✨(encryption) add ability to pause encryption to accept sip users or use server features

Reduce duplication by introducing YAML anchors for configurations
shared across multiple services.

Most settings were nearly identical across the three summary
services, making them easier to maintain and update.

.dockerignore

@@ -4,7 +4,7 @@ __pycache__
 **/__pycache__
 **/*.pyc
 venv
-.venv
+**/.venv
 
 # System-specific files
 .DS_Store

.github/workflows/docker-hub.yml

@@ -12,6 +12,9 @@ on:
     branches:
       - 'main'
 
+permissions:
+  contents: read
+
 env:
   DOCKER_USER: 1001:127
   DOCKER_CONTAINER_REGISTRY_HOSTNAME: docker.io
@@ -20,6 +23,8 @@ env:
 jobs:
   build-and-push-backend:
     runs-on: ubuntu-latest
+    permissions:
+      contents: read
     steps:
       -
         name: Checkout repository
@@ -43,12 +48,12 @@ jobs:
         with:
           username: ${{ secrets.DOCKER_HUB_USER }}
           password: ${{ secrets.DOCKER_HUB_PASSWORD }}
-#      -
-#        name: Run trivy scan
-#        uses: numerique-gouv/action-trivy-cache@main
-#        with:
-#          docker-build-args: '--target backend-production -f Dockerfile'
-#          docker-image-name: '${{ env.DOCKER_CONTAINER_REGISTRY_HOSTNAME }}/${{ env.DOCKER_CONTAINER_REGISTRY_NAMESPACE }}/meet-backend:${{ github.sha }}'
+      -
+        name: Run trivy scan
+        uses: numerique-gouv/action-trivy-cache@main
+        with:
+          docker-build-args: '--target backend-production -f Dockerfile'
+          docker-image-name: '${{ env.DOCKER_CONTAINER_REGISTRY_HOSTNAME }}/${{ env.DOCKER_CONTAINER_REGISTRY_NAMESPACE }}/meet-backend:${{ github.sha }}'
       -
         name: Build and push
         uses: docker/build-push-action@v6
@@ -63,6 +68,8 @@ jobs:
 
   build-and-push-frontend-generic:
     runs-on: ubuntu-latest
+    permissions:
+      contents: read
     steps:
       -
         name: Checkout repository
@@ -86,12 +93,12 @@ jobs:
         with:
           username: ${{ secrets.DOCKER_HUB_USER }}
           password: ${{ secrets.DOCKER_HUB_PASSWORD }}
-#      -
-#        name: Run trivy scan
-#        uses: numerique-gouv/action-trivy-cache@main
-#        with:
-#          docker-build-args: '-f src/frontend/Dockerfile --target frontend-production'
-#          docker-image-name: '${{ env.DOCKER_CONTAINER_REGISTRY_HOSTNAME }}/${{ env.DOCKER_CONTAINER_REGISTRY_NAMESPACE }}/meet-frontend:${{ github.sha }}'
+      -
+        name: Run trivy scan
+        uses: numerique-gouv/action-trivy-cache@main
+        with:
+          docker-build-args: '-f src/frontend/Dockerfile --target frontend-production'
+          docker-image-name: '${{ env.DOCKER_CONTAINER_REGISTRY_HOSTNAME }}/${{ env.DOCKER_CONTAINER_REGISTRY_NAMESPACE }}/meet-frontend:${{ github.sha }}'
       -
         name: Build and push
         uses: docker/build-push-action@v6
@@ -107,6 +114,8 @@ jobs:
 
   build-and-push-frontend-dinum:
     runs-on: ubuntu-latest
+    permissions:
+      contents: read
     steps:
       -
         name: Checkout repository
@@ -130,12 +139,12 @@ jobs:
         with:
           username: ${{ secrets.DOCKER_HUB_USER }}
           password: ${{ secrets.DOCKER_HUB_PASSWORD }}
-#      -
-#        name: Run trivy scan
-#        uses: numerique-gouv/action-trivy-cache@main
-#        with:
-#          docker-build-args: '-f docker/dinum-frontend/Dockerfile --target frontend-production'
-#          docker-image-name: '${{ env.DOCKER_CONTAINER_REGISTRY_HOSTNAME }}/${{ env.DOCKER_CONTAINER_REGISTRY_NAMESPACE }}/meet-frontend-dinum:${{ github.sha }}'
+      -
+        name: Run trivy scan
+        uses: numerique-gouv/action-trivy-cache@main
+        with:
+          docker-build-args: '-f docker/dinum-frontend/Dockerfile --target frontend-production'
+          docker-image-name: '${{ env.DOCKER_CONTAINER_REGISTRY_HOSTNAME }}/${{ env.DOCKER_CONTAINER_REGISTRY_NAMESPACE }}/meet-frontend-dinum:${{ github.sha }}'
       -
         name: Build and push
         uses: docker/build-push-action@v6
@@ -151,6 +160,8 @@ jobs:
 
