wip

2026-09-30 22:48:35 +00:00 · 2026-07-10 17:37:24 +02:00
491 changed files with 8858 additions and 27791 deletions
@@ -13,10 +13,10 @@ jobs:
    runs-on: ubuntu-latest
    steps:
      - name: Checkout
-        uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6.1.0
+        uses: actions/checkout@v6

      - name: Download Crowdin files
-        uses: crowdin/github-action@c7af9bc98b01694653031fef2a0dc6c7888ce9bc # v2.17.0
+        uses: crowdin/github-action@v2
        with:
          upload_sources: false
          upload_translations: false
@@ -30,36 +30,36 @@ jobs:
    steps:
      -
        name: Checkout repository
-        uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6.1.0
+        uses: actions/checkout@v6
      -
        name: Set up QEMU
        if: env.IS_MULTI_PLATFORM_BUILD == 'true'
-        uses: docker/setup-qemu-action@c7c53464625b32c7a7e944ae62b3e17d2b600130 # v3.7.0
+        uses: docker/setup-qemu-action@v3
      -
        name: Set up Docker Buildx
-        uses: docker/setup-buildx-action@8d2750c68a42422c14e847fe6c8ac0403b4cbd6f # v3.12.0
+        uses: docker/setup-buildx-action@v3
      -
        name: Docker meta
        id: meta
-        uses: docker/metadata-action@c299e40c65443455700f0fdfc63efafe5b349051 # v5.10.0
+        uses: docker/metadata-action@v5
        with:
          images: '${{ env.DOCKER_CONTAINER_REGISTRY_NAMESPACE }}/meet-backend'
      -
        name: Login to DockerHub
        if: github.event_name != 'pull_request' || startsWith(github.head_ref, 'integration/')
-        uses: docker/login-action@c94ce9fb468520275223c153574b00df6fe4bcc9 # v3.7.0
+        uses: docker/login-action@v3
        with:
          username: ${{ secrets.DOCKER_HUB_USER }}
          password: ${{ secrets.DOCKER_HUB_PASSWORD }}
      -
        name: Run trivy scan
-        uses: numerique-gouv/action-trivy-cache@d6e94cfb488f03a0b3e8b8739aad94e74d24d8da # main
+        uses: numerique-gouv/action-trivy-cache@main
        with:
          docker-build-args: '--target backend-production -f Dockerfile'
          docker-image-name: '${{ env.DOCKER_CONTAINER_REGISTRY_HOSTNAME }}/${{ env.DOCKER_CONTAINER_REGISTRY_NAMESPACE }}/meet-backend:${{ github.sha }}'
      -
        name: Build and push
-        uses: docker/build-push-action@10e90e3645eae34f1e60eeb005ba3a3d33f178e8 # v6.19.2
+        uses: docker/build-push-action@v6
        with:
          context: .
          target: backend-production
@@ -76,36 +76,36 @@ jobs:
    steps:
      -
        name: Checkout repository
-        uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6.1.0
+        uses: actions/checkout@v6
      -
        name: Set up QEMU
        if: env.IS_MULTI_PLATFORM_BUILD == 'true'
-        uses: docker/setup-qemu-action@c7c53464625b32c7a7e944ae62b3e17d2b600130 # v3.7.0
+        uses: docker/setup-qemu-action@v3
      -
        name: Set up Docker Buildx
-        uses: docker/setup-buildx-action@8d2750c68a42422c14e847fe6c8ac0403b4cbd6f # v3.12.0
+        uses: docker/setup-buildx-action@v3
      -
        name: Docker meta
        id: meta
-        uses: docker/metadata-action@c299e40c65443455700f0fdfc63efafe5b349051 # v5.10.0
+        uses: docker/metadata-action@v5
        with:
          images: '${{ env.DOCKER_CONTAINER_REGISTRY_NAMESPACE }}/meet-frontend'
      -
        name: Login to DockerHub
        if: github.event_name != 'pull_request' || startsWith(github.head_ref, 'integration/')
-        uses: docker/login-action@c94ce9fb468520275223c153574b00df6fe4bcc9 # v3.7.0
+        uses: docker/login-action@v3
        with:
          username: ${{ secrets.DOCKER_HUB_USER }}
          password: ${{ secrets.DOCKER_HUB_PASSWORD }}
      -
        name: Run trivy scan
-        uses: numerique-gouv/action-trivy-cache@d6e94cfb488f03a0b3e8b8739aad94e74d24d8da # main
+        uses: numerique-gouv/action-trivy-cache@main
        with:
          docker-build-args: '-f src/frontend/Dockerfile --target frontend-production'
          docker-image-name: '${{ env.DOCKER_CONTAINER_REGISTRY_HOSTNAME }}/${{ env.DOCKER_CONTAINER_REGISTRY_NAMESPACE }}/meet-frontend:${{ github.sha }}'
      -
        name: Build and push
-        uses: docker/build-push-action@10e90e3645eae34f1e60eeb005ba3a3d33f178e8 # v6.19.2
+        uses: docker/build-push-action@v6
        with:
          context: .
          file: ./src/frontend/Dockerfile
@@ -123,36 +123,36 @@ jobs:
    steps:
      -
        name: Checkout repository
-        uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6.1.0
+        uses: actions/checkout@v6
      -
        name: Set up QEMU
        if: env.IS_MULTI_PLATFORM_BUILD == 'true'
-        uses: docker/setup-qemu-action@c7c53464625b32c7a7e944ae62b3e17d2b600130 # v3.7.0
+        uses: docker/setup-qemu-action@v3
      -
        name: Set up Docker Buildx
-        uses: docker/setup-buildx-action@8d2750c68a42422c14e847fe6c8ac0403b4cbd6f # v3.12.0
+        uses: docker/setup-buildx-action@v3
      -
        name: Docker meta
        id: meta
-        uses: docker/metadata-action@c299e40c65443455700f0fdfc63efafe5b349051 # v5.10.0
+        uses: docker/metadata-action@v5
        with:
          images: '${{ env.DOCKER_CONTAINER_REGISTRY_NAMESPACE }}/meet-frontend-dinum'
      -
        name: Login to DockerHub
        if: github.event_name != 'pull_request' || startsWith(github.head_ref, 'integration/')
-        uses: docker/login-action@c94ce9fb468520275223c153574b00df6fe4bcc9 # v3.7.0
+        uses: docker/login-action@v3
        with:
          username: ${{ secrets.DOCKER_HUB_USER }}
          password: ${{ secrets.DOCKER_HUB_PASSWORD }}
      -
        name: Run trivy scan
-        uses: numerique-gouv/action-trivy-cache@d6e94cfb488f03a0b3e8b8739aad94e74d24d8da # main
+        uses: numerique-gouv/action-trivy-cache@main
        with:
          docker-build-args: '-f docker/dinum-frontend/Dockerfile --target frontend-production'
          docker-image-name: '${{ env.DOCKER_CONTAINER_REGISTRY_HOSTNAME }}/${{ env.DOCKER_CONTAINER_REGISTRY_NAMESPACE }}/meet-frontend-dinum:${{ github.sha }}'
      -
        name: Build and push
-        uses: docker/build-push-action@10e90e3645eae34f1e60eeb005ba3a3d33f178e8 # v6.19.2
+        uses: docker/build-push-action@v6
        with:
          context: .
          file: ./docker/dinum-frontend/Dockerfile
@@ -170,30 +170,30 @@ jobs:
    steps:
      -
        name: Checkout repository
-        uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6.1.0
+        uses: actions/checkout@v6
      -
        name: Set up QEMU
        if: env.IS_MULTI_PLATFORM_BUILD == 'true'
-        uses: docker/setup-qemu-action@c7c53464625b32c7a7e944ae62b3e17d2b600130 # v3.7.0
+        uses: docker/setup-qemu-action@v3
      -
        name: Set up Docker Buildx
-        uses: docker/setup-buildx-action@8d2750c68a42422c14e847fe6c8ac0403b4cbd6f # v3.12.0
+        uses: docker/setup-buildx-action@v3
      -
        name: Docker meta
        id: meta
-        uses: docker/metadata-action@c299e40c65443455700f0fdfc63efafe5b349051 # v5.10.0
+        uses: docker/metadata-action@v5
        with:
          images: '${{ env.DOCKER_CONTAINER_REGISTRY_NAMESPACE }}/meet-summary'
      -
        name: Login to DockerHub
        if: github.event_name != 'pull_request' || startsWith(github.head_ref, 'integration/')
-        uses: docker/login-action@c94ce9fb468520275223c153574b00df6fe4bcc9 # v3.7.0
+        uses: docker/login-action@v3
        with:
          username: ${{ secrets.DOCKER_HUB_USER }}
          password: ${{ secrets.DOCKER_HUB_PASSWORD }}
      -
        name: Run trivy scan
-        uses: numerique-gouv/action-trivy-cache@d6e94cfb488f03a0b3e8b8739aad94e74d24d8da # main
+        uses: numerique-gouv/action-trivy-cache@main
        continue-on-error: true
        with:
          docker-build-args: '-f src/summary/Dockerfile --target production'
@@ -201,7 +201,7 @@ jobs:
          docker-context: './src/summary'
      -
        name: Build and push
-        uses: docker/build-push-action@10e90e3645eae34f1e60eeb005ba3a3d33f178e8 # v6.19.2
+        uses: docker/build-push-action@v6
        with:
          context: ./src/summary
          file: ./src/summary/Dockerfile
@@ -219,30 +219,30 @@ jobs:
    steps:
      -
        name: Checkout repository
-        uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6.1.0
+        uses: actions/checkout@v6
      -
        name: Set up QEMU
        if: env.IS_MULTI_PLATFORM_BUILD == 'true'
-        uses: docker/setup-qemu-action@c7c53464625b32c7a7e944ae62b3e17d2b600130 # v3.7.0
+        uses: docker/setup-qemu-action@v3
      -
        name: Set up Docker Buildx
-        uses: docker/setup-buildx-action@8d2750c68a42422c14e847fe6c8ac0403b4cbd6f # v3.12.0
+        uses: docker/setup-buildx-action@v3
      -
        name: Docker meta
        id: meta
-        uses: docker/metadata-action@c299e40c65443455700f0fdfc63efafe5b349051 # v5.10.0
+        uses: docker/metadata-action@v5
        with:
          images: lasuite/meet-agents
      -
        name: Login to DockerHub
        if: github.event_name != 'pull_request' || startsWith(github.head_ref, 'integration/')
-        uses: docker/login-action@c94ce9fb468520275223c153574b00df6fe4bcc9 # v3.7.0
+        uses: docker/login-action@v3
        with:
          username: ${{ secrets.DOCKER_HUB_USER }}
          password: ${{ secrets.DOCKER_HUB_PASSWORD }}
      -
        name: Run trivy scan
-        uses: numerique-gouv/action-trivy-cache@d6e94cfb488f03a0b3e8b8739aad94e74d24d8da # main
+        uses: numerique-gouv/action-trivy-cache@main
        continue-on-error: true
        with:
          docker-build-args: '-f src/agents/Dockerfile --target production'
@@ -250,7 +250,7 @@ jobs:
          docker-context: './src/agents'
      -
        name: Build and push
-        uses: docker/build-push-action@10e90e3645eae34f1e60eeb005ba3a3d33f178e8 # v6.19.2
+        uses: docker/build-push-action@v6
        with:
          context: ./src/agents
          file: ./src/agents/Dockerfile
@@ -273,7 +273,7 @@ jobs:
    runs-on: ubuntu-latest
    if: github.event_name != 'pull_request'
    steps:
-      - uses: numerique-gouv/action-argocd-webhook-notification@cac2ee67896eb13e84e804f60c4271370424eaa8 # main
+      - uses: numerique-gouv/action-argocd-webhook-notification@main
        id: notify
        with:
          deployment_repo_path: "${{ secrets.DEPLOYMENT_REPO_URL }}"
@@ -1,4 +1,4 @@
-name: CI
+name: meet Workflow

 on:
  push:
@@ -18,7 +18,7 @@ jobs:
      contents: read
    steps:
      - name: Checkout repository
-        uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6.1.0
+        uses: actions/checkout@v6
        with:
          fetch-depth: 0
      - name: show
@@ -26,17 +26,17 @@ jobs:
      - name: Enforce absence of print statements in code
        if: always()
        run: |
-          ! git diff origin/${{ github.event.pull_request.base.ref }}..HEAD -- . ':(exclude).github/workflows/**' | grep "print("
+          ! git diff origin/${{ github.event.pull_request.base.ref }}..HEAD -- . ':(exclude)**/meet.yml' | grep "print("
      - name: Check absence of fixup commits
        if: always()
        run: |
          ! git log | grep 'fixup!'
-      - name: Install uv
+      - name: Install gitlint
        if: always()
-        uses: astral-sh/setup-uv@37802adc94f370d6bfd71619e3f0bf239e1f3b78 # v7.6.0
+        run: pip install --user requests gitlint
      - name: Lint commit messages added to main
        if: always()
-        run: uvx --no-build --from gitlint-core==0.19.1 gitlint --commits origin/${{ github.event.pull_request.base.ref }}..HEAD
+        run: ~/.local/bin/gitlint --commits origin/${{ github.event.pull_request.base.ref }}..HEAD

  check-changelog:
    runs-on: ubuntu-latest
@@ -47,7 +47,7 @@ jobs:
        contents: read
    steps:
      - name: Checkout repository
-        uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6.1.0
+        uses: actions/checkout@v6
        with:
          fetch-depth: 50
      - name: Check that the CHANGELOG has been modified in the current branch
@@ -59,7 +59,7 @@ jobs:
      contents: read
    steps:
      - name: Checkout repository
-        uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6.1.0
+        uses: actions/checkout@v6
      - name: Check CHANGELOG max line length
        run: |
          max_line_length=$(cat CHANGELOG.md | grep -Ev "^\[.*\]: https://github.com" | wc -L)
@@ -77,15 +77,15 @@ jobs:
        working-directory: src/mail
    steps:
      - name: Checkout repository
-        uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6.1.0
+        uses: actions/checkout@v6

      - name: Install Node.js
-        uses: actions/setup-node@249970729cb0ef3589644e2896645e5dc5ba9c38 # v6.5.0
+        uses: actions/setup-node@v6
        with:
          node-version: "22"

      - name: Restore the mail templates
-        uses: actions/cache@caa296126883cff596d87d8935842f9db880ef25 # v5.1.0
+        uses: actions/cache@v5
        id: mail-templates
        with:
          path: "src/backend/core/templates/mail"
@@ -93,11 +93,11 @@ jobs:

      - name: Install yarn
        if: steps.mail-templates.outputs.cache-hit != 'true'
-        run: npm install -g --ignore-scripts yarn@1.22.22
+        run: npm install -g yarn

      - name: Install node dependencies
        if: steps.mail-templates.outputs.cache-hit != 'true'
-        run: yarn install --frozen-lockfile --ignore-scripts
+        run: yarn install --frozen-lockfile

      - name: Build mails
        if: steps.mail-templates.outputs.cache-hit != 'true'
@@ -105,7 +105,7 @@ jobs:

      - name: Cache mail templates
        if: steps.mail-templates.outputs.cache-hit != 'true'
-        uses: actions/cache@caa296126883cff596d87d8935842f9db880ef25 # v5.1.0
+        uses: actions/cache@v5
        with:
          path: "src/backend/core/templates/mail"
          key: mail-templates-${{ hashFiles('src/mail/mjml') }}
@@ -119,22 +119,22 @@ jobs:
        working-directory: src/backend
    steps:
      - name: Checkout repository
-        uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6.1.0
+        uses: actions/checkout@v6
      - name: Install Python
-        uses: actions/setup-python@ece7cb06caefa5fff74198d8649806c4678c61a1 # v6.3.0
+        uses: actions/setup-python@v6
        with:
          python-version: "3.13"
      - name: Install uv
-        uses: astral-sh/setup-uv@37802adc94f370d6bfd71619e3f0bf239e1f3b78 # v7.6.0
+        uses: astral-sh/setup-uv@v7
      - name: Install the project
        run: uv sync --locked --all-extras

      - name: Check code formatting with ruff
-        run: uv run --no-sync --no-build ruff format . --diff
+        run: uv run ruff format . --diff
      - name: Lint code with ruff
-        run: uv run --no-sync --no-build ruff check .
+        run: uv run ruff check .
      - name: Lint code with pylint
-        run: uv run --no-sync --no-build pylint meet demo core
+        run: uv run pylint meet demo core

  lint-agents:
    runs-on: ubuntu-latest
@@ -145,19 +145,19 @@ jobs:
        working-directory: src/agents
    steps:
      - name: Checkout repository
-        uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6.1.0
+        uses: actions/checkout@v6
      - name: Install Python
-        uses: actions/setup-python@ece7cb06caefa5fff74198d8649806c4678c61a1 # v6.3.0
+        uses: actions/setup-python@v6
        with:
          python-version: "3.13"
      - name: Install uv
-        uses: astral-sh/setup-uv@37802adc94f370d6bfd71619e3f0bf239e1f3b78 # v7.6.0
+        uses: astral-sh/setup-uv@v7
      - name: Install the project
-        run: uv sync --locked --all-extras --no-build
+        run: uv sync --locked --all-extras
      - name: Check code formatting with ruff
-        run: uv run --no-sync --no-build ruff format . --diff
+        run: uv run ruff format . --diff
      - name: Lint code with ruff
-        run: uv run --no-sync --no-build ruff check .
+        run: uv run ruff check .

  lint-summary:
    runs-on: ubuntu-latest
@@ -168,19 +168,18 @@ jobs:
        working-directory: src/summary
    steps:
      - name: Checkout repository
-        uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6.1.0
+        uses: actions/checkout@v6
      - name: Install Python
-        uses: actions/setup-python@ece7cb06caefa5fff74198d8649806c4678c61a1 # v6.3.0
+        uses: actions/setup-python@v6
        with:
          python-version: "3.13"
-      - name: Install uv
-        uses: astral-sh/setup-uv@37802adc94f370d6bfd71619e3f0bf239e1f3b78 # v7.6.0
-      - name: Install the project
-        run: uv sync --locked --all-extras
+          cache: "pip"
+      - name: Install development dependencies
+        run: pip install --user .[dev]
      - name: Check code formatting with ruff
-        run: uv run --no-sync --no-build ruff format . --diff
+        run: ~/.local/bin/ruff format . --diff
      - name: Lint code with ruff
-        run: uv run --no-sync --no-build ruff check .
+        run: ~/.local/bin/ruff check .

  test-back:
    runs-on: ubuntu-latest
@@ -236,7 +235,7 @@ jobs:

    steps:
      - name: Checkout repository
-        uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6.1.0
+        uses: actions/checkout@v6

      - name: Create writable /data
        run: |
@@ -244,7 +243,7 @@ jobs:
          sudo mkdir -p /data/static

      - name: Restore the mail templates
-        uses: actions/cache@caa296126883cff596d87d8935842f9db880ef25 # v5.1.0
+        uses: actions/cache@v5
        id: mail-templates
        with:
          path: "src/backend/core/templates/mail"
@@ -252,20 +251,18 @@ jobs:

      - name: Start MinIO
        run: |
-          docker pull quay.io/minio/minio
+          docker pull minio/minio
          docker run -d --name minio \
            -p 9000:9000 \
            -e "MINIO_ACCESS_KEY=meet" \
            -e "MINIO_SECRET_KEY=password" \
            -v /data/media:/data \
-            quay.io/minio/minio server --console-address :9001 /data
+            minio/minio server --console-address :9001 /data

      # Tool to wait for a service to be ready
      - name: Install Dockerize
        run: |
-          curl --proto "=https" --proto-redir "=https" --tlsv1.2 -sSLf \
-            https://github.com/jwilder/dockerize/releases/download/v0.8.0/dockerize-linux-amd64-v0.8.0.tar.gz |
-            sudo tar -C /usr/local/bin -xzv
+          curl -sSL https://github.com/jwilder/dockerize/releases/download/v0.8.0/dockerize-linux-amd64-v0.8.0.tar.gz | sudo tar -C /usr/local/bin -xzv

      - name: Wait for MinIO to be ready
        run: |
@@ -280,11 +277,11 @@ jobs:
            mc mb meet/meet-media-storage"

      - name: Install Python
-        uses: actions/setup-python@ece7cb06caefa5fff74198d8649806c4678c61a1 # v6.3.0
+        uses: actions/setup-python@v6
        with:
          python-version: "3.13"
      - name: Install uv
-        uses: astral-sh/setup-uv@37802adc94f370d6bfd71619e3f0bf239e1f3b78 # v7.6.0
+        uses: astral-sh/setup-uv@v7
      - name: Install the dependencies
        run: uv sync --locked --all-extras

@@ -294,10 +291,10 @@ jobs:
          sudo apt-get install -y gettext

      - name: Generate a MO file from strings extracted from the project
-        run: uv run --no-sync --no-build python manage.py compilemessages
+        run: uv run python manage.py compilemessages

      - name: Run tests
-        run: uv run --no-sync --no-build pytest -n 2
+        run: uv run pytest -n 2

  test-summary:
    runs-on: ubuntu-latest
@@ -323,7 +320,7 @@ jobs:

    steps:
      - name: Checkout repository
-        uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6.1.0
+        uses: actions/checkout@v6

      - name: Install ffmpeg
        run: |
@@ -331,18 +328,16 @@ jobs:
          sudo apt-get install -y ffmpeg

      - name: Install Python
-        uses: actions/setup-python@ece7cb06caefa5fff74198d8649806c4678c61a1 # v6.3.0
+        uses: actions/setup-python@v6
        with:
          python-version: "3.13"
+          cache: "pip"

-      - name: Install uv
-        uses: astral-sh/setup-uv@37802adc94f370d6bfd71619e3f0bf239e1f3b78 # v7.6.0
-
-      - name: Install the project
-        run: uv sync --locked --all-extras
+      - name: Install development dependencies
+        run: pip install --user .[dev]

      - name: Run summary tests
-        run: uv run --no-sync --no-build pytest
+        run: ~/.local/bin/pytest

  lint-front:
    runs-on: ubuntu-latest
@@ -350,10 +345,10 @@ jobs:
      contents: read
    steps:
      - name: Checkout repository
-        uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6.1.0
+        uses: actions/checkout@v6

      - name: Install dependencies
-        run: cd src/frontend/ && npm ci --ignore-scripts
+        run: cd src/frontend/ && npm ci

      - name: Check linting
        run: cd src/frontend/ && npm run lint
@@ -370,10 +365,10 @@ jobs:
        working-directory: src/sdk/library
    steps:
      - name: Checkout repository
-        uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6.1.0
+        uses: actions/checkout@v6

      - name: Install dependencies
-        run: npm ci --ignore-scripts
+        run: npm ci

      - name: Check linting
        run: npm run lint
@@ -391,10 +386,10 @@ jobs:
        working-directory: src/sdk/library
    steps:
      - name: Checkout repository
-        uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6.1.0
+        uses: actions/checkout@v6

      - name: Install dependencies
-        run: npm ci --ignore-scripts
+        run: npm ci

      - name: Build SDK
        run: npm run build
@@ -13,7 +13,7 @@ jobs:
    runs-on: ubuntu-latest
    steps:
      - name: Checkout
-        uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6.1.0
+        uses: actions/checkout@v6
        with:
          fetch-depth: 0

@@ -21,12 +21,12 @@ jobs:
        run: rm -rf ./src/helm/extra

      - name: Install Helm
-        uses: azure/setup-helm@1a275c3b69536ee54be43f2070a358922e12c8d4 # v4.3.1
+        uses: azure/setup-helm@v4
        env:
          GITHUB_TOKEN: "${{ secrets.GITHUB_TOKEN }}"

      - name: Publish Helm charts
-        uses: numerique-gouv/helm-gh-pages@2cf477ae49d7c70037ceb1685803f4f7bad9b981 # add-overwrite-option
+        uses: numerique-gouv/helm-gh-pages@add-overwrite-option
        with:
          charts_dir: ./src/helm
          linting: on
@@ -0,0 +1,29 @@
+# /!\
+# Security Note: This action is not hardened against prompt injection attacks and should only be used
+# to review trusted PRs. Configure your repository with "Require approval for all external contributors"
+# to ensure workflows only run after a maintainer has reviewed the PR.
+name: Security Review
+
+permissions:
+  pull-requests: write  # Needed for leaving PR comments
+  contents: read
+
+on:
+  pull_request:
+    branches:
+      - 'main'
+
+jobs:
+  security:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v6
+        with:
+          ref: ${{ github.event.pull_request.head.sha || github.sha }}
+          fetch-depth: 2
+
+      - uses: anthropics/claude-code-security-review@0c6a49f1fa56a1d472575da86a94dbc1edb78eda
+        with:
+          comment-pr: true
+          exclude-directories: docs,gitlint,LICENSES,bin
+          claude-api-key: ${{ secrets.CLAUDE_API_KEY }}
@@ -86,6 +86,3 @@ docker/livekit/rootCA.pem

 # Frontend rollup-plugin-visualizer
 /src/frontend/rollup-plugin-visualizer/*
-
-# NixOS
-.devenv
@@ -8,294 +8,19 @@ and this project adheres to

 ## [Unreleased]

-## [1.32.1] - 2026-09-25
-
-### Fixed
-
- 🔒️(backend) fix CVE-2026-73228 and CVE-2026-73229 in drf
- 🔒️(agent) fix CRITICAL CVE-2026-63072 / CVE-2026-63073 in libssl3t64
-
-## [1.32.0] - 2026-09-25
-
-### Added
-
- ✨(backend) make the LiveKit default video codec configurable
- 🔧(dev) add support for Bureautix workstations
- ✨(frontend) add screen share zoom controls #1498
-
-### Changed
-
- 🔥(backend) remove unused API viewset and permission helpers
- 🔊(backend) pin the dockerflow logger level to WARNING
- 🚑️(summary) serve health endpoints with the dockerflow router
- ♻️(backend) serve the dockerflow views early in the middleware stack
- 📈(frontend) include LiveKit SIDs in the connection analytics event
- 🔇(backend) silence expected 401 warnings on /me
- 🔇(backend) silence noisy request summary info logs
- ⚡️(frontend) defer loading the Crisp script until idle
- ⬆️(frontend) upgrade react-i18next from 17.0.10 to 17.0.12
- ⬆️(frontend) upgrade posthog-js from 1.414.0 to 1.418.10
- ⬆️(addons) upgrade i18next from 26.3.6 to 26.4.0
- ⬆️(frontend) upgrade humanize-duration from 3.33.2 to 3.34.1
- ⬆️(addons) upgrade i18next from 26.4.0 to 26.4.2
- 🔖(helm) release chart 0.0.28
- ♻️(backend) decouple recording event handling from LiveKit egress statuses
-
-### Fixed
-
- 🐛(helm) probe liveness on __lbheartbeat__ and readiness on __heartbeat__
- 🐛(helm) render periodSeconds and failureThreshold on probes
- 🐛(backend) report the app release to Sentry instead of "NA"
- 🐛(frontend) play the waiting room notification sound on every arrival
- 🐛(frontend) apply saved reception resolution when joining a meeting #1714
- 🐛(backend) acknowledge unknown LiveKit webhook events instead of 422
- 🔒️(backend) enforce display name setting on rename API
- 🔒️(backend) reject inactive users in resource server backend
- 🐛(frontend) fix file permissions in the Docker image
- 🚸(frontend) inform user that recording waits until a track is published
- 🔒(backend) upgrade base image to python:3.13.5-alpine3.24
- 🐛(backend) handle failed and aborted egresses
- 🩹(frontend) notify participants when a recording fails or is aborted
- 🔒️(frontend) fix HIGH CVE-2026-93990 in libexpat
-
-## [1.31.0] - 2026-09-08
-
-### Added
-
- ✨(frontend) add 1080p sending resolution option #1660
- ✨(backend) add Traefik support via configurable media-auth url header #1649
- ✨(backend) update a room's attributes from the external API
- 🔊(backend) log request duration in Gunicorn workers
- 📈(frontend) track missing lobby participant on accept/reject
- ✨(backend) sort waiting participants by their arrival time
-
-### Changed
-
- ⬆️(dev) pin LiveKit server to v1.13.6
- 🔒(frontend) upgrade base image to 1.30.4-alpine3.24
-
-### Fixed
-
- 🐛(backend) allow any printable ASCII characters in user sub field #1673
- 🐛(frontend) keep the sending resolution picked while the camera is off #1667
- 🐛(frontend) restore automatic lower-hand on speaking
- 🐛(frontend) center Avatar initials with a font-aware cap-height ratio
- 🐛(frontend) keep feedback buttons on one line for fr/es/en
- ⚡️(frontend) increase lobby polling interval on both sides
- ⚡️(frontend) add trailing slash on the /me endpoint call
- ⚡️(backend) refactor lobby storage to bound key lookups per room
- ⚡️(backend) refactor presence cache to bound key lookups per room
- 💄(frontend) position the login hint dynamically next to the button
-
-## [1.30.0] - 2026-09-01
-
-### Added
-
- ✨(agent) support Voxtral realtime as inference engine
- 🌐(i18n) add Spanish language support
- ✨(frontend) expose publish permissions on the media state element #1661
-
-### Changed
-
- 🔥(backend) remove the S3 storage-event webhook for recordings
- ♻️(backend) always finalize recordings using the LiveKit egress_ended webhook
- ⬆️(frontend) upgrade posthog-js from 1.409.5 to 1.414.0
- ⬆️(frontend) upgrade @fontsource-variable/lexend from 5.2.11 to 5.3.0
- ⬆️(frontend) upgrade @fontsource/opendyslexic from 5.2.5 to 5.3.0
- ⬆️(addons) upgrade core-js from 3.49.0 to 3.50.0
- ♻️(backend) factorize s3 client creation in utils
- ♿️(frontend) close side panel with Escape key #1507
-
-### Fixed
-
- 🐛(frontend) fix chat text-area bug
-
-## [1.29.0] - 2026-08-25
-
-### Added
-
- ✨(any) let any authenticated user manage the lobby on trusted rooms
-
-### Changed
-
- 📱(frontend) collapse mobile control bar items on narrow viewports
- 📱(frontend) stack idle modal buttons in a column on mobile
- 📱(frontend) improve feedback screen responsiveness on mobile
- ⬆️(frontend) upgrade @fontsource-variable/atkinson-hyperlegible-next
- ⬆️(frontend) upgrade i18next-resources-to-backend from 1.2.1 to 1.2.3
- ⬆️(frontend) upgrade @tanstack/react-query from 5.101.1 to 5.101.4
- ⬆️(frontend) upgrade @pandacss/preset-panda from 1.11.3 to 1.12.0
- ⬆️(frontend) upgrade posthog-js from 1.404.1 to 1.409.5
- ⚡️(frontend) apply frugal constraint to the active meeting audio track
- ⚡️(backend) replace blocking Redis KEYS with cursor-based SCAN
- ✨(summary) add hostname to analytics properties
-
-## [1.28.0] - 2026-08-24
-
-### Added
-
- 📈(frontend) track errors when starting or stopping a recording
- 🚸(frontend) explain camera-in-use failures on the join screen
-
-### Changed
-
- ✨(backend) accept form-urlencoded on the user token endpoint
- ✨(summary) configurable s3 region
- ⬆️(frontend) upgrade i18next and react-i18next patch versions
- ⬆️(frontend) upgrade posthog-js from 1.395.0 to 1.404.1
- ⬆️(frontend) upgrade livekit-client and @livekit/components-react
- 💄(frontend) increase the blur intensity
-
-### Fixed
-
- 📝(docs) fix minor typos in comments and docstrings
- ⬆️(backend) bump sqlparse from 0.5.5 to 0.6.0
- ⬆️(mail) bump @html-to/text-cli from 0.6.0 to 0.6.1
- 🐛(frontend) treat client-initiated connect aborts as events
- 🐛(frontend) use state instead of a ref for MoreControls container
- 🐛(frontend) stop init_virtual_background from firing on blur updates
- 🐛(frontend) hoist mute confirmation dialog to VideoConference level
- 🐛(frontend) fix joined notification tile no longer rendering properly
- 🐛(frontend) handle device-in-use errors on Chrome / Windows 10
- 🐛(frontend) handle Firefox/Windows AbortError on device start
- 🐛(frontend) treat "Timeout starting source" AbortError as device-in-use
- 🔇(frontend) suppress leaked WebSocket error events from livekit-client
-
-## [1.27.0] - 2026-08-14
-
-### Changed
-
- 🔥(frontend) drop unused vendored ConnectionObserver
- 🐛(frontend) vendor formatChatMessageLinks and trim surrounding newlines
-
-### Fixed
-
- 📈(frontend) downgrade unreachable external home URL from error to event
- 🐛(frontend) handle 401 responses when syncing user preferences
- 🐛(frontend) harden speaker test against missing sinks and play errors
- 🐛(frontend) implement hysteresis band for the control bar layout
- 🐛(frontend) fix toolbar ResizeObserver loop and alignment drift
- 🐛(analytics) filter benign ResizeObserver loop error in Sentry/PostHog
- 🐛(frontend) stop reporting screen-share denials as errors
- 🐛(frontend) generalize screen-share error modal beyond macOS
- 📈(frontend) stop double-reporting media device failures
-
-## [1.26.0] - 2026-08-12
-
-### Added
-
- 📈(frontend) capture media diagnostics on media errors
- ✨(frontend) add an audio gauge to the microphone select menu
- ✨(frontend) add a sound tester to the output select menu
- ✨(frontend) prompt for permissions when toggling a denied device
- ⚗️(frontend) capture console.error in PostHog
- 📈(frontend) snapshot media devices on the happy path
- 🚸(frontend) guide users when the OS blocks browser media access
- ✨(frontend) add a silent-microphone watcher on join and room screens
-
-### Changed
-
- ♻️(frontend) encapsulate error tracking behind a telemetry module
- ♻️(frontend) encapsulate PostHog capture calls in the telemetry module
- 🔧(frontend) sync persisted device ids with the actual selected devices
- 💄(frontend) hide the ProConnect button on narrow viewports
- ♻️(frontend) prefer captureMediaEvent over reportError when no-op
-
-### Fixed
-
- 🐛(frontend) drop exact deviceId constraint on dynamic track creation
- 🐛(frontend) fix permission store regression
- 🐛(frontend) handle missing device errors gracefully
- 🐛(frontend) display the meeting id in the join screen page title
-
-## [1.25.2] - 2026-08-06
-
-### Fixed
-
- 🐛(frontend) serve MediaPipe assets under a versioned path
- 🐛(frontend) harmonize cache configuration for MediaPipe assets
-
-## [1.25.1] - 2026-08-06
-
-### Fixed
-
- 🚑️(frontend) fix background crash from MediaPipe WASM version mismatch
-
-## [1.25.0] - 2026-08-05
-
-### Added
-
- ✨(summary) report exception type in failure analytics
- ✨(frontend) add configurable documentation menu item
- ✨(frontend) allow promoting authenticated participants
- ✨(frontend) introduce an "unauthenticated" participant badge
- ✨(backend) add roomkit viewset to start a room without WebRTC join
- ✨(frontend) let users set default configuration for generated links
- ✨(frontend) expose media state to external gateways
- ✨(frontend) add connection test feature
- ✨(sdk) allow passing a background color to the calendar iframe
- ✨(sdk) add a room configuration popup from CreateMeetingButton
-
-### Changed
-
- ⬆️(frontend) upgrade @mediapipe/tasks-vision from 0.10.14 to 0.10.35
- ⬆️(frontend) upgrade i18next from 26.3.1 to 26.3.6
- ⬆️(frontend) upgrade posthog-js from 1.391.2 to 1.395.0
- ⬆️(frontend) upgrade @tanstack/react-query from 5.101.0 to 5.101.1
- ⬆️(frontend) upgrade livekit-client from 2.19.2 to 2.20.0
- ⚡️(frontend) limit unnecessary re-renders #1510
- 📝(legal) update terms of service
- 💄(frontend) render Avatar initials in uppercase
- 💄(frontend) improve participant name rendering in the list
- 🚚(backend) rename TelephonyService to SIPManagement
- ⬆️(dependencies) update python dependencies
-
-### Fixed
-
- 🐛(transcription) fix silent bug in speaker assignment
- 🐛(summary) extend tasks auto retry logic
- 🐛(summary) properly detect when failure webhook should be sent
- 🐛(backend) preserve recording metadata when updating room access
- 🐛(backend) allow any string as sub in the API serializer
- 🐛(frontend) fall back to user.full_name on request-entry
- 🚸(frontend) show two initials in the Avatar when possible
- 🩹(all) clear the SonarCloud reliability finding and the lint debt
- 🐛(frontend) stop the installed app reopening the room it came from
- 🐛(backend) serialize lazy title in summary payload
- 💄(frontend) show pointer cursor on interactive switches
- 🐛(frontend) fix icon centering in the Switch primitive
- 🐛(frontend) keep Unicode initials intact in avatar
- 🐛(frontend) prevent concurrent settings updates from overwriting each other
-
-## [1.24.0] - 2026-07-21
-
 ### Added

 - ✨(backend) allow searching the recording admin table by owner email
 - ✨(frontend) add participant color gradient when camera is off #1490
- ✨(all) allow forcing SSO display name for authenticated users
- ➕(frontend) install vite-plugin-static-copy for MediaPipe WASM assets
- ✨(addon) show add-in tools when creating meetings in shared calendars

 ### Changed

 - 🗑️(settings) deprecate SUMMARY_SERVICE_VERSION=1
 - ⬆️(mail) update mjml to v5 and @html-to/text-cli
- 🚸(frontend) initialize the join input name with the persisted full name
- ♻️(frontend) refactor background processors to use the new API
- ♻️(frontend) inline model weights to avoid loading them from remote
- ♻️(frontend) inline MediaPipe WASM modules to avoid loading from remote
- ⬆️(frontend) upgrade posthog-js from 1.387.0 to 1.391.2
- ⬆️(frontend) upgrade react-stately from 3.47.0 to 3.48.0
- ⬆️(frontend) upgrade react-aria from 3.49.0 to 3.50.0
- ⬆️(frontend) upgrade react-aria-components from 1.18.0 to 1.19.0

 ### Fixed

 - 🩹(backend) identify externally provisioned users to PostHog
- 🐛(backend) fix info panel crash for unregistered rooms
- ♿️(frontend) focus side panel container on open #1452
- 🐛(summary) whisper call error handling

 ## [1.23.0] - 2026-07-08

@@ -1,7 +1,7 @@
 # Django Meet

 # ---- base image to inherit from ----
-FROM python:3.13.15-alpine3.24 AS base
+FROM python:3.13.5-alpine3.21 AS base

 # Upgrade pip to its latest release to speed up dependencies installation
 RUN python -m pip install --upgrade pip
@@ -37,7 +37,7 @@ RUN --mount=type=cache,target=/root/.cache/uv \
  uv sync --locked --no-dev

 # ---- mails ----
-FROM node:22 AS mail-builder
+FROM node:20 AS mail-builder

 COPY ./src/mail /mail/app

@@ -39,33 +39,18 @@ DB_PORT            = 5432
 DOCKER_UID          = $(shell id -u)
 DOCKER_GID          = $(shell id -g)
 DOCKER_USER         = $(DOCKER_UID):$(DOCKER_GID)
-COMPOSE                  = DOCKER_USER=$(DOCKER_USER) docker compose
-COMPOSE_EXEC             = $(COMPOSE) exec
-COMPOSE_EXEC_APP         = $(COMPOSE_EXEC) app-dev
-COMPOSE_RUN              = $(COMPOSE) run --rm
-COMPOSE_RUN_APP          = $(COMPOSE_RUN) app-dev
-COMPOSE_RUN_LINT_BACK    = $(COMPOSE_RUN) --no-deps app-dev
-COMPOSE_RUN_LINT_AGENTS  = $(COMPOSE_RUN) --no-deps multi-user-transcriber-dev
-COMPOSE_RUN_LINT_SUMMARY = $(COMPOSE_RUN) --no-deps app-summary-dev
-COMPOSE_RUN_CROWDIN      = $(COMPOSE_RUN) crowdin crowdin
-WAIT_DB                  = @$(COMPOSE_RUN) dockerize -wait tcp://$(DB_HOST):$(DB_PORT) -timeout 60s
+COMPOSE             = DOCKER_USER=$(DOCKER_USER) docker compose
+COMPOSE_EXEC        = $(COMPOSE) exec
+COMPOSE_EXEC_APP    = $(COMPOSE_EXEC) app-dev
+COMPOSE_RUN         = $(COMPOSE) run --rm
+COMPOSE_RUN_APP     = $(COMPOSE_RUN) app-dev
+COMPOSE_RUN_CROWDIN = $(COMPOSE_RUN) crowdin crowdin
+WAIT_DB             = @$(COMPOSE_RUN) dockerize -wait tcp://$(DB_HOST):$(DB_PORT) -timeout 60s

 # -- Backend
 MANAGE              = $(COMPOSE_RUN_APP) python manage.py
 MAIL_NPM            = $(COMPOSE_RUN) -w /app/src/mail node npm

-# -- Linters
-LINT_RUFF_FORMAT    = ruff format .
-LINT_RUFF_CHECK     = ruff check . --fix
-LINT_PYLINT         = pylint meet demo core
-LINT_BACK           = echo 'lint:ruff-format started…' && $(LINT_RUFF_FORMAT) \
-  && echo 'lint:ruff-check started…' && $(LINT_RUFF_CHECK) \
-  && echo 'lint:pylint started…' && $(LINT_PYLINT)
-LINT_AGENTS         = echo 'lint:ruff-format started…' && $(LINT_RUFF_FORMAT) \
-  && echo 'lint:ruff-check started…' && $(LINT_RUFF_CHECK)
-LINT_SUMMARY        = echo 'lint:ruff-format started…' && $(LINT_RUFF_FORMAT) \
-  && echo 'lint:ruff-check started…' && $(LINT_RUFF_CHECK)
-
 # -- Frontend
 PATH_FRONT          = ./src/frontend

@@ -139,7 +124,6 @@ logs: ## display app-dev logs (follow mode)
 run-backend: ## start only the backend application and all needed services
 	@$(COMPOSE) up --force-recreate -d celery-dev --remove-orphans
 	@$(COMPOSE) up --force-recreate -d nginx
-	@$(COMPOSE) up -d livekit
 	@echo "Wait for postgresql to be up..."
 	@$(WAIT_DB)
 .PHONY: run-backend
@@ -204,37 +188,27 @@ demo: ## flush db then create a demo for load testing purpose
 	@$(MANAGE) create_demo
 .PHONY: demo

-lint: ## lint all python sources (back-end, agents, summary)
-	@$(MAKE) lint-back
-	@$(MAKE) lint-agents
-	@$(MAKE) lint-summary
+# Nota bene: Black should come after isort just in case they don't agree...
+lint: ## lint back-end python sources
+lint: \
+  lint-ruff-format \
+  lint-ruff-check \
+  lint-pylint
 .PHONY: lint

-lint-back: ## lint back-end python sources
-	@$(COMPOSE_RUN_LINT_BACK) sh -c "$(LINT_BACK)"
-.PHONY: lint-back
-
-lint-agents: ## lint agents python sources
-	@$(COMPOSE_RUN_LINT_AGENTS) sh -c "$(LINT_AGENTS)"
-.PHONY: lint-agents
-
-lint-summary: ## lint summary python sources
-	@$(COMPOSE_RUN_LINT_SUMMARY) sh -c "$(LINT_SUMMARY)"
-.PHONY: lint-summary
-
 lint-ruff-format: ## format back-end python sources with ruff
 	@echo 'lint:ruff-format started…'
-	@$(COMPOSE_RUN_LINT_BACK) $(LINT_RUFF_FORMAT)
+	@$(COMPOSE_RUN_APP) ruff format .
 .PHONY: lint-ruff-format

 lint-ruff-check: ## lint back-end python sources with ruff
 	@echo 'lint:ruff-check started…'
-	@$(COMPOSE_RUN_LINT_BACK) $(LINT_RUFF_CHECK)
+	@$(COMPOSE_RUN_APP) ruff check . --fix
 .PHONY: lint-ruff-check

 lint-pylint: ## lint back-end python sources with pylint only on changed files from main
 	@echo 'lint:pylint started…'
-	@$(COMPOSE_RUN_LINT_BACK) $(LINT_PYLINT)
+	@$(COMPOSE_RUN_APP) pylint meet demo core
 .PHONY: lint-pylint

 test: ## run project tests; pass extra pytest args via ARGS, e.g. `make test ARGS="-vv"`
@@ -292,7 +266,7 @@ shell: ## connect to database shell
 # -- Database

 dbshell: ## connect to database shell
-	@$(COMPOSE_EXEC_APP) python manage.py dbshell
+	docker compose exec app-dev python manage.py dbshell
 .PHONY: dbshell

 resetdb: FLUSH_ARGS ?=
@@ -4,7 +4,7 @@

 Security is very important to us.

