sender)) {
+        savedEncodings.set(
+          sender,
+          params.encodings.map((encoding) => encoding.maxBitrate)
+        )
+      }
+      const activeCount =
+        params.encodings.filter((encoding) => encoding.active !== false)
+          .length || 1
+      // Split the budget across active simulcast layers / SVC encoding.
+      const perEncoding = Math.max(
+        30_000,
+        Math.floor((kbps * 1000) / activeCount)
+      )
+      params.encodings.forEach((encoding) => {
+        encoding.maxBitrate = perEncoding
+      })
+    }
+
+    try {
+      await sender.setParameters(params)
+    } catch (e) {
+      console.warn('[MeetDevtools] setParameters failed', e)
+    }
+  }
+}
+
+export const setDownlinkCap = (
+  room: Room,
+  kbps: number | null
+): Promise<void> =>
+  room.simulateScenario('subscriber-bandwidth', kbps === null ? 0 : kbps * 1000)
+
+export type Scenario = {
+  id: string
+  label: string
+  /** where the simulation happens */
+  side: 'client' | 'server'
+  run: (room: Room) => Promise<void>
+}
+
+export const SCENARIOS: Scenario[] = [
+  {
+    id: 'resume',
+    label: 'reconnect (resume)',
+    side: 'client',
+    // Replays a signaling WebSocket loss; media keeps flowing, client resumes.
+    run: (room) => room.simulateScenario('signal-reconnect'),
+  },
+  {
+    id: 'resume-fail',
+    label: 'reconnect (resume fails)',
+    side: 'client',
+    // Same, but the next resume attempt fails → exercises the retry ladder.
+    run: (room) => room.simulateScenario('resume-reconnect'),
+  },
+  {
+    id: 'full-reconnect',
+    label: 'full reconnect',
+    side: 'client',
+    // Complete rejoin with brand-new peer connections.
+    run: (room) => room.simulateScenario('full-reconnect'),
+  },
+  {
+    id: 'migration',
+    label: 'server migration',
+    side: 'server',
+    run: (room) => room.simulateScenario('migration'),
+  },
+  {
+    id: 'node-failure',
+    label: 'SFU node failure',
+    side: 'server',
+    run: (room) => room.simulateScenario('node-failure'),
+  },
+  {
+    id: 'server-leave',
+    label: 'server disconnect',
+    side: 'server',
+    // Server-initiated leave: the closest thing to "you got kicked".
+    run: (room) => room.simulateScenario('server-leave'),
+  },
+]
+
+export type TransportMode =
+  | 'auto'
+  | 'tcp'
+  | 'turn-udp'
+  | 'turn-tcp'
+  | 'turn-tls'
+
+const clearServerTransportPreference = (room: Room): Promise<void> =>
+  room.engine.client.sendSimulateScenario(
+    new SimulateScenario({
+      scenario: { case: 'switchCandidateProtocol', value: 0 },
+    })
+  )
+
+const setRelayOnly = (room: Room, relay: boolean) => {
+  room.engine.rtcConfig = {
+    ...room.engine.rtcConfig,
+    iceTransportPolicy: relay ? 'relay' : 'all',
+  }
+}
+
+const settle = () => new Promise((resolve) => setTimeout(resolve, 300))
+
+export const forceTransport = async (
+  room: Room,
+  mode: 'tcp' | 'turn-udp' | 'turn-tcp' | 'turn-tls'
+): Promise<void> => {
+  if (mode === 'turn-udp') {
+    await clearServerTransportPreference(room)
+    setRelayOnly(room, true)
+    await settle()
+    return room.simulateScenario('full-reconnect')
+  }
+  setRelayOnly(room, false)
+  return room.simulateScenario(mode === 'turn-tls' ? 'force-tls' : 'force-tcp')
+}
+
+export const releaseForcedTransport = async (room: Room): Promise<void> => {
+  setRelayOnly(room, false)
+  await clearServerTransportPreference(room)
+  await settle()
+  await room.simulateScenario('full-reconnect')
+}
+
+export const transportModeFromRoute = (route?: {
+  protocol?: string
+  relayProtocol?: string
+}): TransportMode => {
+  // relayProtocol is the client→TURN leg; protocol alone means no relay.
+  if (route?.relayProtocol === 'tls') return 'turn-tls'
+  if (route?.relayProtocol === 'tcp') return 'turn-tcp'
+  if (route?.relayProtocol === 'udp') return 'turn-udp'
+  if (route?.protocol === 'tcp') return 'tcp'
+  return 'auto'
+}