   build-and-push-summary:
     runs-on: ubuntu-latest
+    permissions:
+      contents: read
     steps:
       -
         name: Checkout repository
@@ -174,13 +185,13 @@ jobs:
         with:
           username: ${{ secrets.DOCKER_HUB_USER }}
           password: ${{ secrets.DOCKER_HUB_PASSWORD }}
-#      -
-#        name: Run trivy scan
-#        uses: numerique-gouv/action-trivy-cache@main
-#        continue-on-error: true
-#        with:
-#          docker-build-args: '-f src/summary/Dockerfile --target production'
-#          docker-image-name: '${{ env.DOCKER_CONTAINER_REGISTRY_HOSTNAME }}/${{ env.DOCKER_CONTAINER_REGISTRY_NAMESPACE }}/meet-summary:${{ github.sha }}'
+      -
+        name: Run trivy scan
+        uses: numerique-gouv/action-trivy-cache@main
+        continue-on-error: true
+        with:
+          docker-build-args: '-f src/summary/Dockerfile --target production'
+          docker-image-name: '${{ env.DOCKER_CONTAINER_REGISTRY_HOSTNAME }}/${{ env.DOCKER_CONTAINER_REGISTRY_NAMESPACE }}/meet-summary:${{ github.sha }}'
           docker-context: './src/summary'
       -
         name: Build and push
@@ -197,6 +208,8 @@ jobs:
 
   build-and-push-agents:
     runs-on: ubuntu-latest
+    permissions:
+      contents: read
     steps:
       -
         name: Checkout repository
@@ -220,14 +233,14 @@ jobs:
         with:
           username: ${{ secrets.DOCKER_HUB_USER }}
           password: ${{ secrets.DOCKER_HUB_PASSWORD }}
-#      -
-#        name: Run trivy scan
-#        uses: numerique-gouv/action-trivy-cache@main
-#        continue-on-error: true
-#        with:
-#          docker-build-args: '-f src/agents/Dockerfile --target production'
-#          docker-image-name: '${{ env.DOCKER_CONTAINER_REGISTRY_HOSTNAME }}/${{ env.DOCKER_CONTAINER_REGISTRY_NAMESPACE }}/meet-agents:${{ github.sha }}'
-#          docker-context: './src/agents'
+      -
+        name: Run trivy scan
+        uses: numerique-gouv/action-trivy-cache@main
+        continue-on-error: true
+        with:
+          docker-build-args: '-f src/agents/Dockerfile --target production'
+          docker-image-name: '${{ env.DOCKER_CONTAINER_REGISTRY_HOSTNAME }}/${{ env.DOCKER_CONTAINER_REGISTRY_NAMESPACE }}/meet-agents:${{ github.sha }}'
+          docker-context: './src/agents'
       -
         name: Build and push
         uses: docker/build-push-action@v6
@@ -242,6 +255,8 @@ jobs:
           labels: ${{ steps.meta.outputs.labels }}
 
   notify-argocd:
+    permissions:
+      contents: read
     needs:
       - build-and-push-frontend-generic
       - build-and-push-frontend-dinum

.github/workflows/meet.yml

@@ -124,15 +124,17 @@ jobs:
         uses: actions/setup-python@v6
         with:
           python-version: "3.13"
-          cache: "pip"
-      - name: Install development dependencies
-        run: pip install --user .[dev]
+      - name: Install uv
+        uses: astral-sh/setup-uv@v7
+      - name: Install the project
+        run: uv sync --locked --all-extras
+
       - name: Check code formatting with ruff
-        run: ~/.local/bin/ruff format . --diff
+        run: uv run ruff format . --diff
       - name: Lint code with ruff
-        run: ~/.local/bin/ruff check .
+        run: uv run ruff check .
       - name: Lint code with pylint
-        run: ~/.local/bin/pylint meet demo core
+        run: uv run pylint meet demo core
 
   lint-agents:
     runs-on: ubuntu-latest
@@ -279,10 +281,10 @@ jobs:
         uses: actions/setup-python@v6
         with:
           python-version: "3.13"
-          cache: "pip"
-
-      - name: Install development dependencies
-        run: pip install --user .[dev]
+      - name: Install uv
+        uses: astral-sh/setup-uv@v7
+      - name: Install the dependencies
+        run: uv sync --locked --all-extras
 