-If you have any issue regarding security, please disclose the information responsibly by submitting [this form](https://vdp.numerique.gouv.fr/p/Send-a-report?lang=en) and not by creating an issue on the repository. You can also email us at visio@numerique.gouv.fr
+If you have any issue regarding security, please disclose the information responsibly submiting [this form](https://vdp.numerique.gouv.fr/p/Send-a-report?lang=en) and not by creating an issue on the repository. You can also email us at visio@numerique.gouv.fr

 We appreciate your effort to make Visio more secure.

@@ -16,25 +16,6 @@ the following command inside your docker container:

 ## [Unreleased]

-## v1.30.0
-
-### Removing S3 storage-event webhooks for recordings
-
-Recordings were previously confirmed as saved by an S3 storage-event webhook posting to `/api/v1.0/recordings/storage-hook/`. That endpoint has been removed: recordings are now always finalized from LiveKit's own `egress_ended` webhook, which has been the default path since v1.22.0.
-
-**Required for every deployment:** LiveKit must be able to deliver webhooks to the backend at `/api/v1.0/rooms/webhooks-livekit/`. This is now the only way a recording reaches a saved state; if `egress_ended` is never delivered, recordings stay in the `active` state.
-
-For hosters who had configured storage-event webhooks:
- Recordings reach the same final state, but they are now finalized when LiveKit reports the egress as ended rather than when the storage backend reports the upload.
- Remove the event notification from your bucket configuration: it now targets a non-existent endpoint and will fail on every delivery.
-
-For hosters who had **not** configured storage-event webhooks:
- Nothing changes. Recordings have been finalized from the `egress_ended` webhook since v1.22.0.
-
-In both cases, the following settings are no longer used and can be removed from your env: `RECORDING_EVENT_PARSER_CLASS`, `RECORDING_ENABLE_STORAGE_EVENT_AUTH`, `RECORDING_STORAGE_EVENT_ENABLE`, `RECORDING_STORAGE_EVENT_TOKEN`.
-
-On completion of the egress, a recording moves to `notification_succeeded`, or to `saved` if notifying external services failed.
-
 ## v1.23.0

 As part of the 1.23.0 release, the legacy `api/v1` implementation has been removed from the _experimental_ Summary service and Meet has been migrated to the new `api/v2`.
@@ -5,7 +5,7 @@ set -eo pipefail
 REPO_DIR="$(cd "$( dirname "${BASH_SOURCE[0]}" )/.." && pwd)"
 UNSET_USER=0

-export COMPOSE_FILE="${COMPOSE_FILE:-${REPO_DIR}/compose.yml}"
+COMPOSE_FILE="${REPO_DIR}/compose.yml"
 COMPOSE_PROJECT="meet"


@@ -42,6 +42,7 @@ function _docker_compose() {
    echo "🐳(compose) project: '${COMPOSE_PROJECT}' file: '${COMPOSE_FILE}'"
    docker compose \
        -p "${COMPOSE_PROJECT}" \
+        -f "${COMPOSE_FILE}" \
        --project-directory "${REPO_DIR}" \
        "$@"
 }
@@ -0,0 +1,6 @@
+#!/usr/bin/env bash
+
+# shellcheck source=bin/_config.sh
+source "$(dirname "${BASH_SOURCE[0]}")/_config.sh"
+
+_docker_compose "$@"
@@ -110,12 +110,6 @@ cd -
 # Update summary pyproject.toml
 update_python_version "summary"

-# Run uv lock in summary
-print_info "Running uv lock in summary..."
-cd "src/summary"
-uv lock
-cd -
-
 # Update agents pyproject.toml
 update_python_version "agents"

@@ -169,9 +163,7 @@ echo "      - src/mail/package.json"
 echo "      - src/backend/pyproject.toml"
 echo "      - src/backend/uv.lock"
 echo "      - src/summary/pyproject.toml"
-echo "      - src/summary/uv.lock"
 echo "      - src/agents/pyproject.toml"
-echo "      - src/agents/uv.lock"
 echo "      - CHANGELOG.md"
 echo ""
 print_warning "Next steps:"
@@ -17,7 +17,7 @@ services:

  minio:
    user: ${DOCKER_USER:-1000}
-    image: quay.io/minio/minio
+    image: minio/minio
    environment:
      - MINIO_ROOT_USER=meet
      - MINIO_ROOT_PASSWORD=password
@@ -35,7 +35,7 @@ services:
      - ./data/media:/data

  createbuckets:
-    image: quay.io/minio/mc
+    image: minio/mc
    depends_on:
      minio:
        condition: service_healthy
@@ -46,6 +46,21 @@ services:
      /usr/bin/mc mb meet/meet-media-storage && \
      exit 0;"

+  createwebhook:
+    image: minio/mc
+    depends_on:
+      minio:
+        condition: service_healthy
+        restart: true
+    entrypoint: >
+      sh -c "
+      /usr/bin/mc alias set meet http://minio:9000 meet password &&
+      /usr/bin/mc admin config set meet notify_webhook:meet-webhook endpoint='http://app-dev:8000/api/v1.0/recordings/storage-hook/' auth_token='Bearer password' &&
+      /usr/bin/mc admin service restart meet --wait --json &&
+      sleep 15 &&
+      /usr/bin/mc event add meet/meet-media-storage arn:minio:sqs::meet-webhook:webhook --event put --prefix "recordings" &&
+      exit 0;"
+
  app-dev:
    build:
      context: .
@@ -70,7 +85,9 @@ services:
        - postgresql
        - mailcatcher
        - redis
+        - livekit
        - createbuckets
+        - createwebhook
    extra_hosts:
      - "127.0.0.1.nip.io:host-gateway"
    networks:
@@ -80,7 +97,7 @@ services:
  celery-dev:
    user: ${DOCKER_USER:-1000}
    image: meet:backend-development
-    command: ["celery", "-A", "meet.celery_app", "worker", "-l", "DEBUG", "--pool=solo"]
+    command: ["celery", "-A", "meet.celery_app", "worker", "-l", "DEBUG"]
    environment:
      - DJANGO_CONFIGURATION=Development
    env_file:
@@ -115,7 +132,7 @@ services:
  celery:
    user: ${DOCKER_USER:-1000}
    image: meet:backend-production
-    command: ["celery", "-A", "meet.celery_app", "worker", "-l", "INFO", "--pool=solo"]
+    command: ["celery", "-A", "meet.celery_app", "worker", "-l", "INFO"]
    environment:
      - DJANGO_CONFIGURATION=Demo
    env_file:
@@ -164,7 +181,7 @@ services:
    working_dir: /app

  node:
-    image: node:22
+    image: node:18
    user: "${DOCKER_USER:-1000}"
    environment:
      HOME: /tmp
@@ -207,14 +224,12 @@ services:
      - kc_postgresql

  livekit:
-    image: livekit/livekit-server:v1.13.6
+    image: livekit/livekit-server
    entrypoint: /livekit-server --dev --bind 0.0.0.0 --config ./config.yaml
    ports:
      - "7880:7880"
      - "7881:7881"
      - "7882:7882/udp"
-      - "3478:3478/udp"
-      - "30000-30100:30000-30100/udp"
    volumes:
      - ./docker/livekit/config/livekit-server.yaml:/config.yaml
    depends_on:
@@ -235,7 +250,6 @@ services:
    build:
      context: ./src/agents
      target: development
-    user: ${DOCKER_USER:-1000}
    command: ["python", "metadata_collector.py", "dev"]
    env_file:
      - env.d/development/metadata_collector
@@ -254,8 +268,6 @@ services:
    build:
      context: ./src/agents
      target: development
-    user: ${DOCKER_USER:-1000}
-    command: ["python", "multi_user_transcriber.py", "dev"]
    env_file:
      - env.d/development/multi_user_transcriber
    volumes:
@@ -1,47 +0,0 @@
-{
-  "nodes": {
-    "devenv": {
-      "locked": {
-        "dir": "src/modules",
-        "lastModified": 1778705847,
-        "narHash": "sha256-EQnZCy7r4VMO6KDoytxHBa0mFbM1D9g1kaDfs/s0YZA=",
-        "ref": "refs/tags/v2.1.2",
-        "rev": "ea3d94ac9d6bf6a1313773170122ca4e2ef5a0be",
-        "revCount": 6569,
-        "type": "git",
-        "url": "https://github.com/cachix/devenv"
-      },
-      "original": {
-        "dir": "src/modules",
-        "ref": "refs/tags/v2.1.2",
-        "type": "git",
-        "url": "https://github.com/cachix/devenv"
-      }
-    },
-    "nixpkgs": {
-      "locked": {
-        "lastModified": 1789542786,
-        "narHash": "sha256-ajQuqcxnj6RYnwCjA/9FTCnrdR2+BDzstE8UembXf60=",
-        "ref": "nixos-26.05",
-        "rev": "4c7870105e7f1fdf9c48688c8d7efc21abf0688a",
-        "shallow": true,
-        "type": "git",
-        "url": "https://github.com/NixOS/nixpkgs"
-      },
-      "original": {
-        "ref": "nixos-26.05",
-        "shallow": true,
-        "type": "git",
-        "url": "https://github.com/NixOS/nixpkgs"
-      }
-    },
-    "root": {
-      "inputs": {
-        "devenv": "devenv",
-        "nixpkgs": "nixpkgs"
-      }
-    }
-  },
-  "root": "root",
-  "version": 7
-}
@@ -1,265 +0,0 @@
-# =============================================================================
-#  devenv.nix — La Suite Meet ("Visio") developer environment
-# =============================================================================
-{
-  pkgs,
-  lib,
-  config,
-  ...
-}:
-
-let
-  python = pkgs.python313;
-  nodejs = pkgs.nodejs_22;
-
-  backendDir = "src/backend";
-  agentsDir = "src/agents";
-  summaryDir = "src/summary";
-  frontendDir = "src/frontend";
-
-  readDotEnv =
-    file:
-    let
-      lines = lib.splitString "\n" (builtins.readFile file);
-      unquote =
-        v:
-        let
-          len = builtins.stringLength v;
-        in
-        if len >= 2 && lib.hasPrefix "\"" v && lib.hasSuffix "\"" v then
-          builtins.substring 1 (len - 2) v
-        else if len >= 2 && lib.hasPrefix "'" v && lib.hasSuffix "'" v then
-          builtins.substring 1 (len - 2) v
-        else
-          v;
-      parseLine =
-        line:
-        let
-          m = builtins.match "[ \t]*([A-Za-z_][A-Za-z0-9_]*)[ \t]*=[ \t]*(.*)" line;
-        in
-        if m == null then null else { name = builtins.elemAt m 0; value = unquote (builtins.elemAt m 1); };
-    in
-    builtins.listToAttrs (builtins.filter (x: x != null) (map parseLine lines));
-
-  # Reuse existing .env
-  dotEnv =
-    (readDotEnv ./env.d/development/common.dist)
-    // (readDotEnv ./env.d/development/postgresql.dist);
-
-  sharedEnv = builtins.removeAttrs dotEnv [ "PYTHONPATH" ]; # only makes sense inside the backend container.
-in
-{
-  options.meet = {
-    agents.enable = lib.mkEnableOption "tooling for the LiveKit agents in src/agents";
-    summary.enable = lib.mkEnableOption "tooling for the summary service in src/summary";
-    k8s.enable = lib.mkEnableOption "Kubernetes dev utilities";
-  };
-
-  config = {
-    # Profile can be activated with devenv --profile <profile> shell
-    profiles = {
-      agents.module = {
-        meet.agents.enable = true;
-      };
-      summary.module = {
-        meet.summary.enable = true;
-      };
-      k8s.module = {
-        meet.k8s.enable = true;
-      };
-    };
-    languages.python = {
-      enable = true;
-      package = python;
-      directory = backendDir;
-      manylinux.enable = pkgs.stdenv.hostPlatform.isLinux;
-
-      libraries = [
-        "${config.devenv.dotfile}/profile"
-        pkgs.file
-        pkgs.zlib
-        pkgs.libffi
-        pkgs.openssl
-      ];
-
-      uv.enable = true;
-      uv.sync.enable = false;
-      venv.enable = false;
-      lsp.enable = true;
-    };
-
-    languages.javascript = {
-      enable = true;
-      package = nodejs;
-      directory = frontendDir;
-
-      npm.enable = true;
-      yarn.enable = true;
-      corepack.enable = false;
-    };
-
-    languages.typescript.enable = false;
-    languages.nix.enable = true;
-
-    packages =
-      with pkgs;
-      [
-        gnumake
-        file
-        shared-mime-info
-        gettext
-        postgresql_16
-        git
-        curl
-        jq
-        podman
-        podman-compose
-        docker-client
-      ]
-
-      # -- LiveKit agents
-      ++ lib.optionals config.meet.agents.enable [
-        glib
-        portaudio
-        livekit-cli
-      ]
-
-      # -- summary service
-      ++ lib.optionals config.meet.summary.enable [
-        redis
-      ]
-
-      # -- Kubernetes tools
-      ++ lib.optionals config.meet.k8s.enable [
-        kubectl
-        kubernetes-helm
-        helmfile
-        tilt
-        kind
-        mkcert
-      ];
-
-    env = sharedEnv // {
-      UV_LINK_MODE = "copy";
-
-      PYTHONDONTWRITEBYTECODE = "1";
-      PYTHONUNBUFFERED = "1";
-
-      UV_PROJECT_ENVIRONMENT = lib.mkForce ".venv";
-
-      COMPOSE_PROJECT_NAME = "meet";
-
-      DJANGO_DATA_DIR = "${config.devenv.root}/data";
-
-      # Database / Pgsql
-      DB_HOST = "127.0.0.1";
-      DB_PORT = "15432";
-      PGHOST = "127.0.0.1";
-      PGPORT = "15432";
-      PGDATABASE = sharedEnv.DB_NAME;
-      PGUSER = sharedEnv.DB_USER;
-      PGPASSWORD = sharedEnv.DB_PASSWORD;
-
-      REDIS_URL = "redis://127.0.0.1:6379/1";
-      CELERY_BROKER_URL = "redis://127.0.0.1:6379/0";
-
-      # S3 / MinIO
-      AWS_S3_ENDPOINT_URL = "http://127.0.0.1:9000";
-
-      # OIDC
-      OIDC_OP_JWKS_ENDPOINT = "http://localhost:8083/realms/meet/protocol/openid-connect/certs";
-      OIDC_OP_TOKEN_ENDPOINT = "http://localhost:8083/realms/meet/protocol/openid-connect/token";
-      OIDC_OP_USER_ENDPOINT = "http://localhost:8083/realms/meet/protocol/openid-connect/userinfo";
-      OIDC_OP_INTROSPECTION_ENDPOINT = "http://localhost:8083/realms/meet/protocol/openid-connect/token/introspect";
-
-      # summary service
-      SUMMARY_SERVICE_ENDPOINT = "http://127.0.0.1:8001/api/v2/async-jobs/transcribe/";
-      SUMMARY_SERVICE_VERSION = "2";
-
-      # Mail
-      DJANGO_EMAIL_HOST = "127.0.0.1";
-    };
-
-    scripts = {
-
-      meet-venv = {
-        description = "Create/refresh meet uv virtualenvs for backend, agents and summary";
-        exec = ''
-          set -euo pipefail
-          cd "$DEVENV_ROOT"
-
-          echo "==> ${backendDir} (uv sync --locked, dependency-groups)"
-          ( cd "${backendDir}" && uv sync --locked --all-groups )
-
-          echo "==> ${agentsDir} (uv sync --locked --all-extras)"
-          ( cd "${agentsDir}" && uv sync --locked --all-extras )
-
-          echo "==> ${summaryDir} (uv sync --locked --all-extras)"
-          ( cd "${summaryDir}" && uv sync --locked --all-extras )
-
-          echo
-          echo "Synced the following virtualenvs successfully:"
-          echo "  ${backendDir}/.venv"
-          echo "  ${agentsDir}/.venv"
-          echo "  ${summaryDir}/.venv"
-        '';
-      };
-    };
-
-    enterShell = ''
-      # Make podman socket accessible in order to launch regular docker commands.
-      # Set MEET_PODMAN_SOCKET=0 to keep the DOCKER_HOST of the calling environment.
-      case "''${MEET_PODMAN_SOCKET:-1}" in
-        0|false|no|off) ;;
-        *)
-          _rundir="''${XDG_RUNTIME_DIR:-/run/user/$(id -u)}"
-          export DOCKER_HOST="unix://$_rundir/podman/podman.sock"
-          unset _rundir
-          ;;
-      esac
-
-      # Compose files to merge
-      _compose_dir="${config.devenv.root}/docker/compose.d"
-      _compose_files="${config.devenv.root}/compose.yml"
-
-      export DOCKER_USER="$(id -u):$(id -g)"
-
-      case "''${DOCKER_HOST:-}" in
-        *podman*)
-          _compose_files="$_compose_files:$_compose_dir/compose.podman.yml"
-
-          # Build images with Podman/Buildah rather than BuildKit. `docker
-          # compose build` otherwise has buildx boot a moby/buildkit container,
-          # and that container lands in its own network namespace with neither
-          # the proxy in its environment nor any route to it.
-          # Buildah has neither problem: base images are resolved by the Podman systemd
-          # service, which inherits the proxy from its systemd socket activated unit, and
-          # RUN steps execute in the *host* network namespace
-
-          export DOCKER_BUILDKIT=0
-          export COMPOSE_BAKE=false
-          ;;
-      esac
-
-
-      # Apply Bureautix override
-      if [ -n "''${http_proxy:-}" ]; then
-        _compose_files="$_compose_files:$_compose_dir/compose.bureautix.yml"
-      fi
-
-      export COMPOSE_FILE="$_compose_files"
-      unset _compose_dir _compose_files
-
-      # Make binaries accessible
-      for _d in \
-        "$DEVENV_ROOT/${backendDir}/.venv/bin" \
-        "$DEVENV_ROOT/${agentsDir}/.venv/bin" \
-        "$DEVENV_ROOT/${summaryDir}/.venv/bin" \
-        "$DEVENV_ROOT/${frontendDir}/node_modules/.bin"
-      do
-        [ -d "$_d" ] && export PATH="$_d:$PATH"
-      done
-      unset _d
-    '';
-  };
-}
@@ -1,5 +0,0 @@
-inputs:
-  nixpkgs:
-    url: git+https://github.com/NixOS/nixpkgs?ref=nixos-26.05&shallow=1
-  devenv:
-    url: git+https://github.com/cachix/devenv?ref=refs/tags/v2.1.2&dir=src/modules
@@ -1,48 +0,0 @@
-# Bureautix proxy overrides
-#
-# Builds submitted through the Docker API of the Podman service get none of
-# the proxy variables in their RUN steps. We need to pass the http_proxy explicitely
-# otherwise all connections fail during the build.
-
-x-proxy-vars: &proxy-vars
-  http_proxy: ${http_proxy:-}
-  https_proxy: ${https_proxy:-}
-  no_proxy: ${no_proxy:-}
-
-services:
-  app:
-    build:
-      args:
-        <<: *proxy-vars
-  app-dev:
-    build:
-      args:
-        <<: *proxy-vars
-  frontend:
-    build:
-      args:
-        <<: *proxy-vars
-  metadata-collector-dev:
-    build:
-      args:
-        <<: *proxy-vars
-  multi-user-transcriber-dev:
-    build:
-      args:
-        <<: *proxy-vars
-  app-summary-dev:
-    build:
-      args:
-        <<: *proxy-vars
-  celery-summary-transcribe:
-    build:
-      args:
-        <<: *proxy-vars
-  celery-summary-summarize:
-    build:
-      args:
-        <<: *proxy-vars
-  # The local proxy listens on 8080 and collides with Keycloak's published admin port.
-  keycloak:
-    ports: !override
-      - "8081:8080"
@@ -1,33 +0,0 @@
-# Rootless Podman override for compose.yml.
-#
-# Rootless Podman maps container UID 0 to the host user and every other
-# container UID to a subuid that owns nothing in the worktree. Meet compose.ymlruns
-# its containers as DOCKER_USER=$(id -u):$(id -g), which would land on such a
-# subuid and make every bind mount effectively read-only.
-#
-# `userns_mode: keep-id` maps the host user to the same UID and GID inside the
-# container instead, so DOCKER_USER keeps its Docker value and files written
-# through a bind mount are owned by the host user on both sides.
-#
-# Only the services that mount the worktree and run as DOCKER_USER are listed.
-
-x-keep-id: &keep-id
-  userns_mode: keep-id
-
-services:
-  app-dev:
-    <<: *keep-id
-  celery-dev:
-    <<: *keep-id
-  minio:
-    <<: *keep-id
-  node:
-    <<: *keep-id
-  crowdin:
-    <<: *keep-id
-  metadata-collector-dev:
-    <<: *keep-id
-  multi-user-transcriber-dev:
-    <<: *keep-id
-  app-summary-dev:
-    <<: *keep-id
@@ -54,12 +54,18 @@ RUN npx webpack --mode production


 # ---- Front-end image ----
-FROM nginxinc/nginx-unprivileged:1.30.4-alpine3.24 AS frontend-production
+FROM nginxinc/nginx-unprivileged:1.30.3-alpine3.23 AS frontend-production

 USER root
-RUN apk upgrade --no-cache libexpat && \
-    apk del curl
-USER nginx
+
+# Security patches for known CVEs
+RUN apk update && apk upgrade  \
+    libcrypto3>=3.5.7-r0 \
+    libssl3>=3.5.7-r0 \
+    musl \
+    musl-utils \
+    zlib>=1.3.2-r0 \
+    && apk del curl

 USER nginx

@@ -1,6 +1,5 @@
 :root {
    --fonts-sans: 'Marianne', ui-sans-serif, system-ui, sans-serif;
-    --avatar-cap-height: 0.7;
 }

 .Header-beforeLogo {
@@ -65,11 +65,6 @@ server {
      sub_filter_once off;
  }

-  location ^~ /assets/mediapipe/wasm/ {
-      expires 30d;
-      add_header Cache-Control "public, max-age=2592000";
-  }
-
  # Serve static files with caching
  location ~* ^/assets/.*\.(css|js|json|png|jpg|jpeg|gif|ico|svg|woff|woff2|ttf|eot)$ {
      expires 30d;
@@ -14,4 +14,3 @@ accesslog = "-"
 # Using '-' for the error log file makes gunicorn log errors to stderr
 errorlog = "-"
 loglevel = "info"
-access_log_format = '%(h)s %(l)s %(u)s %(t)s "%(r)s" %(s)s %(b)s "%(f)s" "%(a)s" %(M)s'
@@ -1,4 +1,4 @@
-FROM livekit/livekit-server:v1.13.6
+FROM livekit/livekit-server:v1.9.4

 # We inject the nip.io certificate manually because the livekit chart doesn't support volume mounting
 COPY rootCA.pem /etc/ssl/certs/
@@ -8,23 +8,3 @@ webhook:
  api_key: devkey
  urls:
      - http://app-dev:8000/api/v1.0/rooms/webhooks-livekit/
-
-turn:
-  enabled: true
-  domain: turn.127.0.0.1.nip.io
-  udp_port: 3478
-  tls_port: 0
-  external_tls: false
-  relay_range_start: 30000
-  relay_range_end: 30100
-  allow_restricted_peer_cidrs:
-    - 192.168.0.0/16
-    - 172.16.0.0/12
-
-rtc:
-  node_ip: 127.0.0.1
-  advertise_internal_ip: true
-  udp_port: 7882
-  tcp_port: 7881
-  use_external_ip: false
-
@@ -23,11 +23,14 @@ It uses LiveKit Egress to record room sessions. For reference, see the [LiveKit
 To use the room recording feature, the following components are required:

 - A running [LiveKit Egress](https://github.com/livekit/egress) server capable of handling room composite recordings.
- A S3-compatible object storage where the egress uploads the recorded files.
+- A S3-compatible object storage that supports webhook events to notify the backend when recordings are uploaded.
 - An email service to notify room owners when a recording is available for download.
 - Webhook events configured between LiveKit Server and the backend.


+> [!CAUTION]
+>  Minio supports lifecycle events; other providers may not work out of the box. There is currently a dependency on Minio, which is planned to be refactored in the future.
+
 > [!NOTE]
 > Celery isn’t in use for these async tasks yet. It’s something we’d like to add, but it’s not planned at this stage.

@@ -72,7 +75,7 @@ sequenceDiagram
    LiveKit->>Egress: Stop recording
    Egress->>Storage: Upload recorded file
    
-    LiveKit->>Backend: POST /api/v1.0/rooms/webhooks-livekit/ (egress_ended)
+    Storage->>Backend: Storage event notification
    Backend->>Backend: Update Recording status to SAVED
    Backend->>Email: Send notification to room owner
    
@@ -91,6 +94,10 @@ sequenceDiagram
 | **RECORDING_ENABLE**                    | Boolean     | `False`                                                                                                                                                            | Enable or disable the room recording feature.                                                                                                                                                                                                                                                      |
 | **RECORDING_OUTPUT_FOLDER**             | String      | `"recordings"`                                                                                                                                                     | Folder/prefix where recordings are stored in the object storage.                                                                                                                                                                                                                                   |
 | **RECORDING_WORKER_CLASSES**            | Dict        | `{ "screen_recording": "core.recording.worker.services.VideoCompositeEgressService", "transcript": "core.recording.worker.services.AudioCompositeEgressService" }` | Maps recording types to their worker service classes.                                                                                                                                                                                                                                              |
+| **RECORDING_EVENT_PARSER_CLASS**        | String      | `"core.recording.event.parsers.MinioParser"`                                                                                                                       | Class responsible for parsing storage events and updating the backend.                                                                                                                                                                                                                             |
+| **RECORDING_ENABLE_STORAGE_EVENT_AUTH** | Boolean     | `True`                                                                                                                                                             | Enable authentication for storage event webhook requests.                                                                                                                                                                                                                                          |
+| **RECORDING_STORAGE_EVENT_ENABLE**      | Boolean     | `False`                                                                                                                                                            | Enable handling of storage events (must configure webhook in storage). If `False`, fallback to LiveKit egress complete webhook.                                                    |
+| **RECORDING_STORAGE_EVENT_TOKEN**       | Secret/File | `None`                                                                                                                                                             | Token used to authenticate storage webhook requests, if `RECORDING_ENABLE_STORAGE_EVENT_AUTH` is enabled.                                                                                                                                                                                          |
 | **RECORDING_EXPIRATION_DAYS**           | Integer     | `None`                                                                                                                                                             | Number of days before recordings expire. Should match bucket lifecycle policy. Set to `None` for no expiration.                                                                                                                                                                                    |
 | **RECORDING_MAX_DURATION**              | Integer     | `None`                                                                                                                                                             | Maximum duration of a recording in milliseconds. Must be synced with the LiveKit Egress configuration. Set to None for unlimited duration. When the maximum duration is reached, the recording is automatically stopped and saved, and the user is prompted in the frontend with an alert message. |
 | **RECORDING_ENCODING_ENABLED**          | Boolean     | `False`                                                                                                                                                            | When `False`, LiveKit Egress uses its built-in `H264_720P_30` preset. When `True`, the `RECORDING_ENCODING_*` values below are sent to LiveKit as advanced `EncodingOptions`. See [Tuning recording encoding](#tuning-recording-encoding).                                                          |
@@ -102,6 +109,19 @@ sequenceDiagram
 | **RECORDING_ENCODING_KEY_FRAME_INTERVAL_S** | Float   | `4.0`                                                                                                                                                              | Keyframe interval in seconds. Drives seek granularity in the recorded MP4 (a player can only seek to keyframe boundaries). Larger values give the encoder slightly more bits for non-keyframe content at a fixed bitrate. `4.0` is a standard VOD value. Only applied when `RECORDING_ENCODING_ENABLED` is `True`. |


+### Manual Storage Webhook
+
+Storage events must be configured manually; the Kubernetes chart does not do this automatically.
+
+1. Configure your S3 bucket to send file creation events to the backend webhook.
+2. Enable events and token in settings:
+
+```python
+RECORDING_STORAGE_EVENT_ENABLE = True
+RECORDING_ENABLE_STORAGE_EVENT_AUTH = True
+RECORDING_STORAGE_EVENT_TOKEN = <token>
+```
+
 > [!NOTE]
 > Questions? Open an issue on [GitHub](https://github.com/suitenumerique/meet/issues/new?assignees=&labels=bug&template=Bug_report.md) or join our [Matrix community](https://matrix.to/#/#meet-official:matrix.org).

@@ -344,7 +344,6 @@ These are the environmental options available on meet backend.
 | FRONTEND_SILENCE_LIVEKIT_DEBUG                  | Silence LiveKit debug logs                                                                                                                                   | false                                                                                                                                                         |
 | FRONTEND_IS_SILENT_LOGIN_ENABLED                | Enable silent login feature                                                                                                                                  | true                                                                                                                                                          |
 | FRONTEND_FEEDBACK                               | Frontend feedback configuration                                                                                                                              | {}                                                                                                                                                            |
-| FRONTEND_DOCUMENTATION_URL                      | URL of the documentation opened from the room options menu. If unset, the documentation menu item is hidden                                                  |                                                                                                                                                               |
 | FRONTEND_USE_FRENCH_GOV_FOOTER                  | Show the French government footer in the homepage                                                                                                            | false                                                                                                                                                         |
 | FRONTEND_USE_PROCONNECT_BUTTON                  | Show a "Login with ProConnect" button in the homepage instead of a "Login" button                                                                            | false                                                                                                                                                         |
 | DJANGO_EMAIL_BACKEND                            | Email backend library                                                                                                                                        | django.core.mail.backends.smtp.EmailBackend                                                                                                                   |
@@ -406,6 +405,10 @@ These are the environmental options available on meet backend.
 | RECORDING_ENABLE                                | Record meeting option                                                                                                                                        | false                                                                                                                                                         |
 | RECORDING_OUTPUT_FOLDER                         | Folder to store meetings                                                                                                                                     | recordings                                                                                                                                                    |
 | RECORDING_WORKER_CLASSES                        | Worker classes for recording                                                                                                                                 | {"screen_recording": "core.recording.worker.services.VideoCompositeEgressService","transcript": "core.recording.worker.services.AudioCompositeEgressService"} |
+| RECORDING_EVENT_PARSER_CLASS                    | Storage event engine for recording                                                                                                                           | core.recording.event.parsers.MinioParser                                                                                                                      |
+| RECORDING_ENABLE_STORAGE_EVENT_AUTH             | Enable storage event authorization                                                                                                                           | true                                                                                                                                                          |
+| RECORDING_STORAGE_EVENT_ENABLE                  | Enable recording storage events. If false, fallback to egress webhook.                                                                                                                           | false                                                                                                                                                         |
+| RECORDING_STORAGE_EVENT_TOKEN                   | Recording storage event token                                                                                                                                |                                                                                                                                                               |
 | RECORDING_EXPIRATION_DAYS                       | Recording expiration in days                                                                                                                                 |                                                                                                                                                               |
 | RECORDING_MAX_DURATION                          | Maximum recording duration in milliseconds. Must match LiveKit Egress configuration exactly.                                                                 |                                                                                                                                                               |
 | SCREEN_RECORDING_BASE_URL                       | Screen recording base URL                                                                                                                                    |                                                                                                                                                               |
@@ -16,11 +16,11 @@ info:
    * `rooms:list` – List rooms accessible to the delegated user.
    * `rooms:retrieve` – Retrieve details of a specific room.
    * `rooms:create` – Create new rooms.
-    * `rooms:update` – Update the access level and configuration of existing rooms.
+    * `rooms:update` – **Coming soon** Update existing rooms, e.g., add attendees to a room.
    * `rooms:delete` – **Coming soon** Delete rooms generated by the application.
-
+    
    #### Upcoming Features
-
+    
    * **Add attendees to a room:** You will be able to update a room to include a list of attendees, allowing them to bypass the lobby system automatically.
    * **Delete application-generated rooms:** Rooms created via the application can be deleted when no longer needed.

@@ -50,24 +50,10 @@ paths:
        
        The application must be authorized for the user's email domain.
        The returned token expires after a configured duration and must be refreshed by calling this endpoint again.
-
-        Request parameters may be sent either as "application/x-www-form-urlencoded"
-        (as specified by RFC 6749 for OAuth 2.0 token endpoints) or as "application/json".
      operationId: generateToken
      requestBody:
        required: true
        content:
-          application/x-www-form-urlencoded:
-            schema:
-              $ref: '#/components/schemas/TokenRequest'
-            examples:
-              tokenRequest:
-                summary: Request token for user delegation
-                value:
-                  client_id: "550e8400-e29b-41d4-a716-446655440000"
-                  client_secret: "1234567890abcdefghijklmnopqrstuvwxyz"
-                  grant_type: "client_credentials"
-                  scope: "user@example.com"
          application/json:
            schema:
              $ref: '#/components/schemas/TokenRequest'
@@ -131,19 +117,6 @@ paths:
                  summary: Domain not authorized
                  value:
                    error: "This application is not authorized for this email domain."
-        '415':
-          description: |
-            Unsupported media type. The request body must be sent as
-            "application/x-www-form-urlencoded" or "application/json".
-          content:
-            application/json:
-              schema:
-                $ref: '#/components/schemas/Error'
-              examples:
-                unsupportedMediaType:
-                  summary: Unsupported request content type
-                  value:
-                    detail: 'Unsupported media type "text/plain" in request.'

  /rooms:
    get:
@@ -310,67 +283,6 @@ paths:
        '404':
          $ref: '#/components/responses/RoomNotFoundError'

-    patch:
-      tags:
-        - Rooms
-      summary: Update a room
-      description: |
-        Partially updates a room. Only the delegated user's rooms where they are
-        administrator or owner can be updated; any other role gets a `403`.
-
-        **Updatable fields:** `access_level` and `configuration`. Every other field
-        (`id`, `name`, `slug`, `pin_code`) is read-only and silently ignored when sent.
-
-        `configuration` is replaced as a whole, it is not merged with the stored one.
-        Send the complete object you want the room to end up with.
-
-        Full replacement (`PUT`) is not supported. Use `PATCH` instead.
-      operationId: updateRoom
-      security:
-        - BearerAuth: [rooms:update]
-      parameters:
-        - name: id
-          in: path
-          required: true
-          description: Room UUID
-          schema:
-            type: string
-            format: uuid
-      requestBody:
-        required: true
-        content:
-          application/json:
-            schema:
-              $ref: '#/components/schemas/RoomUpdate'
-            examples:
-              accessLevelOnly:
-                summary: Change the access level
-                value:
-                  access_level: "restricted"
-              configurationOnly:
-                summary: Replace the room configuration
-                value:
-                  configuration:
-                    everyone_can_mute: true
-      responses:
-        '200':
-          description: Room updated successfully
-          content:
-            application/json:
-              schema:
-                $ref: '#/components/schemas/Room'
-        '400':
-          $ref: '#/components/responses/BadRequestError'
-        '401':
-          $ref: '#/components/responses/UnauthorizedError'
-        '403':
-          $ref: '#/components/responses/ForbiddenError'
-        '404':
-          $ref: '#/components/responses/RoomNotFoundError'
-        '405':
-          description: |
-            Method not allowed, `PUT` is not supported on this endpoint.
-
 components:
  securitySchemes:
    BearerAuth:
@@ -447,17 +359,6 @@ components:
        configuration:
          $ref: '#/components/schemas/RoomConfiguration'

-    RoomUpdate:
-      type: object
-      description: |
-        Fields that can be updated on an existing room. Both are optional, omitted
-        fields keep their current value.
-      properties:
-        access_level:
-          $ref: '#/components/schemas/RoomAccessLevel'
-        configuration:
-          $ref: '#/components/schemas/RoomConfiguration'
-
    RoomConfiguration:
      type: object
      description: |
@@ -499,9 +400,6 @@ components:
        - `public`: Anyone with the room link can join directly, no authentication required.
        - `trusted`: Authenticated users join directly. Unauthenticated users wait in the lobby for approval.
        - `restricted`: Only participants explicitly trusted by the owner bypass the lobby. Everyone else waits for approval regardless of authentication.
-
-        `public` is rejected with a `400` unless the deployment explicitly enables it
-        for this API. This applies both when creating a room and when updating one.
      example: "trusted"

    Room:
@@ -20,7 +20,7 @@ info:
    * `lasuite_visio:rooms:list` – List rooms accessible to the delegated user.
    * `lasuite_visio:rooms:retrieve` – Retrieve details of a specific room.
    * `lasuite_visio:rooms:create` – Create new rooms.
-    * `lasuite_visio:rooms:update` – Update the access level and configuration of existing rooms.
+    * `lasuite_visio:rooms:update` – **Coming soon** Update existing rooms, e.g., add attendees to a room.
    * `lasuite_visio:rooms:delete` – **Coming soon** Delete rooms generated by the application.
    
    #### Upcoming Features
@@ -206,67 +206,6 @@ paths:
        '404':
          $ref: '#/components/responses/RoomNotFoundError'

-    patch:
-      tags:
-        - Rooms
-      summary: Update a room
-      description: |
-        Partially updates a room. Only rooms where the user is administrator or
-        owner can be updated; any other role gets a `403`.
-
-        **Updatable fields:** `access_level` and `configuration`. Every other field
-        (`id`, `name`, `slug`, `pin_code`) is read-only and silently ignored when sent.
-
-        `configuration` is replaced as a whole, it is not merged with the stored one.
-        Send the complete object you want the room to end up with.
-
-        Full replacement (`PUT`) is not supported. Use `PATCH` instead.
-      operationId: updateRoom
-      security:
-        - BearerAuth: [rooms:update]
-      parameters:
-        - name: id
-          in: path
-          required: true
-          description: Room UUID
-          schema:
-            type: string
-            format: uuid
-      requestBody:
-        required: true
-        content:
-          application/json:
-            schema:
-              $ref: '#/components/schemas/RoomUpdate'
-            examples:
-              accessLevelOnly:
-                summary: Change the access level
-                value:
-                  access_level: "restricted"
-              configurationOnly:
-                summary: Replace the room configuration
-                value:
-                  configuration:
-                    everyone_can_mute: true
-      responses:
-        '200':
-          description: Room updated successfully
-          content:
-            application/json:
-              schema:
-                $ref: '#/components/schemas/Room'
-        '400':
-          $ref: '#/components/responses/BadRequestError'
-        '401':
-          $ref: '#/components/responses/UnauthorizedError'
-        '403':
-          $ref: '#/components/responses/ForbiddenError'
-        '404':
-          $ref: '#/components/responses/RoomNotFoundError'
-        '405':
-          description: |
-            Method not allowed, `PUT` is not supported on this endpoint.
-
 components:
  securitySchemes:
    BearerAuth:
@@ -288,17 +227,6 @@ components:
        configuration:
          $ref: '#/components/schemas/RoomConfiguration'

-    RoomUpdate:
-      type: object
-      description: |
-        Fields that can be updated on an existing room. Both are optional, omitted
-        fields keep their current value.
-      properties:
-        access_level:
-          $ref: '#/components/schemas/RoomAccessLevel'
-        configuration:
-          $ref: '#/components/schemas/RoomConfiguration'
-
    RoomConfiguration:
      type: object
      description: |
@@ -340,9 +268,6 @@ components:
        - `public`: Anyone with the room link can join directly, no authentication required.
        - `trusted`: Authenticated users join directly. Unauthenticated users wait in the lobby for approval.
        - `restricted`: Only participants explicitly trusted by the owner bypass the lobby. Everyone else waits for approval regardless of authentication.
-
-        `public` is rejected with a `400` unless the deployment explicitly enables it
-        for this API. This applies both when creating a room and when updating one.
      example: "trusted"

    Room:
@@ -11,14 +11,14 @@ There are two ways to customize LaSuite Meet:

 ### How to Use

-To use this feature, simply set the `FRONTEND_CUSTOM_CSS_URL` environment variable (of the **backend** service) to the URL of your custom CSS file. For example:
+To use this feature, simply set the `FRONTEND_CSS_URL` environment variable to the URL of your custom CSS file. For example:

 ```javascript
-FRONTEND_CUSTOM_CSS_URL=https://example.com/custom-style.css
+FRONTEND_CSS_URL=https://example.com/custom-style.css
 ```

 > [!TIP]
-> If you serve your CSS file on the same domain as LaSuite Meet, paths are supported, i.e. `FRONTEND_CUSTOM_CSS_URL=/custom/style.css` will load `https://your-domain.com/custom/style.css`.
+> If you serve your CSS file on the same domain as LaSuite Meet, paths are supported, i.e. `FRONTEND_CSS_URL=/custom/style.css` will load `https://your-domain.com/custom/style.css`.