src/frontend/src/features/devtools/useWebRTCStats.ts

@@ -0,0 +1,243 @@
+import { useEffect, useRef, useState } from 'react'
+import { Room } from 'livekit-client'
+
+export type TrackRow = {
+  key: string
+  dir: 'up' | 'down'
+  label: string
+  codec?: string
+  kbps: number
+  fps?: number
+  res?: string
+}
+
+export type StatsSnapshot = {
+  ts: number
+  /** wire totals from transport stats (includes headers, RTCP, FEC) */
+  upKbps: number
+  downKbps: number
+  rttMs?: number
+  /** worst inbound RTP jitter across subscribed tracks */
+  jitterMs?: number
+  availableOutKbps?: number
+  /** selected ICE route of the publisher transport (measured, not assumed) */
+  route?: { protocol?: string; type?: string; relayProtocol?: string }
+  /**
+   * relayProtocol values of gathered relay local candidates — i.e. which
+   * client→TURN transports are actually configured (udp/tcp/tls). Empty
+   * when no TURN server is configured.
+   */
+  turnProtocols: string[]
+  tracks: TrackRow[]
+}
+
+type StatDict = Record<string, unknown>
+type Counters = Record<string, number>
+
+const asNumber = (v: unknown): number | undefined =>
+  typeof v === 'number' && Number.isFinite(v) ? v : undefined
+
+const asString = (v: unknown): string | undefined =>
+  typeof v === 'string' ? v : undefined
+
+const shortCodec = (mimeType?: string) =>
+  mimeType ? mimeType.replace(/^(audio|video)\//, '') : undefined
+
+const buildTrackLabels = (room: Room) => {
+  const labels = new Map<string, string>()
+  room.localParticipant.trackPublications.forEach((pub) => {
+    const id = pub.track?.mediaStreamTrack?.id
+    if (id) labels.set(id, `local ${pub.source}`)
+  })
+  room.remoteParticipants.forEach((participant) => {
+    // Keep rows scannable: participant names capped at 10 chars.
+    const rawName = participant.name || participant.identity
+    const name = rawName.length > 10 ? `${rawName.slice(0, 10)}.` : rawName
+    participant.trackPublications.forEach((pub) => {
+      const id = pub.track?.mediaStreamTrack?.id
+      if (id) labels.set(id, `${name} ${pub.source}`)
+    })
+  })
+  return labels
+}
+
+export const useWebRTCStats = (
+  room: Room,
+  enabled: boolean,
+  intervalMs = 1000
+) => {
+  // Single source of truth: the snapshot is just the last history entry.
+  const [history, setHistory] = useState<StatsSnapshot[]>([])
+  const prevRef = useRef(new Map<string, Counters>())
+
+  useEffect(() => {
+    if (!enabled) return
+
+    let cancelled = false
+    const prev = prevRef.current
+
+    /** Per-stat counter deltas; returns 0 on the first sighting. */
+    const deltas = (key: string, now: Counters): Counters => {
+      const before = prev.get(key)
+      prev.set(key, now)
+      const out: Counters = {}
+      for (const [name, value] of Object.entries(now)) {
+        out[name] = before?.[name] !== undefined ? value - before[name] : 0
+      }
+      return out
+    }
+
+    const collect = async () => {
+      const reports: Array<{ pc: 'pub' | 'sub'; report: RTCStatsReport }> = []
+      try {
+        // Not public API — see file header.
+        const manager = room.engine?.pcManager
+        const pub = await manager?.publisher?.getStats()
+        if (pub) reports.push({ pc: 'pub', report: pub })
+        const sub = await manager?.subscriber?.getStats()
+        if (sub) reports.push({ pc: 'sub', report: sub })
+      } catch {
+        // Engine not ready or SDK internals changed; panel shows nothing.
+      }
+      if (cancelled || reports.length === 0) return
+
+      const labels = buildTrackLabels(room)
+      const tracks: TrackRow[] = []
+      let upKbps = 0
+      let downKbps = 0
+      let rttMs: number | undefined
+      let jitterMs: number | undefined
+      let availableOutKbps: number | undefined
+      let route: StatsSnapshot['route']
+      const turnProtocols = new Set<string>()
+
+      for (const { pc, report } of reports) {
+        const byId = new Map<string, StatDict>()
+        report.forEach((stat) => byId.set(stat.id as string, stat as StatDict))
+
+        report.forEach((raw) => {
+          const stat = raw as StatDict
+          const type = asString(stat.type)
+          const ts = asNumber(stat.timestamp) ?? Date.now()
+          const key = `${pc}:${asString(stat.id) ?? ''}`
+