       - name: Install gettext (required to compile messages)
         run: |
@@ -290,10 +292,50 @@ jobs:
           sudo apt-get install -y gettext
 
       - name: Generate a MO file from strings extracted from the project
-        run: python manage.py compilemessages
+        run: uv run python manage.py compilemessages
 
       - name: Run tests
-        run: ~/.local/bin/pytest -n 2
+        run: uv run pytest -n 2
+
+  test-summary:
+    runs-on: ubuntu-latest
+    permissions:
+      contents: read
+    defaults:
+      run:
+        working-directory: src/summary
+
+    env:
+      APP_API_TOKEN: "test-api-token"
+      AWS_STORAGE_BUCKET_NAME: "http://meet-media-storage"
+      AWS_S3_ENDPOINT_URL: "minio:9000"
+      AWS_S3_ACCESS_KEY_ID: "meet"
+      AWS_S3_SECRET_ACCESS_KEY: "password"
+      WHISPERX_BASE_URL: "https://configure-your-url.com"
+      WHISPERX_ASR_MODEL: "large-v2"
+      WHISPERX_API_KEY: "test-whisperx-secret"
+      WHISPERX_DEFAULT_LANGUAGE: "fr"
+      LLM_BASE_URL: "https://configure-your-url.com"
+      LLM_API_KEY: "test-llm-secret"
+      LLM_MODEL: "test-llm-model"
+      WEBHOOK_API_TOKEN: "test-webhook-secret"
+      WEBHOOK_URL: "https://configure-your-url.com"
+
+    steps:
+      - name: Checkout repository
+        uses: actions/checkout@v6
+
+      - name: Install Python
+        uses: actions/setup-python@v6
+        with:
+          python-version: "3.13"
+          cache: "pip"
+
+      - name: Install development dependencies
+        run: pip install --user .[dev]
+
+      - name: Run summary tests
+        run: ~/.local/bin/pytest
 
   lint-front:
     runs-on: ubuntu-latest

.gitignore

@@ -31,6 +31,7 @@ MANIFEST
 
 # Translations	# Translations
 *.pot
+*.mo
 
 # Environments
 .env

CHANGELOG.md

@@ -8,26 +8,74 @@ and this project adheres to
 
 ## [Unreleased]
 
+### Changed
+
+- ⬆️(dependencies) update python dependencies
+
+### Fixed
+
+- 🔒️(backend) fix email disclosure in room invitation endpoint #1200
+- 🐛(backend) fix regression in update-participant endpoint #1204
+
+## [1.12.0] - 2026-03-24
+
+### Changed
+
+- ♻️(backend) configurable SESSION_ENGINE #1038 #1154
+- ♿️(frontend) fix sidepanel accessibility aria-label #1182
+- ♿️(frontend) fix more tools heading hierarchy #1181
+- ♿️(fronted) improve button descriptions for More tools actions #1184
+- 💄(spinner) enforce spinner height #1183
+- 💄(custom-background) add upload indicator with preview #1183
+- ♿️(backend) improve logo accessibility in recording email notification #1092
+- ♿️(summary) improve accessibility of transcription download link #1187
+- 💄(frontend) show OS-specific shortcut in participant tile hint #1193
+- ⬆️(frontend) bump flatted from 3.3.1 to 3.4.2 in /src/frontend #1188
+- ⬆️️️(frontend) bump undici from 6.23.0 to 6.24.1 in /src/frontend
+- ⬆️️️(frontend) bump hono from 4.12.2 to 4.12.7 in /src/frontend
+- ⬆️️️(frontend) bump dompurify from 3.3.1 to 3.3.2 in /src/frontend
+
+### Fixed
+
+- 🐛(frontend) disable personal custom background while deleting #1183
+- 🐛(frontend) auto-select new custom background when not logged in #1183
+- 🐛(frontend) fix device selection not applying during conference #1156
+
+## [1.11.0] - 2026-03-19
+
 ### Added
 