 Setting this variable makes the app load your CSS at runtime, adding a `<link>` to `<head>` so you can override CSS variables and customize the frontend without rebuilding.

@@ -34,11 +34,10 @@ Let's say you want to change the font of our application to a custom font. You c

 :root {
  --fonts-sans: 'Roboto', ui-sans-serif, system-ui, sans-serif;
-  --avatar-cap-height: 0.7;
 }
 ```

-Then, set the `FRONTEND_CUSTOM_CSS_URL` environment variable to the URL of your custom CSS file. Once you've done this, our application will load your custom CSS file and apply the styles, changing the default font to the one you specified.
+Then, set the `FRONTEND_CSS_URL` environment variable to the URL of your custom CSS file. Once you've done this, our application will load your custom CSS file and apply the styles, changing the default font to the one you specified.

 > [!IMPORTANT]
 > You can override any CSS token—semantic or palette. See [panda.config.ts](../src/frontend/panda.config.ts) for all defined semantic tokens.
@@ -63,6 +63,8 @@ ALLOW_UNREGISTERED_ROOMS=False

 # Recording
 RECORDING_ENABLE=True
+RECORDING_STORAGE_EVENT_ENABLE=True
+RECORDING_STORAGE_EVENT_TOKEN=password
 SUMMARY_SERVICE_ENDPOINT=http://app-summary-dev:8000/api/v2/async-jobs/transcribe/
 SUMMARY_SERVICE_API_TOKEN=password
 SUMMARY_SERVICE_WEBHOOK_API_TOKEN=webhook-password
@@ -83,10 +85,6 @@ RECORDING_DOWNLOAD_BASE_URL=http://localhost:3000/recording
 # Telephony
 ROOM_TELEPHONY_ENABLED=True

-# RoomKit
-# ROOMKIT_ENABLED = True
-# ROOMKIT_SERVER_TO_SERVER_API_TOKEN = ThisIsAnExampleKeyForDevPurposeOnly
-
 # Metadata
 METADATA_COLLECTOR_ENABLED=True

@@ -102,6 +100,3 @@ APPLICATION_JWT_AUDIENCE=http://localhost:8071/external-api/v1.0/
 APPLICATION_JWT_SECRET_KEY=devKey
 APPLICATION_BASE_URL=http://localhost:3000

-# Diagnostics
-CONNECTION_TEST_ENABLED = True
-
@@ -1,23 +1,14 @@
-AWS_S3_ENDPOINT_URL=minio:9000
-AWS_S3_ACCESS_KEY_ID=meet
-AWS_S3_SECRET_ACCESS_KEY=password
-
 LIVEKIT_URL=ws://livekit:7880
 LIVEKIT_API_KEY=devkey
 LIVEKIT_API_SECRET=secret

-STT_PROVIDER=voxtral-vllm # voxtral-vllm, kyutai, deepgram
+STT_PROVIDER=kyutai # kyutai, deepgram
 ENABLE_SILERO_VAD=False

-DEEPGRAM_API_KEY=your-deepgram-api-key
+DEEPGRAM_API_KEY=

-KYUTAI_STT_BASE_URL=url
-KYUTAI_API_KEY=your-kyutai-api-key
-
-VOXTRAL_VLLM_BASE_URL=wss://<host>/v1/realtime
-VOXTRAL_VLLM_MODEL=voxtral-mini-4b-realtime-2602
-VOXTRAL_VLLM_API_KEY=your-vllm-api-key
-VOXTRAL_VLLM_TARGET_STREAMING_DELAY_MS=480
+KYUTAI_STT_BASE_URL=
+KYUTAI_API_KEY=

 SENTRY_DSN=
 SENTRY_ENVIRONMENT=
@@ -3,14 +3,14 @@ Gitlint extra rule to validate that the message title is of the form
 "<gitmoji>(<scope>) <subject>"
 """

-import json
+from __future__ import unicode_literals
+
 import re
-import urllib.request
+
+import requests

 from gitlint.rules import CommitMessageTitle, LineRule, RuleViolation

-GITMOJIS_URL = "https://raw.githubusercontent.com/carloscuesta/gitmoji/master/packages/gitmojis/src/gitmojis.json"
-

 class GitmojiTitle(LineRule):
    """
@@ -28,9 +28,10 @@ class GitmojiTitle(LineRule):
        Download the list possible gitmojis from the project's github repository and check that
        title contains one of them.
        """
-        with urllib.request.urlopen(GITMOJIS_URL, timeout=10) as response:
-            gitmojis = json.load(response)["gitmojis"]
-        emojis = [re.escape(item["emoji"]) for item in gitmojis]
+        gitmojis = requests.get(
+            "https://raw.githubusercontent.com/carloscuesta/gitmoji/master/packages/gitmojis/src/gitmojis.json"
+        ).json()["gitmojis"]
+        emojis = [item["emoji"] for item in gitmojis]
        pattern = r"^({:s})\(.*\)\s[a-z].*$".format("|".join(emojis))
        if not re.search(pattern, title):
            violation_msg = 'Title does not match regex "<gitmoji>(<scope>) <subject>"'
@@ -1,52 +0,0 @@
-publiccodeYmlVersion: 0.5.0
-name: LaSuite Meet
-applicationSuite: LaSuite
-url: https://github.com/suitenumerique/meet
-releaseDate: 2026-07-22
-platforms:
-  - web
-organisation:
-  name: DINUM
-  uri: https://numerique.gouv.fr
-fundedBy:
-  - name: Direction interministérielle du numérique (DINUM)
-    uri: https://www.numerique.gouv.fr
-developmentStatus: stable
-softwareType: standalone/web
-intendedAudience:
-  countries:
-    - FR
-description:
-  en:
-    localisedName: LaSuite Meet
-    shortDescription: "Open Source video conference solution, based on LiveKit"
-    longDescription: "Open Source video conference application, based on LiveKit,
-      Django and React. It is the official web video conference application of
-      French Ministries."
-    features:
-      - Optimized for stability in large meetings (+100 p.)
-      - Support for multiple screen sharing streams
-      - Non-persistent, secure chat
-      - Meeting recording
-      - Meeting transcription & Summary
-      - Telephony integration
-      - Secure participation with robust authentication and access control
-      - Customizable frontend style
-legal:
-  license: MIT
-maintenance:
-  type: internal
-  contacts:
-    - name: "Samuel Paccoud"
-      email: samuel.paccoud@numerique.gouv.fr
-      affiliation: DINUM
-    - name: "Antoine Lebaud"
-      email: antoine.lebaud.ext@numerique.gouv.fr
-      affiliation: DINUM
-localisation:
-  localisationReady: true
-  availableLanguages:
-    - fr
-    - de
-    - en
-    - nl
@@ -1,7 +1,7 @@
 <?xml version="1.0" encoding="UTF-8" standalone="yes"?>
 <OfficeApp xmlns="http://schemas.microsoft.com/office/appforoffice/1.1" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xmlns:bt="http://schemas.microsoft.com/office/officeappbasictypes/1.0" xmlns:mailappor="http://schemas.microsoft.com/office/mailappversionoverrides/1.0" xsi:type="MailApp">
  <Id>a025f0f6-757a-4790-97f3-99c66c4a5795</Id>
-  <Version>1.0.0.0</Version>
+  <Version>0.0.2.0</Version>
  <ProviderName>__APP_NAME__</ProviderName>
  <DefaultLocale>fr-FR</DefaultLocale>
  <DisplayName DefaultValue="__APP_NAME__"/>
@@ -205,174 +205,5 @@
        </bt:String>
      </bt:LongStrings>
    </Resources>
-
-    <!-- ─── V1.1 override: required for shared folder / delegate support ─── -->
-    <VersionOverrides xmlns="http://schemas.microsoft.com/office/mailappversionoverrides/1.1" xsi:type="VersionOverridesV1_1">
-      <Requirements>
-        <bt:Sets DefaultMinVersion="1.8">
-          <bt:Set Name="Mailbox"/>
-        </bt:Sets>
-      </Requirements>
-      <Hosts>
-        <Host xsi:type="MailHost">
-          <DesktopFormFactor>
-            <FunctionFile resid="Commands.Url"/>
-            <SupportsSharedFolders>true</SupportsSharedFolders>
-
-            <!-- ─── Mail: Read ─────────────────────────────────────────── -->
-            <ExtensionPoint xsi:type="MessageReadCommandSurface">
-              <OfficeTab id="TabDefault">
-                <Group id="msgReadGroup">
-                  <Label resid="GroupLabel"/>
-                  <Control xsi:type="Button" id="msgReadOpenPaneButton">
-                    <Label resid="TaskpaneButton.Label"/>
-                    <Supertip>
-                      <Title resid="TaskpaneButton.Label"/>
-                      <Description resid="TaskpaneButton.Tooltip"/>
-                    </Supertip>
-                    <Icon>
-                      <bt:Image size="16" resid="Icon.16x16"/>
-                      <bt:Image size="32" resid="Icon.32x32"/>
-                      <bt:Image size="80" resid="Icon.80x80"/>
-                    </Icon>
-                    <Action xsi:type="ShowTaskpane">
-                      <SourceLocation resid="Taskpane.Url"/>
-                    </Action>
-                  </Control>
-                </Group>
-              </OfficeTab>
-            </ExtensionPoint>
-
-            <!-- ─── Mail: Compose ─────────────────────────────────────── -->
-            <ExtensionPoint xsi:type="MessageComposeCommandSurface">
-              <OfficeTab id="TabDefault">
-                <Group id="msgComposeGroup">
-                  <Label resid="GroupLabel"/>
-                  <Control xsi:type="Button" id="msgComposeGenerateLinkButton">
-                    <Label resid="GenerateLink.Label"/>
-                    <Supertip>
-                      <Title resid="GenerateLink.Label"/>
-                      <Description resid="GenerateLink.Tooltip"/>
-                    </Supertip>
-                    <Icon>
-                      <bt:Image size="16" resid="Icon.16x16"/>
-                      <bt:Image size="32" resid="Icon.32x32"/>
-                      <bt:Image size="80" resid="Icon.80x80"/>
-                    </Icon>
-                    <Action xsi:type="ExecuteFunction">
-                      <FunctionName>generateMeetingLinkFromMail</FunctionName>
-                    </Action>
-                  </Control>
-                  <Control xsi:type="Button" id="msgComposeOpenPaneButton">
-                    <Label resid="TaskpaneButton.Label"/>
-                    <Supertip>
-                      <Title resid="TaskpaneButton.Label"/>
-                      <Description resid="TaskpaneButton.Tooltip"/>
-                    </Supertip>
-                    <Icon>
-                      <bt:Image size="16" resid="Settings.16x16"/>
-                      <bt:Image size="32" resid="Settings.32x32"/>
-                      <bt:Image size="80" resid="Settings.80x80"/>
-                    </Icon>
-                    <Action xsi:type="ShowTaskpane">
-                      <SourceLocation resid="Taskpane.Url"/>
-                    </Action>
-                  </Control>
-                </Group>
-              </OfficeTab>
-            </ExtensionPoint>
-
-            <!-- ─── Calendar: Compose (New/Edit appointment) ──────────── -->
-            <ExtensionPoint xsi:type="AppointmentOrganizerCommandSurface">
-              <OfficeTab id="TabDefault">
-                <Group id="apptComposeGroup">
-                  <Label resid="GroupLabel"/>
-                  <Control xsi:type="Button" id="apptGenerateLinkButton">
-                    <Label resid="GenerateLink.Label"/>
-                    <Supertip>
-                      <Title resid="GenerateLink.Label"/>
-                      <Description resid="GenerateLink.Tooltip"/>
-                    </Supertip>
-                    <Icon>
-                      <bt:Image size="16" resid="Icon.16x16"/>
-                      <bt:Image size="32" resid="Icon.32x32"/>
-                      <bt:Image size="80" resid="Icon.80x80"/>
-                    </Icon>
-                    <Action xsi:type="ExecuteFunction">
-                      <FunctionName>generateMeetingLinkFromCalendar</FunctionName>
-                    </Action>
-                  </Control>
-
-                  <Control xsi:type="Button" id="apptOpenSettingsButton">
-                    <Label resid="OpenSettings.Label"/>
-                    <Supertip>
-                      <Title resid="OpenSettings.Label"/>
-                      <Description resid="OpenSettings.Tooltip"/>
-                    </Supertip>
-                    <Icon>
-                      <bt:Image size="16" resid="Settings.16x16"/>
-                      <bt:Image size="32" resid="Settings.32x32"/>
-                      <bt:Image size="80" resid="Settings.80x80"/>
-                    </Icon>
-                    <Action xsi:type="ShowTaskpane">
-                      <SourceLocation resid="Taskpane.Url"/>
-                    </Action>
-                  </Control>
-
-                </Group>
-              </OfficeTab>
-            </ExtensionPoint>
-
-          </DesktopFormFactor>
-        </Host>
-      </Hosts>
-      <Resources>
-        <bt:Images>
-          <bt:Image id="Settings.16x16" DefaultValue="https://localhost:3000/addons/outlook/assets/settings-16.png"/>
-          <bt:Image id="Settings.32x32" DefaultValue="https://localhost:3000/addons/outlook/assets/settings-32.png"/>
-          <bt:Image id="Settings.80x80" DefaultValue="https://localhost:3000/addons/outlook/assets/settings-80.png"/>
-          <bt:Image id="Add.16x16" DefaultValue="https://localhost:3000/addons/outlook/assets/add-16.png"/>
-          <bt:Image id="Add.32x32" DefaultValue="https://localhost:3000/addons/outlook/assets/add-32.png"/>
-          <bt:Image id="Add.80x80" DefaultValue="https://localhost:3000/addons/outlook/assets/add-80.png"/>
-          <bt:Image id="Icon.16x16" DefaultValue="https://localhost:3000/addons/outlook/assets/icon-16.png"/>
-          <bt:Image id="Icon.32x32" DefaultValue="https://localhost:3000/addons/outlook/assets/icon-32.png"/>
-          <bt:Image id="Icon.80x80" DefaultValue="https://localhost:3000/addons/outlook/assets/icon-80.png"/>
-        </bt:Images>
-        <bt:Urls>
-          <bt:Url id="Commands.Url" DefaultValue="https://localhost:3000/addons/outlook/commands.html"/>
-          <bt:Url id="Taskpane.Url" DefaultValue="https://localhost:3000/addons/outlook/taskpane.html"/>
-        </bt:Urls>
-        <bt:ShortStrings>
-          <!-- Default (French) -->
-          <bt:String id="GroupLabel" DefaultValue="__APP_NAME__"/>
-          <bt:String id="GenerateLink.Label" DefaultValue="Ajouter un lien __APP_NAME__">
-            <bt:Override Locale="en-US" Value="Add a __APP_NAME__ link"/>
-            <bt:Override Locale="de-DE" Value="__APP_NAME__-Link hinzufügen"/>
-          </bt:String>
-          <bt:String id="TaskpaneButton.Label" DefaultValue="Ouvrir les paramètres">
-            <bt:Override Locale="en-US" Value="Open settings"/>
-            <bt:Override Locale="de-DE" Value="Einstellungen öffnen"/>
-          </bt:String>
-          <bt:String id="OpenSettings.Label" DefaultValue="Paramètres">
-            <bt:Override Locale="en-US" Value="Settings"/>
-            <bt:Override Locale="de-DE" Value="Einstellungen"/>
-          </bt:String>
-        </bt:ShortStrings>
-        <bt:LongStrings>
-          <bt:String id="GenerateLink.Tooltip" DefaultValue="Génère un lien de réunion __APP_NAME__ et l'insère dans l'événement.">
-            <bt:Override Locale="de-DE" Value="Generiert einen __APP_NAME__-Besprechungslink und fügt ihn in den Termin ein."/>
-            <bt:Override Locale="en-US" Value="Generates a __APP_NAME__ meeting link and inserts it into the item."/>
-          </bt:String>
-          <bt:String id="TaskpaneButton.Tooltip" DefaultValue="Ouvre les paramètres de connexion __APP_NAME__.">
-            <bt:Override Locale="de-DE" Value="Öffnet die __APP_NAME__-Verbindungseinstellungen."/>
-            <bt:Override Locale="en-US" Value="Opens the __APP_NAME__ connection settings."/>
-          </bt:String>
-          <bt:String id="OpenSettings.Tooltip" DefaultValue="Ouvre les paramètres de connexion __APP_NAME__.">
-            <bt:Override Locale="de-DE" Value="Öffnet die __APP_NAME__-Verbindungseinstellungen."/>
-            <bt:Override Locale="en-US" Value="Opens the __APP_NAME__ connection settings."/>
-          </bt:String>
-        </bt:LongStrings>
-      </Resources>
-    </VersionOverrides>
  </VersionOverrides>
 </OfficeApp>
@@ -9,8 +9,8 @@
      "version": "0.0.1",
      "license": "MIT",
      "dependencies": {
-        "core-js": "3.50.0",
-        "i18next": "26.4.2",
+        "core-js": "3.49.0",
+        "i18next": "26.3.1",
        "i18next-browser-languagedetector": "8.2.1",
        "regenerator-runtime": "0.14.1"
      },
@@ -6863,14 +6863,11 @@
      }
    },
    "node_modules/core-js": {
-      "version": "3.50.0",
-      "resolved": "https://registry.npmjs.org/core-js/-/core-js-3.50.0.tgz",
-      "integrity": "sha512-BRWgOLKkFeCgRudR6zrs8p9XJZcE14grzKMMssoYrk6krtuEZ7MTKPIY5RzOnqsEKIR9kst7wNzphttraT+Yqw==",
+      "version": "3.49.0",
+      "resolved": "https://registry.npmjs.org/core-js/-/core-js-3.49.0.tgz",
+      "integrity": "sha512-es1U2+YTtzpwkxVLwAFdSpaIMyQaq0PBgm3YD1W3Qpsn1NAmO3KSgZfu+oGSWVu6NvLHoHCV/aYcsE5wiB7ALg==",
      "hasInstallScript": true,
      "license": "MIT",
-      "engines": {
-        "node": "*"
-      },
      "funding": {
        "type": "opencollective",
        "url": "https://opencollective.com/core-js"
@@ -9367,9 +9364,9 @@
      }
    },
    "node_modules/i18next": {
-      "version": "26.4.2",
-      "resolved": "https://registry.npmjs.org/i18next/-/i18next-26.4.2.tgz",
-      "integrity": "sha512-RX+R0VLg13IbvRuJSxnqykUFS9vQZTl8wYpWPCIUDWVrSGjsQywB5Y+pjzrkboxGAuYfJZVH1InFTdgBdxq6ug==",
+      "version": "26.3.1",
+      "resolved": "https://registry.npmjs.org/i18next/-/i18next-26.3.1.tgz",
+      "integrity": "sha512-txQqd5EULsqEh9OJqRH15aCaOuy/nLJyhw5EHCSKLKJE1aBbb3Zve2+uQIxgWhPm1QqUQoWyQBm2kfmmIrzkcQ==",
      "funding": [
        {
          "type": "individual",
@@ -9386,7 +9383,7 @@
      ],
      "license": "MIT",
      "peerDependencies": {
-        "typescript": "^5 || ^6 || ^7"
+        "typescript": "^5 || ^6"
      },
      "peerDependenciesMeta": {
        "typescript": {
@@ -26,8 +26,8 @@
    "watch": "webpack --mode development --watch"
  },
  "dependencies": {
-    "core-js": "3.50.0",
-    "i18next": "26.4.2",
+    "core-js": "3.49.0",
+    "i18next": "26.3.1",
    "i18next-browser-languagedetector": "8.2.1",
    "regenerator-runtime": "0.14.1"
  },
@@ -57,7 +57,8 @@
       data-i18n="footer.feedback"
    ></a>
    <div id="footer-right">
-        <span class="version-number">1.0.0</span>
+        <span class="version-badge">beta</span>
+        <span class="version-number">0.0.2</span>
    </div>
 </footer>
 </body>
@@ -1,11 +1,9 @@
 FROM python:3.14.6-slim AS base

-# Install system dependencies required by LiveKit, fetching packages over HTTPS only for Bureautix proxy
-RUN sed -i "s|^URIs: http://|URIs: https://|" /etc/apt/sources.list.d/debian.sources \
-    && apt-get update && apt-get install -y --no-install-recommends  \
+# Install system dependencies required by LiveKit
+RUN apt-get update && apt-get install -y \
    libglib2.0-0 \
    libgobject-2.0-0 \
-    libssl3t64 \
    && rm -rf /var/lib/apt/lists/*


@@ -1,7 +1,6 @@
 """Multi user transcription agent."""

 import asyncio
-import contextlib
 import logging
 import os

@@ -26,7 +25,6 @@ from livekit.agents import (
 )
 from livekit.plugins import deepgram, silero

-import voxtral_vllm_stt
 from observability import configure_sentry, set_job_context
 from tasks import done_callback

@@ -38,18 +36,9 @@ TRANSCRIBER_AGENT_NAME = os.getenv("TRANSCRIBER_AGENT_NAME", "multi-user-transcr
 STT_PROVIDER = os.getenv("STT_PROVIDER", "deepgram")
 ENABLE_SILERO_VAD = os.getenv("ENABLE_SILERO_VAD", "true").lower() == "true"

-SESSION_DRAIN_TIMEOUT_S = 15.0

-
-def create_stt_provider(vad: silero.VAD | None = None):
-    """Create STT provider based on environment configuration.
-
-    Args:
-        vad: Shared, prewarmed VAD instance. Required in practice for
-            voxtral-vllm (no server-side endpointing): if omitted, the plugin
-            loads its own Silero model synchronously on the event loop, once
-            per participant, freezing all active sessions for the duration.
-    """
+def create_stt_provider():
+    """Create STT provider based on environment configuration."""
    if STT_PROVIDER == "deepgram":
        # Note: Not all Deepgram API parameters are supported by the LiveKit plugin
        # detect_language is NOT supported for real-time streaming
@@ -60,9 +49,6 @@ def create_stt_provider(vad: silero.VAD | None = None):
        )
    elif STT_PROVIDER == "kyutai":
        _stt_instance = kyutai.STT(base_url=os.getenv("KYUTAI_STT_BASE_URL"))
-    elif STT_PROVIDER == "voxtral-vllm":
-        # The plugin resolves base_url / model / api_key from the environment.
-        _stt_instance = voxtral_vllm_stt.STT(vad=vad)
    else:
        raise ValueError(f"Unknown STT_PROVIDER: {STT_PROVIDER}")

@@ -72,9 +58,9 @@ def create_stt_provider(vad: silero.VAD | None = None):
 class Transcriber(Agent):
    """Create a transcription agent for a specific participant."""

-    def __init__(self, *, participant_identity: str, vad: silero.VAD | None = None):
+    def __init__(self, *, participant_identity: str):
        """Init transcription agent."""
-        stt = create_stt_provider(vad=vad)
+        stt = create_stt_provider()

        super().__init__(
            instructions="not-needed",
@@ -90,7 +76,6 @@ class MultiUserTranscriber:
        """Init multi user transcription agent."""
        self.ctx = ctx
        self._sessions: dict[str, AgentSession] = {}
-        self._starting: dict[str, asyncio.Task] = {}
        self._tasks: set[asyncio.Task] = set()

    def start(self):
@@ -111,30 +96,22 @@ class MultiUserTranscriber:

    def on_participant_connected(self, participant: rtc.RemoteParticipant):
        """Handle new participant connection by starting transcription session."""
-        identity = participant.identity
-        if identity in self._sessions or identity in self._starting:
+        if participant.identity in self._sessions:
            return

-        logger.info(f"starting session for {identity}")
+        logger.info(f"starting session for {participant.identity}")
        task = asyncio.create_task(self._start_session(participant))
-        self._starting[identity] = task
        self._tasks.add(task)
-        task.add_done_callback(lambda t, i=identity: self._starting.pop(i, None))
        task.add_done_callback(
            done_callback(
                logger,
                self._tasks,
-                f"start transcription session for {identity}",
+                f"start transcription session for {participant.identity}",
            )
        )

    def on_participant_disconnected(self, participant: rtc.RemoteParticipant):
        """Handle participant disconnection by closing transcription session."""
-        if (start_task := self._starting.pop(participant.identity, None)) is not None:
-            logger.info(f"cancelling pending session start for {participant.identity}")
-            start_task.cancel()
-            return
-
        if (session := self._sessions.pop(participant.identity, None)) is None:
            return

@@ -150,12 +127,10 @@ class MultiUserTranscriber:
        )

    async def _start_session(self, participant: rtc.RemoteParticipant) -> AgentSession:
-        """Create and start transcription session for participant.
+        """Create and start transcription session for participant."""
+        if participant.identity in self._sessions:
+            return self._sessions[participant.identity]

-        Deduplication happens synchronously in on_participant_connected via
-        self._starting; by the time this coroutine runs, the identity is
-        already reserved.
-        """
        vad = self.ctx.proc.userdata.get("vad", None)
        session = AgentSession(vad=vad)
        room_io = RoomIO(
@@ -166,30 +141,18 @@ class MultiUserTranscriber:
                text_input=False, audio_output=False, text_output=True
            ),
        )
-        try:
-            await room_io.start()
-            await session.start(
-                agent=Transcriber(
-                    participant_identity=participant.identity,
-                    vad=vad,
-                )
+        await room_io.start()
+        await session.start(
+            agent=Transcriber(
+                participant_identity=participant.identity,
            )
-        except BaseException:
-            with contextlib.suppress(Exception):
-                await session.aclose()
-            raise
+        )
        self._sessions[participant.identity] = session
        return session

    async def _close_session(self, sess: AgentSession) -> None:
        """Close and cleanup transcription session."""
-        try:
-            await asyncio.wait_for(sess.drain(), timeout=SESSION_DRAIN_TIMEOUT_S)
-        except (TimeoutError, asyncio.TimeoutError):
-            logger.warning(
-                "session drain timed out after %.0fs; forcing close",
-                SESSION_DRAIN_TIMEOUT_S,
-            )
+        await sess.drain()
        await sess.aclose()


@@ -1,24 +1,22 @@

 [project]
 name = "agents"
-version = "1.32.1"
+version = "1.23.0"
 requires-python = ">=3.12"
 dependencies = [
-    "livekit-agents==1.6.7",
-    "livekit-plugins-deepgram==1.6.7",
-    "livekit-plugins-silero==1.6.7",
+    "livekit-agents==1.6.4",
+    "livekit-plugins-deepgram==1.6.4",
+    "livekit-plugins-silero==1.6.4",
    "livekit-plugins-kyutai-lasuite==0.0.6",
    "python-dotenv==1.2.2",
    "protobuf==6.33.6",
    "minio==7.2.20",
-    "sentry-sdk==2.66.1",
-    "websockets==17.1",
-    "httpx==0.28.1",
+    "sentry-sdk==2.60.0",
 ]

 [project.optional-dependencies]
 dev = [
-    "ruff==0.16.0",
+    "ruff==0.15.19",
 ]

 [tool.uv]
@@ -1,476 +0,0 @@
-"""LiveKit STT plugin for Voxtral Realtime served via vLLM (/v1/realtime).
-
-vLLM exposes Voxtral Realtime over a WebSocket that follows the OpenAI Realtime
-API protocol (not Mistral's proprietary realtime protocol).
-"""
-
-from __future__ import annotations
-
-import asyncio
-import base64
-import json
-import logging
-import os
-import weakref
-from collections import deque
-from dataclasses import dataclass, field
-
-import websockets
-from livekit.agents import (
-    DEFAULT_API_CONNECT_OPTIONS,
-    APIConnectionError,
-    APIConnectOptions,
-    APIStatusError,
-    stt,
-    utils,
-)
-from livekit.agents import (
-    vad as vad_module,
-)
-from livekit.agents.types import NOT_GIVEN, NotGivenOr
-from livekit.agents.utils import is_given
-
-logger = logging.getLogger("voxtral-vllm-stt")
-
-SAMPLE_RATE = 16000
-NUM_CHANNELS = 1
-CHUNK_SAMPLES = 1600  # 100 ms @ 16 kHz mono
-PREROLL_CHUNKS = 5  # keep 500 ms of audio before start of speech as detected by VAD
-
-# Reconnect policy: exponential backoff capped at MAX, give up after MAX_ATTEMPTS
-# consecutive failures (a successful handshake resets the counter).
-RECONNECT_BACKOFF_BASE_S = 0.5
-RECONNECT_BACKOFF_MAX_S = 8.0
-RECONNECT_MAX_ATTEMPTS = 5
-
-
-@dataclass
-class _STTOptions:
-    base_url: str
-    model: str
-    api_key: str | None
-    target_streaming_delay_ms: int | None
-
-
-@dataclass
-class _PendingUtterance:
-    """An utterance in flight on the shared websocket used for reconnect.
-
-    `sent_chunks` holds every chunk we have already enqueued for send on this
-    or a prior connection; on reconnect we replay them before resuming reads
-    from `queue`. vLLM concatenates `input_audio_buffer.append` events into a
-    single audio buffer per generation, so duplicates from a partial prior send
-    are harmless.
-    """
-
-    queue: asyncio.Queue[bytes | None]
-    sent_chunks: list[bytes] = field(default_factory=list)
-    ended: bool = False
-
-
-class STT(stt.STT):
-    """LiveKit STT speaking the OpenAI Realtime protocol served by vLLM."""
-
-    def __init__(
-        self,
-        *,
-        base_url: NotGivenOr[str] = NOT_GIVEN,
-        model: NotGivenOr[str] = NOT_GIVEN,
-        api_key: NotGivenOr[str] = NOT_GIVEN,
-        target_streaming_delay_ms: NotGivenOr[int] = NOT_GIVEN,
-        vad: vad_module.VAD | None = None,
-    ) -> None:
-        """Build the STT.
-
-        Args:
-            base_url: WebSocket URL of the vLLM realtime endpoint, e.g.
-                ws://example:8000/v1/realtime. Falls back to $VOXTRAL_VLLM_BASE_URL.
-            model: Model name exposed by vLLM, default
-                mistralai/Voxtral-Mini-4B-Realtime-2602.
-            api_key: Optional bearer token. Falls back to $VOXTRAL_VLLM_API_KEY.
-            target_streaming_delay_ms: Target streaming delay in ms forwarded to
-                vLLM via session.update. Falls back to
-                $VOXTRAL_VLLM_TARGET_STREAMING_DELAY_MS, else server default.
-            vad: Voice Activity Detector. If omitted, Silero VAD is loaded.
-        """
-        super().__init__(
-            capabilities=stt.STTCapabilities(streaming=True, interim_results=True)
-        )
-
-        resolved_url = (
-            base_url
-            if is_given(base_url)
-            else os.environ.get(
-                "VOXTRAL_VLLM_BASE_URL", "ws://127.0.0.1:8000/v1/realtime"
-            )
-        )
-        resolved_model = (
-            model
-            if is_given(model)
-            else os.environ.get(
-                "VOXTRAL_VLLM_MODEL", "mistralai/Voxtral-Mini-4B-Realtime-2602"
-            )
-        )
-        resolved_key = (
-            api_key if is_given(api_key) else os.environ.get("VOXTRAL_VLLM_API_KEY")
-        )
-        resolved_delay = (
-            target_streaming_delay_ms
-            if is_given(target_streaming_delay_ms)
-            else (
-                int(os.environ["VOXTRAL_VLLM_TARGET_STREAMING_DELAY_MS"])
-                if os.environ.get("VOXTRAL_VLLM_TARGET_STREAMING_DELAY_MS")
-                else None
-            )
-        )
-
-        if vad is None:
-            try:
-                from livekit.plugins.silero import VAD as SileroVAD  # noqa: PLC0415
-            except ImportError as exc:
-                raise ImportError(
-                    "livekit-plugins-silero is required for vLLM Voxtral realtime "
-                    "(no server-side endpointing)."
-                ) from exc
-            vad = SileroVAD.load()
-        self._vad = vad
-
-        self._opts = _STTOptions(
-            base_url=resolved_url,
-            model=resolved_model,
-            api_key=resolved_key,
-            target_streaming_delay_ms=resolved_delay,
-        )
-        self._streams: weakref.WeakSet[SpeechStream] = weakref.WeakSet()
-
-    @property
-    def model(self) -> str:
-        """Return the configured vLLM model name."""
-        return self._opts.model
-
-    @property
-    def provider(self) -> str:
-        """Return the provider identifier."""
-        return "vllm-voxtral-realtime"
-
-    async def _recognize_impl(self, *_args, **_kwargs) -> stt.SpeechEvent:
-        raise NotImplementedError(
-            "vLLM Voxtral Realtime STT only supports streaming recognition."
-        )
-
-    def stream(
-        self,
-        *,
-        conn_options: APIConnectOptions = DEFAULT_API_CONNECT_OPTIONS,
-    ) -> SpeechStream:
-        """Open a new streaming recognition stream."""
-        s = SpeechStream(
-            stt=self,
-            opts=self._opts,
-            vad_instance=self._vad,
-            conn_options=conn_options,
-        )
-        self._streams.add(s)
-        return s
-
-
-class SpeechStream(stt.RecognizeStream):
-    """Voxtral realtime handler."""
-
-    def __init__(
-        self,
-        *,
-        stt: STT,
-        opts: _STTOptions,
-        vad_instance: vad_module.VAD,
-        conn_options: APIConnectOptions,
-    ) -> None:
-        """Init the speech stream."""
-        super().__init__(stt=stt, conn_options=conn_options, sample_rate=SAMPLE_RATE)
-        self._opts = opts
-        self._vad = vad_instance
-        self._utterance_q: asyncio.Queue[bytes | None] | None = None
-        self._speaking = False
-        self._preroll: deque[bytes] = deque(maxlen=PREROLL_CHUNKS)
-        # Voxtral realtime is strictly sequential: only one generation runs at a
-        # time, and a new `commit` is ignored while the previous one is still
-        # producing. We queue per-utterance audio buffers here and let the
-        # pipeline process them one by one on the shared websocket.
-        self._utterance_chan: asyncio.Queue[asyncio.Queue[bytes | None] | None] = (
-            asyncio.Queue()
-        )
-
-    @utils.log_exceptions(logger=logger)
-    async def _run(self) -> None:
-        vad_stream = self._vad.stream()
-
-        bstream = utils.audio.AudioByteStream(
-            sample_rate=SAMPLE_RATE,
-            num_channels=NUM_CHANNELS,
-            samples_per_channel=CHUNK_SAMPLES,
-        )
-
-        async def input_task() -> None:
-            async for data in self._input_ch:
-                if isinstance(data, self._FlushSentinel):
-                    for frame in bstream.flush():
-                        self._handle_chunk(frame.data.tobytes())
-                    continue
-
-                vad_stream.push_frame(data)
-                for frame in bstream.write(data.data.tobytes()):
-                    self._handle_chunk(frame.data.tobytes())
-
-            vad_stream.end_input()
-
-        async def vad_task() -> None:
-            async for ev in vad_stream:
-                if ev.type == vad_module.VADEventType.START_OF_SPEECH:
-                    self._on_start_of_speech()
-                elif ev.type == vad_module.VADEventType.END_OF_SPEECH:
-                    self._on_end_of_speech()
-
-        pipeline_t = asyncio.create_task(self._utterance_pipeline())
-        try:
-            await asyncio.gather(input_task(), vad_task())
-            # signal end-of-stream; pipeline finishes pending utterances first
-            self._utterance_chan.put_nowait(None)
-            await pipeline_t
-        except (APIStatusError, APIConnectionError, asyncio.CancelledError):
-            raise
-        except Exception as exc:
-            logger.exception("vLLM realtime stream failed")
-            raise APIConnectionError() from exc
-        finally:
-            if not pipeline_t.done():
-                pipeline_t.cancel()
-            try:
-                await pipeline_t
-            except asyncio.CancelledError:
-                # CancelledError is the expected flow on cancel()
-                pass
-            except Exception:
-                logger.exception("utterance pipeline failed during finalize")
-            await vad_stream.aclose()
-
-    def _handle_chunk(self, chunk: bytes) -> None:
-        self._preroll.append(chunk)
-        if self._speaking and self._utterance_q is not None:
-            self._utterance_q.put_nowait(chunk)
-
-    def _on_start_of_speech(self) -> None:
-        if self._speaking:
-            return
-        self._speaking = True
-        q: asyncio.Queue[bytes | None] = asyncio.Queue()
-        for chunk in self._preroll:
-            q.put_nowait(chunk)
-        self._utterance_q = q
-        self._utterance_chan.put_nowait(q)
-        self._event_ch.send_nowait(
-            stt.SpeechEvent(type=stt.SpeechEventType.START_OF_SPEECH)
-        )
-
-    def _on_end_of_speech(self) -> None:
-        if not self._speaking:
-            return
-        self._speaking = False
-        if self._utterance_q is not None:
-            self._utterance_q.put_nowait(None)
-        self._utterance_q = None
-        self._event_ch.send_nowait(
-            stt.SpeechEvent(type=stt.SpeechEventType.END_OF_SPEECH)
-        )
-
-    async def _handshake(self, ws: websockets.ClientConnection) -> str:
-        created = json.loads(await ws.recv())
-        if created.get("type") != "session.created":
-            raise APIStatusError(
-                f"expected session.created, got {created}",
-                status_code=500,
-                body=created,
-            )
-        session_update: dict = {"type": "session.update", "model": self._opts.model}
-        if self._opts.target_streaming_delay_ms is not None:
-            session_update["target_streaming_delay_ms"] = (
-                self._opts.target_streaming_delay_ms
-            )
-        await ws.send(json.dumps(session_update))
-        return created.get("id", "")
-
-    def _auth_headers(self) -> dict[str, str]:
-        if self._opts.api_key:
-            return {"Authorization": f"Bearer {self._opts.api_key}"}
-        return {}
-
-    async def _utterance_pipeline(self) -> None:
-        # Owns the websocket lifecycle. On drop, reopens and resumes the
-        # in-flight utterance (if any) by replaying its already-sent chunks.
-        pending: _PendingUtterance | None = None
-        attempt = 0
-        while True:
-            try:
-                async with websockets.connect(
-                    self._opts.base_url,
-                    additional_headers=self._auth_headers(),
-                    open_timeout=self._conn_options.timeout,
-                ) as ws:
-                    request_id = await self._handshake(ws)
-                    attempt = 0
-                    while True:
-                        if pending is None:
-                            q = await self._utterance_chan.get()
-                            if q is None:
-                                return
-                            pending = _PendingUtterance(queue=q)
-                        await self._process_utterance(ws, pending, request_id)
-                        pending = None
-            except (websockets.WebSocketException, OSError, TimeoutError) as exc:
-                attempt += 1
-                if attempt > RECONNECT_MAX_ATTEMPTS:
-                    logger.exception(
-                        "vLLM realtime: giving up after %d reconnect attempts",
-                        RECONNECT_MAX_ATTEMPTS,
-                    )
-                    raise APIConnectionError() from exc
-                backoff = min(
-                    RECONNECT_BACKOFF_BASE_S * (2 ** (attempt - 1)),
-                    RECONNECT_BACKOFF_MAX_S,
-                )
-                if pending is None:
-                    logger.warning(
-                        "vLLM WS connection lost between utterances "
-                        "(attempt %d/%d): %s; retrying in %.1fs",
-                        attempt,
-                        RECONNECT_MAX_ATTEMPTS,
-                        exc,
-                        backoff,
-                    )
-                else:
-                    logger.warning(
-                        "vLLM WS dropped mid-utterance (%d chunks buffered, "
-                        "ended=%s, attempt %d/%d): %s; retrying in %.1fs",
-                        len(pending.sent_chunks),
-                        pending.ended,
-                        attempt,
-                        RECONNECT_MAX_ATTEMPTS,
-                        exc,
-                        backoff,
-                    )
-                await asyncio.sleep(backoff)
-
-    async def _process_utterance(
-        self,
-        ws: websockets.ClientConnection,
-        pending: _PendingUtterance,
-        request_id: str,
-    ) -> None:
-        # Start a fresh generation. Safe to send here: the previous utterance's
-        # transcription.done has already been received (we await it below), so
-        # the server-side generation_task is done and won't ignore this commit.
-        await ws.send(json.dumps({"type": "input_audio_buffer.commit"}))
-        send_t = asyncio.create_task(self._send_audio(ws, pending))
-        try:
-            await self._receive_one_transcription(ws, request_id)
-        finally:
-            if not send_t.done():
-                send_t.cancel()
-            try:
-                await send_t
-            except (asyncio.CancelledError, websockets.WebSocketException):
-                pass
-            except Exception:
-                logger.exception("send-audio task failed during finalize")
-
-    @staticmethod
-    async def _send_audio(
-        ws: websockets.ClientConnection, pending: _PendingUtterance
-    ) -> None:
-        # Replay anything already sent on a previous (now-dead) connection.
-        # sent_chunks is appended before send, so a chunk that failed to send
-        # last time is still present and gets retried here.
-        for chunk in pending.sent_chunks:
-            await ws.send(
-                json.dumps(
-                    {
-                        "type": "input_audio_buffer.append",
-                        "audio": base64.b64encode(chunk).decode("ascii"),
-                    }
-                )
-            )
-        if pending.ended:
-            await ws.send(
-                json.dumps({"type": "input_audio_buffer.commit", "final": True})
-            )
-            return
-        while True:
-            chunk = await pending.queue.get()
-            if chunk is None:
-                pending.ended = True
-                await ws.send(
-                    json.dumps({"type": "input_audio_buffer.commit", "final": True})
-                )
-                return
-            pending.sent_chunks.append(chunk)
-            await ws.send(
-                json.dumps(
-                    {
-                        "type": "input_audio_buffer.append",
-                        "audio": base64.b64encode(chunk).decode("ascii"),
-                    }
-                )
-            )
-
-    async def _receive_one_transcription(
-        self, ws: websockets.ClientConnection, request_id: str
-    ) -> None:
-        # Use recv() rather than `async for`: the latter swallows
-        # ConnectionClosed on close-mid-iteration, which would let a dropped
-        # WS look like a clean "no transcription" return.
-        current_text = ""
-        while True:
-            raw = await ws.recv()
-            data = json.loads(raw)
-            event_type = data.get("type")
-
-            if event_type == "transcription.delta":
-                delta = data.get("delta", "")
-                if not delta:
-                    continue
-                current_text += delta
-                self._event_ch.send_nowait(
-                    stt.SpeechEvent(
-                        type=stt.SpeechEventType.INTERIM_TRANSCRIPT,
-                        request_id=request_id,
-                        alternatives=[stt.SpeechData(text=current_text, language="")],
-                    )
-                )
-            elif event_type == "transcription.done":
-                final_text = data.get("text") or current_text
-                self._event_ch.send_nowait(
-                    stt.SpeechEvent(
-                        type=stt.SpeechEventType.FINAL_TRANSCRIPT,
-                        request_id=request_id,
-                        alternatives=[stt.SpeechData(text=final_text, language="")],
-                    )
-                )
-                usage = data.get("usage") or {}
-                self._event_ch.send_nowait(
-                    stt.SpeechEvent(
-                        type=stt.SpeechEventType.RECOGNITION_USAGE,
-                        request_id=request_id,
-                        recognition_usage=stt.RecognitionUsage(
-                            audio_duration=float(
-                                usage.get("audio_seconds")
-                                or usage.get("prompt_audio_seconds")
-                                or 0
-                            ),
-                            input_tokens=int(usage.get("prompt_tokens") or 0),
-                            output_tokens=int(usage.get("completion_tokens") or 0),
-                        ),
-                    )
-                )
-                return
-            elif event_type == "error":
-                err = data.get("error")
-                raise APIStatusError(str(err), status_code=500, body=data)
@@ -8,7 +8,3 @@ class AnalyticsEvent(StrEnum):

    # Rooms
    ROOM_CREATED = "room_created"
-    ROOM_UPDATED = "room_updated"
-
-    # Roomkit (meeting-room SIP devices)
-    ROOMKIT_JOINED = "roomkit_joined"
@@ -61,21 +61,13 @@ def get_frontend_configuration(request):
            ],
        },
        "telephony": build_telephony_config(),
-        "resource": {