+          if (
+            type === 'local-candidate' &&
+            asString(stat.candidateType) === 'relay'
+          ) {
+            // Relay candidates are only gathered when a TURN server is
+            // configured and reachable; relayProtocol says how the client
+            // reaches it (udp/tcp/tls).
+            turnProtocols.add(
+              asString(stat.relayProtocol) ?? asString(stat.protocol) ?? 'udp'
+            )
+          }
+
+          if (type === 'transport') {
+            const d = deltas(key, {
+              sent: asNumber(stat.bytesSent) ?? 0,
+              received: asNumber(stat.bytesReceived) ?? 0,
+              ts,
+            })
+            if (d.ts > 0) {
+              upKbps += Math.max(0, (d.sent * 8) / d.ts)
+              downKbps += Math.max(0, (d.received * 8) / d.ts)
+            }
+          }
+
+          if (type === 'candidate-pair' && stat.nominated === true) {
+            const rtt = asNumber(stat.currentRoundTripTime)
+            if (rtt !== undefined) rttMs = Math.round(rtt * 1000)
+            const available = asNumber(stat.availableOutgoingBitrate)
+            if (available !== undefined && pc === 'pub') {
+              availableOutKbps = Math.round(available / 1000)
+            }
+            if (pc === 'pub') {
+              const local = byId.get(asString(stat.localCandidateId) ?? '')
+              route = {
+                protocol: asString(local?.protocol),
+                type: asString(local?.candidateType),
+                relayProtocol: asString(local?.relayProtocol),
+              }
+            }
+          }
+
+          if (type === 'outbound-rtp' || type === 'inbound-rtp') {
+            const isUp = type === 'outbound-rtp'
+
+            if (!isUp) {
+              const jitter = asNumber(stat.jitter)
+              if (jitter !== undefined) {
+                const ms = Math.round(jitter * 1000)
+                if (jitterMs === undefined || ms > jitterMs) jitterMs = ms
+              }
+            }
+
+            const d = deltas(key, {
+              bytes: asNumber(isUp ? stat.bytesSent : stat.bytesReceived) ?? 0,
+              ts,
+            })
+            const kbps = d.ts > 0 ? Math.max(0, (d.bytes * 8) / d.ts) : 0
+
+            // Resolve codec + source track.
+            const codecStat = byId.get(asString(stat.codecId) ?? '')
+            let msTrackId = asString(stat.trackIdentifier)
+            if (!msTrackId && isUp) {
+              const mediaSource = byId.get(asString(stat.mediaSourceId) ?? '')
+              msTrackId = asString(mediaSource?.trackIdentifier)
+            }
+            const rid = asString(stat.rid)
+            const baseLabel =
+              (msTrackId && labels.get(msTrackId)) ??
+              `${asString(stat.kind) ?? 'media'} ssrc ${asNumber(stat.ssrc) ?? '?'}`
+
+            const width = asNumber(stat.frameWidth)
+            const height = asNumber(stat.frameHeight)
+
+            tracks.push({
+              key,
+              dir: isUp ? 'up' : 'down',
+              label: rid ? `${baseLabel} [${rid}]` : baseLabel,
+              codec: shortCodec(asString(codecStat?.mimeType)),
+              kbps,
+              fps: asNumber(stat.framesPerSecond),
+              res: width && height ? `${width}x${height}` : undefined,
+            })
+          }
+        })
+      }
+
+      // Stable order (direction, then label): sorting by bitrate would
+      // reshuffle rows on every tick as kbps fluctuates.
+      tracks.sort((a, b) =>
+        a.dir === b.dir
+          ? a.label.localeCompare(b.label)
+          : a.dir === 'up'
+            ? -1
+            : 1
+      )
+
+      const next: StatsSnapshot = {
+        ts: Date.now(),
+        upKbps: Math.round(upKbps),
+        downKbps: Math.round(downKbps),
+        rttMs,
+        jitterMs,
+        availableOutKbps,
+        route,
+        turnProtocols: Array.from(turnProtocols).sort(),
+        tracks,
+      }
+      setHistory((h) => [...h.slice(-59), next])
+    }
+
+    void collect()
+    const id = window.setInterval(() => void collect(), intervalMs)
+    return () => {
+      cancelled = true
+      window.clearInterval(id)
+    }
+  }, [room, enabled, intervalMs])
+
+  return { snapshot: history[history.length - 1], history }
+}