 - ✨(helm) support celery with our Django backend #1124
 - ✨(helm) support ingress for custom background image #1124
 - ✨(backend) add authenticated user rate throttling on request-entry #1129
+- ✨(backend) expose `is_active` field for Application in Django admin #1133
+- ✨(file-upload) disable by default & limit count by user #1141
+- ✨(frontend) custom background #1067
 
 ### Changed
 
 - ♿️(frontend) Caption text size setting for accessibility #1062
 - ♿️(frontend) sync html lang attribute with i18n for screen readers #1111
 - ♿️(frontend) improve MoreLink a11y and UX on home page #1112
-- ♿(frontend) improve chat toast a11y for screen readers #1109
-- ♿(frontend) improve ui and aria labels for help article links #1108
+- ♿️(frontend) improve chat toast a11y for screen readers #1109
+- ♿️(frontend) improve ui and aria labels for help article links #1108
 - 🌐(frontend) improve German translation #1125
+- 🔨(python-env) migrate meet main app to UV #1120
+- ♻️(backend) align Application model field with `is_active` convention #1133
+- 🔐(backend) avoids revealing the inactive status of an application #1135
+- ⚡️(helm) reduce initialDelaySeconds and add periods seconds #1139
+- 🔒️(backend) avoid information exposure through exception messages #1144
+- ⬆️(dependencies) update PyJWT to v2.12.0 [SECURITY] #1151
+- 📌(agents) unpin OpenSSL and related dependencies #1167
+- ♿️(frontend) add caption font and background color customization #1122
 
 ### Fixed
 
 - 🐛(frontend) fix hand icon and queue position alignment and position #1119
 - 🩹(backend) add page_size to pagination for room endpoints #1131
 - 🐛(backend) refactor lobby throttling to use participant id #1129
+- 🩹(backend) ignore non-recording uploads in storage webhook handler #1142
+- 🐛(frontend) fix dimension mismatch in BackgroundCustomProcessor #1116
 
 ## [1.10.0] - 2026-03-05
 

Dockerfile

@@ -13,14 +13,28 @@ RUN apk update && \
 # ---- Back-end builder image ----
 FROM base AS back-builder
 
-WORKDIR /builder
 
-# Copy required python dependencies
-COPY ./src/backend /builder
+ENV UV_COMPILE_BYTECODE=1
+ENV UV_LINK_MODE=copy
 
-RUN mkdir /install && \
-  pip install --prefix=/install .
+# Disable Python downloads, because we want to use the system interpreter
+# across both images. If using a managed Python version, it needs to be
+# copied from the build image into the final image;
+ENV UV_PYTHON_DOWNLOADS=0
 
+# install uv
+COPY --from=ghcr.io/astral-sh/uv:0.10.9 /uv /uvx /bin/
+
+WORKDIR /app
+
+
+RUN --mount=type=cache,target=/root/.cache/uv \
+  --mount=type=bind,source=src/backend/uv.lock,target=uv.lock \
+  --mount=type=bind,source=src/backend/pyproject.toml,target=pyproject.toml \
+  uv sync --locked --no-install-project --no-dev
+COPY src/backend /app
+RUN --mount=type=cache,target=/root/.cache/uv \
+  uv sync --locked --no-dev
 
 # ---- mails ----
 FROM node:20 AS mail-builder
@@ -30,7 +44,7 @@ COPY ./src/mail /mail/app
 WORKDIR /mail/app
 
 RUN yarn install --frozen-lockfile && \
-    yarn build
+  yarn build
 
 
 # ---- static link collector ----
@@ -42,17 +56,17 @@ RUN apk add \
   libmagic \
   rdfind
 
-# Copy installed python dependencies
-COPY --from=back-builder /install /usr/local
-
-# Copy Meet application (see .dockerignore)
-COPY ./src/backend /app/
-
 WORKDIR /app
 
+# Copy the application from the builder
+COPY --from=back-builder /app /app
+
+ENV PATH="/app/.venv/bin:$PATH"
+
+
 # collectstatic
 RUN DJANGO_CONFIGURATION=Build DJANGO_JWT_PRIVATE_SIGNING_KEY=Dummy \
-    python manage.py collectstatic --noinput
+  python manage.py collectstatic --noinput
 