-            "default_access_level": settings.RESOURCE_DEFAULT_ACCESS_LEVEL,
-        },
        "subtitle": {"enabled": settings.ROOM_SUBTITLE_ENABLED},
-        "diagnostics": {"connection_test_enabled": settings.CONNECTION_TEST_ENABLED},
        "livekit": {
            "url": settings.LIVEKIT_CONFIGURATION["url"],
            "force_wss_protocol": settings.LIVEKIT_FORCE_WSS_PROTOCOL,
            "enable_firefox_proxy_workaround": settings.LIVEKIT_ENABLE_FIREFOX_PROXY_WORKAROUND,
            "default_sources": settings.LIVEKIT_DEFAULT_SOURCES,
-            "default_video_codec": settings.LIVEKIT_DEFAULT_VIDEO_CODEC,
        },
-        "authenticated_users_can_edit_display_name": (
-            settings.AUTHENTICATED_PARTICIPANTS_CAN_EDIT_DISPLAY_NAME
-        ),
    }
    frontend_configuration.update(settings.FRONTEND_CONFIGURATION)
    return Response(frontend_configuration)
@@ -11,12 +11,11 @@ class FeatureFlag:

    FLAGS = {
        "recording": "RECORDING_ENABLE",
+        "storage_event": "RECORDING_STORAGE_EVENT_ENABLE",
        "subtitle": "ROOM_SUBTITLE_ENABLED",
        "file_upload": "FILE_UPLOAD_ENABLED",
        "addons": "ADDONS_ENABLED",
        "application": "APPLICATION_ENABLED",
-        "roomkit": "ROOMKIT_ENABLED",
-        "connection_test": "CONNECTION_TEST_ENABLED",
    }

    @classmethod
@@ -5,12 +5,11 @@ from django.http import Http404

 from rest_framework import permissions

-from ..models import RoleChoices, RoomAccessLevel
-from ..services.participants_management import (
-    ParticipantNotFoundException,
-    ParticipantsManagement,
-    ParticipantsManagementException,
-)
+from ..models import RoleChoices
+
+ACTION_FOR_METHOD_TO_PERMISSION = {
+    "versions_detail": {"DELETE": "versions_destroy", "GET": "versions_retrieve"}
+}


 class IsAuthenticated(permissions.BasePermission):
@@ -23,6 +22,15 @@ class IsAuthenticated(permissions.BasePermission):
        return bool(request.auth) or request.user.is_authenticated


+class IsAuthenticatedOrSafe(IsAuthenticated):
+    """Allows access to authenticated users (or anonymous users but only on safe methods)."""
+
+    def has_permission(self, request, view):
+        if request.method in permissions.SAFE_METHODS:
+            return True
+        return super().has_permission(request, view)
+
+
 class IsSelf(IsAuthenticated):
    """
    Allows access only to authenticated users. Alternative method checking the presence
@@ -158,75 +166,3 @@ class CanMuteParticipant(permissions.BasePermission):

        # LiveKit token scoped to this room
        return request.auth.video.room == str(obj.id)
-
-
-class IsPresentInMeeting(permissions.BasePermission):
-    """Check that the requesting user is currently connected to the meeting.
-
-    The requester must be session-authenticated (their DB identity is needed
-    to check privileges); presence is verified against LiveKit using their
-    `sub` as participant identity. Fails closed on LiveKit errors.
-    """
-
-    message = "You must be connected to the meeting to perform this action."
-
-    def has_object_permission(self, request, view, obj):
-        """Verify the requester's identity is a participant of the room."""
-        user = request.user
-
-        if not user or not user.is_authenticated:
-            return False
-
-        try:
-            return ParticipantsManagement().check_if_in_meeting(
-                room_name=str(obj.pk), identity=str(user.sub)
-            )
-        except ParticipantNotFoundException:
-            return False
-        except ParticipantsManagementException:
-            return False
-
-
-class CanManageLobby(permissions.BasePermission):
-    """Grant lobby management (list/accept/deny waiting participants).
-
-    - Room admins/owners can always manage the lobby.
-    - When the room access level is TRUSTED, any authenticated user who is
-      currently connected to the meeting can manage the lobby. Presence is
-      verified cache-first (Redis), falling back to the LiveKit API.
-
-    Access level is always read fresh from the DB; only presence is cached,
-    so changing the room to RESTRICTED takes effect immediately.
-    """
-
-    message = "You are not allowed to manage this room's lobby."
-
-    # pylint: disable=too-many-return-statements
-    def has_object_permission(self, request, view, obj):  # noqa: PLR0911
-        """Check privileges first, then the trusted-room presence path."""
-        user = request.user
-
-        if not user or not user.is_authenticated:
-            return False
-
-        # Product choice: lobby management is reserved for session-authenticated
-        # users with a real account, not holders of a LiveKit room token.
-        if request.auth and hasattr(request.auth, "video"):
-            return False
-
-        if obj.is_administrator_or_owner(user):
-            return True
-
-        if obj.access_level != RoomAccessLevel.TRUSTED:
-            return False
-
-        self.message = "You must be connected to the meeting to manage its lobby."
-
-        try:
-            return ParticipantsManagement().check_if_in_meeting_cached(
-                room_name=str(obj.pk), identity=str(user.sub)
-            )
-        except ParticipantNotFoundException:
-            return False
-        except ParticipantsManagementException:
-            return False
@@ -31,28 +31,9 @@ class UserSerializer(serializers.ModelSerializer):

    class Meta:
        model = models.User
-        fields = [
-            "id",
-            "email",
-            "full_name",
-            "short_name",
-            "timezone",
-            "language",
-            "default_room_access_level",
-            "default_room_configuration",
-        ]
+        fields = ["id", "email", "full_name", "short_name", "timezone", "language"]
        read_only_fields = ["id", "email", "full_name", "short_name"]

-    def validate_default_room_configuration(self, value):
-        """Validate the default room configuration against the RoomConfiguration schema."""
-        if value is None or value == {}:
-            return value
-        try:
-            RoomConfiguration.model_validate(value)
-        except PydanticValidationError as e:
-            raise serializers.ValidationError(e.errors()) from e
-        return value
-

 class UserLightSerializer(serializers.ModelSerializer):
    """Serialize users with limited fields."""
@@ -202,11 +183,13 @@ class RoomSerializer(serializers.ModelSerializer):
                user=request.user,
                username=username,
                configuration=output["configuration"],
-                role=role,
+                is_admin_or_owner=is_admin_or_owner,
            )
        else:
            del output["pin_code"]

+        output["is_administrable"] = is_admin_or_owner
+
        return output


@@ -316,8 +299,8 @@ class RoomInviteSerializer(serializers.Serializer):
 class BaseParticipantsManagementSerializer(BaseValidationOnlySerializer):
    """Base serializer for participant management operations."""

-    participant_identity = serializers.CharField(
-        help_text="LiveKit participant identity (matching the user's sub format)"
+    participant_identity = serializers.UUIDField(
+        help_text="LiveKit participant identity (UUID format)"
    )


@@ -329,15 +312,6 @@ class MuteParticipantSerializer(BaseParticipantsManagementSerializer):
    )


-class ParticipantRoleSerializer(BaseParticipantsManagementSerializer):
-    """Validate an in-meeting role change (promotion/demotion) request."""
-
-    role = serializers.ChoiceField(
-        choices=[models.RoleChoices.MEMBER, models.RoleChoices.ADMIN],
-        help_text="Target role. Ownership cannot be granted this way.",
-    )
-
-
 TrackSource = Literal["camera", "microphone", "screen_share", "screen_share_audio"]


@@ -73,27 +73,3 @@ class CreationCallbackAnonRateThrottle(MonitoredAnonRateThrottle):
    """Throttle Anonymous user requesting room generation callback"""

    scope = "creation_callback"
-
-
-class RoomKitJoinRateThrottle(MonitoredUserRateThrottle):
-    """Throttle the LiveKit SIP module requesting roomkit joins.
-
-    The roomkit endpoints are authenticated as a machine user, so all requests
-    share a single throttle bucket. This is not a security measure against
-    brute-force attacks but a guard against accidental hammering from a buggy
-    SIP module.
-    """
-
-    scope = "roomkit_join"
-
-
-class ConnectionTestUserRateThrottle(MonitoredUserRateThrottle):
-    """Throttle authenticated users requesting connection test tokens."""
-
-    scope = "connection_test"
-
-
-class ConnectionTestAnonRateThrottle(MonitoredAnonRateThrottle):
-    """Throttle anonymous users requesting connection test tokens."""
-
-    scope = "connection_test"
@@ -2,10 +2,8 @@
 # pylint: disable=too-many-lines

 import uuid
-from datetime import timedelta
 from logging import getLogger
 from urllib.parse import unquote, urlparse
-from uuid import uuid4

 from django.conf import settings
 from django.core.exceptions import ValidationError as DjangoValidationError
@@ -29,9 +27,6 @@ from rest_framework import (
 from rest_framework import (
    exceptions as drf_exceptions,
 )
-from rest_framework import (
-    permissions as drf_permissions,
-)
 from rest_framework import (
    response as drf_response,
 )
@@ -41,15 +36,28 @@ from rest_framework import (
 from rest_framework.settings import api_settings

 from core import analytics, enums, models, utils
-from core.api import throttling
 from core.api.filters import ListFileFilter
 from core.enums import MEDIA_STORAGE_URL_PATTERN
 from core.recording.enums import FileExtension
-from core.recording.event.authentication import RecordingProcessWebhookAuthentication
+from core.recording.event.authentication import (
+    RecordingProcessWebhookAuthentication,
+    StorageEventAuthentication,
+)
+from core.recording.event.exceptions import (
+    InvalidBucketError,
+    InvalidFilepathError,
+    InvalidFileTypeError,
+    ParsingEventDataError,
+)
+from core.recording.event.parsers import get_parser
 from core.recording.services.metadata_collector import (
    MetadataCollectorException,
    MetadataCollectorService,
 )
+from core.recording.services.recording_events import (
+    RecordingEventsService,
+    RecordingNotSavableError,
+)
 from core.recording.worker.exceptions import (
    RecordingStartError,
    RecordingStopError,
@@ -75,18 +83,15 @@ from core.services.participants_management import (
    ParticipantsManagementException,
 )
 from core.services.room_creation import RoomCreation
-from core.services.room_management import RoomManagement
-from core.services.room_roles import (
-    RoomRoleError,
-    RoomRoleService,
+from core.services.room_management import (
+    RoomManagement,
+    RoomManagementException,
+    RoomNotFoundException,
 )
 from core.services.subtitle import SubtitleException, SubtitleService
-from core.tasks.connection_test import delete_connection_test_room
 from core.tasks.file import process_file_deletion
-from core.utils import generate_token

 from ..authentication.livekit import LiveKitTokenAuthentication
-from ..models import RoomAccessLevel
 from . import permissions, serializers, throttling
 from .feature_flag import FeatureFlag

@@ -95,6 +100,60 @@ from .feature_flag import FeatureFlag
 logger = getLogger(__name__)


+class NestedGenericViewSet(viewsets.GenericViewSet):
+    """
+    A generic Viewset aims to be used in a nested route context.
+    e.g: `/api/v1.0/resource_1/<resource_1_pk>/resource_2/<resource_2_pk>/`
+
+    It allows to define all url kwargs and lookup fields to perform the lookup.
+    """
+
+    lookup_fields: list[str] = ["pk"]
+    lookup_url_kwargs: list[str] = []
+
+    def __getattribute__(self, file):
+        """
+        This method is overridden to allow to get the last lookup field or lookup url kwarg
+        when accessing the `lookup_field` or `lookup_url_kwarg` attribute. This is useful
+        to keep compatibility with all methods used by the parent class `GenericViewSet`.
+        """
+        if file in ["lookup_field", "lookup_url_kwarg"]:
+            return getattr(self, file + "s", [None])[-1]
+
+        return super().__getattribute__(file)
+
+    def get_queryset(self):
+        """
+        Get the list of files for this view.
+
+        `lookup_fields` attribute is enumerated here to perform the nested lookup.
+        """
+        queryset = super().get_queryset()
+
+        # The last lookup field is removed to perform the nested lookup as it corresponds
+        # to the object pk, it is used within get_object method.
+        lookup_url_kwargs = (
+            self.lookup_url_kwargs[:-1]
+            if self.lookup_url_kwargs
+            else self.lookup_fields[:-1]
+        )
+
+        filter_kwargs = {}
+        for index, lookup_url_kwarg in enumerate(lookup_url_kwargs):
+            if lookup_url_kwarg not in self.kwargs:
+                raise KeyError(
+                    f"Expected view {self.__class__.__name__} to be called with a URL "
+                    f'keyword argument named "{lookup_url_kwarg}". Fix your URL conf, or '
+                    "set the `.lookup_fields` attribute on the view correctly."
+                )
+
+            filter_kwargs.update(
+                {self.lookup_fields[index]: self.kwargs[lookup_url_kwarg]}
+            )
+
+        return queryset.filter(**filter_kwargs)
+
+
 class SerializerPerActionMixin:
    """
    A mixin to allow to define serializer classes for each action.
@@ -208,9 +267,6 @@ class RoomViewSet(
            username = request.query_params.get("username", None)
            data = {
                "id": None,
-                "slug": slug,
-                "is_administrable": False,
-                "access_level": RoomAccessLevel.PUBLIC,
                "livekit": {
                    "url": settings.LIVEKIT_CONFIGURATION["url"],
                    "room": slug,
@@ -244,27 +300,8 @@ class RoomViewSet(
        return drf_response.Response(serializer.data)

    def perform_create(self, serializer):
-        """Set the current user as owner of the newly created room.
-
-        Apply the user's default room preferences (access level and configuration)
-        unless the request explicitly provides its own values.
-        """
-        user = self.request.user
-        save_kwargs = {}
-
-        if (
-            "access_level" not in serializer.validated_data
-            and user.default_room_access_level not in (None, "")
-        ):
-            save_kwargs["access_level"] = user.default_room_access_level
-
-        user_default_configuration = user.default_room_configuration
-        if not serializer.validated_data.get(
-            "configuration"
-        ) and user_default_configuration not in (None, {}):
-            save_kwargs["configuration"] = user.default_room_configuration
-
-        room = serializer.save(**save_kwargs)
+        """Set the current user as owner of the newly created room."""
+        room = serializer.save()
        models.ResourceAccess.objects.create(
            resource=room,
            user=self.request.user,
@@ -298,7 +335,26 @@ class RoomViewSet(
        ):
            return

-        RoomManagement.sync_room_metadata(room)
+        metadata = {
+            "configuration": room.configuration,
+            "access_level": room.access_level,
+        }
+
+        try:
+            RoomManagement().update_metadata(
+                room_name=str(room.id),
+                metadata=metadata,
+            )
+        except RoomNotFoundException:
+            logger.info(
+                "LiveKit room %s does not exist yet, skipping metadata sync",
+                room.id,
+            )
+        except RoomManagementException:
+            logger.warning(
+                "Failed to sync metadata to LiveKit for room %s",
+                room.id,
+            )

    @decorators.action(
        detail=True,
@@ -445,7 +501,7 @@ class RoomViewSet(
        methods=["post"],
        url_path="enter",
        permission_classes=[
-            permissions.CanManageLobby,
+            permissions.HasPrivilegesOnRoom,
        ],
    )
    def allow_participant_to_enter(self, request, pk=None):  # pylint: disable=unused-argument
@@ -483,7 +539,7 @@ class RoomViewSet(
        methods=["GET"],
        url_path="waiting-participants",
        permission_classes=[
-            permissions.CanManageLobby,
+            permissions.HasPrivilegesOnRoom,
        ],
    )
    def list_waiting_participants(self, request, pk=None):  # pylint: disable=unused-argument
@@ -579,53 +635,6 @@ class RoomViewSet(
            status=drf_status.HTTP_200_OK,
        )

-    @decorators.action(
-        detail=True,
-        methods=["post"],
-        url_path="update-participant-role",
-        permission_classes=[
-            permissions.HasPrivilegesOnRoom,
-            permissions.IsPresentInMeeting,
-        ],
-    )
-    def update_participant_role(self, request, pk=None):  # pylint: disable=unused-argument
-        """Promote or demote a participant currently connected to the meeting.
-
-        Requires the requester to be session-authenticated, have privileges
-        (admin/owner) on the room, and be connected to the meeting.
-
-        If the target participant has a user account, the role is persisted
-        (`ResourceAccess`) then mirrored to their LiveKit attributes.
-
-        If the participant is anonymous, the promotion will fail.
-        """
-
-        room = self.get_object()
-
-        serializer = serializers.ParticipantRoleSerializer(data=request.data)
-        serializer.is_valid(raise_exception=True)
-
-        participant_identity = serializer.validated_data["participant_identity"]
-        role = serializer.validated_data["role"]
-
-        if str(request.user.sub) == str(participant_identity):
-            return drf_response.Response(
-                {"error": "You cannot change your own role."},
-                status=drf_status.HTTP_403_FORBIDDEN,
-            )
-
-        try:
-            result = RoomRoleService().set_participant_role(
-                room=room,
-                participant_identity=participant_identity,
-                role=role,
-                actor=request.user,
-            )
-        except RoomRoleError as e:
-            return drf_response.Response({"error": str(e)}, status=e.status_code)
-
-        return drf_response.Response(result, status=drf_status.HTTP_200_OK)
-
    @decorators.action(
        detail=True,
        methods=["post"],
@@ -855,15 +864,6 @@ class RoomViewSet(
        """Rename the current participant in the room."""
        room = self.get_object()

-        if (
-            not settings.AUTHENTICATED_PARTICIPANTS_CAN_EDIT_DISPLAY_NAME
-            and request.user.is_authenticated
-        ):
-            return drf_response.Response(
-                {"error": "Authenticated participants cannot edit their display name"},
-                status=drf_status.HTTP_403_FORBIDDEN,
-            )
-
        serializer = serializers.RenameParticipantSerializer(data=request.data)
        serializer.is_valid(raise_exception=True)

@@ -952,6 +952,56 @@ class RecordingViewSet(
            .filter(Q(accesses__user=user) | Q(accesses__team__in=user.get_teams()))
        )

+    @decorators.action(
+        detail=False,
+        methods=["post"],
+        url_path="storage-hook",
+        authentication_classes=[StorageEventAuthentication],
+    )
+    @FeatureFlag.require("storage_event")
+    def on_storage_event_received(self, request, pk=None):  # pylint: disable=unused-argument
+        """Handle incoming storage hook events for recordings."""
+
+        parser = get_parser()
+
+        try:
+            recording_id = parser.get_recording_id(request.data)
+
+        except ParsingEventDataError as e:
+            raise drf_exceptions.PermissionDenied("Invalid request data.") from e
+
+        except InvalidBucketError as e:
+            raise drf_exceptions.PermissionDenied("Invalid bucket specified.") from e
+
+        except InvalidFilepathError:
+            return drf_response.Response(
+                {"message": "Notification ignored."},
+            )
+
+        except InvalidFileTypeError:
+            return drf_response.Response(
+                {"message": "Notification ignored."},
+            )
+
+        try:
+            recording = models.Recording.objects.get(id=recording_id)
+        except models.Recording.DoesNotExist as e:
+            raise drf_exceptions.NotFound("No recording found for this event.") from e
+
+        # Save recording
+        recording_events_service = RecordingEventsService()
+        try:
+            recording_events_service.handle_complete(recording)
+        except RecordingNotSavableError:
+            raise drf_exceptions.PermissionDenied(
+                f"Recording with ID {recording_id} cannot be saved because it is either,"
+                " in an error state or has already been saved."
+            ) from None
+
+        return drf_response.Response(
+            {"message": "Event processed."},
+        )
+
    @decorators.action(
        detail=False,
        methods=["post"],
@@ -1008,10 +1058,9 @@ class RecordingViewSet(

    def _auth_get_original_url(self, request):
        """
-        Extracts and parses the original URL from the configured header.
+        Extracts and parses the original URL from the "HTTP_X_ORIGINAL_URL" header.
        Raises PermissionDenied if the header is missing.
-        The original url is passed by the reverse proxy in the header named by the
-        MEDIA_AUTH_ORIGINAL_URL_HEADER setting, which defaults to "HTTP_X_ORIGINAL_URL".
+        The original url is passed by nginx in the "HTTP_X_ORIGINAL_URL" header.
        See corresponding ingress configuration in Helm chart and read about the
        nginx.ingress.kubernetes.io/auth-url annotation to understand how the Nginx ingress
        is configured to do this.
@@ -1021,13 +1070,9 @@ class RecordingViewSet(
        reasons.
        """
        # Extract the original URL from the request header
-        original_url = request.META.get(settings.MEDIA_AUTH_ORIGINAL_URL_HEADER)
+        original_url = request.META.get("HTTP_X_ORIGINAL_URL")
        if not original_url:
-            logger.warning(
-                "Missing %s header in subrequest. Set MEDIA_AUTH_ORIGINAL_URL_HEADER "
-                "to the header your reverse proxy sends.",
-                settings.MEDIA_AUTH_ORIGINAL_URL_HEADER,
-            )
+            logger.warning("Missing HTTP_X_ORIGINAL_URL header in subrequest")
            raise drf_exceptions.PermissionDenied()

        logger.debug("Original url: '%s'", original_url)
@@ -1352,8 +1397,7 @@ class FileViewSet(
        Authorize access based on the original URL of an Nginx subrequest
        and user permissions. Returns a dictionary of URL parameters if authorized.

-        The original url is passed by the reverse proxy in the header named by the
-        MEDIA_AUTH_ORIGINAL_URL_HEADER setting, which defaults to "HTTP_X_ORIGINAL_URL".
+        The original url is passed by nginx in the "HTTP_X_ORIGINAL_URL" header.
        See corresponding ingress configuration in Helm chart and read about the
        nginx.ingress.kubernetes.io/auth-url annotation to understand how the Nginx ingress
        is configured to do this.
@@ -1372,13 +1416,9 @@ class FileViewSet(
        - PermissionDenied if authorization fails.
        """
        # Extract the original URL from the request header
-        original_url = request.META.get(settings.MEDIA_AUTH_ORIGINAL_URL_HEADER)
+        original_url = request.META.get("HTTP_X_ORIGINAL_URL")
        if not original_url:
-            logger.warning(
-                "Missing %s header in subrequest. Set MEDIA_AUTH_ORIGINAL_URL_HEADER "
-                "to the header your reverse proxy sends.",
-                settings.MEDIA_AUTH_ORIGINAL_URL_HEADER,
-            )
+            logger.warning("Missing HTTP_X_ORIGINAL_URL header in subrequest")
            raise drf_exceptions.PermissionDenied()

        parsed_url = urlparse(original_url)
@@ -1449,68 +1489,3 @@ class FileViewSet(
        request = utils.generate_s3_authorization_headers(f"{url_params.get('key'):s}")

        return drf_response.Response("authorized", headers=request.headers, status=200)
-
-
-class DiagnosticsViewSet(viewsets.ViewSet):
-    """Endpoints helping users and support diagnose connectivity issues.
-
-    Diagnostics are grouped behind a single prefix so upcoming checks
-    (rtcstats collection, ICE candidate reports, etc.) can be added as new
-    actions rather than new top-level routes.
-
-    They are open to anonymous users: someone who cannot join a room is
-    exactly who needs to run a test, and they may well not be logged in.
-    Each action therefore carries its own throttle scope.
-    """
-
-    permission_classes = [drf_permissions.AllowAny]
-
-    @decorators.action(
-        detail=False,
-        methods=["POST"],
-        url_path="connection",
-        url_name="connection",
-        throttle_classes=[
-            throttling.ConnectionTestUserRateThrottle,
-            throttling.ConnectionTestAnonRateThrottle,
-        ],
-    )
-    @FeatureFlag.require("connection_test")
-    def connection(self, request):
-        """Return a short-lived LiveKit token for an ephemeral test room.
-
-        Going through the room API is not an option here: it is tied to
-        registered meetings, lobby rules and longer-lived tokens. Each call
-        gets its own room so two people testing at the same time never meet.
-        """
-        room = f"{settings.CONNECTION_TEST_ROOM_PREFIX}-{uuid4()}"
-        expires_in = settings.CONNECTION_TEST_TOKEN_TTL_SECONDS
-
-        # LiveKit refreshes tokens for connected clients, so JWT TTL alone does not
-        # eject someone who stays connected. Schedule a hard DeleteRoom when Celery
-        # is available.
-        if settings.CELERY_ENABLED:
-            max_age = (
-                settings.CONNECTION_TEST_TOKEN_TTL_SECONDS
-                + settings.CONNECTION_TEST_ROOM_EXTRA_AGE_SECONDS
-            )
-            delete_connection_test_room.apply_async(
-                args=[room],
-                countdown=max_age,
-            )
-
-        return drf_response.Response(
-            {
-                "livekit": {
-                    "url": settings.LIVEKIT_CONFIGURATION["url"],
-                    "room": room,
-                    "token": generate_token(
-                        room=room,
-                        user=request.user,
-                        username="Connection Test",
-                        ttl=timedelta(seconds=expires_in),
-                    ),
-                    "expires_in": expires_in,
-                },
-            }
-        )
@@ -3,11 +3,7 @@
 import contextlib

 from django.conf import settings
-from django.core.exceptions import (
-    ImproperlyConfigured,
-    SuspiciousOperation,
-    ValidationError,
-)
+from django.core.exceptions import ImproperlyConfigured, SuspiciousOperation
 from django.utils.translation import gettext_lazy as _

 from lasuite.oidc_login.backends import (
@@ -21,7 +17,6 @@ from core.services.marketing import (
    ContactData,
    get_marketing_service,
 )
-from core.validators import sub_validator


 class OIDCAuthenticationBackend(LaSuiteOIDCAuthenticationBackend):
@@ -89,19 +84,6 @@ class OIDCAuthenticationBackend(LaSuiteOIDCAuthenticationBackend):

    def get_existing_user(self, sub, email):
        """Fetch existing user by sub or email."""
-
-        sub = str(sub)
-
-        try:
-            sub_validator(sub)
-        except ValidationError as err:
-            raise SuspiciousOperation(
-                "User info contained an invalid sub claim"
-            ) from err
-
-        if len(sub) > 255:
-            raise SuspiciousOperation("User info contained an invalid sub claim")
-
        try:
            return User.objects.get(sub=sub)
        except User.DoesNotExist:
@@ -22,7 +22,7 @@ logger = logging.getLogger(__name__)
 class BaseJWTAuthentication(authentication.BaseAuthentication):
    """Base JWT authentication class."""

-    def __init__(  # noqa: PLR0917
+    def __init__(
        self,
        secret_key,
        algorithm,
@@ -286,10 +286,6 @@ class ResourceServerBackend(LaSuiteBackend):
        if user is None and settings.OIDC_CREATE_USER:
            user = self.create_user(sub)

-        if user is not None and not user.is_active:
-            logger.warning("Inactive user attempted authentication: %s", user.pk)
-            raise SuspiciousOperation("User account is disabled.")
-
        return user

    def create_user(self, sub):
@@ -1,6 +1,5 @@
 """External API endpoints"""

-import copy
 from logging import getLogger

 from django.conf import settings
@@ -13,9 +12,6 @@ from rest_framework import decorators, mixins, viewsets
 from rest_framework import (
    exceptions as drf_exceptions,
 )
-from rest_framework import (
-    parsers as drf_parsers,
-)
 from rest_framework import (
    response as drf_response,
 )
@@ -26,7 +22,6 @@ from rest_framework import (
 from core import analytics, api, models
 from core.api.feature_flag import FeatureFlag
 from core.services.jwt_token import JwtTokenService
-from core.services.room_management import RoomManagement

 from ..services.provisional_user_service import (
    ProvisionalUserCreationDisabledError,
@@ -46,7 +41,6 @@ class ApplicationViewSet(viewsets.ViewSet):
        methods=["post"],
        url_path="token",
        url_name="token",
-        parser_classes=[drf_parsers.FormParser, drf_parsers.JSONParser],
    )
    @FeatureFlag.require("application")
    def generate_jwt_access_token(self, request, *args, **kwargs):
@@ -144,7 +138,6 @@ class RoomViewSet(
    mixins.CreateModelMixin,
    mixins.RetrieveModelMixin,
    mixins.ListModelMixin,
-    mixins.UpdateModelMixin,
    viewsets.GenericViewSet,
 ):
    """Application-delegated API for room management.
@@ -157,12 +150,8 @@ class RoomViewSet(
    - list: List rooms the user has access to (requires 'rooms:list' scope)
    - retrieve: Get room details (requires 'rooms:retrieve' scope)
    - create: Create a new room owned by the user (requires 'rooms:create' scope)
-    - partial_update: Update a room's access level and configuration, for
-      administrators and owners only (requires 'rooms:update' scope)
    """

-    http_method_names = ["get", "post", "patch", "head", "options"]
-
    authentication_classes = [
        authentication.ApplicationJWTAuthentication,
        authentication.AddonsJWTAuthentication,
@@ -196,39 +185,7 @@ class RoomViewSet(
        serializer = self.get_serializer(queryset, many=True)
        return drf_response.Response(serializer.data)

-    def _track_room_event(self, room, event, **extra_properties):
-        """Log a room operation for auditing and forward it to analytics."""
-
-        auth_method = type(self.request.successful_authenticator).__name__
-        client_id = (self.request.auth or {}).get("client_id", "unknown")
-
-        # Log for auditing
-        details = "".join(f", {key}={value}" for key, value in extra_properties.items())
-        logger.info(
-            "Room %s via application: room_id=%s, user_id=%s, client_id=%s, auth_method=%s%s",
-            event.removeprefix("room_"),
-            room.id,
-            self.request.user.id,
-            client_id,
-            auth_method,
-            details,
-        )
-
-        analytics.capture(
-            self.request.user,
-            event,
-            {
-                "room_id": str(room.pk),
-                "access_level": room.access_level,
-                "client_id": client_id,
-                "external_api": True,
-                "auth_method": auth_method,
-                **extra_properties,
-                "$set": {"email": self.request.user.email},
-            },
-        )
-
-    def perform_create(self, serializer: serializers.RoomSerializer):
+    def perform_create(self, serializer):
        """Set the current user as owner of the newly created room."""
        room = serializer.save()
        models.ResourceAccess.objects.create(
@@ -237,31 +194,27 @@ class RoomViewSet(
            role=models.RoleChoices.OWNER,
        )

-        self._track_room_event(room, analytics.AnalyticsEvent.ROOM_CREATED)
+        auth_method = type(self.request.successful_authenticator).__name__
+        client_id = (self.request.auth or {}).get("client_id", "unknown")

-    def perform_update(self, serializer: serializers.RoomSerializer):
-        """Persist the room update, sync it to LiveKit, then log and track it."""
-
-        previous_values = {
-            "access_level": serializer.instance.access_level,
-            "configuration": copy.deepcopy(serializer.instance.configuration),
-        }
-
-        room = serializer.save()
-
-        # Report the fields that actually changed, not the ones that were submitted.
-        updated_fields = sorted(
-            field
-            for field, previous_value in previous_values.items()
-            if getattr(room, field) != previous_value
+        # Log for auditing
+        logger.info(
+            "Room created via application: room_id=%s, user_id=%s, client_id=%s, auth_method=%s",
+            room.id,
+            self.request.user.id,
+            client_id,
+            auth_method,
        )

-        if updated_fields:
-            RoomManagement.sync_room_metadata(room)
-
-        self._track_room_event(
-            room,
-            analytics.AnalyticsEvent.ROOM_UPDATED,
-            updated_fields=updated_fields,
-            previous_access_level=previous_values["access_level"],
+        analytics.capture(
+            self.request.user,
+            analytics.AnalyticsEvent.ROOM_CREATED,
+            {
+                "room_id": str(room.pk),
+                "access_level": room.access_level,
+                "client_id": client_id,
+                "external_api": True,
+                "auth_method": auth_method,
+                "$set": {"email": self.request.user.email},
+            },
        )
@@ -48,6 +48,8 @@ class ResourceFactory(factory.django.DjangoModelFactory):
                else:
                    UserResourceAccessFactory(resource=self, user=item[0], role=item[1])

+        self.save()
+

 class UserResourceAccessFactory(factory.django.DjangoModelFactory):
    """Create fake resource user accesses for testing."""
@@ -95,6 +97,8 @@ class RecordingFactory(factory.django.DjangoModelFactory):
                        recording=self, user=item[0], role=item[1]
                    )

+            self.save()
+

 class UserRecordingAccessFactory(factory.django.DjangoModelFactory):
    """Create fake recording user accesses for testing."""
@@ -1,25 +0,0 @@
-"""Logging filters for the core application."""
-
-import logging
-
-from django.conf import settings
-
-
-class SilenceExpected401(logging.Filter):
-    """Drop the expected 401 from anonymous hits on the /me endpoint.
-
-    The frontend probes `/users/me/` to check authentication; a 401 for
-    anonymous users is normal, not a warning worth logging.
-    """
-
-    def filter(self, record):
-        """Return False for a 401 on a silenced path, True otherwise."""
-        if getattr(record, "status_code", None) != 401:
-            return True
-
-        request = getattr(record, "request", None)
-        path = getattr(request, "path", None)
-        if not path:
-            return True
-
-        return path not in settings.LOGGING_SILENCED_401_PATHS
@@ -8,8 +8,6 @@ import uuid
 from django.conf import settings
 from django.db import migrations, models

-import core.validators
-

 class Migration(migrations.Migration):

@@ -43,7 +41,7 @@ class Migration(migrations.Migration):
                ('id', models.UUIDField(default=uuid.uuid4, editable=False, help_text='primary key for the record as UUID', primary_key=True, serialize=False, verbose_name='id')),
                ('created_at', models.DateTimeField(auto_now_add=True, help_text='date and time at which a record was created', verbose_name='created on')),
                ('updated_at', models.DateTimeField(auto_now=True, help_text='date and time at which a record was last updated', verbose_name='updated on')),
-                ('sub', models.CharField(blank=True, help_text='Optional for pending users; required upon account activation. 255 characters or fewer. Printable ASCII characters only.', max_length=255, null=True, unique=True, validators=[core.validators.sub_validator], verbose_name='sub')),
+                ('sub', models.CharField(blank=True, help_text='Optional for pending users; required upon account activation. 255 characters or fewer. Letters, numbers, and @/./+/-/_ characters only.', max_length=255, null=True, unique=True, validators=[django.core.validators.RegexValidator(message='Enter a valid sub. This value may contain only letters, numbers, and @/./+/-/_ characters.', regex='^[\\w.@+-]+\\Z')], verbose_name='sub')),
                ('email', models.EmailField(blank=True, max_length=254, null=True, verbose_name='identity email address')),
                ('admin_email', models.EmailField(blank=True, max_length=254, null=True, unique=True, verbose_name='admin email address')),
                ('language', models.CharField(choices=settings.LANGUAGES, default=settings.LANGUAGE_CODE, help_text='The language in which the user wants to see the interface.', max_length=10, verbose_name='language')),
@@ -1,23 +0,0 @@
-# Generated by Django 5.2.14 on 2026-08-03 13:40
-
-from django.db import migrations, models
-
-
-class Migration(migrations.Migration):
-
-    dependencies = [
-        ('core', '0021_recording_external_process_id_alter_recording_status'),
-    ]
-
-    operations = [
-        migrations.AddField(
-            model_name='user',
-            name='default_room_access_level',
-            field=models.CharField(blank=True, choices=[('public', 'Public Access'), ('trusted', 'Trusted Access'), ('restricted', 'Restricted Access')], help_text='Access level applied by default to new rooms created by this user. When empty, the instance default is used.', max_length=50, null=True, verbose_name='default room access level'),
-        ),
-        migrations.AddField(
-            model_name='user',
-            name='default_room_configuration',
-            field=models.JSONField(blank=True, default=dict, help_text='Configurations applied by default to new rooms created by this user.', verbose_name='default room configuration'),
-        ),
-    ]
@@ -1,18 +0,0 @@
-# Generated by Django 5.2.16 on 2026-09-23 16:49
-
-from django.db import migrations, models
-
-
-class Migration(migrations.Migration):
-
-    dependencies = [
-        ('core', '0022_user_default_room_access_level_and_more'),
-    ]
-
-    operations = [
-        migrations.AlterField(
-            model_name='recording',
-            name='status',
-            field=models.CharField(choices=[('initiated', 'Initiated'), ('active', 'Active'), ('stopped', 'Stopped'), ('saved', 'Saved'), ('aborted', 'Aborted'), ('failed', 'Failed'), ('failed_to_start', 'Failed to Start'), ('failed_to_stop', 'Failed to Stop'), ('notification_succeeded', 'Notification succeeded'), ('external_process_successful', 'External process successful'), ('external_process_failed', 'External process failed')], default='initiated', max_length=50),
-        ),
-    ]
@@ -27,7 +27,6 @@ from timezone_field import TimeZoneField

 from . import fields, utils
 from .recording.enums import FileExtension
-from .validators import sub_validator

 logger = getLogger(__name__)

@@ -58,7 +57,6 @@ class RecordingStatusChoices(models.TextChoices):
    STOPPED = "stopped", _("Stopped")
    SAVED = "saved", _("Saved")
    ABORTED = "aborted", _("Aborted")
-    FAILED = "failed", _("Failed")
    FAILED_TO_START = "failed_to_start", _("Failed to Start")
    FAILED_TO_STOP = "failed_to_stop", _("Failed to Stop")
    NOTIFICATION_SUCCEEDED = "notification_succeeded", _("Notification succeeded")
@@ -80,13 +78,17 @@ class RecordingStatusChoices(models.TextChoices):
            cls.STOPPED,
            cls.SAVED,
            cls.ABORTED,
-            cls.FAILED,
            cls.EXTERNAL_PROCESS_SUCCESSFUL,
            cls.EXTERNAL_PROCESS_FAILED,
            cls.FAILED_TO_START,
            cls.FAILED_TO_STOP,
        }

+    @classmethod
+    def is_unsuccessful(cls, status):
+        """Determine if the recording status represents an unsuccessful state."""
+        return status in {cls.ABORTED, cls.FAILED_TO_START, cls.FAILED_TO_STOP}
+

 class RecordingModeChoices(models.TextChoices):
    """Recording mode choices."""
@@ -143,11 +145,19 @@ class BaseModel(models.Model):
 class User(AbstractBaseUser, BaseModel, auth_models.PermissionsMixin):
    """User model to work with OIDC only authentication."""

+    sub_validator = validators.RegexValidator(
+        regex=r"^[\w.@+-]+\Z",
+        message=_(
+            "Enter a valid sub. This value may contain only letters, "
+            "numbers, and @/./+/-/_ characters."
+        ),
+    )
+
    sub = models.CharField(
        _("sub"),
        help_text=_(
            "Optional for pending users; required upon account activation. "
-            "255 characters or fewer. Printable ASCII characters only."
+            "255 characters or fewer. Letters, numbers, and @/./+/-/_ characters only."
        ),
        max_length=255,
        unique=True,
@@ -179,25 +189,6 @@ class User(AbstractBaseUser, BaseModel, auth_models.PermissionsMixin):
        default=settings.TIME_ZONE,
        help_text=_("The timezone in which the user wants to see times."),
    )
-    default_room_access_level = models.CharField(
-        max_length=50,
-        choices=RoomAccessLevel.choices,
-        blank=True,
-        null=True,
-        verbose_name=_("default room access level"),
-        help_text=_(
-            "Access level applied by default to new rooms created by this user. "
-            "When empty, the instance default is used."
-        ),
-    )
-    default_room_configuration = models.JSONField(
-        blank=True,
-        default=dict,
-        verbose_name=_("default room configuration"),
-        help_text=_(
-            "Configurations applied by default to new rooms created by this user."
-        ),
-    )
    is_device = models.BooleanField(
        _("device"),
        default=False,
@@ -438,14 +429,7 @@ class Room(Resource):

    def save(self, *args, **kwargs):
        """Generate a unique n-digit pin code for new rooms."""
-
-        # Roomkit devices also join by PIN, so a PIN is needed as soon as
-        # either integration is enabled.
-        if (
-            (settings.ROOM_TELEPHONY_ENABLED or settings.ROOMKIT_ENABLED)
-            and not self.pk
-            and not self.pin_code
-        ):
+        if settings.ROOM_TELEPHONY_ENABLED and not self.pk and not self.pin_code:
            self.pin_code = self.generate_unique_pin_code(
                length=settings.ROOM_TELEPHONY_PIN_LENGTH
            )