src/frontend/src/features/rooms/components/Conference.tsx

@@ -43,6 +43,7 @@ import { useSnapshot } from 'valtio'
 import { userPreferencesStore } from '@/stores/userPreferences'
 import { userStore } from '@/stores/user'
 import { WatchMediaDeviceErrors } from './WatchMediaDeviceErrors'
+import { MeetDevtools } from '@/features/devtools'
 import { VOICE_AUDIO_CONSTRAINTS } from '@/features/rooms/livekit/utils/constants'
 
 export const Conference = ({
@@ -298,6 +299,7 @@ export const Conference = ({
           <VideoConference />
           {!isMobile && <InviteDialog mode={mode} />}
           <PictureInPictureConference />
+          <MeetDevtools />
         </LiveKitRoom>
       </Screen>
     </QueryAware>

src/frontend/src/features/rooms/livekit/components/controls/Device/VideoDeviceControl.tsx

@@ -2,7 +2,7 @@ import { useTranslation } from 'react-i18next'
 import { useTrackToggle, UseTrackToggleProps } from '@livekit/components-react'
 import { Button, Popover } from '@/primitives'
 import { RiArrowUpSLine, RiImageCircleAiFill } from '@remixicon/react'
-import { Track, type VideoCaptureOptions } from 'livekit-client'
+import { Track, type VideoCaptureOptions, VideoPresets } from 'livekit-client'
 
 import { ToggleDevice } from './ToggleDevice'
 import { css } from '@/styled-system/css'
@@ -57,7 +57,8 @@ export const VideoDeviceControl = ({
 }: VideoDeviceControlProps) => {
   const { t } = useTranslation('rooms', { keyPrefix: 'selectDevice' })
 
-  const { videoDeviceId, processorConfig } = useSnapshot(userChoicesStore)
+  const { videoDeviceId, processorConfig, videoPublishResolution } =
+    useSnapshot(userChoicesStore)
 
   const onChange = React.useCallback(
     (enabled: boolean, isUserInitiated: boolean) =>
@@ -97,6 +98,9 @@ export const VideoDeviceControl = ({
 
     await toggle(!trackProps.enabled, {
       processor: processor,
+      ...(videoPublishResolution && {
+        resolution: VideoPresets[videoPublishResolution].resolution,
+      }),
     } as VideoCaptureOptions)
   }
 

src/frontend/src/features/settings/components/tabs/VideoTab.tsx

@@ -18,6 +18,7 @@ import {
   saveVideoPublishResolution,
   saveVideoSubscribeQuality,
   userChoicesStore,
+  VIDEO_RESOLUTIONS,
   VideoResolution,
 } from '@/stores/userChoices'
 import { RowWrapper } from './layout/RowWrapper'
@@ -32,7 +33,8 @@ const EMPTY_PROPS = {}
 
 export const VideoTab = ({ id }: VideoTabProps) => {
   const { t } = useTranslation('settings', { keyPrefix: 'video' })
-  const { localParticipant, remoteParticipants } = useRoomContext()
+  const room = useRoomContext()
+  const { localParticipant, remoteParticipants } = room
 
   const {
     videoDeviceId,
@@ -69,20 +71,21 @@ export const VideoTab = ({ id }: VideoTabProps) => {
         isDisabled: true,
       }
 
-  const handleVideoResolutionChange = async (key: 'h720' | 'h360' | 'h180') => {
-    const videoPublication = localParticipant.getTrackPublication(
+  const handleVideoResolutionChange = async (key: VideoResolution) => {
+    saveVideoPublishResolution(key)
+    const videoTrack = localParticipant.getTrackPublication(
       Track.Source.Camera
-    )
-    const videoTrack = videoPublication?.track
-    if (videoTrack) {
-      saveVideoPublishResolution(key)
-      await videoTrack.restartTrack({
-        resolution: VideoPresets[key].resolution,
-        deviceId: { exact: videoDeviceId },
-        processor:
-          BackgroundProcessorFactory.fromProcessorConfig(processorConfig),
-      })
+    )?.track
+    if (!videoTrack) {
+      return
     }
+
+    await videoTrack.restartTrack({
+      resolution: VideoPresets[key].resolution,
+      deviceId: { exact: videoDeviceId },
+      processor:
+        BackgroundProcessorFactory.fromProcessorConfig(processorConfig),
+    })
   }
 