 # Replace duplicated file by a symlink to decrease the overall size of the
 # final image
@@ -81,14 +95,17 @@ COPY ./docker/files/usr/local/bin/entrypoint /usr/local/bin/entrypoint
 # docker user (see entrypoint).
 RUN chmod g=u /etc/passwd
 
-# Copy installed python dependencies
-COPY --from=back-builder /install /usr/local
-
-# Copy Meet application (see .dockerignore)
-COPY ./src/backend /app/
+# Copy the application from the builder
+COPY --from=back-builder /app /app
 
 WORKDIR /app
 
+ENV PATH="/app/.venv/bin:$PATH"
+
+# Generate compiled translation messages
+RUN DJANGO_CONFIGURATION=Build \
+  python manage.py compilemessages --ignore=".venv/**/*"
+
 # We wrap commands run in this container by the following entrypoint that
 # creates a user on-the-fly with the container user ID (see USER) and root group
 # ID.
@@ -103,10 +120,9 @@ USER root:root
 # Install psql
 RUN apk add postgresql-client
 
-# Uninstall Meet and re-install it in editable mode along with development
-# dependencies
-RUN pip uninstall -y meet
-RUN pip install -e .[dev]
+# Install development dependencies
+RUN --mount=from=ghcr.io/astral-sh/uv:0.10.9,source=/uv,target=/bin/uv \
+  uv sync --all-extras --locked
 
 # Restore the un-privileged user running the application
 ARG DOCKER_USER
@@ -115,7 +131,7 @@ USER ${DOCKER_USER}
 # Target database host (e.g. database engine following docker compose services
 # name) & port
 ENV DB_HOST=postgresql \
-    DB_PORT=5432
+  DB_PORT=5432
 
 # Run django development server
 CMD ["python", "manage.py", "runserver", "0.0.0.0:8000"]

Makefile

@@ -125,10 +125,16 @@ run-summary: ## start only the summary application and all needed services
 	@$(COMPOSE) up --force-recreate -d celery-summary-summarize
 .PHONY: run-summary
 
+run-sip: ## start the SIP gateway and the browser-based softphone (Janus + nginx)
+	@$(COMPOSE) up --force-recreate -d sip
+	@$(COMPOSE) up --force-recreate -d sip-web-janus sip-web
+.PHONY: run-sip
+
 run:
 run: ## start the wsgi (production) and development server
 	@$(MAKE) run-backend
 	@$(MAKE) run-summary
+	@$(MAKE) run-sip
 	@$(COMPOSE) up --force-recreate -d frontend
 .PHONY: run
 
@@ -191,6 +197,7 @@ lint-pylint: ## lint back-end python sources with pylint only on changed files f
 
 test: ## run project tests
 	@$(MAKE) test-back-parallel
+	@$(MAKE) test-summary
 .PHONY: test
 
 test-back: ## run back-end tests
@@ -203,6 +210,11 @@ test-back-parallel: ## run all back-end tests in parallel
 	bin/pytest -n auto $${args:-${1}}
 .PHONY: test-back-parallel
 
+test-summary: ## run summary tests
+	@args="$(filter-out $@,$(MAKECMDGOALS))" && \
+	bin/pytest-summary $${args:-${1}}
+.PHONY: test-summary
+
 makemigrations:  ## run django makemigrations for the Meet project.
 	@echo "$(BOLD)Running makemigrations$(RESET)"
 	@$(COMPOSE) up -d postgresql
@@ -223,7 +235,7 @@ superuser: ## Create an admin superuser with password "admin"
 .PHONY: superuser
 
 back-i18n-compile: ## compile the gettext files
-	@$(MANAGE) compilemessages --ignore="venv/**/*"
+	@$(MANAGE) compilemessages --ignore=".venv/**/*"
 .PHONY: back-i18n-compile
 
 back-i18n-generate: ## create the .pot files used for i18n
@@ -354,13 +366,13 @@ install-external-secrets: ## install the kubernetes secrets from Vaultwarden
 .PHONY: build-k8s-cluster
 
 start-tilt: ## start the kubernetes cluster using kind
-	tilt up -f ./bin/Tiltfile
+	tilt up --namespace=meet -f ./bin/Tiltfile
 .PHONY: build-k8s-cluster
 