@@ -579,7 +563,6 @@ class Recording(BaseModel):
    4. NOTIFICATION_SUCCEEDED: External service has been notified of this recording

    Error States:
-    - FAILED: Egress failed mid-recording
    - FAILED_TO_START: Worker failed to initialize recording
    - FAILED_TO_STOP: Worker failed during stop operation
    - ABORTED: Recording was terminated before completion
@@ -8,50 +8,3 @@ class FileExtension(Enum):

    OGG = "ogg"
    MP4 = "mp4"
-
-
-class RecordingWorkerEvent(Enum):
-    """Lifecycle events a recording worker reports about a recording.
-
-    It is intended to be free of SFU-specific vocabulary.
-    """
-
-    # The worker accepted the request but is not recording yet.
-    STARTING = "starting"
-    # The worker is recording.
-    STARTED = "started"
-    # The worker stopped recording and is flushing the media file.
-    SAVING = "saving"
-
-    # The recording ended, its media file is available.
-    COMPLETED = "completed"
-    # The recording ended on its configured limit, its media file is available.
-    LIMIT_REACHED = "limit reached"
-    # The worker stopped before it ever started recording, there is no media file.
-    ABORTED = "aborted"
-    # The worker hit a runtime error once recording had started; its media file
-    # may be available.
-    FAILED = "failed"
-
-    @classmethod
-    def is_terminal(cls, event):
-        """Determine if the event ends the recording's lifecycle (successful or not)."""
-
-        return event in TERMINAL_EVENTS
-
-
-SUCCESSFUL_EVENTS = frozenset(
-    {
-        RecordingWorkerEvent.COMPLETED,
-        RecordingWorkerEvent.LIMIT_REACHED,
-    }
-)
-
-UNSUCCESSFUL_EVENTS = frozenset(
-    {
-        RecordingWorkerEvent.ABORTED,
-        RecordingWorkerEvent.FAILED,
-    }
-)
-
-TERMINAL_EVENTS = SUCCESSFUL_EVENTS | UNSUCCESSFUL_EVENTS
@@ -1,4 +1,4 @@
-"""Authentication classes for server-to-server webhook token validation."""
+"""Authentication class for storage event token validation."""

 import logging
 import secrets
@@ -12,9 +12,9 @@ logger = logging.getLogger(__name__)


 class MachineUser:
-    """Represent a non-interactive system user for automated operations."""
+    """Represent a non-interactive system user for automated storage operations."""

-    def __init__(self, username: str = "machine_user") -> None:
+    def __init__(self, username: str = "storage_event_user") -> None:
        self.pk = None
        self.username = username
        self.is_active = True
@@ -41,17 +41,24 @@ class HeaderBasedAuthentication(BaseAuthentication):
    TOKEN_TYPE = "Bearer"  # noqa S105
    REALM = ""

+    IS_ENFORCED_SETTINGS_KEY = None
    EXPECTED_TOKEN_SETTINGS_KEY = None

    def authenticate(self, request):
        """Validate the Bearer token from the Authorization header."""

+        if self.IS_ENFORCED_SETTINGS_KEY is not None:
+            if not getattr(settings, self.IS_ENFORCED_SETTINGS_KEY):
+                return MachineUser(), None
+
        if (
            self.EXPECTED_TOKEN_SETTINGS_KEY is None
            or (required_token := getattr(settings, self.EXPECTED_TOKEN_SETTINGS_KEY))
            is None
        ):
-            raise AuthenticationFailed("Authentication token is not configured.")
+            raise AuthenticationFailed(
+                "Authentication is enabled but token is not configured."
+            )

        auth_header = request.headers.get(self.AUTH_HEADER)
        if not auth_header:
@@ -81,6 +88,18 @@ class HeaderBasedAuthentication(BaseAuthentication):
        return f"{self.TOKEN_TYPE} realm='{self.REALM}'"


+class StorageEventAuthentication(HeaderBasedAuthentication):
+    """Authenticate requests using a Bearer token for storage event integration.
+    This class validates Bearer tokens for storage events that don't map to database users.
+    It's designed for S3-compatible storage integrations and similar use cases.
+    Events are submitted when a webhook is configured on some bucket's events.
+    """
+
+    REALM = "Storage event API"
+    IS_ENFORCED_SETTINGS_KEY = "RECORDING_ENABLE_STORAGE_EVENT_AUTH"
+    EXPECTED_TOKEN_SETTINGS_KEY = "RECORDING_STORAGE_EVENT_TOKEN"  # noqa S105
+
+
 class RecordingProcessWebhookAuthentication(HeaderBasedAuthentication):
    """
    Custom authentication class for recording process webhook requests.
@@ -0,0 +1,17 @@
+"""Storage parsers specific exceptions."""
+
+
+class ParsingEventDataError(Exception):
+    """Raised when the request data is malformed, incomplete, or missing."""
+
+
+class InvalidBucketError(Exception):
+    """Raised when the bucket name in the request does not match the expected one."""
+
+
+class InvalidFileTypeError(Exception):
+    """Raised when the file type in the request is not supported."""
+
+
+class InvalidFilepathError(Exception):
+    """Raised when the filepath in the request is invalid."""
@@ -9,7 +9,7 @@ from zoneinfo import ZoneInfo, ZoneInfoNotFoundError
 from django.conf import settings
 from django.core.mail import send_mail
 from django.template.loader import render_to_string
-from django.utils.translation import get_language, gettext, override
+from django.utils.translation import get_language, override
 from django.utils.translation import gettext_lazy as _

 import aiohttp
@@ -121,7 +121,7 @@ class NotificationService:
                msg_plain = render_to_string(
                    "mail/text/screen_recording.txt", personalized_context
                )
-                subject = gettext("Your recording is ready")  # Force translation
+                subject = str(_("Your recording is ready"))  # Force translation

                try:
                    send_mail(
@@ -192,7 +192,7 @@ class NotificationService:
        """Generate title from context or return default."""
        if recording_datetime is None:
            with override(locale):
-                return gettext("Transcription")
+                return _("Transcription")

        dt = recording_datetime
        if owner_timezone:
@@ -0,0 +1,178 @@
+"""Meet storage event parser classes."""
+
+import logging
+import mimetypes
+import re
+from dataclasses import dataclass
+from functools import lru_cache
+from typing import Any, Dict, Optional, Protocol
+from urllib.parse import quote
+
+from django.conf import settings
+from django.utils.module_loading import import_string
+
+from core.enums import FILE_EXT_REGEX, UUID_REGEX
+
+from .exceptions import (
+    InvalidBucketError,
+    InvalidFilepathError,
+    InvalidFileTypeError,
+    ParsingEventDataError,
+)
+
+# Additional MIME type mapping
+mimetypes.add_type("audio/ogg", ".ogg")
+
+logger = logging.getLogger(__name__)
+
+
+@dataclass
+class StorageEvent:
+    """Represents a storage event with relevant metadata.
+    Attributes:
+        filepath: Identifier for the affected recording
+        filetype: Type of storage event
+        bucket_name: When the event occurred
+        metadata: Additional event data
+    """
+
+    filepath: str
+    filetype: str
+    bucket_name: str
+    metadata: Optional[Dict[str, Any]]
+
+    def __post_init__(self):
+        if self.filepath is None:
+            raise TypeError("filepath cannot be None")
+        if self.filetype is None:
+            raise TypeError("filetype cannot be None")
+        if self.bucket_name is None:
+            raise TypeError("bucket_name cannot be None")
+
+
+class EventParser(Protocol):
+    """Interface for parsing storage events."""
+
+    def __init__(self, bucket_name, allowed_filetypes=None):
+        """Initialize parser with bucket name and optional allowed filetypes."""
+
+    def parse(self, data: Dict) -> StorageEvent:
+        """Extract storage event data from raw dictionary input."""
+
+    def validate(self, data: StorageEvent) -> str:
+        """Verify storage event data meets all requirements."""
+
+    def get_recording_id(self, data: Dict) -> str:
+        """Extract recording ID from event dictionary."""
+
+
+@lru_cache(maxsize=1)
+def get_parser() -> EventParser:
+    """Return cached instance of configured event parser.
+    Uses function memoization instead of a factory class since the only
+    varying parameter is the parser class from settings. A factory class
+    would add unnecessary complexity when a cached function provides the
+    same singleton behavior with simpler code.
+    """
+
+    event_parser_cls = import_string(settings.RECORDING_EVENT_PARSER_CLASS)
+    return event_parser_cls(bucket_name=settings.AWS_STORAGE_BUCKET_NAME)
+
+
+class BaseS3Parser:
+    """Base class for handling parsing and validation of S3-compatible storage events."""
+
+    def __init__(self, bucket_name: str, allowed_filetypes=None):
+        """Initialize parser with target bucket name and accepted filetypes."""
+
+        if not bucket_name:
+            raise ValueError("Bucket name cannot be None or empty")
+
+        self._bucket_name = bucket_name
+        self._allowed_filetypes = allowed_filetypes or {"audio/ogg", "video/mp4"}
+
+        # pylint: disable=line-too-long
+        self._filepath_regex = re.compile(
+            rf"(?P<url_encoded_folder_path>(?:[^%]+%2F)+)?{settings.RECORDING_OUTPUT_FOLDER}%2F(?P<recording_id>{UUID_REGEX})\.(?P<extension>{FILE_EXT_REGEX})"
+        )
+
+    def validate(self, event_data: StorageEvent) -> str:
+        """Verify StorageEvent matches bucket, filetype and filepath requirements."""
+
+        if event_data.bucket_name != self._bucket_name:
+            raise InvalidBucketError(
+                f"Invalid bucket: expected {self._bucket_name}, got {event_data.bucket_name}"
+            )
+
+        if event_data.filetype not in self._allowed_filetypes:
+            raise InvalidFileTypeError(
+                f"Invalid file type, expected {self._allowed_filetypes},"
+                f"got '{event_data.filetype}'"
+            )
+
+        match = self._filepath_regex.match(event_data.filepath)
+        if not match:
+            raise InvalidFilepathError(
+                f"Invalid filepath structure: {event_data.filepath}"
+            )
+
+        recording_id = match.group("recording_id")
+        return recording_id
+
+    def get_recording_id(self, data):
+        """Extract recording ID from S3 event through parsing and validation."""
+
+        event_data = self.parse(data)
+        return self.validate(event_data)
+
+    def parse(self, data: Dict) -> StorageEvent:
+        """To be implemented by subclasses."""
+        raise NotImplementedError("Subclasses must implement parse()")
+
+
+class MinioParser(BaseS3Parser):
+    """Minio specific event parsing."""
+
+    def parse(self, data: Dict) -> StorageEvent:
+        if not data:
+            raise ParsingEventDataError("Received empty data.")
+        try:
+            record = data["Records"][0]
+            s3 = record["s3"]
+            return StorageEvent(
+                filepath=s3["object"]["key"],
+                filetype=s3["object"]["contentType"],  # Minio-specific field
+                bucket_name=s3["bucket"]["name"],
+                metadata=None,
+            )
+        except (KeyError, IndexError) as e:
+            raise ParsingEventDataError(f"Malformed Minio event: {e}") from e
+        except TypeError as e:
+            raise ParsingEventDataError(f"Missing essential data fields: {e}") from e
+
+
+class S3Parser(BaseS3Parser):
+    """AWS S3 specific event parsing."""
+
+    def parse(self, data: Dict) -> StorageEvent:
+        if not data:
+            raise ParsingEventDataError("Received empty data.")
+        try:
+            # AWS S3 structure can slightly differ from Minio implementation
+            record = data["Records"][0]
+            s3 = record["s3"]
+            filepath = s3["object"]["key"]
+            if not filepath:
+                raise ParsingEventDataError("Missing object key name")
+            filetype, _ = mimetypes.guess_type(filepath)
+            # Normalize raw S3-compatible object keys without re-encoding
+            # already encoded AWS S3 notification keys.
+            filepath = quote(filepath, safe="%+")
+            return StorageEvent(
+                filepath=filepath,
+                filetype=filetype,
+                bucket_name=s3["bucket"]["name"],
+                metadata=None,
+            )
+        except (KeyError, IndexError) as e:
+            raise ParsingEventDataError(f"Malformed S3 event: {e}") from e
@@ -1,19 +1,14 @@
-"""Recording-related Events Service"""
+"""Recording-related LiveKit Events Service"""
+
+# pylint: disable=no-member

 from logging import getLogger

+from livekit import api
+
 from core import models, utils
 from core.models import Recording
-from core.recording.enums import (
-    UNSUCCESSFUL_EVENTS,
-    RecordingWorkerEvent,
-)
 from core.recording.event.notification import notification_service
-from core.services.room_management import (
-    RoomManagement,
-    RoomManagementException,
-    RoomNotFoundException,
-)

 logger = getLogger(__name__)

@@ -26,76 +21,44 @@ class RecordingNotSavableError(Exception):
    """Recording cannot be saved because it is either in an error state or has already been saved"""


-# Notification sent to the room's participants, per event and recording mode.
-NOTIFICATION_PREFIXES = {
-    models.RecordingModeChoices.SCREEN_RECORDING: "screenRecording",
-    models.RecordingModeChoices.TRANSCRIPT: "transcription",
-}
-NOTIFICATION_SUFFIXES = {
-    RecordingWorkerEvent.LIMIT_REACHED: "LimitReached",
-    RecordingWorkerEvent.FAILED: "Failed",
-    RecordingWorkerEvent.ABORTED: "Aborted",
-}
-
-
-def get_notification_type(recording_mode, event):
-    """Generate corresponding notification type string."""
-    try:
-        return f"{NOTIFICATION_PREFIXES[recording_mode]}{NOTIFICATION_SUFFIXES[event]}"
-    except KeyError:
-        return None
-
-
-# Recording status in the room's metadata, per event.
-ROOM_METADATA_RECORDING_STATUSES = {
-    RecordingWorkerEvent.STARTED: "started",
-    RecordingWorkerEvent.SAVING: "saving",
-}
-
-
 class RecordingEventsService:
-    """Handles recording-related worker events.
-
-    Two entry points: `handle_update` for the events a running recording
-    reports, and `handle_terminal_event` for the one ending it.
-    """
+    """Handles recording-related LiveKit webhook events."""

    @staticmethod
-    def log_worker_error(recording, event, error=None, error_code=None):
-        """Log FAILED at error level and expected ABORTED outcomes at info level."""
+    def handle_update(recording: Recording, egress_status):
+        """Handle egress status updates and sync recording state to room metadata."""

-        if event == RecordingWorkerEvent.FAILED:
-            log = logger.error
-        elif event == RecordingWorkerEvent.ABORTED:
-            log = logger.info
-        else:
-            return
+        room_name = str(recording.room.id)

-        log(
-            "Recording worker reported %s for recording %s (room=%s, mode=%s): %s (error_code=%s)",
-            event.value,
-            recording.id,
-            recording.room.id,
-            recording.mode,
-            error or "no error reported",
-            error_code or "no error_code reported",
-        )
+        status_mapping = {
+            api.EgressStatus.EGRESS_ACTIVE: "started",
+            api.EgressStatus.EGRESS_ENDING: "saving",
+            api.EgressStatus.EGRESS_ABORTED: "aborted",
+        }
+
+        recording_status = status_mapping.get(egress_status)
+        if recording_status:
+            try:
+                utils.update_room_metadata(
+                    room_name, {"recording_status": recording_status}
+                )
+            except utils.MetadataUpdateException as e:
+                logger.exception("Failed to update room's metadata: %s", e)

    @staticmethod
-    def _notify_participants(recording: Recording, event: RecordingWorkerEvent):
-        """Notify the room's participants that a recording ended on the given event."""
-        recording_mode = recording.options.get("original_mode", None) or recording.mode
+    def handle_limit_reached(recording: Recording):
+        """Stop recording and notify participants when limit is reached."""

-        notification_type = get_notification_type(recording_mode, event)
+        recording.status = models.RecordingStatusChoices.STOPPED
+        recording.save()
+
+        notification_mapping = {
+            models.RecordingModeChoices.SCREEN_RECORDING: "screenRecordingLimitReached",
+            models.RecordingModeChoices.TRANSCRIPT: "transcriptionLimitReached",
+        }
+
+        notification_type = notification_mapping.get(recording.mode)
        if not notification_type:
-            logger.warning(
-                "Could not find notification type for: "
-                "room=%s, recording_id=%s, mode=%s, event=%s",
-                recording.room.id,
-                recording.id,
-                recording_mode,
-                event.value,
-            )
            return

        try:
@@ -104,152 +67,20 @@ class RecordingEventsService:
                notification_data={"type": notification_type},
            )
        except utils.NotificationError as e:
+            logger.exception(
+                "Failed to notify participants about recording limit reached: "
+                "room=%s, recording_id=%s, mode=%s",
+                recording.room.id,
+                recording.id,
+                recording.mode,
+            )
            raise RecordingEventsError(
                f"Failed to notify participants in room '{recording.room.id}' about "
-                f"recording {event.value} (recording_id={recording.id})"
+                f"recording limit reached (recording_id={recording.id})"
            ) from e

    @staticmethod
-    def _log_notification_failure(recording, event: RecordingWorkerEvent):
-        """Log a participant notification error on an unsuccessful recording."""
-
-        logger.exception(
-            "Failed to notify participants that recording %s %s (room=%s)",
-            recording.id,
-            event.value,
-            recording.room.id,
-        )
-
-    @staticmethod
-    def handle_update(recording: Recording, event: RecordingWorkerEvent):
-        """Handle non-terminal worker events and sync recording state to room metadata.
-
-        Terminal events are dispatched through `handle_terminal_event` instead.
-        """
-
-        room_name = str(recording.room.id)
-
-        recording_status = ROOM_METADATA_RECORDING_STATUSES.get(event)
-        if recording_status:
-            try:
-                RoomManagement.update_metadata(
-                    room_name, {"recording_status": recording_status}
-                )
-            except RoomNotFoundException:
-                logger.info(
-                    "LiveKit room %s no longer exists, skipping metadata update",
-                    room_name,
-                )
-            except RoomManagementException as e:
-                logger.exception("Failed to update room's metadata: %s", e)
-
-    def handle_terminal_event(self, recording: Recording, event: RecordingWorkerEvent):
-        """Run the appropriate handlers for a terminal event, given the recording's state."""
-
-        if not RecordingWorkerEvent.is_terminal(event):
-            logger.warning(
-                "Ignoring non-terminal event %s dispatched as a terminal event "
-                "for recording %s.",
-                event.value,
-                recording.id,
-            )
-            return
-
-        if event in UNSUCCESSFUL_EVENTS:
-            self._flag_unsuccessful_recording(recording, event)
-        else:
-            self._save_successful_recording(recording, event)
-
-    def _flag_unsuccessful_recording(
-        self, recording: Recording, event: RecordingWorkerEvent
-    ):
-        """Persist the outcome of a recording the worker announced as unsuccessful."""
-
-        # Aborted
-        if event == RecordingWorkerEvent.ABORTED:
-            if recording.status == models.RecordingStatusChoices.ACTIVE:
-                self._apply_outcome(recording, event, self._handle_aborted)
-            return
-
-        # Failed
-        if event == RecordingWorkerEvent.FAILED:
-            if recording.is_savable():
-                self._apply_outcome(recording, event, self._handle_failed)
-            return
-
-        logger.error(
-            "Unsuccessful event %s has no handler; recording %s keeps status '%s'.",
-            event.value,
-            recording.id,
-            recording.status,
-        )
-
-    def _save_successful_recording(
-        self, recording: Recording, event: RecordingWorkerEvent
-    ):
-        """Save a recording whose media file the worker made available."""
-
-        # Limit reached
-        if (
-            event == RecordingWorkerEvent.LIMIT_REACHED
-            and recording.status == models.RecordingStatusChoices.ACTIVE
-        ):
-            self._apply_outcome(recording, event, self._handle_limit_reached)
-
-        try:
-            self._handle_successful(recording)
-        except RecordingNotSavableError:
-            logger.warning(
-                "Recording %s is not savable on a completed recording "
-                "(already saved or in an error state); ignoring.",
-                recording.id,
-            )
-
-    def _apply_outcome(
-        self, recording: Recording, event: RecordingWorkerEvent, handler
-    ):
-        """Keep notification failure non-fatal."""
-
-        try:
-            handler(recording)
-        except RecordingEventsError:
-            self._log_notification_failure(recording, event)
-
-    @classmethod
-    def _handle_limit_reached(cls, recording: Recording):
-        """Stop recording and notify participants when limit is reached."""
-
-        recording.status = models.RecordingStatusChoices.STOPPED
-        recording.save()
-
-        cls._notify_participants(recording, RecordingWorkerEvent.LIMIT_REACHED)
-
-    @classmethod
-    def _handle_failed(cls, recording: Recording):
-        """Set recording status to failed, matching the worker event, and notify participants.
-
-        FAILED: used when an actual runtime/pipeline error occurs after the
-        recording has started
-        """
-        recording.status = models.RecordingStatusChoices.FAILED
-        recording.save()
-
-        cls._notify_participants(recording, RecordingWorkerEvent.FAILED)
-
-    @classmethod
-    def _handle_aborted(cls, recording: Recording):
-        """Set recording status to aborted, matching the worker event, and notify participants.
-
-        ABORTED: used when the worker stops before it ever became
-        active/recording
-        """
-        recording.status = models.RecordingStatusChoices.ABORTED
-        recording.save()
-
-        cls._notify_participants(recording, RecordingWorkerEvent.ABORTED)
-
-    @staticmethod
-    def _handle_successful(recording: Recording):
+    def handle_complete(recording: Recording):
        """Notify external services and save recording."""

        if not recording.is_savable():
@@ -2,12 +2,8 @@

 import logging

+from core import utils
 from core.models import Recording, RecordingStatusChoices
-from core.services.room_management import (
-    RoomManagement,
-    RoomManagementException,
-    RoomNotFoundException,
-)

 from .exceptions import (
    RecordingStartError,
@@ -68,15 +64,10 @@ class WorkerServiceMediator:
        mode = recording.options.get("original_mode", None) or recording.mode

        try:
-            RoomManagement.update_metadata(
+            utils.update_room_metadata(
                room_name, {"recording_mode": mode, "recording_status": "starting"}
            )
-        except RoomNotFoundException:
-            logger.info(
-                "LiveKit room %s no longer exists, skipping metadata update",
-                room_name,
-            )
-        except RoomManagementException as e:
+        except utils.MetadataUpdateException as e:
            logger.exception("Failed to update room's metadata: %s", e)

        logger.info(
@@ -2,8 +2,6 @@

 # pylint: disable=no-member

-import logging
-
 from asgiref.sync import async_to_sync
 from livekit import api as livekit_api

@@ -12,8 +10,6 @@ from ..enums import FileExtension
 from .exceptions import WorkerConnectionError, WorkerResponseError
 from .factories import WorkerServiceConfig

-logger = logging.getLogger(__name__)
-

 class BaseEgressService:
    """Base egress defining common methods to manage and interact with LiveKit egress processes."""
@@ -53,22 +49,6 @@ class BaseEgressService:
        finally:
            await lkapi.aclose()

-    @staticmethod
-    def _log_egress_error(response, event: str):
-        """Log the reason LiveKit reported an unsuccessful egress on stop.
-
-        Mirrors the logging done in the 'egress_ended' webhook. The
-        StopEgress response carries the same error fields.
-        """
-        logger.error(
-            "Egress %s on stop (egress_id=%s, status=%s): %s (error_code=%s)",
-            event,
-            response.egress_id,
-            livekit_api.EgressStatus.Name(response.status),
-            response.error or "no error reported",
-            response.error_code or "no error_code reported",
-        )
-
    def stop(self, worker_id: str) -> str:
        """Stop an ongoing egress worker.
        The StopEgressRequest is shared among all types of egress,
@@ -86,26 +66,14 @@ class BaseEgressService:
                "LiveKit response is missing the recording status."
            )

+        # To avoid exposing EgressStatus values and coupling with LiveKit outside of this class,
+        # the response status is mapped to simpler "ABORTED", "STOPPED" or "FAILED_TO_STOP" strings.
+        if response.status == livekit_api.EgressStatus.EGRESS_ABORTED:
+            return "ABORTED"
+
        if response.status == livekit_api.EgressStatus.EGRESS_ENDING:
            return "STOPPED"

-        if response.status == livekit_api.EgressStatus.EGRESS_LIMIT_REACHED:
-            return "STOPPED"
-
-        # Cases below should be very infrequent as status changes should be
-        # received and processed by `handle_ended`, thus `stop` would not
-        # be called (unless failure and stop are very close in time).
-        # We therefore accept not to notify the user in this code branch.
-        # This could be fixed in a future refactoring.
-        if response.status == livekit_api.EgressStatus.EGRESS_ABORTED:
-            self._log_egress_error(response, "aborted")
-            return "ABORTED"
-
-        if response.status == livekit_api.EgressStatus.EGRESS_FAILED:
-            self._log_egress_error(response, "failed")
-            return "FAILED"
-
-        self._log_egress_error(response, "failed to stop")
        return "FAILED_TO_STOP"

    def start(self, room_name, recording_id):
@@ -1 +0,0 @@
-"""Meet core roomkit API endpoints for meeting-room (SIP) device integration."""
@@ -1,65 +0,0 @@
-"""Authentication for the roomkit API of the Meet core app."""
-
-import logging
-import secrets
-
-from django.conf import settings
-
-from rest_framework.authentication import BaseAuthentication
-from rest_framework.exceptions import AuthenticationFailed
-
-from core.recording.event.authentication import MachineUser
-
-logger = logging.getLogger(__name__)
-
-
-class ServerToServerAuthentication(BaseAuthentication):
-    """Custom authentication class for roomkit server-to-server requests.
-
-    Validates the Authorization header against the roomkit server-to-server
-    token. A valid PIN code is intentionally not enough to authenticate: the
-    endpoints are restricted to the LiveKit SIP module's credentials.
-    """
-
-    AUTH_HEADER = "Authorization"
-    TOKEN_TYPE = "Bearer"  # noqa S105
-
-    def authenticate(self, request):
-        """Validate the Bearer token from the Authorization header.
-
-        Returns a (MachineUser, token) pair on success, and raises
-        AuthenticationFailed if the header is missing, malformed, or contains
-        an invalid token.
-        """
-        required_token = settings.ROOMKIT_SERVER_TO_SERVER_API_TOKEN
-        if not required_token:
-            raise AuthenticationFailed("Server-to-server token is not configured.")
-
-        auth_header = request.headers.get(self.AUTH_HEADER)
-        if not auth_header:
-            logger.warning(
-                "Roomkit authentication failed: missing Authorization header (ip: %s)",
-                request.META.get("REMOTE_ADDR"),
-            )
-            raise AuthenticationFailed("Authorization header is missing.")
-
-        # Validate token format and existence
-        auth_parts = auth_header.split(" ")
-        if len(auth_parts) != 2 or auth_parts[0] != self.TOKEN_TYPE:
-            raise AuthenticationFailed("Invalid authorization header.")
-
-        token = auth_parts[1]
-
-        # Use constant-time comparison to prevent timing attacks
-        if not secrets.compare_digest(token.encode(), required_token.encode()):
-            logger.warning(
-                "Roomkit authentication failed: invalid token (ip: %s)",
-                request.META.get("REMOTE_ADDR"),
-            )
-            raise AuthenticationFailed("Invalid server-to-server token.")
-
-        return MachineUser(username="roomkit"), token
-
-    def authenticate_header(self, request):
-        """Return the WWW-Authenticate header value."""
-        return f"{self.TOKEN_TYPE} realm='Roomkit server to server'"
@@ -1,21 +0,0 @@
-"""Serializers for the roomkit API of the Meet core app."""
-
-# pylint: disable=abstract-method
-
-from django.conf import settings
-
-from rest_framework import serializers
-
-from core.api.serializers import BaseValidationOnlySerializer
-
-
-class RoomKitJoinSerializer(BaseValidationOnlySerializer):
-    """Validate roomkit join requests from the LiveKit SIP module."""
-
-    pin_code = serializers.CharField(required=True)
-
-    def validate_pin_code(self, value):
-        """Ensure the PIN code matches the configured length."""
-        if len(value) != settings.ROOM_TELEPHONY_PIN_LENGTH:
-            raise serializers.ValidationError("PIN code length is invalid.")
-        return value
@@ -1,89 +0,0 @@
-"""Roomkit API endpoints for meeting-room (SIP) device integration."""
-
-from logging import getLogger
-
-from rest_framework import decorators, viewsets
-from rest_framework import (
-    exceptions as drf_exceptions,
-)
-from rest_framework import (
-    response as drf_response,
-)
-from rest_framework import (
-    status as drf_status,
-)
-
-from core import analytics, models
-from core.api import permissions, throttling
-from core.api.feature_flag import FeatureFlag
-from core.services.sip_management import SIPException, SIPManagement
-
-from . import authentication, serializers
-
-logger = getLogger(__name__)
-
-
-class RoomKitViewSet(viewsets.ViewSet):
-    """Server-to-server API endpoints for the roomkit integration.
-
-    Groups all interactions between roomkit (SIP) devices and the backend,
-    brokered by the LiveKit SIP module. All endpoints are authenticated
-    with the roomkit server-to-server tokens.
-    """
-
-    authentication_classes = [authentication.ServerToServerAuthentication]
-    permission_classes = [permissions.IsAuthenticated]
-
-    @decorators.action(
-        detail=False,
-        methods=["post"],
-        url_path="join",
-        throttle_classes=[throttling.RoomKitJoinRateThrottle],
-    )
-    @FeatureFlag.require("roomkit")
-    def join(self, request):
-        """Prepare a room for a meeting-room (SIP) device joining by PIN code.
-
-        Called by the LiveKit SIP module when a meeting-room device dials in
-        with a PIN code before any WebRTC participant has joined. Resolves the
-        room by PIN and creates its SIP dispatch rule, so the device can enter
-        without waiting for a WebRTC user.
-
-        The webhook-based creation path is kept: both converge on the same rule
-        through the shared SIPManagement.
-        """
-
-        serializer = serializers.RoomKitJoinSerializer(data=request.data)
-        serializer.is_valid(raise_exception=True)
-
-        try:
-            room = models.Room.objects.get(
-                pin_code=serializer.validated_data["pin_code"]
-            )
-        except models.Room.DoesNotExist as e:
-            raise drf_exceptions.NotFound("No room found for this PIN code.") from e
-
-        try:
-            created = SIPManagement().ensure_dispatch_rule(room)
-        except SIPException as e:
-            raise drf_exceptions.APIException("Could not create dispatch rule.") from e
-
-        analytics.capture(
-            request.user,
-            analytics.AnalyticsEvent.ROOMKIT_JOINED,
-            {
-                "room_id": str(room.pk),
-                "dispatch_rule_created": created,
-            },
-        )
-
-        logger.info(
-            "Roomkit join requested: room_id=%s, dispatch_rule_created=%s",
-            room.id,
-            created,
-        )
-
-        return drf_response.Response(
-            {"status": "success"},
-            status=drf_status.HTTP_200_OK,
-        )
@@ -30,7 +30,7 @@ class TokenDecodeError(JWTError):
 class JwtTokenService:
    """Generic JWT token service with configurable settings."""

-    def __init__(  # noqa: PLR0917
+    def __init__(
        self,
        secret_key: str,
        algorithm: str,
@@ -11,22 +11,19 @@ from django.conf import settings

 from livekit import api

-from core import models
-from core.recording.enums import RecordingWorkerEvent
+from core import models, utils
 from core.recording.services.metadata_collector import (
    MetadataCollectorException,
    MetadataCollectorService,
 )
-from core.recording.services.recording_events import RecordingEventsService
+from core.recording.services.recording_events import (
+    RecordingEventsError,
+    RecordingEventsService,
+    RecordingNotSavableError,
+)

 from .lobby import LobbyService
-from .presence import PresenceCache
-from .room_management import (
-    RoomManagement,
-    RoomManagementException,
-    RoomNotFoundException,
-)
-from .sip_management import SIPException, SIPManagement
+from .telephony import TelephonyException, TelephonyService

 logger = getLogger(__name__)

@@ -49,6 +46,12 @@ class InvalidPayloadError(LiveKitWebhookError):
    status_code = 400


+class UnsupportedEventTypeError(LiveKitWebhookError):
+    """Unsupported event type."""
+
+    status_code = 422
+
+
 class ActionFailedError(LiveKitWebhookError):
    """Webhook action fails to process or complete."""

@@ -65,7 +68,6 @@ class LiveKitWebhookEventType(Enum):
    # Participant events
    PARTICIPANT_JOINED = "participant_joined"
    PARTICIPANT_LEFT = "participant_left"
-    PARTICIPANT_CONNECTION_ABORTED = "participant_connection_aborted"

    # Track events
    TRACK_PUBLISHED = "track_published"
@@ -81,30 +83,6 @@ class LiveKitWebhookEventType(Enum):
    INGRESS_ENDED = "ingress_ended"


-# LiveKit egress statuses mapped to recording worker event statuses
-EGRESS_STATUS_TO_RECORDING_EVENT = {
-    api.EgressStatus.EGRESS_STARTING: RecordingWorkerEvent.STARTING,
-    api.EgressStatus.EGRESS_ACTIVE: RecordingWorkerEvent.STARTED,
-    api.EgressStatus.EGRESS_ENDING: RecordingWorkerEvent.SAVING,
-    api.EgressStatus.EGRESS_COMPLETE: RecordingWorkerEvent.COMPLETED,
-    api.EgressStatus.EGRESS_LIMIT_REACHED: RecordingWorkerEvent.LIMIT_REACHED,
-    api.EgressStatus.EGRESS_ABORTED: RecordingWorkerEvent.ABORTED,
-    api.EgressStatus.EGRESS_FAILED: RecordingWorkerEvent.FAILED,
-}
-
-
-def to_recording_event(egress_status):
-    """Translate a LiveKit egress status into a recording worker event."""
-
-    event = EGRESS_STATUS_TO_RECORDING_EVENT.get(egress_status)
-    if event is None:
-        logger.warning(
-            "Unmapped LiveKit egress status '%s', ignoring the event.",
-            egress_status,
-        )
-    return event
-
-
 class LiveKitEventsService:
    """Service for processing and handling LiveKit webhook events and notifications."""

@@ -116,7 +94,6 @@ class LiveKitEventsService:
            "egress_ended": self._handle_egress_ended,
            "room_started": self._handle_room_started,
            "room_finished": self._handle_room_finished,
-            "participant_left": self._handle_participant_left,
        }

        token_verifier = api.TokenVerifier(
@@ -125,8 +102,7 @@ class LiveKitEventsService:
        )
        self.webhook_receiver = api.WebhookReceiver(token_verifier)
        self.lobby_service = LobbyService()
-        self.presence_cache = PresenceCache()
-        self.sip_management = SIPManagement()
+        self.telephony_service = TelephonyService()
        self.recording_events = RecordingEventsService()

        self._filter_regex = None
@@ -156,26 +132,16 @@ class LiveKitEventsService:

        room_name = data.room.name or data.egress_info.room_name

-        if self._is_connection_test_room(room_name):
-            logger.info(
-                "Ignoring webhook event for connection test room '%s'.",
-                room_name,
-            )
-            return
-
        if self._filter_regex and not self._filter_regex.search(room_name):
            logger.info("Filtered webhook event for room '%s'", room_name)
            return

        try:
            webhook_type = LiveKitWebhookEventType(data.event)
-        except ValueError:
-            logger.warning(
-                "Ignoring unknown LiveKit webhook event type '%s' for room '%s'",
-                data.event,
-                room_name,
-            )
-            return
+        except ValueError as e:
+            raise UnsupportedEventTypeError(
+                f"Unknown webhook type: {data.event}"
+            ) from e

        # Handle according to received webhook type
        handler = self._webhook_handlers.get(webhook_type.value)
@@ -194,20 +160,12 @@ class LiveKitEventsService:
                f"Recording with worker ID {egress_id} does not exist"
            ) from err

-        event = to_recording_event(data.egress_info.status)
-        if event is None:
-            return
-
-        self.recording_events.handle_update(recording, event)
+        egress_status = data.egress_info.status
+        self.recording_events.handle_update(recording, egress_status)

    def _handle_egress_ended(self, data):
-        """Handle 'egress_ended' event.
+        """Handle 'egress_ended' event."""

-        Egress ended is sent with one of these statuses:
-        EGRESS_COMPLETE, EGRESS_FAILED, EGRESS_ABORTED, EGRESS_LIMIT_REACHED
-        """
-
-        # Fetch recording
        try:
            recording = models.Recording.objects.select_related("room").get(
                worker_id=data.egress_info.egress_id
@@ -217,46 +175,48 @@ class LiveKitEventsService:
                f"Recording with worker ID {data.egress_info.egress_id} does not exist"
            ) from err

-        event = to_recording_event(data.egress_info.status)
-
-        # Log if/why the recording failed
-        self.recording_events.log_worker_error(
-            recording,
-            event,
-            error=data.egress_info.error,
-            error_code=data.egress_info.error_code,
-        )
-
-        # Update room
        try:
            room_name = str(recording.room.id)
-            RoomManagement.update_metadata(
-                room_name, remove_keys=["recording_mode", "recording_status"]
+            utils.update_room_metadata(
+                room_name, {}, ["recording_mode", "recording_status"]
            )
-        except RoomNotFoundException:
-            logger.info(
-                "LiveKit room %s no longer exists, skipping metadata update",
-                room_name,
-            )
-        except RoomManagementException as e:
+        except utils.MetadataUpdateException as e:
            logger.exception("Failed to update room's metadata: %s", e)

-        # Stop metadata collector
        if recording.options.get("metadata_collector_dispatch_id", None) is not None:
            try:
                MetadataCollectorService().stop(recording)
            except MetadataCollectorException:
                logger.warning("Failed to stop the MetadataCollectorService")

-        if event is None:
-            return
+        if (
+            data.egress_info.status == api.EgressStatus.EGRESS_LIMIT_REACHED
+            and recording.status == models.RecordingStatusChoices.ACTIVE
+        ):
+            try:
+                self.recording_events.handle_limit_reached(recording)
+            except RecordingEventsError as e:
+                raise ActionFailedError(
+                    f"Failed to process limit reached event for recording {recording}"
+                ) from e

-        self.recording_events.handle_terminal_event(recording, event)
+        # Fallback for completion when no MinIO/S3 webhooks are configured
+        if (
+            not settings.RECORDING_STORAGE_EVENT_ENABLE
+        ) and data.egress_info.status in [
+            api.EgressStatus.EGRESS_COMPLETE,
+            api.EgressStatus.EGRESS_LIMIT_REACHED,
+        ]:
+            try:
+                self.recording_events.handle_complete(recording)
+            except RecordingNotSavableError:
+                logger.warning(
+                    "Recording %s is not savable on egress complete "
+                    "(already saved or in an error state); ignoring.",
+                    recording.id,
+                )

-    @staticmethod
-    def _is_connection_test_room(room_name: str) -> bool:
-        """Return True for ephemeral rooms created by the connection test endpoint."""
-        return room_name.startswith(settings.CONNECTION_TEST_ROOM_PREFIX)
+        # Silently ignoring EGRESS_ABORTED, EGRESS_FAILED

    def _handle_room_started(self, data):
        """Handle 'room_started' event."""
@@ -275,12 +235,12 @@ class LiveKitEventsService:
        except models.Room.DoesNotExist as err:
            raise ActionFailedError(f"Room with ID {room_id} does not exist") from err

-        if settings.ROOM_TELEPHONY_ENABLED or settings.ROOMKIT_ENABLED:
+        if settings.ROOM_TELEPHONY_ENABLED:
            try:
-                self.sip_management.ensure_dispatch_rule(room)
-            except SIPException as e:
+                self.telephony_service.create_dispatch_rule(room)
+            except TelephonyException as e:
                raise ActionFailedError(
-                    f"Failed to create sip dispatch rule for room {room_id}"
+                    f"Failed to create telephony dispatch rule for room {room_id}"
                ) from e

    def _handle_room_finished(self, data):
@@ -295,39 +255,17 @@ class LiveKitEventsService:
            )
            raise ActionFailedError("Failed to process room finished event") from e

-        if settings.ROOM_TELEPHONY_ENABLED or settings.ROOMKIT_ENABLED:
+        if settings.ROOM_TELEPHONY_ENABLED:
            try:
-                self.sip_management.delete_dispatch_rule(room_id)
-            except SIPException as e:
+                self.telephony_service.delete_dispatch_rule(room_id)
+            except TelephonyException as e:
                raise ActionFailedError(
-                    f"Failed to delete sip dispatch rule for room {room_id}"
+                    f"Failed to delete telephony dispatch rule for room {room_id}"
                ) from e

-        self.presence_cache.clear_room(room_id)
-
        try:
            self.lobby_service.clear_room_cache(room_id)
        except Exception as e:
            raise ActionFailedError(
                f"Failed to clear room cache for room {room_id}"
            ) from e
-
-    def _handle_participant_left(self, data):
-        """Handle 'participant_left': invalidate the presence cache.
-
-        Presence entries are created lazily (only for users who administrate
-        the lobby of a trusted room), so for most participants this delete is
-        a no-op DEL on a key that never existed. Eager invalidation shrinks
-        the window during which a departed participant could still act on a
-        trusted room's lobby (cache hit until TTL expiry). It is gated behind
-        `PRESENCE_CLEAR_ON_PARTICIPANT_LEFT` so its production impact can be
-        measured and the behaviour reverted independently of the feature.
-        When disabled, invalidation relies on `room_finished` and the TTL.
-        """
-        if not settings.PRESENCE_CLEAR_ON_PARTICIPANT_LEFT:
-            return
-
-        identity = data.participant.identity
-        if not identity:
-            return
-        self.presence_cache.clear(data.room.name, identity)
@@ -4,12 +4,11 @@ import logging
 import uuid
 from dataclasses import dataclass
 from enum import Enum
-from typing import Dict, FrozenSet, Optional, Sequence, Tuple
+from typing import Dict, List, Optional, Tuple
 from uuid import UUID

 from django.conf import settings
 from django.core.cache import cache
-from django.utils import timezone

 from core import models, utils

@@ -47,7 +46,6 @@ class LobbyParticipant:
    username: str
    color: str
    id: str
-    entered_at: str

    def to_dict(self) -> Dict[str, str]:
        """Serialize the participant object to a dict representation."""
@@ -56,7 +54,6 @@ class LobbyParticipant:
            "username": self.username,
            "id": self.id,
            "color": self.color,
-            "entered_at": self.entered_at,
        }

    @classmethod
@@ -71,7 +68,6 @@ class LobbyParticipant:
                username=data["username"],
                id=data["id"],
                color=data["color"],
-                entered_at=data["entered_at"],
            )
        except (KeyError, ValueError) as e:
            logger.exception("Error creating Participant from dict:")
@@ -90,47 +86,6 @@ class LobbyService:
        """Generate cache key for participant(s) data."""
        return f"{settings.LOBBY_KEY_PREFIX}_{room_id!s}_{participant_id}"

-    @staticmethod
-    def _get_index_key(room_id: UUID) -> str:
-        """Raw Redis key of the per-room participant index (a native SET)."""
-        return cache.client.make_key(f"{settings.LOBBY_KEY_PREFIX}-index_{room_id!s}")
-
-    @staticmethod
-    def _redis(write: bool = True):
-        """Raw redis-py client.
-
-        SADD/SREM/SMEMBERS are not exposed by the Django cache API; this is
-        the documented django-redis escape hatch.
-        """
-        return cache.client.get_client(write=write)
-
-    def _index_add(self, room_id: UUID, participant_id: str) -> None:
-        """Record a participant id in the room index."""
-        index_key = self._get_index_key(room_id)
-        pipe = self._redis().pipeline(transaction=False)
-        pipe.sadd(index_key, participant_id)
-        pipe.expire(index_key, settings.LOBBY_ACCEPTED_TIMEOUT)
-        pipe.execute()
-
-    def _index_members(self, room_id: UUID) -> FrozenSet[str]:
-        """All participant ids currently indexed for the room."""
-        members = self._redis(write=False).smembers(self._get_index_key(room_id))
-        return frozenset(
-            member.decode() if isinstance(member, bytes) else member
-            for member in members
-        )
-
-    def _index_touch(self, room_id: UUID) -> None:
-        """Re-arm the room index backstop TTL."""
-        self._redis().expire(
-            self._get_index_key(room_id), settings.LOBBY_ACCEPTED_TIMEOUT
-        )
-
-    def _index_remove(self, room_id: UUID, *participant_ids: str) -> None:
-        """Drop participant ids from the room index."""
-        if participant_ids:
-            self._redis().srem(self._get_index_key(room_id), *participant_ids)
-
    @staticmethod
    def _get_or_create_participant_id(request) -> str:
        """Extract unique participant identifier from the request."""
@@ -149,30 +104,21 @@ class LobbyService:
            )

    @staticmethod
-    def can_bypass_lobby(room, user, role) -> bool:
+    def can_bypass_lobby(room, user) -> bool:
        """Determines if a user can bypass the waiting lobby and join a room directly.

        A user can bypass the lobby if:
        1. The room is public (open to everyone)
        2. The room has TRUSTED access level and the user is authenticated
-        2. The room has RESTRICTED access level and the user has any role

        Note: Room access levels can change while participants are waiting in the lobby.
        This function only checks the current state and should be called each time
        a participant requests entry to ensure consistent access control, even for
        participants who have already begun waiting.
        """
-        return (
-            room.is_public
-            or (
-                room.access_level == models.RoomAccessLevel.TRUSTED
-                and user.is_authenticated
-            )
-            or (
-                room.access_level == models.RoomAccessLevel.RESTRICTED
-                and user.is_authenticated
-                and role is not None
-            )
+        return room.is_public or (
+            room.access_level == models.RoomAccessLevel.TRUSTED
+            and user.is_authenticated
        )

    def request_entry(
@@ -198,16 +144,14 @@ class LobbyService:
        participant = self._get_participant(room.id, participant_id)

        room_id = str(room.id)
-        user_role = room.get_role(request.user)

-        if self.can_bypass_lobby(room=room, user=request.user, role=user_role):
+        if self.can_bypass_lobby(room=room, user=request.user):
            if participant is None:
                participant = LobbyParticipant(
                    status=LobbyParticipantStatus.ACCEPTED,
                    username=username,
                    id=participant_id,
                    color=utils.generate_color(participant_id),
-                    entered_at=timezone.now().isoformat(),
                )
            else:
                participant.status = LobbyParticipantStatus.ACCEPTED
@@ -218,8 +162,8 @@ class LobbyService:
                username=username,
                color=participant.color,
                configuration=room.configuration,
+                is_admin_or_owner=False,
                participant_id=participant_id,
-                role=user_role,
            )
            return participant, livekit_config

@@ -239,8 +183,8 @@ class LobbyService:
                username=username,
                color=participant.color,
                configuration=room.configuration,
+                is_admin_or_owner=False,
                participant_id=participant_id,
-                role=user_role,
            )

        return participant, livekit_config
@@ -255,12 +199,15 @@ class LobbyService:
        cache.touch(
            self._get_cache_key(room_id, participant_id), settings.LOBBY_WAITING_TIMEOUT
        )
-        self._index_touch(room_id)

    def enter(
        self, room_id: UUID, participant_id: str, username: str
    ) -> LobbyParticipant:
-        """Add participant to waiting lobby."""
+        """Add participant to waiting lobby.
+
+        Create a new participant entry in waiting status and notify room
+        participants of the new entry request.
+        """

        color = utils.generate_color(participant_id)

@@ -269,7 +216,6 @@ class LobbyService:
            username=username,
            id=participant_id,
            color=color,
-            entered_at=timezone.now().isoformat(),
        )

        try:
@@ -289,7 +235,6 @@ class LobbyService:
            participant.to_dict(),
            timeout=settings.LOBBY_WAITING_TIMEOUT,
        )
-        self._index_add(room_id, participant_id)

        return participant

@@ -311,42 +256,28 @@ class LobbyService:
            cache.delete(cache_key)
            return None

-    def list_waiting_participants(self, room_id: UUID) -> Sequence[dict]:
+    def list_waiting_participants(self, room_id: UUID) -> List[dict]:
        """List all waiting participants for a room."""

-        member_ids = self._index_members(room_id)
+        pattern = self._get_cache_key(room_id, "*")
+        keys = cache.keys(pattern)

-        if not member_ids:
-            return ()
+        if not keys:
+            return []

-        keys_by_id = {
-            participant_id: self._get_cache_key(room_id, participant_id)
-            for participant_id in member_ids
-        }
-        data = cache.get_many(list(keys_by_id.values()))
+        data = cache.get_many(keys)

-        dead_ids = []
        waiting_participants = []
-
-        for participant_id, cache_key in keys_by_id.items():
-            raw_participant = data.get(cache_key)
-            if raw_participant is None:
-                dead_ids.append(participant_id)
-                continue
+        for cache_key, raw_participant in data.items():
            try:
                participant = LobbyParticipant.from_dict(raw_participant)
            except LobbyParticipantParsingError:
                cache.delete(cache_key)
-                dead_ids.append(participant_id)
                continue
            if participant.status == LobbyParticipantStatus.WAITING:
                waiting_participants.append(participant.to_dict())

-        self._index_remove(room_id, *dead_ids)
-
-        waiting_participants.sort(key=lambda p: p["entered_at"], reverse=True)
-
-        return tuple(waiting_participants)
+        return waiting_participants

    def handle_participant_entry(
        self,
@@ -400,24 +331,20 @@ class LobbyService:

        participant.status = status
        cache.set(cache_key, participant.to_dict(), timeout=timeout)
-        self._index_touch(room_id)

    def clear_room_cache(self, room_id: UUID) -> None:
        """Clear all participant entries from the cache for a specific room."""

-        member_ids = self._index_members(room_id)
-        if member_ids:
-            cache.delete_many(
-                [
-                    self._get_cache_key(room_id, participant_id)
-                    for participant_id in member_ids
-                ]
-            )
-        self._redis().delete(self._get_index_key(room_id))
+        pattern = self._get_cache_key(room_id, "*")
+        keys = cache.keys(pattern)
+
+        if not keys:
+            return
+
+        cache.delete_many(keys)

    def clear_participant_cache(self, room_id: UUID, participant_id: str) -> None:
        """Clear a given participant entry from the cache for a specific room."""

        cache_key = self._get_cache_key(room_id, participant_id)
        cache.delete(cache_key)
-        self._index_remove(room_id, participant_id)
@@ -20,7 +20,6 @@ from livekit.protocol.models import ParticipantInfo
 from core import utils

 from .lobby import LobbyService
-from .presence import PresenceCache

 logger = getLogger(__name__)

@@ -73,9 +72,7 @@ class ParticipantsManagement:

    @async_to_sync
    async def remove(self, room_name: str, identity: str):
-        """Remove a participant from a room and clear their lobby/presence cache."""
-
-        PresenceCache().clear(room_name, identity)
+        """Remove a participant from a room and clear their lobby cache."""

        try:
            LobbyService().clear_participant_cache(
@@ -115,7 +112,7 @@ class ParticipantsManagement:
            await lkapi.aclose()

    @async_to_sync
-    async def update(  # noqa: PLR0917
+    async def update(
        self,
        room_name: str,
        identity: str,
@@ -159,30 +156,6 @@ class ParticipantsManagement:
        finally:
            await lkapi.aclose()

-    def check_if_in_meeting_cached(self, room_name: str, identity: str) -> bool:
-        """Cache-first variant of `check_if_in_meeting`.
-
-        Cache hit  -> True without touching LiveKit.
-        Cache miss -> ask LiveKit; memoize only positive answers.
-
-        Raises the same exceptions as `check_if_in_meeting` so callers keep
-        failing closed the same way.
-        """
-        if not room_name or not identity:
-            return False
-
-        presence_cache = PresenceCache()
-
-        if presence_cache.is_marked_present(room_name, identity):
-            return True
-
-        present = self.check_if_in_meeting(room_name=room_name, identity=identity)
-
-        if present:
-            presence_cache.mark_present(room_name, identity)
-
-        return present
-
    @async_to_sync
    async def check_if_in_meeting(self, room_name: str, identity: str) -> bool:
        """Check whether `identity` is currently a participant in `room_name`.
@@ -1,79 +0,0 @@
-"""Presence cache."""
-
-from typing import FrozenSet
-from uuid import UUID
-
-from django.conf import settings
-from django.core.cache import cache
-
-
-class PresenceCache:
-    """Store and invalidate (room, identity) presence entries."""
-
-    @staticmethod
-    def _get_cache_key(room_id: UUID | str, identity: str) -> str:
-        """Cache key for a (room, identity) presence entry."""
-        return f"{settings.PRESENCE_KEY_PREFIX}_{room_id!s}_{identity}"
-
-    @staticmethod
-    def _get_index_key(room_id: UUID | str) -> str:
-        """Raw Redis key of the per-room identity index (a native SET).
-
-        Built through django-redis' make_key so it lives under the same
-        KEY_PREFIX/version namespace as the presence entries.
-        """
-        return cache.client.make_key(
-            f"{settings.PRESENCE_KEY_PREFIX}-index_{room_id!s}"
-        )
-
-    @staticmethod
-    def _redis(write: bool = True):
-        """Raw redis-py client.
-
-        SADD/SREM/SMEMBERS are not exposed by the Django cache API; this is
-        the documented django-redis escape hatch.
-        """
-        return cache.client.get_client(write=write)
-
-    def _index_members(self, room_id: UUID | str) -> FrozenSet[str]:
-        """All identities currently indexed for the room."""
-        members = self._redis(write=False).smembers(self._get_index_key(room_id))
-        return frozenset(
-            member.decode() if isinstance(member, bytes) else member
-            for member in members
-        )
-
-    def is_marked_present(self, room_id: UUID | str, identity: str) -> bool:
-        """Return True if a positive presence entry exists in cache."""
-        return bool(cache.get(self._get_cache_key(room_id, identity)))
-
-    def mark_present(self, room_id: UUID | str, identity: str) -> None:
-        """Record that `identity` is in `room_id` and index it for the room."""
-        cache.set(
-            self._get_cache_key(room_id, identity),
-            True,
-            timeout=settings.PRESENCE_CACHE_TIMEOUT,
-        )
-        index_key = self._get_index_key(room_id)
-        pipe = self._redis().pipeline(transaction=False)
-        pipe.sadd(index_key, identity)
-        pipe.expire(index_key, settings.PRESENCE_CACHE_TIMEOUT)
-        pipe.execute()
-
-    def clear(self, room_id: UUID | str, identity: str) -> None:
-        """Forget presence for one participant (e.g. on participant_left)."""
-        cache.delete(self._get_cache_key(room_id, identity))
-        self._redis().srem(self._get_index_key(room_id), identity)
-
-    def clear_room(self, room_id: UUID | str) -> None:
-        """Forget presence for every participant of a room (on room_finished).
-
-        Deletes the indexed entries and the index itself with targeted
-        commands instead of a full-keyspace pattern scan.
-        """
-        identities = self._index_members(room_id)
-        if identities:
-            cache.delete_many(
-                [self._get_cache_key(room_id, identity) for identity in identities]
-            )
-        self._redis().delete(self._get_index_key(room_id))
@@ -8,8 +8,6 @@ from typing import Dict, Optional

 from asgiref.sync import async_to_sync
 from livekit.api import (
-    DeleteRoomRequest,
-    ListRoomsRequest,
    TwirpError,
    UpdateRoomMetadataRequest,
 )
@@ -30,52 +28,30 @@ class RoomNotFoundException(RoomManagementException):
 class RoomManagement:
    """Service for managing LiveKit rooms."""

-    @classmethod
    @async_to_sync
-    async def update_metadata(
-        cls,
-        room_name: str,
-        metadata: Optional[Dict] = None,
-        remove_keys: Optional[list[str]] = None,
-    ):
-        """Merge values into a LiveKit room's metadata.
+    async def update_metadata(self, room_name: str, metadata: Optional[Dict] = None):
+        """Update a LiveKit room's metadata.

        The `room_name` corresponds to the LiveKit room identifier
        (i.e. the Room model's UUID as a string).
-
-        Raises:
-            RoomNotFoundException: the room does not exist in LiveKit.
-            RoomManagementException: the metadata update otherwise fails.
        """

        lkapi = utils.create_livekit_client()

        try:
-            response = await lkapi.room.list_rooms(ListRoomsRequest(names=[room_name]))
-
-            if not response.rooms:
-                logger.warning(
-                    "Room %s not found in LiveKit, skipping metadata update",
-                    room_name,
-                )
-                raise RoomNotFoundException("Room does not exist")
-
-            existing_metadata = json.loads(response.rooms[0].metadata or "{}")
-
-            for key in remove_keys or []:
-                existing_metadata.pop(key, None)
-
-            updated_metadata = {**existing_metadata, **(metadata or {})}
-
            await lkapi.room.update_room_metadata(
                UpdateRoomMetadataRequest(
                    room=room_name,
-                    metadata=json.dumps(updated_metadata),
+                    metadata=json.dumps(metadata) if metadata is not None else "",
                )
            )

        except TwirpError as e:
            if e.code == "not_found":
+                logger.warning(
+                    "Room %s not found in LiveKit, skipping metadata update",
+                    room_name,
+                )
                raise RoomNotFoundException("Room does not exist") from e

            logger.exception(
@@ -86,60 +62,3 @@ class RoomManagement:

        finally:
            await lkapi.aclose()
-
-    @classmethod
-    @async_to_sync
-    async def delete_room(cls, room_name: str):
-        """Delete a LiveKit room and disconnect all participants.
-
-        Raises:
-            RoomNotFoundException: the room does not exist in LiveKit.
-            RoomManagementException: the deletion otherwise fails.
-        """
-
-        lkapi = utils.create_livekit_client()
-
-        try:
-            await lkapi.room.delete_room(DeleteRoomRequest(room=room_name))
-            logger.info("Deleted LiveKit room %s", room_name)
-        except TwirpError as e:
-            if e.code == "not_found":
-                logger.warning(
-                    "Room %s not found in LiveKit, skipping deletion",
-                    room_name,
-                )
-                raise RoomNotFoundException("Room does not exist") from e
-
-            logger.exception("Unexpected error deleting room %s", room_name)
-            raise RoomManagementException("Could not delete room") from e
-        finally:
-            await lkapi.aclose()
-
-    @classmethod
-    def sync_room_metadata(cls, room):
-        """Push a room's configuration and access level to its LiveKit room metadata.
-
-        Failures are swallowed: a room that is not live yet, or a LiveKit hiccup,
-        should never fail the request that triggered the update.
-        """
-
-        metadata = {
-            "configuration": room.configuration,
-            "access_level": room.access_level,
-        }
-
-        try:
-            cls.update_metadata(
-                room_name=str(room.id),
-                metadata=metadata,
-            )
-        except RoomNotFoundException:
-            logger.info(
-                "LiveKit room %s does not exist yet, skipping metadata sync",
-                room.id,
-            )
-        except RoomManagementException:
-            logger.warning(
-                "Failed to sync metadata to LiveKit for room %s",
-                room.id,
-            )
@@ -1,178 +0,0 @@
-"""Room role management service.
-
-Single entry point for changing a user's role on a room, used by:
- the in-meeting endpoint (promote/demote a connected participant)
- (more to come soon)
-
-`ResourceAccess` is the source of truth. The LiveKit `room_role`
-participant attribute is only a projection of it, synced best-effort.
-"""
-
-from logging import getLogger
-from uuid import UUID
-
-from core import models
-from core.services.participants_management import (
-    ParticipantNotFoundException,
-    ParticipantsManagement,
-    ParticipantsManagementException,
-)
-
-logger = getLogger(__name__)
-
-
-class RoomRoleError(Exception):
-    """Base exception for room role management errors."""
-
-    status_code = 400
-
-
-class SelfActionError(RoomRoleError):
-    """Raised when a user tries to change their own role."""
-
-    status_code = 403
-
-
-class OwnerRoleError(RoomRoleError):
-    """Raised when trying to demote an owner or grant ownership."""
-
-    status_code = 403
-
-
-class ParticipantNotInMeetingError(RoomRoleError):
-    """Raised when the target participant is not connected to the meeting."""
-
-    status_code = 404
-
-
-class UserNotFoundError(RoomRoleError):
-    """Raised when the target participant has no user account in database."""
-
-    status_code = 404
-
-
-ASSIGNABLE_ROLES = (models.RoleChoices.MEMBER, models.RoleChoices.ADMIN)
-
-
-class RoomRoleService:
-    """Manage promotion and demotion of room co-hosts."""
-
-    def set_role(
-        self, room: models.Room, user: models.User, role: str, actor: models.User
-    ):
-        """Persist `role` for `user` on `room`, idempotently and atomically.
-
-        Returns the up-to-date `ResourceAccess`. Never grants or removes
-        ownership: granting OWNER is refused, and an existing OWNER access
-        is never modified.
-        """
-
-        if role not in ASSIGNABLE_ROLES:
-            raise OwnerRoleError("Ownership cannot be granted through this action.")
-
-        if actor is not None and user == actor:
-            raise SelfActionError("You cannot change your own role.")
-
-        access, created = models.ResourceAccess.objects.get_or_create(
-            resource=room,
-            user=user,
-            defaults={"role": role},
-        )
-
-        if created:
-            return access
-
-        if access.role == models.RoleChoices.OWNER:
-            raise OwnerRoleError("Room owners cannot be demoted.")
-
-        if access.role != role:
-            access.role = role
-            access.save(update_fields=["role", "updated_at"])
-
-        return access
-
-    def set_participant_role(
-        self,
-        room: models.Room,
-        participant_identity: UUID,
-        role: str,
-        actor: models.User,
-    ):
-        """Change the role of a participant currently connected to the meeting.
-
-        - The participant must be connected (checked against LiveKit).
-        - The participant must map to a user account.
-        - The role is persisted in DB then mirrored to LiveKit.
-
-        Returns a dict: {"role", "livekit_synced"}.
-        """
-
-        room_name = str(room.pk)
-        participants_management = ParticipantsManagement()
-
-        try:
-            is_in_meeting = participants_management.check_if_in_meeting(
-                room_name=room_name, identity=str(participant_identity)
-            )
-        except ParticipantNotFoundException as e:
-            raise ParticipantNotInMeetingError(
-                "Participant is not connected to this meeting."
-            ) from e
-
-        if not is_in_meeting:
-            raise ParticipantNotInMeetingError(
-                "Participant is not connected to this meeting."
-            )
-
-        user = models.User.objects.filter(sub=participant_identity).first()
-
-        if user is None:
-            raise UserNotFoundError(
-                "This participant has no user account and cannot be assigned a role."
-            )
-
-        # Source of truth first: even if the LiveKit sync below fails,
-        # the role is real and any fresh token will carry it.
-        self.set_role(room=room, user=user, role=role, actor=actor)
-
-        livekit_synced = self._sync_livekit_role(
-            room_name=room_name,
-            participant_identity=str(participant_identity),
-            role=str(role),
-        )
-
-        return {
-            "role": role,
-            "livekit_synced": livekit_synced,
-        }
-
-    @staticmethod
-    def _sync_livekit_role(room_name: str, participant_identity: str, role: str):
-        """Mirror the role to the participant's LiveKit attributes.
-
-        Best-effort: returns False on failure instead of raising, so callers
-        can report a partial success. Re-running the action re-syncs.
-        """
-        try:
-            ParticipantsManagement().update(
-                room_name=room_name,
-                identity=participant_identity,
-                attributes={"room_role": role},
-            )
-        except ParticipantNotFoundException:
-            # The participant left between the presence check and the update:
-            # harmless, the DB state (if any) remains authoritative.
-            logger.info(
-                "Participant %s left room %s before role sync",
-                participant_identity,
-                room_name,
-            )
-            return False
-        except ParticipantsManagementException:
-            logger.exception(
-                "Could not sync role to LiveKit for participant %s in room %s",
-                participant_identity,
-                room_name,
-            )
-            return False
-        return True
@@ -1,9 +1,9 @@
-"""SIP management service for managing SIP dispatch rules for room access."""
+"""Telephony service for managing SIP dispatch rules for room access."""

 from logging import getLogger

 from asgiref.sync import async_to_sync
-from livekit.api import TwirpError, TwirpErrorCode
+from livekit.api import TwirpError
 from livekit.protocol.sip import (
    CreateSIPDispatchRuleRequest,
    DeleteSIPDispatchRuleRequest,
@@ -17,16 +17,12 @@ from core import utils
 logger = getLogger(__name__)


-class SIPException(Exception):
-    """Exception raised when SIP operations fail."""
+class TelephonyException(Exception):
+    """Exception raised when telephony operations fail."""


-class DispatchRuleConflictError(SIPException):
-    """Raised when a dispatch rule already exists for the same routing criteria."""
-
-
-class SIPManagement:
-    """Service for managing SIP access through the telephony or roomkit system (SIP)."""
+class TelephonyService:
+    """Service for managing participant access through the telephony system (SIP)."""

    def _rule_name(self, room_id):
        """Generate the rule name for a room based on its ID."""
@@ -36,7 +32,7 @@ class SIPManagement:
    async def create_dispatch_rule(self, room):
        """Create a SIP inbound dispatch rule for direct room routing.

-        Configures livekit-sip to route incoming SIP calls directly to the specified room
+        Configures telephony to route incoming SIP calls directly to the specified room
        using the room's ID and PIN code for authentication.
        """

@@ -55,12 +51,10 @@ class SIPManagement:
        try:
            await lkapi.sip.create_sip_dispatch_rule(create=request)
        except TwirpError as e:
-            if e.code == TwirpErrorCode.ALREADY_EXISTS:
-                raise DispatchRuleConflictError("Dispatch rule already exists") from e
            logger.exception(
                "Unexpected error creating dispatch rule for room %s", room.id
            )
-            raise SIPException("Could not create dispatch rule") from e
+            raise TelephonyException("Could not create dispatch rule") from e

        finally:
            await lkapi.aclose()
@@ -85,7 +79,7 @@ class SIPManagement:
            )
        except TwirpError as e:
            logger.exception("Failed to list dispatch rules for room %s", room_id)
-            raise SIPException("Could not list dispatch rules") from e
+            raise TelephonyException("Could not list dispatch rules") from e
        finally:
            await lkapi.aclose()

@@ -100,28 +94,6 @@ class SIPManagement:
            if existing_rule.name == rule_name
        ]

-    @async_to_sync
-    async def has_dispatch_rule(self, room_id):
-        """Check whether at least one dispatch rule exists for a specific room."""
-        return bool(await self._list_dispatch_rules_ids(room_id))
-
-    def ensure_dispatch_rule(self, room):
-        """Create the SIP dispatch rule for a room if it does not already exist.
-
-        Returns:
-            bool: True if a rule was created, False if it already existed.
-        """
-
-        if self.has_dispatch_rule(room.pk):
-            return False
-
-        try:
-            self.create_dispatch_rule(room)
-        except DispatchRuleConflictError:
-            return False
-
-        return True
-
    @async_to_sync
    async def delete_dispatch_rule(self, room_id):
        """Delete all SIP inbound dispatch rules associated with a specific room."""
@@ -146,7 +118,7 @@ class SIPManagement:

        except TwirpError as e:
            logger.exception("Failed to delete dispatch rules for room %s", room_id)
-            raise SIPException("Could not delete dispatch rules") from e
+            raise TelephonyException("Could not delete dispatch rules") from e

        finally:
            await lkapi.aclose()
@@ -1,9 +0,0 @@
-"""Celery tasks for the core app."""
-
-from core.tasks.connection_test import delete_connection_test_room
-from core.tasks.file import process_file_deletion
-
-__all__ = (
-    "delete_connection_test_room",
-    "process_file_deletion",
-)
@@ -1,11 +1,4 @@
-"""
-Celery task decorator that degrades to a synchronous call when Celery is off.
-"""
-
-# The Celery app is imported lazily so that importing this module does not pull
-# in Celery when CELERY_ENABLED is false.
 # ruff: noqa: PLC0415
-# pylint: disable=import-outside-toplevel

 from django.conf import settings

@@ -1,39 +0,0 @@
-"""Tasks related to connection test rooms."""
-
-import logging
-
-from django.conf import settings
-
-from core.services.room_management import (
-    RoomManagement,
-    RoomManagementException,
-    RoomNotFoundException,
-)
-from core.tasks._task import task
-
-logger = logging.getLogger(__name__)
-
-
-@task
-def delete_connection_test_room(room_name: str):
-    """Force-delete an ephemeral connection-test room.
-
-    Used as a hard cap so a participant cannot keep an auto-refreshed
-    LiveKit session open indefinitely after requesting a test token.
-    """
-    prefix = settings.CONNECTION_TEST_ROOM_PREFIX
-    if not room_name.startswith(prefix):
-        logger.error(
-            "Refusing to delete room '%s': expected prefix '%s'.",
-            room_name,
-            prefix,
-        )
-        return
-
-    try:
-        RoomManagement.delete_room(room_name)
-    except RoomNotFoundException:
-        # Room may already be gone after empty/departure timeout.
-        logger.info("Connection test room '%s' already gone.", room_name)
-    except RoomManagementException:
-        logger.exception("Failed to delete connection test room '%s'.", room_name)
@@ -40,111 +40,6 @@ def test_authentication_getter_existing_user(monkeypatch):
    assert user == db_user


-@pytest.mark.parametrize(
-    "sub",
-    [
-        # NUL (U+0000) passes str.isascii() but PostgreSQL text fields
-        # cannot store or compare it (DataError)
-        "auth0|abc\x00def",
-        # lone surrogates cannot be encoded to UTF-8 for the DB lookup
-        # (UnicodeEncodeError), which runs before any model validation
-        "bad\ud800sub",
-        # plainly invalid subs would otherwise escape as ValidationError
-        # on user creation, which mozilla-django-oidc does not catch
-        "\u00e9milie",
-        "a" * 256,
-        # ASCII control characters are rejected by policy
-        "tab\tsub",
-        "del\x7fsub",
-    ],
-)
-def test_authentication_getter_invalid_sub_rejected_cleanly(monkeypatch, sub):
-    """
-    Subs that can never be persisted should be rejected with
-    SuspiciousOperation (turned into a clean authentication failure by
-    mozilla-django-oidc) instead of leaking DataError, UnicodeEncodeError
-    or ValidationError as a server error.
-    """
-    klass = OIDCAuthenticationBackend()
-
-    def get_userinfo_mocked(*args):
-        return {"sub": sub, "email": "john@example.com"}
-
-    monkeypatch.setattr(OIDCAuthenticationBackend, "get_userinfo", get_userinfo_mocked)
-
-    with pytest.raises(
-        SuspiciousOperation,
-        match="User info contained an invalid sub claim",
-    ):
-        klass.get_or_create_user(access_token="test-token", id_token=None, payload=None)
-
-    assert models.User.objects.exists() is False
-
-
-def test_authentication_getter_numeric_sub(monkeypatch):
-    """
-    Some providers serialize the sub as a JSON number. It should keep working
-    (CharField coerces it to a string on save) and must not crash the early
-    sub checks in get_existing_user.
-    """
-    klass = OIDCAuthenticationBackend()
-
-    def get_userinfo_mocked(*args):
-        return {"sub": 12345, "email": "john@example.com"}
-
-    monkeypatch.setattr(OIDCAuthenticationBackend, "get_userinfo", get_userinfo_mocked)
-
-    user = klass.get_or_create_user(
-        access_token="test-token", id_token=None, payload=None
-    )
-
-    assert user.sub == "12345"
-    assert models.User.objects.count() == 1
-
-
-def test_authentication_getter_new_user_auth0_pipe_sub(monkeypatch):
-    """
-    A first login with an Auth0-style sub containing a pipe ("provider|user-id")
-    should create the user instead of raising a ValidationError.
-    Regression test for https://github.com/suitenumerique/meet/issues/[XXX].
-    """
-    klass = OIDCAuthenticationBackend()
-
-    def get_userinfo_mocked(*args):
-        return {"sub": "auth0|644c0bc8f1874ef6d339fb34", "email": "john@example.com"}
-
-    monkeypatch.setattr(OIDCAuthenticationBackend, "get_userinfo", get_userinfo_mocked)
-
-    user = klass.get_or_create_user(
-        access_token="test-token", id_token=None, payload=None
-    )
-
-    assert user.sub == "auth0|644c0bc8f1874ef6d339fb34"
-    assert user.email == "john@example.com"
-    assert models.User.objects.count() == 1
-
-
-def test_authentication_getter_existing_user_auth0_pipe_sub(monkeypatch):
-    """
-    A returning user with an Auth0-style pipe sub should be matched by sub,
-    not duplicated or rejected.
-    """
-    klass = OIDCAuthenticationBackend()
-    db_user = UserFactory(sub="auth0|644c0bc8f1874ef6d339fb34")
-
-    def get_userinfo_mocked(*args):
-        return {"sub": db_user.sub}
-
-    monkeypatch.setattr(OIDCAuthenticationBackend, "get_userinfo", get_userinfo_mocked)
-
-    user = klass.get_or_create_user(
-        access_token="test-token", id_token=None, payload=None
-    )
-
-    assert user == db_user
-    assert models.User.objects.count() == 1
-
-
 def test_authentication_getter_new_user_no_email(monkeypatch):
    """
    If no user matches, a user should be created.
@@ -7,7 +7,6 @@ from urllib.parse import quote, urlparse

 from django.conf import settings
 from django.core.files.storage import default_storage
-from django.test import override_settings
 from django.utils import timezone

 import pytest
@@ -144,59 +143,3 @@ def test_api_files_media_auth_own_file_deleted():
    )

    assert response.status_code == 403
-
-
-@override_settings(MEDIA_AUTH_ORIGINAL_URL_HEADER="HTTP_X_FORWARDED_URI")
-def test_api_files_media_auth_custom_original_url_header():
-    """
-    Authorization should honour the configured original-url header.
-
-    Covers the attachment subrequest path, which resolves the header separately
-    from the recording one. Reverse proxies other than nginx-ingress use
-    different headers: Traefik's ForwardAuth sends X-Forwarded-Uri and cannot
-    emit X-Original-URL at all.
-    """
-    user = factories.UserFactory()
-
-    file = factories.FileFactory(
-        type=models.FileTypeChoices.BACKGROUND_IMAGE,
-        update_upload_state=models.FileUploadStateChoices.READY,
-        creator=user,
-    )
-
-    client = APIClient()
-    client.force_login(user)
-
-    default_storage.save(file.file_key, BytesIO(b"my prose"))
-
-    original_url = f"http://localhost/media/{file.file_key:s}"
-    response = client.get(
-        "/api/v1.0/files/media-auth/", HTTP_X_FORWARDED_URI=original_url
-    )
-
-    assert response.status_code == 200
-    assert "AWS4-HMAC-SHA256 Credential=" in response["Authorization"]
-
-
-@override_settings(MEDIA_AUTH_ORIGINAL_URL_HEADER="HTTP_X_FORWARDED_URI")
-def test_api_files_media_auth_default_header_ignored_when_reconfigured():
-    """
-    Only the configured header should be honoured, never a hardcoded fallback.
-    """
-    user = factories.UserFactory()
-
-    file = factories.FileFactory(
-        type=models.FileTypeChoices.BACKGROUND_IMAGE,
-        update_upload_state=models.FileUploadStateChoices.READY,
-        creator=user,
-    )
-
-    client = APIClient()
-    client.force_login(user)
-
-    original_url = f"http://localhost/media/{file.file_key:s}"
-    response = client.get(
-        "/api/v1.0/files/media-auth/", HTTP_X_ORIGINAL_URL=original_url
-    )
-
-    assert response.status_code == 403
@@ -11,98 +11,135 @@ from rest_framework.exceptions import AuthenticationFailed

 from core.recording.event.authentication import (
    MachineUser,
-    RecordingProcessWebhookAuthentication,
+    StorageEventAuthentication,
 )


 def test_successful_authentication(settings):
    """Test successful authentication with valid token."""
-    settings.SUMMARY_SERVICE_WEBHOOK_API_TOKEN = "valid-test-token"
+    settings.RECORDING_STORAGE_EVENT_TOKEN = "valid-test-token"
    request = RequestFactory().get("/")
    request.headers = {"Authorization": "Bearer valid-test-token"}

-    user, token = RecordingProcessWebhookAuthentication().authenticate(request)
+    user, token = StorageEventAuthentication().authenticate(request)
    assert token == "valid-test-token"
    assert isinstance(user, MachineUser)


-def test_authentication_fails_when_token_not_configured(settings):
-    """Authentication should fail when no token is configured."""
+def test_disabled_authentication_with_header(settings):
+    """Authentication should pass when no auth is configured, and header is present."""
+    settings.RECORDING_STORAGE_EVENT_TOKEN = None
+    settings.RECORDING_ENABLE_STORAGE_EVENT_AUTH = False

-    settings.SUMMARY_SERVICE_WEBHOOK_API_TOKEN = None
+    request = RequestFactory().get("/")
+    request.headers = {"Authorization": "Bearer some-token"}
+
+    user, token = StorageEventAuthentication().authenticate(request)
+    assert token is None
+    assert isinstance(user, MachineUser)
+
+
+def test_disabled_authentication_without_header(settings):
+    """Authentication should pass when no auth is configured, and no header is present."""
+    settings.RECORDING_STORAGE_EVENT_TOKEN = None
+    settings.RECORDING_ENABLE_STORAGE_EVENT_AUTH = False
+
+    request = RequestFactory().get("/")
+
+    user, token = StorageEventAuthentication().authenticate(request)
+    assert token is None
+    assert isinstance(user, MachineUser)
+
+
+def test_authentication_when_disabled(settings):
+    """Authentication should pass when disabled, regardless of token configuration."""
+    settings.RECORDING_STORAGE_EVENT_TOKEN = "some-token"
+    settings.RECORDING_ENABLE_STORAGE_EVENT_AUTH = False
+
+    request = RequestFactory().get("/")
+
+    user, token = StorageEventAuthentication().authenticate(request)
+    assert token is None
+    assert isinstance(user, MachineUser)
+
+
+def test_authentication_fails_when_token_not_configured(settings):
+    """Authentication should fail when authentication is enabled but no token is configured."""
+
+    # By default RECORDING_ENABLE_STORAGE_EVENT_AUTH should be True
+    settings.RECORDING_STORAGE_EVENT_TOKEN = None

    request = RequestFactory().get("/")

    with pytest.raises(
        AuthenticationFailed,
-        match="Authentication token is not configured",
+        match="Authentication is enabled but token is not configured",
    ):
-        RecordingProcessWebhookAuthentication().authenticate(request)
+        StorageEventAuthentication().authenticate(request)


 def test_missing_auth_header(settings):
    """Test failure when Authorization header is missing."""
-    settings.SUMMARY_SERVICE_WEBHOOK_API_TOKEN = "valid-test-token"
+    settings.RECORDING_STORAGE_EVENT_TOKEN = "valid-test-token"
    request = RequestFactory().get("/")
    request.headers = {}

    with pytest.raises(AuthenticationFailed, match="Authorization header is required"):
-        RecordingProcessWebhookAuthentication().authenticate(request)
+        StorageEventAuthentication().authenticate(request)


 def test_invalid_auth_header_format(settings):
    """Test failure when Authorization header has invalid format."""
-    settings.SUMMARY_SERVICE_WEBHOOK_API_TOKEN = "valid-test-token"
+    settings.RECORDING_STORAGE_EVENT_TOKEN = "valid-test-token"
    request = RequestFactory().get("/")
    request.headers = {"Authorization": "InvalidFormat"}

    with pytest.raises(AuthenticationFailed, match="Invalid authorization header"):
-        RecordingProcessWebhookAuthentication().authenticate(request)
+        StorageEventAuthentication().authenticate(request)


 def test_invalid_token_type(settings):
    """Test failure when token type is not Bearer."""
-    settings.SUMMARY_SERVICE_WEBHOOK_API_TOKEN = "valid-test-token"
+    settings.RECORDING_STORAGE_EVENT_TOKEN = "valid-test-token"
    request = RequestFactory().get("/")
    request.headers = {"Authorization": "Basic some-token"}

    with pytest.raises(AuthenticationFailed, match="Invalid authorization header"):
-        RecordingProcessWebhookAuthentication().authenticate(request)
+        StorageEventAuthentication().authenticate(request)