   /**
@@ -122,20 +125,13 @@ export const VideoTab = ({ id }: VideoTabProps) => {
   }, [videoDeviceId, videoElement])
 
   const resolutionItems = useMemo(() => {
-    return [
-      {
-        value: 'h720',
-        label: `${t('resolution.publish.items.high')} (720p)`,
-      },
-      {
-        value: 'h360',
-        label: `${t('resolution.publish.items.medium')} (360p)`,
-      },
-      {
-        value: 'h180',
-        label: `${t('resolution.publish.items.low')} (180p)`,
-      },
-    ]
+    const labels: Record<VideoResolution, string> = {
+      h1080: `${t('resolution.publish.items.veryHigh')} (1080p)`,
+      h720: `${t('resolution.publish.items.high')} (720p)`,
+      h360: `${t('resolution.publish.items.medium')} (360p)`,
+      h180: `${t('resolution.publish.items.low')} (180p)`,
+    }
+    return VIDEO_RESOLUTIONS.map((value) => ({ value, label: labels[value] }))
   }, [t])
 
   const videoQualityItems = useMemo(() => {

src/frontend/src/locales/de/settings.json

@@ -56,6 +56,7 @@
       "publish": {
         "label": "Wähle die maximale Auflösung beim Senden",
         "items": {
+          "veryHigh": "Sehr hohe Auflösung",
           "high": "Hohe Auflösung",
           "medium": "Mittlere Auflösung",
           "low": "Niedrige Auflösung"

src/frontend/src/locales/en/settings.json

@@ -56,6 +56,7 @@
       "publish": {
         "label": "Select your sending resolution (max.)",
         "items": {
+          "veryHigh": "Very high definition",
           "high": "High definition",
           "medium": "Standard definition",
           "low": "Low definition"

src/frontend/src/locales/es/settings.json

@@ -56,6 +56,7 @@
       "publish": {
         "label": "Selecciona tu resolución de envío (máx.)",
         "items": {
+          "veryHigh": "Muy alta definición",
           "high": "Alta definición",
           "medium": "Definición estándar",
           "low": "Baja definición"

src/frontend/src/locales/fr/settings.json

@@ -56,6 +56,7 @@
       "publish": {
         "label": "Sélectionner votre résolution d'envoi (max.)",
         "items": {
+          "veryHigh": "Très haute définition",
           "high": "Haute définition",
           "medium": "Définition standard",
           "low": "Basse définition"

src/frontend/src/locales/nl/settings.json

@@ -56,6 +56,7 @@
       "publish": {
         "label": "Selecteer uw verzendresolutie (max.)",
         "items": {
+          "veryHigh": "Zeer hoge definitie",
           "high": "Hoge definitie",
           "medium": "Standaarddefinitie",
           "low": "Lage definitie"

src/frontend/src/stores/userChoices.ts

@@ -10,7 +10,12 @@ import {
 } from '@livekit/components-core'
 import { VideoQuality } from 'livekit-client'
 
-export type VideoResolution = 'h720' | 'h360' | 'h180'
+export const VIDEO_RESOLUTIONS = ['h1080', 'h720', 'h360', 'h180'] as const
+
+export type VideoResolution = (typeof VIDEO_RESOLUTIONS)[number]
+
+const isVideoResolution = (value: unknown): value is VideoResolution =>
+  VIDEO_RESOLUTIONS.includes(value as VideoResolution)
 
 export type LocalUserChoices = Omit<LocalUserChoicesLK, 'username'> & {
   processorConfig?: ProcessorConfig
@@ -21,13 +26,17 @@ export type LocalUserChoices = Omit<LocalUserChoicesLK, 'username'> & {
 }
 
 function getUserChoicesState(): LocalUserChoices {
-  return {
+  const stored: LocalUserChoices = {
     noiseReductionEnabled: false,
     audioOutputDeviceId: 'default', // Use 'default' to match LiveKit's standard device selection behavior
     videoPublishResolution: 'h720',
     videoSubscribeQuality: VideoQuality.HIGH,
     ...loadUserChoices(),
   }
+  if (!isVideoResolution(stored.videoPublishResolution)) {
+    stored.videoPublishResolution = 'h720'
+  }
+  return stored
 }
 
 export const userChoicesStore = proxy<LocalUserChoices>(getUserChoicesState())