 start-tilt-keycloak: ## start the kubernetes cluster using kind, without Pro Connect for authentication, use keycloak
-	DEV_ENV=dev-keycloak tilt up -f ./bin/Tiltfile
+	DEV_ENV=dev-keycloak tilt up --namespace=meet -f ./bin/Tiltfile
 .PHONY: build-k8s-cluster
 
 start-tilt-dinum: ## start the kubernetes cluster using kind, without Pro Connect for authentication, but with DINUM styles
-	DEV_ENV=dev-dinum tilt up -f ./bin/Tiltfile
+	DEV_ENV=dev-dinum tilt up --namespace=meet -f ./bin/Tiltfile
 .PHONY: build-k8s-cluster

README.md

@@ -2,7 +2,6 @@
   <img alt="meet logo" src="./docs/assets/banner-meet-fr.png" maxWidth="100%">
 </p>
 
-
 <p align="center">
   <a href="https://github.com/suitenumerique/meet/stargazers/">
     <img src="https://img.shields.io/github/stars/suitenumerique/meet" alt="">
@@ -12,11 +11,11 @@
   <img alt="GitHub closed issues" src="https://img.shields.io/github/issues-closed/suitenumerique/meet"/>
   <a href="https://github.com/suitenumerique/meet/blob/main/LICENSE">
     <img alt="GitHub closed issues" src="https://img.shields.io/github/license/suitenumerique/meet"/>
-  </a>    
+  </a>
 </p>
 
 <p align="center">
-  <a href="https://livekit.io/">LiveKit</a> - <a href="https://matrix.to/#/#meet-official:matrix.org">Chat with us</a> - <a href="https://github.com/orgs/suitenumerique/projects/3/views/2">Roadmap</a> - <a href="https://github.com/suitenumerique/meet/blob/main/CHANGELOG.md">Changelog</a> - <a href="https://github.com/suitenumerique/meet/issues/new?assignees=&labels=bug&template=Bug_report.md">Bug reports</a> 
+  <a href="https://livekit.io/">LiveKit</a> - <a href="https://matrix.to/#/#meet-official:matrix.org">Chat with us</a> - <a href="https://github.com/orgs/suitenumerique/projects/3/views/2">Roadmap</a> - <a href="https://github.com/suitenumerique/meet/blob/main/CHANGELOG.md">Changelog</a> - <a href="https://github.com/suitenumerique/meet/issues/new?assignees=&labels=bug&template=Bug_report.md">Bug reports</a>
 </p>
 
 <p align="center">
@@ -28,25 +27,65 @@
 ## La Suite Meet: Simple Video Conferencing
 
 Powered by [LiveKit](https://livekit.io/), La Suite Meet offers Zoom-level performance with high-quality video and audio. No installation required—simply join calls directly from your browser. Check out LiveKit's impressive optimizations in their [blog post](https://blog.livekit.io/livekit-one-dot-zero/).
+
 ### Features
+
 - Optimized for stability in large meetings (+100 p.)
 - Support for multiple screen sharing streams
 - Non-persistent, secure chat
-- End-to-end encryption (coming soon)
+- End-to-end encryption with passphrase-in-link key distribution
 - Meeting recording
 - Meeting transcription & Summary (currently in beta)
 - Telephony integration
 - Secure participation with robust authentication and access control
 - Customizable frontend style
 - LiveKit Advances features including :
-  - speaker detection 
-  - simulcast 
-  - end-to-end optimizations 
+  - speaker detection
+  - simulcast
+  - end-to-end optimizations
   - selective subscription
   - SVC codecs (VP9, AV1)
 