 def test_invalid_token(settings):
    """Test failure when token is invalid."""
-    settings.SUMMARY_SERVICE_WEBHOOK_API_TOKEN = "valid-test-token"
+    settings.RECORDING_STORAGE_EVENT_TOKEN = "valid-test-token"
    request = RequestFactory().get("/")
    request.headers = {"Authorization": "Bearer wrong-token"}

    with pytest.raises(AuthenticationFailed, match="Invalid token"):
-        RecordingProcessWebhookAuthentication().authenticate(request)
+        StorageEventAuthentication().authenticate(request)


 def test_malformed_auth_header(settings):
    """Test failure when Authorization header is malformed."""
-    settings.SUMMARY_SERVICE_WEBHOOK_API_TOKEN = "valid-test-token"
+    settings.RECORDING_STORAGE_EVENT_TOKEN = "valid-test-token"
    request = RequestFactory().get("/")
    request.headers = {"Authorization": "Bearer"}  # Missing token part

    with pytest.raises(AuthenticationFailed, match="Invalid authorization header"):
-        RecordingProcessWebhookAuthentication().authenticate(request)
+        StorageEventAuthentication().authenticate(request)


 def test_authenticate_header():
    """Test the WWW-Authenticate header value."""
    request = RequestFactory().get("/")
-    header = RecordingProcessWebhookAuthentication().authenticate_header(request)
-    assert header == "Bearer realm='External process webhook API'"
+    header = StorageEventAuthentication().authenticate_header(request)
+    assert header == "Bearer realm='Storage event API'"


 def test_multiple_spaces_in_auth_header(settings):
-    """Extra spaces between the scheme and the token should be tolerated."""
-    settings.SUMMARY_SERVICE_WEBHOOK_API_TOKEN = "extra-spaces-token"
+    """Test success when Authorization header contains multiple spaces."""
+    settings.RECORDING_STORAGE_EVENT_TOKEN = "valid-test-token"
    request = RequestFactory().get("/")
    request.headers = {"Authorization": "Bearer   extra-spaces-token"}

-    user, token = RecordingProcessWebhookAuthentication().authenticate(request)
-    assert token == "extra-spaces-token"
-    assert isinstance(user, MachineUser)
+    header = StorageEventAuthentication().authenticate_header(request)
+    assert header == "Bearer realm='Storage event API'"
@@ -5,7 +5,6 @@ Test event notification.
 # pylint: disable=assignment-from-no-return,redefined-outer-name,unused-argument,protected-access

 import datetime
-import json
 import smtplib
 from unittest import mock

@@ -419,63 +418,3 @@ def test_notify_summary_service_post_args_without_metadata(
    mock_is_feature_flag_enabled.assert_called_once_with(
        owner, UserFeatureFlag.TRANSCRIPT_SUMMARY_ENABLED
    )
-
-
-@mock.patch("core.recording.event.notification.requests.post")
-@mock.patch("core.recording.event.notification.generate_download_s3_url")
-@mock.patch.object(
-    NotificationService, "_get_recording_timestamps", new_callable=mock.AsyncMock
-)
-def test_notify_summary_service_v2_payload_json_serializable_without_timestamps(
-    mock_get_recording_timestamps,
-    mock_generate_download_s3_url,
-    mock_post,
-    settings,
-):
-    """Regression test for a non-JSON-serializable payload when timestamps are missing.
-
-    When the LiveKit egress can no longer be found, ``_get_recording_timestamps``
-    returns ``(None, None)`` and ``_generate_title`` falls back to its default
-    title. That default must be a real ``str``: it used to return a lazy
-    ``gettext_lazy`` proxy, which ``json.dumps`` cannot serialize, so the real
-    ``requests.post(json=payload)`` call crashed in production with
-    ``TypeError: Object of type __proxy__ is not JSON serializable``.
-    """
-    settings.SUMMARY_SERVICE_VERSION = 2
-    settings.SUMMARY_SERVICE_ENDPOINT = "https://summary.test/api/v2/tasks"
-    settings.SUMMARY_SERVICE_API_TOKEN = "summary-token"
-    settings.RECORDING_DOWNLOAD_BASE_URL = "https://app.test/recordings"
-    settings.SCREEN_RECORDING_BASE_URL = None
-    settings.METADATA_COLLECTOR_ENABLED = False
-
-    recording = factories.RecordingFactory(room__name="Daily")
-    owner = factories.UserFactory(
-        email="owner@test.com",
-        sub="owner-sub",
-        language="fr-fr",
-        timezone="Europe/Paris",
-    )
-    factories.UserRecordingAccessFactory(
-        recording=recording, role=models.RoleChoices.OWNER, user=owner
-    )
-
-    # Egress timestamps unavailable -> default-title branch in _generate_title.
-    mock_get_recording_timestamps.return_value = (None, None)
-    mock_generate_download_s3_url.return_value = "https://storage.test/recording.mp4"
-
-    mock_response = mock.Mock()
-    mock_response.raise_for_status.return_value = None
-    mock_response.json.return_value = {"job_id": "job-77"}
-    mock_post.return_value = mock_response
-
-    result = NotificationService._notify_summary_service(recording)
-
-    assert result is True
-
-    payload = mock_post.call_args.kwargs["json"]
-    title = payload["push_to_docs_config"]["title"]
-
-    # The title must be a plain ``str``, not a lazy translation proxy...
-    assert isinstance(title, str)
-    # ...so the payload serializes exactly the way ``requests`` serializes it.
-    json.dumps(payload)
@@ -0,0 +1,512 @@
+"""
+Test event parsers.
+"""
+
+# pylint: disable=protected-access,redefined-outer-name,unused-argument
+
+from unittest import mock
+
+from django.conf import settings
+
+import pytest
+
+from core.recording.event.exceptions import (
+    InvalidBucketError,
+    InvalidFilepathError,
+    InvalidFileTypeError,
+    ParsingEventDataError,
+)
+from core.recording.event.parsers import (
+    MinioParser,
+    S3Parser,
+    StorageEvent,
+    get_parser,
+)
+
+# MinioParser
+
+
+@pytest.fixture
+def valid_minio_event():
+    """Mock a valid Minio event."""
+    return {
+        "Records": [
+            {
+                "s3": {
+                    "bucket": {"name": "test-bucket"},
+                    "object": {
+                        "key": "recordings%2F46d1a121-2426-484d-8fb3-09b5d886f7a8.ogg",
+                        "contentType": "audio/ogg",
+                    },
+                }
+            }
+        ]
+    }
+
+
+@pytest.fixture
+def minio_parser():
+    """Mock a Minio parser."""
+    return MinioParser(bucket_name="test-bucket")
+
+
+def test_minio_parse_valid_event(minio_parser, valid_minio_event):
+    """Test parsing a valid Minio event."""
+    event = minio_parser.parse(valid_minio_event)
+    assert isinstance(event, StorageEvent)
+    assert event.filepath == "recordings%2F46d1a121-2426-484d-8fb3-09b5d886f7a8.ogg"
+    assert event.filetype == "audio/ogg"
+    assert event.bucket_name == "test-bucket"
+    assert event.metadata is None
+
+
+def test_minio_parse_with_video_type(minio_parser):
+    """Test parsing event with video file type."""
+    video_event = {
+        "Records": [
+            {
+                "s3": {
+                    "bucket": {"name": "test-bucket"},
+                    "object": {
+                        "key": "46d1a121-2426-484d-8fb3-09b5d886f7a8.mp4",
+                        "contentType": "video/mp4",
+                    },
+                }
+            }
+        ]
+    }
+    event = minio_parser.parse(video_event)
+    assert event.filetype == "video/mp4"
+    assert event.filepath.endswith(".mp4")
+
+
+def test_minio_parse_empty_data(minio_parser):
+    """Test parsing empty event data raises error."""
+    with pytest.raises(ParsingEventDataError, match="Received empty data."):
+        minio_parser.parse({})
+
+
+def test_minio_parse_missing_keys(minio_parser):
+    """Test parsing event with missing key."""
+
+    invalid_minio_event = {
+        "Records": [
+            {
+                "s3": {
+                    "bucket": {"name": None},
+                    # Missing 'object' key
+                }
+            }
+        ]
+    }
+
+    with pytest.raises(ParsingEventDataError, match="Malformed Minio event:"):
+        minio_parser.parse(invalid_minio_event)
+
+
+def test_minio_parse_none_key(minio_parser):
+    """Test parsing event with None field."""
+
+    invalid_minio_event = {
+        "Records": [
+            {
+                "s3": {
+                    "bucket": {"name": "test-bucket"},
+                    "object": {
+                        "key": "recording%2F46d1a121-2426-484d-8fb3-09b5d886f7a8.ogg",
+                        "contentType": None,  # 'contentType' should not be None
+                    },
+                }
+            }
+        ]
+    }
+
+    with pytest.raises(ParsingEventDataError, match="Missing essential data fields"):
+        minio_parser.parse(invalid_minio_event)
+
+
+def test_minio_validate_invalid_bucket(minio_parser):
+    """Test validation with wrong bucket name."""
+    event = StorageEvent(
+        filepath="recording%2F46d1a121-2426-484d-8fb3-09b5d886f7a8.ogg",
+        filetype="audio/ogg",
+        bucket_name="wrong-bucket",
+        metadata=None,
+    )
+    with pytest.raises(InvalidBucketError):
+        minio_parser.validate(event)
+
+
+def test_minio_validate_invalid_filetype(minio_parser):
+    """Test validation with unsupported file type."""
+    event = StorageEvent(
+        filepath="recording%2F46d1a121-2426-484d-8fb3-09b5d886f7a8.txt",
+        filetype="text/plain",  # Not included in the default allowed filetypes
+        bucket_name="test-bucket",
+        metadata=None,
+    )
+    with pytest.raises(InvalidFileTypeError):
+        minio_parser.validate(event)
+
+
+@pytest.mark.parametrize(
+    "invalid_filepath",
+    [
+        "invalid_filepath",  # totally invalid string
+        "recordings/46d1a121-2426-484d-8fb3-09b5d886f7a8.ogg",
+        "recordings/46d1a121-2426-484d-8fb3-09b5d886f7a8",  # missing extension
+        "46d1a121-2426-484d-8fb3-09b5d886f7a8",  # missing url_encoded_folder_path and extension
+        "",  # empty string
+        "46d1a121-2426-484d-8fb3-09b5d886f7a8.ogg",  # no folder at all
+        "uploads%2F46d1a121-2426-484d-8fb3-09b5d886f7a8.ogg",  # wrong folder name
+        "folder%2Fuploads%2F46d1a121-2426-484d-8fb3-09b5d886f7a8.ogg",  # nested but no recordings/
+    ],
+)
+def test_minio_validate_invalid_filepath(invalid_filepath, minio_parser):
+    """Test validation with malformed filepath."""
+    event = StorageEvent(
+        filepath=invalid_filepath,
+        filetype="audio/ogg",
+        bucket_name="test-bucket",
+        metadata=None,
+    )
+    with pytest.raises(InvalidFilepathError):
+        minio_parser.validate(event)
+
+
+def test_minio_validate_valid_event(minio_parser):
+    """Test validation with valid event data."""
+    event = StorageEvent(
+        filepath="recordings%2F46d1a121-2426-484d-8fb3-09b5d886f7a8.ogg",
+        filetype="audio/ogg",
+        bucket_name="test-bucket",
+        metadata=None,
+    )
+    recording_id = minio_parser.validate(event)
+    assert recording_id == "46d1a121-2426-484d-8fb3-09b5d886f7a8"
+
+
+def test_minio_get_recording_id_success(minio_parser, valid_minio_event):
+    """Test successful extraction of recording ID."""
+    recording_id = minio_parser.get_recording_id(valid_minio_event)
+    assert recording_id == "46d1a121-2426-484d-8fb3-09b5d886f7a8"
+
+
+def test_minio_validate_filepath_with_folder(minio_parser):
+    """Test validation of filepath with folder structure."""
+    event = StorageEvent(
+        filepath="parent_folder%2Frecordings%2F46d1a121-2426-484d-8fb3-09b5d886f7a8.ogg",
+        filetype="audio/ogg",
+        bucket_name="test-bucket",
+        metadata=None,
+    )
+    recording_id = minio_parser.validate(event)
+    assert recording_id == "46d1a121-2426-484d-8fb3-09b5d886f7a8"
+
+
+def test_minio_empty_allowed_filetypes():
+    """Test MinioParser with empty allowed_filetypes."""
+    empty_types = set()
+    parser = MinioParser(bucket_name="test-bucket", allowed_filetypes=empty_types)
+    assert parser._allowed_filetypes == {"audio/ogg", "video/mp4"}
+
+
+def test_minio_custom_allowed_filetypes():
+    """Test MinioParser with empty allowed_filetypes."""
+    custom_types = {"audio/mp3", "video/mov"}
+    parser = MinioParser(bucket_name="test-bucket", allowed_filetypes=custom_types)
+    assert parser._allowed_filetypes == {"audio/mp3", "video/mov"}
+
+
+def test_minio_validate_custom_filetypes():
+    """Test validation of filepath with folder structure."""
+
+    parser = MinioParser(bucket_name="test-bucket", allowed_filetypes={"audio/mp3"})
+
+    event = StorageEvent(
+        filepath="parent_folder%2Frecordings%2F46d1a121-2426-484d-8fb3-09b5d886f7a8.ogg",
+        filetype="audio/mp3",
+        bucket_name="test-bucket",
+        metadata=None,
+    )
+    parser.validate(event)
+
+
+def test_minio_constructor_none_bucket():
+    """Test MinioParser constructor with None bucket name."""
+    with pytest.raises(ValueError, match="Bucket name cannot be None or empty"):
+        MinioParser(bucket_name=None)
+
+
+def test_minio_constructor_empty_bucket():
+    """Test MinioParser constructor with empty bucket name."""
+    with pytest.raises(ValueError, match="Bucket name cannot be None or empty"):
+        MinioParser(bucket_name="")
+
+
+# S3Parser
+
+
+@pytest.fixture
+def valid_s3_event():
+    """Mock a valid S3 event."""
+    return {
+        "Records": [
+            {
+                "s3": {
+                    "bucket": {"name": "test-bucket"},
+                    "object": {
+                        "key": "recordings%2F46d1a121-2426-484d-8fb3-09b5d886f7a8.ogg",
+                    },
+                }
+            }
+        ]
+    }
+
+
+@pytest.fixture
+def s3_parser():
+    """Mock an S3 parser."""
+    return S3Parser(bucket_name="test-bucket")
+
+
+def test_s3_parse_valid_event(s3_parser, valid_s3_event):
+    """Test parsing a valid S3 event."""
+    event = s3_parser.parse(valid_s3_event)
+    assert isinstance(event, StorageEvent)
+    assert event.filepath == "recordings%2F46d1a121-2426-484d-8fb3-09b5d886f7a8.ogg"
+    assert event.filetype == "audio/ogg"
+    assert event.bucket_name == "test-bucket"
+    assert event.metadata is None
+
+
+def test_s3_parse_empty_data(s3_parser):
+    """Test parsing empty S3 event data raises error."""
+    with pytest.raises(ParsingEventDataError, match="Received empty data."):
+        s3_parser.parse({})
+
+
+def test_s3_parse_missing_keys(s3_parser):
+    """Test parsing S3 event with missing key."""
+    invalid_s3_event = {
+        "Records": [
+            {
+                "s3": {
+                    "bucket": {"name": "test-bucket"},
+                    # Missing 'object' key
+                }
+            }
+        ]
+    }
+
+    with pytest.raises(ParsingEventDataError, match="Malformed S3 event:"):
+        s3_parser.parse(invalid_s3_event)
+
+
+def test_s3_parse_none_key(s3_parser):
+    """Test parsing S3 event with None field."""
+    invalid_s3_event = {
+        "Records": [
+            {
+                "s3": {
+                    "bucket": {"name": "test-bucket"},
+                    "object": {
+                        "key": None,
+                    },
+                }
+            }
+        ]
+    }
+
+    with pytest.raises(ParsingEventDataError, match="Missing object key name"):
+        s3_parser.parse(invalid_s3_event)
+
+
+def test_s3_parse_with_video_type(s3_parser):
+    """Test parsing S3 event with mp4 file extension."""
+    video_event = {
+        "Records": [
+            {
+                "s3": {
+                    "bucket": {"name": "test-bucket"},
+                    "object": {
+                        "key": "recordings%2F46d1a121-2426-484d-8fb3-09b5d886f7a8.mp4",
+                    },
+                }
+            }
+        ]
+    }
+    event = s3_parser.parse(video_event)
+    assert event.filetype == "video/mp4"
+    assert event.filepath.endswith(".mp4")
+
+
+def test_s3_parse_unrecognized_extension(s3_parser):
+    """Test parsing S3 event with unrecognized file extension."""
+    event_with_unknown_ext = {
+        "Records": [
+            {
+                "s3": {
+                    "bucket": {"name": "test-bucket"},
+                    "object": {
+                        "key": "recordings%2F46d1a121-2426-484d-8fb3-09b5d886f7a8.zzunknown999",
+                    },
+                }
+            }
+        ]
+    }
+
+    with pytest.raises(TypeError, match="filetype cannot be None"):
+        s3_parser.parse(event_with_unknown_ext)
+
+
+def test_s3_parser_keeps_encoded_filepath_compatible(settings):
+    """Test S3 parser keeps already encoded object keys compatible."""
+    settings.RECORDING_OUTPUT_FOLDER = "recordings"
+
+    recording_id = "80ae9fe5-639a-438b-b86e-9e3dd2d55f4d"
+    parser = S3Parser(bucket_name="recordings-bucket")
+
+    data = {
+        "Records": [
+            {
+                "s3": {
+                    "bucket": {"name": "recordings-bucket"},
+                    "object": {
+                        "key": f"recordings%2F{recording_id}.mp4",
+                    },
+                }
+            }
+        ]
+    }
+
+    assert parser.get_recording_id(data) == recording_id
+
+
+def test_s3_parser_accepts_unencoded_filepath(settings):
+    """Test S3 parser accepts raw object keys with slash separators."""
+    settings.RECORDING_OUTPUT_FOLDER = "recordings"
+
+    recording_id = "80ae9fe5-639a-438b-b86e-9e3dd2d55f4d"
+    parser = S3Parser(bucket_name="recordings-bucket")
+
+    data = {
+        "Records": [
+            {
+                "s3": {
+                    "bucket": {"name": "recordings-bucket"},
+                    "object": {
+                        "key": f"recordings/{recording_id}.mp4",
+                    },
+                }
+            }
+        ]
+    }
+
+    assert parser.get_recording_id(data) == recording_id
+
+
+def test_s3_parser_preserves_plus_signs_in_encoded_filepath(settings):
+    """Test S3 parser preserves plus signs in already encoded object keys."""
+    settings.RECORDING_OUTPUT_FOLDER = "recordings"
+
+    recording_id = "80ae9fe5-639a-438b-b86e-9e3dd2d55f4d"
+    parser = S3Parser(bucket_name="recordings-bucket")
+
+    data = {
+        "Records": [
+            {
+                "s3": {
+                    "bucket": {"name": "recordings-bucket"},
+                    "object": {
+                        "key": f"folder+name%2Frecordings%2F{recording_id}.mp4",
+                    },
+                }
+            }
+        ]
+    }
+
+    assert parser.get_recording_id(data) == recording_id
+
+
+def test_s3_get_recording_id_success(s3_parser, valid_s3_event):
+    """Test successful extraction of recording ID from S3 event."""
+    recording_id = s3_parser.get_recording_id(valid_s3_event)
+    assert recording_id == "46d1a121-2426-484d-8fb3-09b5d886f7a8"
+
+
+# get_parser
+
+
+@pytest.fixture
+def clear_lru_cache():
+    """Fixture to clear the LRU cache between tests."""
+    get_parser.cache_clear()
+    yield
+    get_parser.cache_clear()
+
+
+def test_returns_correct_instance(clear_lru_cache):
+    """Test if get_parser returns the correct parser instance."""
+    settings.AWS_STORAGE_BUCKET_NAME = "test-bucket"
+    parser = get_parser()
+    assert isinstance(parser, MinioParser)
+    assert parser._bucket_name == "test-bucket"
+
+
+def test_caching_behavior(clear_lru_cache):
+    """Test if the function properly caches the parser instance."""
+    settings.AWS_STORAGE_BUCKET_NAME = "test-bucket"
+    parser1 = get_parser()
+    parser2 = get_parser()
+    assert parser1 is parser2  # Check object identity
+
+
+def test_different_settings_new_instance():
+    """Test if changing settings creates a new instance."""
+    settings.AWS_STORAGE_BUCKET_NAME = "different-bucket"
+    parser = get_parser()
+    assert parser._bucket_name == "different-bucket"
+
+
+def test_import_error_handling(clear_lru_cache):
+    """Test handling of import errors for invalid parser class."""
+    settings.RECORDING_EVENT_PARSER_CLASS = "invalid.parser.path"
+    with pytest.raises(ImportError):
+        get_parser()
+
+
+@mock.patch("core.recording.event.parsers.import_string")
+def test_parser_instantiation_called_once(mock_import_string, clear_lru_cache):
+    """Test that parser class is instantiated only once due to caching."""
+    mock_parser_cls = type(
+        "MockParser",
+        (),
+        {
+            "__init__": lambda self, bucket_name: setattr(
+                self, "_bucket_name", bucket_name
+            )
+        },
+    )
+    mock_import_string.return_value = mock_parser_cls
+
+    # First call
+    parser1 = get_parser()
+    # Second call
+    parser2 = get_parser()
+
+    # Verify import_string was called only once
+    mock_import_string.assert_called_once_with(settings.RECORDING_EVENT_PARSER_CLASS)
+    assert parser1 is parser2
+
+
+def test_cache_clear_behavior(clear_lru_cache, settings):
+    """Test that cache clearing creates new instance."""
+
+    settings.RECORDING_EVENT_PARSER_CLASS = "core.recording.event.parsers.MinioParser"
+
+    parser1 = get_parser()
+    get_parser.cache_clear()
+    parser2 = get_parser()
+
+    assert parser1 is not parser2  # Should be different instances after cache clear
@@ -2,22 +2,16 @@
 Test RecordingEventsService service.
 """

-# pylint: disable=redefined-outer-name,protected-access
+# pylint: disable=redefined-outer-name

-import logging
 from unittest import mock

 import pytest

 from core.factories import RecordingFactory
-from core.recording.enums import RecordingWorkerEvent
 from core.recording.services.recording_events import (
    RecordingEventsError,
    RecordingEventsService,
-    RecordingNotSavableError,
-)
-from core.services.room_management import (
-    RoomManagementException,
 )
 from core.utils import NotificationError

@@ -39,10 +33,10 @@ def service():
 )
@mock.patch("core.utils.notify_participants")
 def test_handle_limit_reached_success(mock_notify, mode, notification_type, service):
-    """Test _handle_limit_reached stops recording and notifies participants."""
+    """Test handle_limit_reached stops recording and notifies participants."""

    recording = RecordingFactory(status="active", mode=mode)
-    service._handle_limit_reached(recording)
+    service.handle_limit_reached(recording)

    assert recording.status == "stopped"
    mock_notify.assert_called_once_with(
@@ -53,69 +47,13 @@ def test_handle_limit_reached_success(mock_notify, mode, notification_type, serv
@pytest.mark.parametrize(
    ("mode", "notification_type"),
    (
-        ("screen_recording", "screenRecordingFailed"),
-        ("transcript", "transcriptionFailed"),
+        ("screen_recording", "screenRecordingLimitReached"),
+        ("transcript", "transcriptionLimitReached"),
    ),
 )
@mock.patch("core.utils.notify_participants")
-def test_handle_failed_success(mock_notify, mode, notification_type, service):
-    """Test _handle_failed marks recording as failed and notifies participants."""
-
-    recording = RecordingFactory(status="active", mode=mode)
-    service._handle_failed(recording)
-
-    assert recording.status == "failed"
-    mock_notify.assert_called_once_with(
-        room_name=str(recording.room.id), notification_data={"type": notification_type}
-    )
-
-
-@pytest.mark.parametrize(
-    ("mode", "notification_type"),
-    (
-        ("screen_recording", "screenRecordingAborted"),
-        ("transcript", "transcriptionAborted"),
-    ),
-)
-@mock.patch("core.utils.notify_participants")
-def test_handle_aborted_success(mock_notify, mode, notification_type, service):
-    """Test _handle_aborted marks recording as aborted and notifies participants."""
-
-    recording = RecordingFactory(status="active", mode=mode)
-    service._handle_aborted(recording)
-
-    assert recording.status == "aborted"
-    mock_notify.assert_called_once_with(
-        room_name=str(recording.room.id), notification_data={"type": notification_type}
-    )
-
-
-@pytest.mark.parametrize(
-    ("mode", "notification_prefix"),
-    (("screen_recording", "screenRecording"), ("transcript", "transcription")),
-)
-@pytest.mark.parametrize(
-    ("handler", "expected_status", "event", "notification_suffix"),
-    (
-        ("_handle_limit_reached", "stopped", "limit reached", "LimitReached"),
-        ("_handle_failed", "failed", "failed", "Failed"),
-        ("_handle_aborted", "aborted", "aborted", "Aborted"),
-    ),
-)
-@mock.patch("core.utils.notify_participants")
-def test_handle_event_notification_error(  # noqa: PLR0913, PLR0917
-    mock_notify,
-    handler,
-    expected_status,
-    event,
-    notification_suffix,
-    mode,
-    notification_prefix,
-    service,
-):  # pylint: disable=too-many-arguments,too-many-positional-arguments
-    """Test handlers raise RecordingEventsError when notifying participants fails,
-    while still applying the recording status of their event.
-    """
+def test_handle_limit_reached_error(mock_notify, mode, notification_type, service):
+    """Test handle_limit_reached raises RecordingEventsError when notification fails."""

    mock_notify.side_effect = NotificationError("Error notifying")

@@ -123,336 +61,12 @@ def test_handle_event_notification_error(  # noqa: PLR0913, PLR0917

    with pytest.raises(
        RecordingEventsError,
-        match=rf"Failed to notify participants in room '.+' "
-        rf"about recording {event} \(recording_id=.+\)",
+        match=r"Failed to notify participants in room '.+' "
+        r"about recording limit reached \(recording_id=.+\)",
    ):
-        getattr(service, handler)(recording)
+        service.handle_limit_reached(recording)

-    assert recording.status == expected_status
+    assert recording.status == "stopped"
    mock_notify.assert_called_once_with(
-        room_name=str(recording.room.id),
-        notification_data={"type": f"{notification_prefix}{notification_suffix}"},
+        room_name=str(recording.room.id), notification_data={"type": notification_type}
    )
-
-
-@pytest.mark.parametrize("status", ["active", "stopped"])
-@pytest.mark.parametrize(
-    ("notify_return_value", "expected_status"),
-    ((True, "notification_succeeded"), (False, "saved")),
-)
-@mock.patch(
-    "core.recording.services.recording_events.notification_service."
-    "notify_external_services"
-)
-def test_handle_successful_saves_recording(  # pylint: disable=too-many-arguments, too-many-positional-arguments
-    mock_notify_external_services,
-    notify_return_value,
-    expected_status,
-    status,
-    service,
-):
-    """Test _handle_successful notifies external services and saves a savable recording."""
-
-    mock_notify_external_services.return_value = notify_return_value
-
-    recording = RecordingFactory(status=status)
-    service._handle_successful(recording)
-
-    mock_notify_external_services.assert_called_once_with(recording)
-
-    recording.refresh_from_db()
-    assert recording.status == expected_status
-
-
-@pytest.mark.parametrize(
-    "status",
-    [
-        "initiated",
-        "saved",
-        "notification_succeeded",
-        "aborted",
-        "failed",
-        "failed_to_start",
-    ],
-)
-@mock.patch(
-    "core.recording.services.recording_events.notification_service."
-    "notify_external_services"
-)
-def test_handle_successful_non_savable_recording(
-    mock_notify_external_services, status, service
-):
-    """Test _handle_successful refuses recordings that are already saved or in error."""
-
-    recording = RecordingFactory(status=status)
-
-    with pytest.raises(RecordingNotSavableError):
-        service._handle_successful(recording)
-
-    mock_notify_external_services.assert_not_called()
-
-    recording.refresh_from_db()
-    assert recording.status == status
-
-
-@pytest.mark.parametrize(
-    ("event", "recording_status"),
-    (
-        (RecordingWorkerEvent.STARTED, "started"),
-        (RecordingWorkerEvent.SAVING, "saving"),
-    ),
-)
-@mock.patch("core.services.room_management.RoomManagement.update_metadata")
-def test_handle_update_syncs_room_metadata(
-    mock_update_metadata, event, recording_status, service
-):
-    """Test handle_update updates the room's metadata."""
-
-    recording = RecordingFactory(status="active")
-    service.handle_update(recording, event)
-
-    mock_update_metadata.assert_called_once_with(
-        str(recording.room.id), {"recording_status": recording_status}
-    )
-
-
-@pytest.mark.parametrize(
-    "event",
-    (
-        RecordingWorkerEvent.STARTING,
-        RecordingWorkerEvent.COMPLETED,
-        RecordingWorkerEvent.LIMIT_REACHED,
-        RecordingWorkerEvent.ABORTED,
-        RecordingWorkerEvent.FAILED,
-    ),
-)
-@mock.patch("core.services.room_management.RoomManagement.update_metadata")
-def test_handle_update_ignores_events_without_a_metadata_status(
-    mock_update_metadata, event, service
-):
-    """Test handle_update doesn't update metadata for events it doesn't match."""
-
-    recording = RecordingFactory(status="active")
-    service.handle_update(recording, event)
-
-    mock_update_metadata.assert_not_called()
-
-
-@pytest.mark.parametrize(
-    ("event", "initial_status", "expected_status", "notification_type"),
-    (
-        (RecordingWorkerEvent.LIMIT_REACHED, "active", "saved", "LimitReached"),
-        (RecordingWorkerEvent.LIMIT_REACHED, "stopped", "saved", None),
-        (RecordingWorkerEvent.LIMIT_REACHED, "saved", "saved", None),
-        (RecordingWorkerEvent.ABORTED, "active", "aborted", "Aborted"),
-        (RecordingWorkerEvent.ABORTED, "failed_to_stop", "failed_to_stop", None),
-        (RecordingWorkerEvent.FAILED, "active", "failed", "Failed"),
-        (RecordingWorkerEvent.FAILED, "stopped", "failed", "Failed"),
-        (RecordingWorkerEvent.FAILED, "aborted", "aborted", None),
-        (RecordingWorkerEvent.COMPLETED, "active", "saved", None),
-        (RecordingWorkerEvent.COMPLETED, "saved", "saved", None),
-    ),
-)
-@mock.patch(
-    "core.recording.services.recording_events.notification_service."
-    "notify_external_services"
-)
-@mock.patch("core.utils.notify_participants")
-def test_handle_terminal_event_dispatches_on_event_and_status(  # noqa: PLR0913, PLR0917
-    mock_notify,
-    mock_notify_external_services,
-    event,
-    initial_status,
-    expected_status,
-    notification_type,
-    service,
-):  # pylint: disable=too-many-arguments,too-many-positional-arguments
-    """Test handle_terminal_event chooses the right handler from the event and status."""
-
-    mock_notify_external_services.return_value = False
-
-    recording = RecordingFactory(status=initial_status, mode="screen_recording")
-    service.handle_terminal_event(recording, event)
-
-    recording.refresh_from_db()
-    assert recording.status == expected_status
-
-    if notification_type is None:
-        mock_notify.assert_not_called()
-    else:
-        mock_notify.assert_called_once_with(
-            room_name=str(recording.room.id),
-            notification_data={"type": f"screenRecording{notification_type}"},
-        )
-
-
-@pytest.mark.parametrize(
-    "event",
-    (
-        RecordingWorkerEvent.STARTING,
-        RecordingWorkerEvent.STARTED,
-        RecordingWorkerEvent.SAVING,
-    ),
-)
-@mock.patch(
-    "core.recording.services.recording_events.notification_service."
-    "notify_external_services"
-)
-@mock.patch("core.utils.notify_participants")
-def test_handle_terminal_event_ignores_non_terminal_events(
-    mock_notify, mock_notify_external_services, event, service, caplog
-):
-    """Test handle_terminal_event refuses non-terminal events."""
-
-    recording = RecordingFactory(status="active")
-
-    with caplog.at_level(logging.WARNING):
-        service.handle_terminal_event(recording, event)
-
-    assert f"Ignoring non-terminal event {event.value}" in caplog.text
-    mock_notify.assert_not_called()
-    mock_notify_external_services.assert_not_called()
-
-    recording.refresh_from_db()
-    assert recording.status == "active"
-
-
-@pytest.mark.parametrize(
-    ("event", "expected_status"),
-    (
-        (RecordingWorkerEvent.LIMIT_REACHED, "saved"),
-        (RecordingWorkerEvent.ABORTED, "aborted"),
-        (RecordingWorkerEvent.FAILED, "failed"),
-    ),
-)
-@mock.patch(
-    "core.recording.services.recording_events.notification_service."
-    "notify_external_services"
-)
-@mock.patch("core.utils.notify_participants")
-def test_handle_terminal_event_survives_a_notification_failure(  # noqa: PLR0913, PLR0917
-    mock_notify,
-    mock_notify_external_services,
-    event,
-    expected_status,
-    service,
-    caplog,
-):  # pylint: disable=too-many-arguments,too-many-positional-arguments
-    """Test handle_terminal_event logs a notification failure instead of raising.
-
-    The recording status must still be persisted: participants missing their
-    notification should not disturb recording.
-    """
-
-    mock_notify_external_services.return_value = False
-    mock_notify.side_effect = NotificationError("Error notifying")
-
-    recording = RecordingFactory(status="active")
-
-    with caplog.at_level(logging.ERROR):
-        service.handle_terminal_event(recording, event)
-
-    assert f"Failed to notify participants that recording {recording.id}" in caplog.text
-
-    recording.refresh_from_db()
-    assert recording.status == expected_status
-
-
-@pytest.mark.parametrize(
-    "status",
-    ["failed_to_start", "aborted", "failed", "failed_to_stop", "saved", "initiated"],
-)
-@mock.patch(
-    "core.recording.services.recording_events.notification_service."
-    "notify_external_services"
-)
-def test_handle_terminal_event_ignores_a_non_savable_recording(
-    mock_notify_external_services, status, service, caplog
-):
-    """Test handle_terminal_event handles a redelivered event idempotently.
-
-    A terminal event may be redelivered for an already finalized recording;
-    this must not raise, otherwise the webhook would 500 and be retried.
-    """
-
-    recording = RecordingFactory(status=status)
-
-    with caplog.at_level(logging.WARNING):
-        service.handle_terminal_event(recording, RecordingWorkerEvent.COMPLETED)
-
-    assert f"Recording {recording.id} is not savable" in caplog.text
-    mock_notify_external_services.assert_not_called()
-
-    recording.refresh_from_db()
-    assert recording.status == status
-
-
-@mock.patch("core.services.room_management.RoomManagement.update_metadata")
-def test_handle_update_survives_a_metadata_failure(
-    mock_update_metadata, service, caplog
-):
-    """Test handle_update logs a metadata failure instead of raising."""
-
-    mock_update_metadata.side_effect = RoomManagementException("Error updating")
-
-    recording = RecordingFactory(status="active")
-
-    with caplog.at_level(logging.ERROR):
-        service.handle_update(recording, RecordingWorkerEvent.SAVING)
-
-    assert "Failed to update room's metadata" in caplog.text
-
-
-@pytest.mark.parametrize(
-    ("event", "expected_level"),
-    (
-        (RecordingWorkerEvent.ABORTED, logging.INFO),
-        (RecordingWorkerEvent.FAILED, logging.ERROR),
-    ),
-)
-def test_log_worker_error_reports_an_unsuccessful_event(
-    event, expected_level, service, caplog
-):
-    """Test log_worker_error records the reason the recording did not succeed."""
-
-    recording = RecordingFactory(status="active", mode="screen_recording")
-
-    with caplog.at_level(logging.INFO):
-        service.log_worker_error(
-            recording, event, error="could not connect to the room", error_code=500
-        )
-
-    assert (
-        f"Recording worker reported {event.value} for recording {recording.id}"
-        in caplog.text
-    )
-    assert "could not connect to the room" in caplog.text
-    assert "error_code=500" in caplog.text
-    worker_logs = [
-        record
-        for record in caplog.records
-        if record.name == "core.recording.services.recording_events"
-    ]
-    assert [record.levelno for record in worker_logs] == [expected_level]
-
-
-@pytest.mark.parametrize(
-    "event",
-    (
-        RecordingWorkerEvent.STARTING,
-        RecordingWorkerEvent.STARTED,
-        RecordingWorkerEvent.SAVING,
-        RecordingWorkerEvent.COMPLETED,
-        RecordingWorkerEvent.LIMIT_REACHED,
-        None,
-    ),
-)
-def test_log_worker_error_stays_quiet_on_anything_else(event, service, caplog):
-    """Test log_worker_error ignores events other than FAILED and ABORTED."""
-
-    recording = RecordingFactory(status="active")
-
-    with caplog.at_level(logging.INFO):
-        service.log_worker_error(recording, event, error="some error", error_code=500)
-
-    assert "Recording worker reported" not in caplog.text
@@ -8,7 +8,6 @@ from uuid import uuid4

 from django.conf import settings
 from django.core.files.storage import default_storage
-from django.test import override_settings
 from django.utils import timezone

 import pytest
@@ -283,63 +282,3 @@ def test_api_recordings_media_auth_success_administrator(mode):
        timeout=1,
    )
    assert response.content.decode("utf-8") == "my prose"
-
-
-def test_api_recordings_media_auth_missing_header():
-    """
-    Test that a subrequest without the configured original-url header is rejected.
-    """
-    user = UserFactory()
-
-    client = APIClient()
-    client.force_login(user)
-
-    response = client.get("/api/v1.0/recordings/media-auth/")
-
-    assert response.status_code == 403
-
-
-@override_settings(MEDIA_AUTH_ORIGINAL_URL_HEADER="HTTP_X_FORWARDED_URI")
-def test_api_recordings_media_auth_custom_original_url_header():
-    """
-    Test that the header carrying the original URL can be configured.
-
-    Reverse proxies other than nginx-ingress use different headers: Traefik's
-    ForwardAuth sends X-Forwarded-Uri and cannot emit X-Original-URL at all.
-    """
-    user = UserFactory()
-
-    client = APIClient()
-    client.force_login(user)
-
-    original_url = f"http://localhost/media/recordings/{uuid4()!s}.mp4"
-
-    response = client.get(
-        "/api/v1.0/recordings/media-auth/", HTTP_X_FORWARDED_URI=original_url
-    )
-
-    # The header was read and parsed: we get as far as looking the recording up,
-    # rather than being rejected for a missing header.
-    assert response.status_code == 404
-
-
-@override_settings(MEDIA_AUTH_ORIGINAL_URL_HEADER="HTTP_X_FORWARDED_URI")
-def test_api_recordings_media_auth_default_header_ignored_when_reconfigured():
-    """
-    Test that only the configured header is honoured.
-
-    Guards against the header being read from a hardcoded name in parallel with
-    the setting.
-    """
-    user = UserFactory()
-
-    client = APIClient()
-    client.force_login(user)
-
-    original_url = f"http://localhost/media/recordings/{uuid4()!s}.mp4"
-
-    response = client.get(
-        "/api/v1.0/recordings/media-auth/", HTTP_X_ORIGINAL_URL=original_url
-    )
-
-    assert response.status_code == 403
@@ -224,7 +224,6 @@ def test_api_recording_retrieve_expired(settings):
        RecordingStatusChoices.INITIATED,
        RecordingStatusChoices.ACTIVE,
        RecordingStatusChoices.SAVED,
-        RecordingStatusChoices.FAILED,
        RecordingStatusChoices.FAILED_TO_START,
        RecordingStatusChoices.FAILED_TO_STOP,
        RecordingStatusChoices.ABORTED,
@@ -0,0 +1,267 @@
+"""
+Test recordings API endpoints in the Meet core app: save recording.
+"""
+
+# pylint: disable=redefined-outer-name,unused-argument
+
+import uuid
+from unittest import mock
+
+import pytest
+from rest_framework.test import APIClient
+
+from ...factories import RecordingFactory
+from ...models import Recording, RecordingStatusChoices
+from ...recording.event.exceptions import (
+    InvalidBucketError,
+    InvalidFilepathError,
+    InvalidFileTypeError,
+    ParsingEventDataError,
+)
+
+pytestmark = pytest.mark.django_db
+
+
+@pytest.fixture
+def recording_settings(settings):
+    """Configure recording-related and storage event Django settings."""
+    settings.RECORDING_STORAGE_EVENT_TOKEN = "testAuthToken"
+    settings.RECORDING_STORAGE_EVENT_ENABLE = True
+    return settings
+
+
+@pytest.fixture
+def mock_get_parser():
+    """Mock 'get_parser' factory function."""
+    with mock.patch("core.api.viewsets.get_parser") as mock_parser:
+        yield mock_parser
+
+
+def test_save_recording_anonymous(settings, client):
+    """Anonymous users should not be allowed to save room recordings."""
+    settings.RECORDING_STORAGE_EVENT_TOKEN = "testAuthToken"
+
+    RecordingFactory(status="active")
+
+    response = client.post(
+        "/api/v1.0/recordings/storage-hook/",
+        {"recording_data": "valid-data"},
+    )
+
+    assert response.status_code == 401
+    assert Recording.objects.count() == 1
+
+
+def test_save_recording_wrong_bearer(settings, client):
+    """Requests with incorrect bearer token should be rejected when auth is required."""
+
+    settings.RECORDING_STORAGE_EVENT_TOKEN = "testAuthToken"
+
+    response = client.post(
+        "/api/v1.0/recordings/storage-hook/",
+        {"recording_data": "valid-data"},
+        HTTP_AUTHORIZATION="Bearer wrongAuthToken",
+    )
+
+    assert response.status_code == 401
+
+
+def test_save_recording_permission_needed(settings, client):
+    """Recordings should not be saved when feature is disabled."""
+
+    settings.RECORDING_STORAGE_EVENT_TOKEN = "testAuthToken"
+    settings.RECORDING_STORAGE_EVENT_ENABLE = False
+
+    response = client.post(
+        "/api/v1.0/recordings/storage-hook/",
+        {"recording_data": "valid-data"},
+        HTTP_AUTHORIZATION="Bearer testAuthToken",
+    )
+
+    assert response.status_code == 404
+    assert response.json() == {"detail": "Not found."}
+
+
+def test_save_recording_parsing_error(recording_settings, mock_get_parser, client):
+    """Test handling of parsing errors in recording event data."""
+    mock_parser = mock.Mock()
+    mock_parser.get_recording_id.side_effect = ParsingEventDataError("Error message")
+    mock_get_parser.return_value = mock_parser
+
+    response = client.post(
+        "/api/v1.0/recordings/storage-hook/",
+        {"recording_data": "valid-data"},
+        HTTP_AUTHORIZATION="Bearer testAuthToken",
+    )
+
+    assert response.status_code == 403
+    assert response.json() == {"detail": "Invalid request data."}
+
+
+def test_save_recording_bucket_error(recording_settings, mock_get_parser, client):
+    """Test handling of invalid storage bucket errors in recording event data."""
+
+    mock_parser = mock.Mock()
+    mock_parser.get_recording_id.side_effect = InvalidBucketError("Error message")
+    mock_get_parser.return_value = mock_parser
+
+    response = client.post(
+        "/api/v1.0/recordings/storage-hook/",
+        {"recording_data": "valid-data"},
+        HTTP_AUTHORIZATION="Bearer testAuthToken",
+    )
+
+    assert response.status_code == 403
+    assert response.json() == {"detail": "Invalid bucket specified."}
+
+
+def test_save_recording_filetype_error(recording_settings, mock_get_parser):
+    """Test handling of unsupported file types in recording event data."""
+
+    mock_parser = mock.Mock()
+    mock_parser.get_recording_id.side_effect = InvalidFileTypeError(
+        "unsupported '.json'"
+    )
+    mock_get_parser.return_value = mock_parser
+
+    client = APIClient()
+
+    response = client.post(
+        "/api/v1.0/recordings/storage-hook/",
+        {"recording_data": "valid-data"},
+        HTTP_AUTHORIZATION="Bearer testAuthToken",
+    )
+
+    assert response.status_code == 200
+    assert response.json() == {"message": "Notification ignored."}
+
+
+def test_save_recording_filepath_error(recording_settings, mock_get_parser):
+    """Test handling of unsupported filepath in recording event data."""
+
+    mock_parser = mock.Mock()
+    mock_parser.get_recording_id.side_effect = InvalidFilepathError(
+        "Invalid filepath structure: parent/folder/recording.jpeg"
+    )
+    mock_get_parser.return_value = mock_parser
+
+    client = APIClient()
+
+    response = client.post(
+        "/api/v1.0/recordings/storage-hook/",
+        {"recording_data": "valid-data"},
+        HTTP_AUTHORIZATION="Bearer testAuthToken",
+    )
+
+    assert response.status_code == 200
+    assert response.json() == {"message": "Notification ignored."}
+
+
+def test_save_recording_unknown_recording(recording_settings, mock_get_parser, client):
+    """Test handling of events for non-existent recordings."""
+
+    RecordingFactory(status="active")
+
+    mock_parser = mock.Mock()
+    mock_parser.get_recording_id.return_value = uuid.uuid4()
+    mock_get_parser.return_value = mock_parser
+
+    response = client.post(
+        "/api/v1.0/recordings/storage-hook/",
+        {"recording_data": "valid-data"},
+        HTTP_AUTHORIZATION="Bearer testAuthToken",
+    )
+
+    assert response.status_code == 404
+    assert response.json() == {"detail": "No recording found for this event."}
+
+
+@pytest.mark.parametrize(
+    "status", ["failed_to_start", "aborted", "failed_to_stop", "saved", "initiated"]
+)
+def test_save_recording_non_savable_recording(
+    recording_settings, mock_get_parser, client, status
+):
+    """Test that recordings in non-savable states cannot be saved."""
+
+    recording = RecordingFactory(status=status)
+
+    mock_parser = mock.Mock()
+    mock_parser.get_recording_id.return_value = recording.id
+    mock_get_parser.return_value = mock_parser
+
+    response = client.post(
+        "/api/v1.0/recordings/storage-hook/",
+        {"recording_data": "valid-data"},
+        HTTP_AUTHORIZATION="Bearer testAuthToken",
+    )
+
+    assert response.status_code == 403
+    assert response.json() == {
+        "detail": f"Recording with ID {recording.id} cannot be saved because it is either,"
+        " in an error state or has already been saved."
+    }
+
+
+@pytest.mark.parametrize("status", ["active", "stopped"])
+def test_save_recording_success(recording_settings, mock_get_parser, client, status):
+    """Test successful saving of recordings in valid states."""
+
+    recording = RecordingFactory(status=status)
+
+    mock_parser = mock.Mock()
+    mock_parser.get_recording_id.return_value = recording.id
+    mock_get_parser.return_value = mock_parser
+
+    response = client.post(
+        "/api/v1.0/recordings/storage-hook/",
+        {"recording_data": "valid-data"},
+        HTTP_AUTHORIZATION="Bearer testAuthToken",
+    )
+
+    assert response.status_code == 200
+    assert response.json() == {"message": "Event processed."}
+
+    recording.refresh_from_db()
+    assert recording.status == RecordingStatusChoices.SAVED
+
+
+@mock.patch(
+    "core.recording.services.recording_events.notification_service."
+    "notify_external_services"
+)
+@pytest.mark.parametrize("notification_succeeded", [True, False])
+def test_save_recording_notifies_external_services(
+    mock_notify_external_services,
+    recording_settings,
+    mock_get_parser,
+    client,
+    notification_succeeded,
+):
+    """External services should be notified when a recording is saved."""
+
+    recording = RecordingFactory(status="active")
+
+    mock_parser = mock.Mock()
+    mock_parser.get_recording_id.return_value = recording.id
+    mock_get_parser.return_value = mock_parser
+
+    mock_notify_external_services.return_value = notification_succeeded
+
+    response = client.post(
+        "/api/v1.0/recordings/storage-hook/",
+        {"recording_data": "valid-data"},
+        HTTP_AUTHORIZATION="Bearer testAuthToken",
+    )
+
+    assert response.status_code == 200
+    assert response.json() == {"message": "Event processed."}
+
+    mock_notify_external_services.assert_called_once_with(recording)
+
+    recording.refresh_from_db()
+    assert recording.status == (
+        RecordingStatusChoices.NOTIFICATION_SUCCEEDED
+        if notification_succeeded
+        else RecordingStatusChoices.SAVED
+    )
@@ -34,8 +34,10 @@ def mediator(mock_worker_service):
    return WorkerServiceMediator(mock_worker_service)


-@mock.patch("core.services.room_management.RoomManagement.update_metadata")
-def test_start_recording_success(mock_update_metadata, mediator, mock_worker_service):
+@mock.patch("core.utils.update_room_metadata")
+def test_start_recording_success(
+    mock_update_room_metadata, mediator, mock_worker_service
+):
    """Test successful recording start"""
    # Setup
    worker_id = "test-worker-123"
@@ -58,7 +60,7 @@ def test_start_recording_success(mock_update_metadata, mediator, mock_worker_ser
    assert mock_recording.worker_id == worker_id
    assert mock_recording.status == RecordingStatusChoices.ACTIVE

-    mock_update_metadata.assert_called_once_with(
+    mock_update_room_metadata.assert_called_once_with(
        str(mock_recording.room.id),
        {"recording_mode": mock_recording.mode, "recording_status": "starting"},
    )
@@ -67,9 +69,9 @@ def test_start_recording_success(mock_update_metadata, mediator, mock_worker_ser
@pytest.mark.parametrize(
    "error_class", [WorkerRequestError, WorkerConnectionError, WorkerResponseError]
 )
-@mock.patch("core.services.room_management.RoomManagement.update_metadata")
+@mock.patch("core.utils.update_room_metadata")
 def test_mediator_start_recording_worker_errors(
-    mock_update_metadata, mediator, mock_worker_service, error_class
+    mock_update_room_metadata, mediator, mock_worker_service, error_class
 ):
    """Test handling of various worker errors during start"""
    # Setup
@@ -87,7 +89,7 @@ def test_mediator_start_recording_worker_errors(
    assert mock_recording.status == RecordingStatusChoices.FAILED_TO_START
    assert mock_recording.worker_id is None

-    mock_update_metadata.assert_not_called()
+    mock_update_room_metadata.assert_not_called()


@pytest.mark.parametrize(
@@ -101,9 +103,9 @@ def test_mediator_start_recording_worker_errors(
        RecordingStatusChoices.ABORTED,
    ],
 )
-@mock.patch("core.services.room_management.RoomManagement.update_metadata")
+@mock.patch("core.utils.update_room_metadata")
 def test_mediator_start_recording_from_forbidden_status(
-    mock_update_metadata, mediator, mock_worker_service, status
+    mock_update_room_metadata, mediator, mock_worker_service, status
 ):
    """Test handling of various worker errors during start"""
    # Setup
@@ -117,7 +119,7 @@ def test_mediator_start_recording_from_forbidden_status(
    mock_recording.refresh_from_db()
    assert mock_recording.status == status

-    mock_update_metadata.assert_not_called()
+    mock_update_room_metadata.assert_not_called()


 def test_mediator_stop_recording_success(mediator, mock_worker_service):
@@ -4,7 +4,6 @@ Test worker service classes.

 # pylint: disable=protected-access,redefined-outer-name,unused-argument,no-member

-import logging
 from unittest.mock import AsyncMock, Mock, patch

 import pytest
@@ -155,9 +154,9 @@ def test_base_egress_filepath_construction(service, filename, extension, expecte
    "response_status,expected_result",
    [
        (livekit_api.EgressStatus.EGRESS_ABORTED, "ABORTED"),
-        (livekit_api.EgressStatus.EGRESS_FAILED, "FAILED"),
        (livekit_api.EgressStatus.EGRESS_COMPLETE, "FAILED_TO_STOP"),
        (livekit_api.EgressStatus.EGRESS_ENDING, "STOPPED"),
+        (livekit_api.EgressStatus.EGRESS_FAILED, "FAILED_TO_STOP"),
    ],
 )
 def test_base_egress_stop_with_status(service, response_status, expected_result):
@@ -176,32 +175,6 @@ def test_base_egress_stop_with_status(service, response_status, expected_result)
    assert result == expected_result


-@pytest.mark.parametrize(
-    "response_status,event",
-    [
-        (livekit_api.EgressStatus.EGRESS_ABORTED, "aborted"),
-        (livekit_api.EgressStatus.EGRESS_FAILED, "failed"),
-        (livekit_api.EgressStatus.EGRESS_COMPLETE, "failed to stop"),
-    ],
-)
-def test_base_egress_stop_logs_livekit_error(service, response_status, event, caplog):
-    """Should log the reason LiveKit reported for an unsuccessful stop."""
-    mock_response = Mock(
-        status=response_status,
-        egress_id="test_worker_id",
-        error="could not connect to the room",
-        error_code=500,
-    )
-    service._handle_request = Mock(return_value=mock_response)
-
-    with caplog.at_level(logging.ERROR):
-        service.stop("test_worker_id")
-
-    assert f"Egress {event} on stop (egress_id=test_worker_id" in caplog.text
-    assert "could not connect to the room" in caplog.text
-    assert "error_code=500" in caplog.text
-
-
 def test_base_egress_stop_missing_status(service):
    """Test stop method when response is missing status"""
    # Mock _handle_request with missing status
@@ -1 +0,0 @@
-"""Tests for the roomkit API of the Meet core app."""
@@ -1,305 +0,0 @@
-"""
-Test the roomkit join server-to-server API endpoint.
-"""
-
-# pylint: disable=redefined-outer-name,unused-argument
-
-from unittest import mock
-
-import pytest
-
-from ...factories import RoomFactory
-from ...services.sip_management import SIPException
-
-pytestmark = pytest.mark.django_db
-
-
-@mock.patch("core.roomkit.viewsets.SIPManagement")
-def test_join_anonymous(mock_sip_management, settings, client):
-    """Requests without an Authorization header should be rejected."""
-
-    mock_sip_instance = mock_sip_management.return_value
-
-    settings.ROOMKIT_ENABLED = True
-    settings.ROOMKIT_SERVER_TO_SERVER_API_TOKEN = "testAuthToken"
-
-    room = RoomFactory(pin_code="1234567890")
-
-    response = client.post("/api/v1.0/roomkit/join/", {"pin_code": room.pin_code})
-
-    assert response.status_code == 401
-    assert response.json() == {"detail": "Authorization header is missing."}
-    mock_sip_instance.ensure_dispatch_rule.assert_not_called()
-
-
-@mock.patch("core.roomkit.viewsets.SIPManagement")
-def test_join_malformed_authorization_header(mock_sip_management, settings, client):
-    """Requests with a malformed Authorization header should be rejected."""
-
-    mock_sip_instance = mock_sip_management.return_value
-
-    settings.ROOMKIT_ENABLED = True
-    settings.ROOMKIT_SERVER_TO_SERVER_API_TOKEN = "testAuthToken"
-
-    room = RoomFactory(pin_code="1234567890")
-
-    response = client.post(
-        "/api/v1.0/roomkit/join/",
-        {"pin_code": room.pin_code},
-        HTTP_AUTHORIZATION="testAuthToken",
-    )
-
-    assert response.status_code == 401
-    assert response.json() == {"detail": "Invalid authorization header."}
-    mock_sip_instance.ensure_dispatch_rule.assert_not_called()
-
-
-@mock.patch("core.roomkit.viewsets.SIPManagement")
-def test_join_wrong_bearer(mock_sip_management, settings, client):
-    """Requests with an incorrect bearer token should be rejected."""
-
-    mock_sip_instance = mock_sip_management.return_value
-
-    settings.ROOMKIT_ENABLED = True
-    settings.ROOMKIT_SERVER_TO_SERVER_API_TOKEN = "testAuthToken"
-
-    room = RoomFactory(pin_code="1234567890")
-
-    response = client.post(
-        "/api/v1.0/roomkit/join/",
-        {"pin_code": room.pin_code},
-        HTTP_AUTHORIZATION="Bearer wrongAuthToken",
-    )
-
-    assert response.status_code == 401
-    assert response.json() == {"detail": "Invalid server-to-server token."}
-    mock_sip_instance.ensure_dispatch_rule.assert_not_called()
-
-
-@mock.patch("core.roomkit.viewsets.SIPManagement")
-def test_join_token_not_configured(mock_sip_management, settings, client):
-    """Requests should be rejected when no server-to-server token is configured."""
-
-    mock_sip_instance = mock_sip_management.return_value
-
-    settings.ROOMKIT_ENABLED = True
-    settings.ROOMKIT_SERVER_TO_SERVER_API_TOKEN = None
-
-    room = RoomFactory(pin_code="1234567890")
-
-    response = client.post(
-        "/api/v1.0/roomkit/join/",
-        {"pin_code": room.pin_code},
-        HTTP_AUTHORIZATION="Bearer testAuthToken",
-    )
-
-    assert response.status_code == 401
-    mock_sip_instance.ensure_dispatch_rule.assert_not_called()
-
-
-@mock.patch("core.roomkit.viewsets.SIPManagement")
-def test_join_roomkit_disabled(mock_sip_management, settings, client):
-    """The endpoint should not be exposed when the roomkit integration is disabled."""
-
-    mock_sip_instance = mock_sip_management.return_value
-
-    settings.ROOMKIT_ENABLED = False
-    settings.ROOMKIT_SERVER_TO_SERVER_API_TOKEN = "testAuthToken"
-
-    room = RoomFactory(pin_code="1234567890")
-
-    response = client.post(
-        "/api/v1.0/roomkit/join/",
-        {"pin_code": room.pin_code},
-        HTTP_AUTHORIZATION="Bearer testAuthToken",
-    )
-
-    assert response.status_code == 404
-    mock_sip_instance.ensure_dispatch_rule.assert_not_called()
-
-
-@mock.patch("core.roomkit.viewsets.SIPManagement")
-def test_join_missing_pin(mock_sip_management, settings, client):
-    """Requests without a PIN code should be rejected."""
-
-    mock_sip_instance = mock_sip_management.return_value
-
-    settings.ROOMKIT_ENABLED = True
-    settings.ROOMKIT_SERVER_TO_SERVER_API_TOKEN = "testAuthToken"
-
-    response = client.post(
-        "/api/v1.0/roomkit/join/",
-        {},
-        HTTP_AUTHORIZATION="Bearer testAuthToken",
-    )
-
-    assert response.status_code == 400
-    assert response.json() == {"pin_code": ["This field is required."]}
-    mock_sip_instance.ensure_dispatch_rule.assert_not_called()
-
-
-@mock.patch("core.roomkit.viewsets.SIPManagement")
-def test_join_blank_pin(mock_sip_management, settings, client):
-    """Requests with a blank PIN code should be rejected."""
-
-    mock_sip_instance = mock_sip_management.return_value
-
-    settings.ROOMKIT_ENABLED = True
-    settings.ROOMKIT_SERVER_TO_SERVER_API_TOKEN = "testAuthToken"
-
-    response = client.post(
-        "/api/v1.0/roomkit/join/",
-        {"pin_code": ""},
-        HTTP_AUTHORIZATION="Bearer testAuthToken",
-    )
-
-    assert response.status_code == 400
-    assert response.json() == {"pin_code": ["This field may not be blank."]}
-    mock_sip_instance.ensure_dispatch_rule.assert_not_called()
-
-
-@mock.patch("core.roomkit.viewsets.SIPManagement")
-def test_join_wrong_pin_length(mock_sip_management, settings, client):
-    """Requests with a PIN code of unexpected length should be rejected."""
-
-    mock_sip_instance = mock_sip_management.return_value
-
-    settings.ROOMKIT_ENABLED = True
-    settings.ROOMKIT_SERVER_TO_SERVER_API_TOKEN = "testAuthToken"
-    settings.ROOM_TELEPHONY_PIN_LENGTH = 10
-
-    response = client.post(
-        "/api/v1.0/roomkit/join/",
-        {"pin_code": "123"},
-        HTTP_AUTHORIZATION="Bearer testAuthToken",
-    )
-
-    assert response.status_code == 400
-    assert response.json() == {"pin_code": ["PIN code length is invalid."]}
-    mock_sip_instance.ensure_dispatch_rule.assert_not_called()
-
-
-@mock.patch("core.roomkit.viewsets.SIPManagement")
-def test_join_unknown_pin(mock_sip_management, settings, client):
-    """Requests with a PIN matching no room should return 404 and create no rule."""
-
-    mock_sip_instance = mock_sip_management.return_value
-
-    settings.ROOMKIT_ENABLED = True
-    settings.ROOMKIT_SERVER_TO_SERVER_API_TOKEN = "testAuthToken"
-
-    RoomFactory(pin_code="1234567890")
-
-    response = client.post(
-        "/api/v1.0/roomkit/join/",
-        {"pin_code": "0987654321"},
-        HTTP_AUTHORIZATION="Bearer testAuthToken",
-    )
-
-    assert response.status_code == 404
-    assert response.json() == {"detail": "No room found for this PIN code."}
-    mock_sip_instance.ensure_dispatch_rule.assert_not_called()
-
-
-@mock.patch("core.roomkit.viewsets.SIPManagement")
-def test_join_success(mock_sip_management, settings, client):
-    """Requests with a valid PIN should create the dispatch rule."""
-
-    mock_sip_instance = mock_sip_management.return_value
-
-    settings.ROOMKIT_ENABLED = True
-    settings.ROOMKIT_SERVER_TO_SERVER_API_TOKEN = "testAuthToken"
-
-    room = RoomFactory(pin_code="1234567890")
-    mock_sip_instance.ensure_dispatch_rule.return_value = True
-
-    response = client.post(
-        "/api/v1.0/roomkit/join/",
-        {"pin_code": room.pin_code},
-        HTTP_AUTHORIZATION="Bearer testAuthToken",
-    )
-
-    assert response.status_code == 200
-    assert response.json() == {"status": "success"}
-    mock_sip_instance.ensure_dispatch_rule.assert_called_once_with(room)
-
-
-@mock.patch("core.roomkit.viewsets.SIPManagement")
-def test_join_dispatch_rule_already_exists(mock_sip_management, settings, client):
-    """Requests should succeed when the dispatch rule already exists (idempotency)."""
-
-    mock_sip_instance = mock_sip_management.return_value
-
-    settings.ROOMKIT_ENABLED = True
-    settings.ROOMKIT_SERVER_TO_SERVER_API_TOKEN = "testAuthToken"
-
-    room = RoomFactory(pin_code="1234567890")
-    mock_sip_instance.ensure_dispatch_rule.return_value = False
-
-    response = client.post(
-        "/api/v1.0/roomkit/join/",
-        {"pin_code": room.pin_code},
-        HTTP_AUTHORIZATION="Bearer testAuthToken",
-    )
-
-    assert response.status_code == 200
-    assert response.json() == {"status": "success"}
-    mock_sip_instance.ensure_dispatch_rule.assert_called_once_with(room)
-
-
-@mock.patch("core.roomkit.viewsets.analytics.capture")
-@mock.patch("core.roomkit.viewsets.SIPManagement")
-def test_join_tracks_analytics_event(
-    mock_sip_management, mock_capture, settings, client
-):
-    """Successful joins should be tracked with an analytics event."""
-
-    mock_sip_instance = mock_sip_management.return_value
-
-    settings.ROOMKIT_ENABLED = True
-    settings.ROOMKIT_SERVER_TO_SERVER_API_TOKEN = "testAuthToken"
-
-    room = RoomFactory(pin_code="1234567890")
-    mock_sip_instance.ensure_dispatch_rule.return_value = True
-
-    response = client.post(
-        "/api/v1.0/roomkit/join/",
-        {"pin_code": room.pin_code},
-        HTTP_AUTHORIZATION="Bearer testAuthToken",
-    )
-
-    assert response.status_code == 200
-    mock_capture.assert_called_once()
-    _user, event, properties = mock_capture.call_args[0]
-    assert str(event) == "roomkit_joined"
-    assert properties == {
-        "room_id": str(room.pk),
-        "dispatch_rule_created": True,
-    }
-
-
-@mock.patch("core.roomkit.viewsets.analytics.capture")
-@mock.patch("core.roomkit.viewsets.SIPManagement")
-def test_join_sip_failure(mock_sip_management, mock_capture, settings, client):
-    """Requests should fail with a server error when the sip management service fails."""
-
-    mock_sip_instance = mock_sip_management.return_value
-
-    settings.ROOMKIT_ENABLED = True
-    settings.ROOMKIT_SERVER_TO_SERVER_API_TOKEN = "testAuthToken"
-
-    room = RoomFactory(pin_code="1234567890")
-    mock_sip_instance.ensure_dispatch_rule.side_effect = SIPException(
-        "Could not create dispatch rule"
-    )
-
-    response = client.post(
-        "/api/v1.0/roomkit/join/",
-        {"pin_code": room.pin_code},
-        HTTP_AUTHORIZATION="Bearer testAuthToken",
-        raise_request_exception=False,
-    )
-
-    assert response.status_code == 500
-    mock_sip_instance.ensure_dispatch_rule.assert_called_once_with(room)
-    mock_capture.assert_not_called()
@@ -3,14 +3,13 @@ Test rooms API endpoints in the Meet core app: create.
 """

 # pylint: disable=redefined-outer-name,unused-argument
-from django.conf import settings
 from django.core.cache import cache

 import pytest
 from rest_framework.test import APIClient

 from ...factories import RoomFactory, UserFactory
-from ...models import Room, RoomAccessLevel
+from ...models import Room

 pytestmark = pytest.mark.django_db

@@ -110,205 +109,3 @@ def test_api_rooms_create_authenticated_existing_slug():

    assert response.status_code == 400
    assert response.json() == {"slug": ["Room with this Slug already exists."]}
-
-
-def test_api_rooms_create_authenticated_user_default_access_level():
-    """
-    The user's default room access level should be applied to the new room
-    when the request does not provide one.
-    """
-    user = UserFactory(default_room_access_level=RoomAccessLevel.RESTRICTED)
-
-    client = APIClient()
-    client.force_login(user)
-
-    response = client.post(
-        "/api/v1.0/rooms/",
-        {
-            "name": "my room",
-        },
-    )
-
-    assert response.status_code == 201
-    room = Room.objects.get()
-    assert room.access_level == RoomAccessLevel.RESTRICTED
-
-
-def test_api_rooms_create_authenticated_explicit_access_level_overrides_default():
-    """
-    An access level explicitly provided in the request should take precedence
-    over the user's default room access level.
-    """
-    user = UserFactory(default_room_access_level=RoomAccessLevel.RESTRICTED)
-
-    client = APIClient()
-    client.force_login(user)
-
-    response = client.post(
-        "/api/v1.0/rooms/",
-        {
-            "name": "my room",
-            "access_level": RoomAccessLevel.TRUSTED,
-        },
-    )
-
-    assert response.status_code == 201
-    room = Room.objects.get()
-    assert room.access_level == RoomAccessLevel.TRUSTED
-
-
-def test_api_rooms_create_authenticated_no_user_default_access_level():
-    """
-    When the user has no default room access level, the instance default
-    should be applied to the new room.
-    """
-    user = UserFactory(default_room_access_level=None)
-
-    client = APIClient()
-    client.force_login(user)
-
-    response = client.post(
-        "/api/v1.0/rooms/",
-        {
-            "name": "my room",
-        },
-    )
-
-    assert response.status_code == 201
-    room = Room.objects.get()
-    assert room.access_level == settings.RESOURCE_DEFAULT_ACCESS_LEVEL
-
-
-def test_api_rooms_create_authenticated_user_default_configuration():
-    """
-    The user's default room configuration should be applied to the new room
-    when the request does not provide one.
-    """
-    user = UserFactory(default_room_configuration={"everyone_can_mute": False})
-
-    client = APIClient()
-    client.force_login(user)
-
-    response = client.post(
-        "/api/v1.0/rooms/",
-        {
-            "name": "my room",
-        },
-    )
-
-    assert response.status_code == 201
-    room = Room.objects.get()
-    assert room.configuration == {"everyone_can_mute": False}
-
-
-def test_api_rooms_create_authenticated_explicit_configuration_overrides_default():
-    """
-    A configuration explicitly provided in the request should take precedence
-    over the user's default room configuration.
-    """
-    user = UserFactory(default_room_configuration={"everyone_can_mute": False})
-
-    client = APIClient()
-    client.force_login(user)
-
-    response = client.post(
-        "/api/v1.0/rooms/",
-        {
-            "name": "my room",
-            "configuration": {"can_publish_sources": ["camera", "microphone"]},
-        },
-        format="json",
-    )
-
-    assert response.status_code == 201
-    room = Room.objects.get()
-    assert room.configuration == {"can_publish_sources": ["camera", "microphone"]}
-
-
-def test_api_rooms_create_authenticated_empty_configuration_falls_back_to_default():
-    """
-    An empty configuration in the request should not be considered an explicit
-    value: the user's default room configuration should still be applied.
-    """
-    user = UserFactory(default_room_configuration={"everyone_can_mute": True})
-
-    client = APIClient()
-    client.force_login(user)
-
-    response = client.post(
-        "/api/v1.0/rooms/",
-        {
-            "name": "my room",
-            "configuration": {},
-        },
-        format="json",
-    )
-
-    assert response.status_code == 201
-    room = Room.objects.get()
-    assert room.configuration == {"everyone_can_mute": True}
-
-
-def test_api_rooms_create_authenticated_empty_user_default_configuration():
-    """
-    When the user's default room configuration is empty, the new room should
-    keep its default empty configuration.
-    """
-    user = UserFactory(default_room_configuration={})
-
-    client = APIClient()
-    client.force_login(user)
-
-    response = client.post(
-        "/api/v1.0/rooms/",
-        {
-            "name": "my room",
-        },
-    )
-
-    assert response.status_code == 201
-    room = Room.objects.get()
-    assert room.configuration == {}
-
-
-def test_api_rooms_create_authenticated_request_precedence_over_user_empty():
-    """
-    When the user's default room configuration is empty, the request should take precedence.
-    """
-    user = UserFactory(default_room_configuration={})
-
-    client = APIClient()
-    client.force_login(user)
-
-    response = client.post(
-        "/api/v1.0/rooms/",
-        {"name": "my room", "configuration": {"everyone_can_mute": True}},
-        format="json",
-    )
-
-    assert response.status_code == 201
-    room = Room.objects.get()
-    assert room.configuration == {"everyone_can_mute": True}
-
-
-def test_api_rooms_create_authenticated_blank_user_default_access_level():
-    """
-    A blank default room access level (stored as an empty string) should be
-    treated as unset: the instance default should be applied to the new room
-    instead of persisting an invalid empty access level.
-    """
-    user = UserFactory(default_room_access_level="")
-
-    client = APIClient()
-    client.force_login(user)
-
-    response = client.post(
-        "/api/v1.0/rooms/",
-        {
-            "name": "my room",
-        },
-    )
-
-    assert response.status_code == 201
-    room = Room.objects.get()
-    assert room.access_level == settings.RESOURCE_DEFAULT_ACCESS_LEVEL
@@ -9,7 +9,6 @@ from unittest import mock
 from django.core.cache import cache

 import pytest
-from freezegun import freeze_time
 from rest_framework.test import APIClient

 from ... import utils
@@ -25,7 +24,6 @@ pytestmark = pytest.mark.django_db
 # Tests for request_entry endpoint


-@freeze_time("2025-01-01 10:00:00")
 def test_request_entry_anonymous(settings):
    """Anonymous users should be allowed to request entry to a room."""
    room = RoomFactory(access_level=RoomAccessLevel.RESTRICTED)
@@ -61,7 +59,6 @@ def test_request_entry_anonymous(settings):
        "username": "test_user",
        "status": "waiting",
        "color": "mocked-color",
-        "entered_at": "2025-01-01T10:00:00+00:00",
        "livekit": None,
    }

@@ -74,7 +71,6 @@ def test_request_entry_anonymous(settings):
    assert participant_data.get("username") == "test_user"


-@freeze_time("2025-01-01 10:00:00")
 def test_request_entry_authenticated_user(settings):
    """Authenticated users should be allowed to request entry."""
    room = RoomFactory(access_level=RoomAccessLevel.RESTRICTED)
@@ -112,7 +108,6 @@ def test_request_entry_authenticated_user(settings):
        "username": "test_user",
        "status": "waiting",
        "color": "mocked-color",
-        "entered_at": "2025-01-01T10:00:00+00:00",
        "livekit": None,
    }

@@ -125,7 +120,6 @@ def test_request_entry_authenticated_user(settings):
    assert participant_data.get("username") == "test_user"


-@freeze_time("2025-01-01 10:00:00")
 def test_request_entry_with_existing_participants(settings):
    """Anonymous users should be allowed to request entry to a room with existing participants."""
    # Create a restricted access room
@@ -144,7 +138,6 @@ def test_request_entry_with_existing_participants(settings):
            "username": "user1",
            "status": "waiting",
            "color": "#123456",
-            "entered_at": "2025-01-01T10:00:00+00:00",
        },
    )
    cache.set(
@@ -154,7 +147,6 @@ def test_request_entry_with_existing_participants(settings):
            "username": "user2",
            "status": "accepted",
            "color": "#654321",
-            "entered_at": "2025-01-01T10:00:00+00:00",
        },
    )

@@ -186,7 +178,6 @@ def test_request_entry_with_existing_participants(settings):
    assert response.json() == {
        "id": participant_id,
        "username": "test_user",
-        "entered_at": "2025-01-01T10:00:00+00:00",
        "status": "waiting",
        "color": "mocked-color",
        "livekit": None,
@@ -201,7 +192,6 @@ def test_request_entry_with_existing_participants(settings):
    assert participant_data.get("username") == "test_user"


-@freeze_time("2025-01-01 10:00:00")
 def test_request_entry_public_room(settings):
    """Entry requests to public rooms should return ACCEPTED status with LiveKit config."""
    room = RoomFactory(access_level=RoomAccessLevel.PUBLIC)
@@ -240,7 +230,6 @@ def test_request_entry_public_room(settings):
    assert response.json() == {
        "id": "123",
        "username": "test_user",
-        "entered_at": "2025-01-01T10:00:00+00:00",
        "status": "accepted",
        "color": "mocked-color",
        "livekit": {"token": "test-token"},
@@ -251,7 +240,6 @@ def test_request_entry_public_room(settings):
    assert not lobby_keys


-@freeze_time("2025-01-01 10:00:00")
 def test_request_entry_authenticated_user_public_room(settings):
    """While authenticated, entry request to public rooms should get accepted."""
    room = RoomFactory(access_level=RoomAccessLevel.PUBLIC)
@@ -294,7 +282,6 @@ def test_request_entry_authenticated_user_public_room(settings):
    assert response.json() == {
        "id": "2f7f162f-e7d1-421b-90e7-02bfbfbf8def",
        "username": "test_user",
-        "entered_at": "2025-01-01T10:00:00+00:00",
        "status": "accepted",
        "color": "mocked-color",
        "livekit": {"token": "test-token"},
@@ -305,7 +292,6 @@ def test_request_entry_authenticated_user_public_room(settings):
    assert not lobby_keys


-@freeze_time("2025-01-01 10:00:00")
 def test_request_entry_waiting_participant_public_room(settings):
    """While waiting, entry request to public rooms should get accepted."""
    room = RoomFactory(access_level=RoomAccessLevel.PUBLIC)
@@ -322,7 +308,6 @@ def test_request_entry_waiting_participant_public_room(settings):
            "username": "user1",
            "status": "waiting",
            "color": "#123456",
-            "entered_at": "2025-01-01T10:00:00+00:00",
        },
    )

@@ -353,7 +338,6 @@ def test_request_entry_waiting_participant_public_room(settings):
        "username": "user1",
        "status": "accepted",
        "color": "#123456",
-        "entered_at": "2025-01-01T10:00:00+00:00",
        "livekit": {"token": "test-token"},
    }

@@ -405,7 +389,7 @@ def test_allow_participant_to_enter_anonymous():

 def test_allow_participant_to_enter_non_owner():
    """Non-privileged users should not be allowed to manage entry requests."""
-    room = RoomFactory(access_level=RoomAccessLevel.RESTRICTED)
+    room = RoomFactory()
    user = UserFactory()
    client = APIClient()
    client.force_login(user)
@@ -459,7 +443,6 @@ def test_allow_participant_to_enter_success(settings, allow_entry, updated_statu
            "status": "waiting",
            "username": "foo",
            "color": "123",
-            "entered_at": "2025-01-01T10:00:00+00:00",
        },
    )

@@ -539,7 +522,7 @@ def test_list_waiting_participants_anonymous():

 def test_list_waiting_participants_non_owner():
    """Non-privileged users should not be allowed to list waiting participants."""
-    room = RoomFactory(access_level=RoomAccessLevel.RESTRICTED)
+    room = RoomFactory()
    user = UserFactory()
    client = APIClient()
    client.force_login(user)
@@ -595,7 +578,6 @@ def test_list_waiting_participants_success(settings):
            "username": "user1",
            "status": "waiting",
            "color": "#123456",
-            "entered_at": "2025-01-01T10:00:00+00:00",
        },
    )
    cache.set(
@@ -605,35 +587,28 @@ def test_list_waiting_participants_success(settings):
            "username": "user2",
            "status": "waiting",
            "color": "#654321",
-            "entered_at": "2025-01-01T10:05:00+00:00",
        },
    )
-    lobby_service = LobbyService()
-    lobby_service._index_add(room.id, "2f7f162f-e7d1-421b-90e7-02bfbfbf8def")
-    lobby_service._index_add(room.id, "f4ca3ab8a6c04ad88097b8da33f60f10")

    response = client.get(f"/api/v1.0/rooms/{room.id}/waiting-participants/")

    assert response.status_code == 200

-    assert response.json() == {
-        "participants": [
-            {
-                "id": "f4ca3ab8a6c04ad88097b8da33f60f10",
-                "username": "user2",
-                "status": "waiting",
-                "color": "#654321",
-                "entered_at": "2025-01-01T10:05:00+00:00",
-            },
-            {
-                "id": "2f7f162f-e7d1-421b-90e7-02bfbfbf8def",
-                "username": "user1",
-                "status": "waiting",
-                "color": "#123456",
-                "entered_at": "2025-01-01T10:00:00+00:00",
-            },
-        ]
-    }
+    participants = response.json().get("participants")
+    assert sorted(participants, key=lambda p: p["id"]) == [
+        {
+            "id": "2f7f162f-e7d1-421b-90e7-02bfbfbf8def",
+            "username": "user1",
+            "status": "waiting",
+            "color": "#123456",
+        },
+        {
+            "id": "f4ca3ab8a6c04ad88097b8da33f60f10",
+            "username": "user2",
+            "status": "waiting",
+            "color": "#654321",
+        },
+    ]


 def test_list_waiting_participants_empty(settings):
@@ -1,106 +0,0 @@
-"""Trusted rooms: any authenticated participant present in the meeting can manage the lobby."""
-
-from unittest import mock
-
-import pytest
-from rest_framework.test import APIClient
-
-from core.factories import RoomFactory, UserFactory
-from core.models import RoomAccessLevel
-from core.services.presence import PresenceCache
-
-pytestmark = pytest.mark.django_db
-
-
-@mock.patch(
-    "core.services.participants_management.ParticipantsManagement.check_if_in_meeting"
-)
-def test_trusted_room_present_user_can_list_waiting(mock_check):
-    """Authenticated + present in a trusted room -> 200, LiveKit asked once then cached."""
-    mock_check.return_value = True
-    user = UserFactory()
-    room = RoomFactory(access_level=RoomAccessLevel.TRUSTED)
-    client = APIClient()
-    client.force_login(user)
-
-    url = f"/api/v1.0/rooms/{room.id}/waiting-participants/"
-    assert client.get(url).status_code == 200
-    assert client.get(url).status_code == 200
-    assert mock_check.call_count == 1
-
-
-@mock.patch(
-    "core.services.participants_management.ParticipantsManagement.check_if_in_meeting"
-)
-def test_trusted_room_absent_user_forbidden(mock_check):
-    """Authenticated but not connected to the meeting -> 403."""
-    mock_check.return_value = False
-    user = UserFactory()
-    room = RoomFactory(access_level=RoomAccessLevel.TRUSTED)
-    client = APIClient()
-    client.force_login(user)
-
-    response = client.get(f"/api/v1.0/rooms/{room.id}/waiting-participants/")
-    assert response.status_code == 403
-
-
-@mock.patch(
-    "core.services.participants_management.ParticipantsManagement.check_if_in_meeting"
-)
-def test_restricted_room_present_user_forbidden(mock_check):
-    """Presence is not enough on a restricted room; LiveKit must not even be asked."""
-    user = UserFactory()
-    room = RoomFactory(access_level=RoomAccessLevel.RESTRICTED)
-    client = APIClient()
-    client.force_login(user)
-
-    response = client.get(f"/api/v1.0/rooms/{room.id}/waiting-participants/")
-    assert response.status_code == 403
-    mock_check.assert_not_called()
-
-
-@mock.patch(
-    "core.services.participants_management.ParticipantsManagement.check_if_in_meeting"
-)
-def test_trusted_room_presence_cleared_after_leave(mock_check):
-    """Once the presence cache is cleared (participant_left), LiveKit is re-checked."""
-    mock_check.return_value = True
-    user = UserFactory()
-    room = RoomFactory(access_level=RoomAccessLevel.TRUSTED)
-    client = APIClient()
-    client.force_login(user)
-    url = f"/api/v1.0/rooms/{room.id}/waiting-participants/"
-
-    assert client.get(url).status_code == 200
-    PresenceCache().clear(room.id, str(user.sub))
-
-    mock_check.return_value = False
-    assert client.get(url).status_code == 403
-    assert mock_check.call_count == 2
-
-
-def test_trusted_room_anonymous_forbidden():
-    """Anonymous users never manage the lobby."""
-    room = RoomFactory(access_level=RoomAccessLevel.TRUSTED)
-    response = APIClient().get(f"/api/v1.0/rooms/{room.id}/waiting-participants/")
-    assert response.status_code == 401
-
-
-@mock.patch(
-    "core.services.participants_management.ParticipantsManagement.check_if_in_meeting"
-)
-def test_trusted_room_present_user_can_accept_entry(mock_check):
-    """Authenticated + present in a trusted room can accept a waiting participant."""
-    mock_check.return_value = True
-    user = UserFactory()
-    room = RoomFactory(access_level=RoomAccessLevel.TRUSTED)
-    client = APIClient()
-    client.force_login(user)
-
-    response = client.post(
-        f"/api/v1.0/rooms/{room.id}/enter/",
-        {"participant_id": "2f7f162f-e7d1-421b-90e7-02bfbfbf8def", "allow_entry": True},
-    )
-    # Permission passed; 404 because that participant isn't actually waiting.
-    assert response.status_code == 404
-    assert response.json() == {"message": "Participant not found."}
@@ -80,7 +80,7 @@ def test_mute_participant_with_livekit_token_for_this_room(mock_livekit_client):
    room = RoomFactory()

    user = AnonymousUser()
-    token = utils.generate_token(str(room.id), user)
+    token = utils.generate_token(str(room.id), user, is_admin_or_owner=False)

    url = reverse("rooms-mute-participant", kwargs={"pk": room.id})
    response = client.post(
@@ -106,7 +106,7 @@ def test_mute_participant_with_livekit_token_for_another_room_forbidden(
    other_room = RoomFactory()

    user = AnonymousUser()
-    token = utils.generate_token(str(other_room.id), user)
+    token = utils.generate_token(str(other_room.id), user, is_admin_or_owner=False)

    url = reverse("rooms-mute-participant", kwargs={"pk": target_room.id})
    response = client.post(
@@ -146,7 +146,7 @@ def test_mute_participant_everyone_can_mute_disabled_blocks_non_admin(
    room = RoomFactory(configuration={"everyone_can_mute": False})

    user = AnonymousUser()
-    token = utils.generate_token(str(room.id), user)
+    token = utils.generate_token(str(room.id), user, is_admin_or_owner=False)

    url = reverse("rooms-mute-participant", kwargs={"pk": room.id})
    response = client.post(
@@ -293,7 +293,7 @@ def test_mute_participant_admin_with_token_for_this_room(mock_livekit_client):
    )
    # Token identity matches the admin user so LiveKitTokenAuthentication
    # resolves request.user back to the admin.
-    token = utils.generate_token(str(room.id), user)
+    token = utils.generate_token(str(room.id), user, is_admin_or_owner=True)

    url = reverse("rooms-mute-participant", kwargs={"pk": room.id})
    response = client.post(
@@ -323,7 +323,7 @@ def test_mute_participant_admin_with_token_for_another_room(mock_livekit_client)
    # Token is scoped to a DIFFERENT room, and admin status must only be
    # honored when established via session, never via a LiveKit
    # token, which can be replayed off-host.
-    token = utils.generate_token(str(other_room.id), user)
+    token = utils.generate_token(str(other_room.id), user, is_admin_or_owner=True)

    url = reverse("rooms-mute-participant", kwargs={"pk": target_room.id})
    response = client.post(
@@ -354,7 +354,7 @@ def test_mute_participant_admin_token_replayed_does_not_grant_admin(
        role=random.choice(["administrator", "owner"]),
    )
    # The token is the only credential.
-    token = utils.generate_token(str(room.id), admin_user)
+    token = utils.generate_token(str(room.id), admin_user, is_admin_or_owner=True)

    url = reverse("rooms-mute-participant", kwargs={"pk": room.id})
    response = client.post(
@@ -374,7 +374,7 @@ def test_mute_participant_livekit_token_triggers_presence_check(mock_livekit_cli
    room = RoomFactory()

    user = AnonymousUser()
-    token = utils.generate_token(str(room.id), user)
+    token = utils.generate_token(str(room.id), user, is_admin_or_owner=False)

    url = reverse("rooms-mute-participant", kwargs={"pk": room.id})
    response = client.post(
@@ -405,7 +405,7 @@ def test_mute_participant_livekit_token_presence_check_returns_participant(
    )

    user = AnonymousUser()
-    token = utils.generate_token(str(room.id), user)
+    token = utils.generate_token(str(room.id), user, is_admin_or_owner=False)

    url = reverse("rooms-mute-participant", kwargs={"pk": room.id})
    response = client.post(
@@ -433,7 +433,7 @@ def test_mute_participant_livekit_token_presence_check_participant_not_found(
    )

    user = AnonymousUser()
-    token = utils.generate_token(str(room.id), user)
+    token = utils.generate_token(str(room.id), user, is_admin_or_owner=False)

    url = reverse("rooms-mute-participant", kwargs={"pk": room.id})
    response = client.post(
@@ -462,7 +462,7 @@ def test_mute_participant_livekit_token_presence_check_twirp_error_forbidden(
    )

    user = AnonymousUser()
-    token = utils.generate_token(str(room.id), user)
+    token = utils.generate_token(str(room.id), user, is_admin_or_owner=False)

    url = reverse("rooms-mute-participant", kwargs={"pk": room.id})
    response = client.post(
@@ -719,13 +719,13 @@ def test_update_participant_invalid_payload():
    )
    client.force_authenticate(user=user)

-    payload = {"participant_identity": ["test"]}
+    payload = {"participant_identity": "invalid-uuid"}

    url = reverse("rooms-update-participant", kwargs={"pk": room.id})
    response = client.post(url, payload, format="json")

    assert response.status_code == status.HTTP_400_BAD_REQUEST
-    assert "Not a valid string." in str(response.data)
+    assert "Must be a valid UUID." in str(response.data)


 def test_update_participant_no_update_fields():
@@ -918,7 +918,7 @@ def test_remove_participant_invalid_payload():
    )
    client.force_authenticate(user=user)

-    payload = {"participant_identity": ["invalid-uuid"]}
+    payload = {"participant_identity": "invalid-uuid"}

    url = reverse("rooms-remove-participant", kwargs={"pk": room.id})
    response = client.post(url, payload, format="json")
--- a/Show More
+++ b/Show More
				`@@ -1 +0,0 @@`
				`"""Meet core roomkit API endpoints for meeting-room (SIP) device integration."""`
				`@@ -1 +0,0 @@`
				`"""Tests for the roomkit API of the Meet core app."""`