+### End-to-end encryption
 
-La Suite Meet is fully self-hostable and released under the MIT License, ensuring complete control and flexibility. It's simple to [get started](https://visio.numerique.gouv.fr/) or [request a demo](mailto:visio@numerique.gouv.fr). 
+La Suite Meet supports end-to-end encryption (E2EE) for meetings, so the media server (LiveKit SFU) cannot read audio, video or screen-share content.
+
+#### How it works
+
+- Each encrypted meeting carries a 48-character random passphrase appended to the URL hash (`#…`). The server never sees it; sharing the meeting link shares the key.
+- Frames are encrypted in the browser via LiveKit's Worker + `crypto.subtle` (AES-GCM); only the media payload is encrypted, codec headers stay clear so the SFU can still packetize RTP.
+- The runtime "is this call encrypted?" decision keys off the URL hash, not the database flag — a compromised server cannot fabricate a passphrase that all participants happen to share.
+- The DB flag (`Room.is_encrypted`) is a hint used at room creation time only (so the Create button knows to generate a hash) and to detect link/server inconsistencies.
+
+#### Opt-in by user
+
+End-to-end encryption is a per-user preference. In **Settings → Security**, signed-in users can enable "End-to-end encryption" — from then on every meeting they create is encrypted by default. Joining is unaffected: if a meeting URL has a passphrase, the joining client uses it.
+
+#### Pause / resume for recording and transcription
+
+While encryption is on, the SFU cannot record or transcribe (it has nothing to read). When an admin (or, if no admin is present, the longest-present participant — provided a pause has already been observed in the session) starts a recording or transcription:
+
+1. A confirmation dialog warns that encryption will be paused.
+2. On confirm, an `ENCRYPTION_PAUSED` message is broadcast over a LiveKit reliable data channel. While the sender hasn't yet flipped its own state, that message is itself encrypted — which is the trust anchor: only callers holding the passphrase can produce frames everyone can decrypt.
+3. Each receiver disables E2EE locally and republishes its tracks unencrypted.
+4. Late joiners send an `ENCRYPTION_STATUS_PROBE` so the leader can re-emit the announcement to them.
+5. When **both** recording and transcription stop, the participant who paused broadcasts `ENCRYPTION_RESUMED` and everyone re-enables E2EE with the same URL passphrase.
+
+The pause state is intentionally session-only and never persisted — `Room.is_encrypted` does not flip.
+
+#### Phone / SIP participants
+
+Phone and other external devices can't decrypt our frames. When one joins an encrypted room, the backend webhook detects them, broadcasts a system notice (admins see a snackbar with an "Open settings" CTA), and removes the external participant. The admin can then disable encryption from the Security settings and the user can dial in again.
+
+#### Configuration
+
+```env
+ENCRYPTION_ENABLED=true
+```
+
+Setting `ENCRYPTION_ENABLED=false` disables the user preference toggle entirely; existing encrypted rooms stay encrypted but no new ones can be created.
+
+La Suite Meet is fully self-hostable and released under the MIT License, ensuring complete control and flexibility. It's simple to [get started](https://visio.numerique.gouv.fr/) or [request a demo](mailto:visio@numerique.gouv.fr).
 
 We’re continuously adding new features to enhance your experience, with the latest updates coming soon!
 
@@ -63,7 +102,6 @@ On the 25th of January 2026, David Amiel, France’s Minister for Civil Service
 - [Philosophy](#philosophy)
 - [Open source](#open-source)
 
-
 ## Get started
 
 ## Docs
@@ -82,15 +120,15 @@ We use Kubernetes for our [production instance](https://visio.numerique.gouv.fr/
 > Some advanced features (ex: recording, transcription) lack detailed documentation. We're working hard to provide comprehensive guides soon.
 
 #### Known instances
+
 We hope to see many more, here is an incomplete list of public La Suite Meet instances. Feel free to make a PR to add ones that are not listed below🙏
 
-| Url                                                           | Org | Access |
-|---------------------------------------------------------------| --- | ------- |
-| [visio.numerique.gouv.fr](https://visio.numerique.gouv.fr/)   | DINUM    | French public agents working for the central administration and the extended public sphere. ProConnect is required to login in or sign up|
-| [visio.suite.anct.gouv.fr](https://visio.suite.anct.gouv.fr/) | ANCT    | French public agents working for the territorial administration and the extended public sphere. ProConnect is required to login in or sign up|
-| [visio.lasuite.coop](https://visio.lasuite.coop/)             | lasuite.coop    | Free and open demo to all. Content and accounts are reset after one month |
-| [mosacloud.cloud](https://mosa.cloud/)                        | mosa.cloud    | Demo instance of mosa.cloud, a dutch company providing services around La Suite apps. |
-
+| Url                                                           | Org          | Access                                                                                                                                        |
+| ------------------------------------------------------------- | ------------ | --------------------------------------------------------------------------------------------------------------------------------------------- |
+| [visio.numerique.gouv.fr](https://visio.numerique.gouv.fr/)   | DINUM        | French public agents working for the central administration and the extended public sphere. ProConnect is required to login in or sign up     |
+| [visio.suite.anct.gouv.fr](https://visio.suite.anct.gouv.fr/) | ANCT         | French public agents working for the territorial administration and the extended public sphere. ProConnect is required to login in or sign up |
+| [visio.lasuite.coop](https://visio.lasuite.coop/)             | lasuite.coop | Free and open demo to all. Content and accounts are reset after one month                                                                     |
+| [mosacloud.cloud](https://mosa.cloud/)                        | mosa.cloud   | Demo instance of mosa.cloud, a dutch company providing services around La Suite apps.                                                         |
 
 ## Contributing
 
@@ -100,7 +138,6 @@ We <3 contributions of any kind, big and small:
 - Open a PR (see our instructions on [developing La Suite Meet locally](https://github.com/suitenumerique/meet/blob/main/docs/developping_locally.md))
 - Submit a [feature request](https://github.com/suitenumerique/meet/issues/new?assignees=&labels=enhancement&template=Feature_request.md) or [bug report](https://github.com/suitenumerique/meet/issues/new?assignees=&labels=bug&template=Bug_report.md)
 
-
 ## Philosophy
 
 We’re relentlessly focused on building the best open-source video conferencing product—La Suite Meet. Growth comes from creating something people truly need, not just from chasing metrics.
@@ -109,7 +146,6 @@ Our users come first. We’re committed to making La Suite Meet as accessible an
 
 Most of the heavy engineering is handled by the incredible LiveKit team, allowing us to focus on delivering a top-tier product. We follow extreme programming practices, favoring pair programming and quick, iterative releases. Challenge our tech and architecture—simplicity is always our top priority.
 
-
 ## Open-source
 
 Gov 🇫🇷 supports open source! This project is available under [MIT license](https://github.com/suitenumerique/meet/blob/0cc2a7b7b4f4821e2c4d9d790efa739622bb6601/LICENSE).
@@ -121,14 +157,13 @@ To learn more, don't hesitate to [reach out](mailto:visio@numerique.gouv.fr).
 
 Come help us make La Suite Meet even better. We're growing fast and [would love some help](mailto:visio@numerique.gouv.fr).
 
-
 ## Contributors 🧞
 
 <a href="https://github.com/suitenumerique/meet/graphs/contributors">
   <img src="https://contrib.rocks/image?repo=suitenumerique/meet" />
 </a>
 
-## Credits 
+## Credits
 
 We're using the awesome [LiveKit](https://livekit.io/) implementation. We're also thankful to the teams behind [Django Rest Framework](https://www.django-rest-framework.org/), [Vite.js](https://vite.dev/), and [React Aria](https://github.com/adobe/react-spectrum) — Thanks for your amazing work!
 This project is tested with BrowserStack.
@@ -137,4 +172,3 @@ This project is tested with BrowserStack.
 
 Code in this repository is published under the MIT license by DINUM (Direction interministériel du numérique).
 Documentation (in the docs/) directory is released under the [Etalab-2.0 license](https://spdx.org/licenses/etalab-2.0.html).
-

bin/Tiltfile

@@ -103,6 +103,7 @@ k8s_resource('meet-celery-backend', resource_deps=['redis'])
 k8s_resource('meet-celery-summarize', resource_deps=['redis'])
 k8s_resource('meet-celery-transcribe', resource_deps=['redis'])
 k8s_resource('meet-backend-migrate', resource_deps=['meet-backend'])
+k8s_resource('livekit-livekit-server', resource_deps=['redis'])
 k8s_resource('livekit-livekit-server-test-connection', resource_deps=['livekit-livekit-server'])
 k8s_resource('keycloak', resource_deps=['kc-postgresql'])
 k8s_resource('meet-backend-createsuperuser', resource_deps=['meet-backend-migrate'])

bin/pytest-summary

@@ -0,0 +1,7 @@
+#!/usr/bin/env bash
+
+source "$(dirname "${BASH_SOURCE[0]}")/_config.sh"
+
+_dc_run \
+    app-summary-dev \
+    python -m pytest "$@"

compose.yml

@@ -58,7 +58,7 @@ services:
       /usr/bin/mc admin config set meet notify_webhook:meet-webhook endpoint='http://app-dev:8000/api/v1.0/recordings/storage-hook/' auth_token='Bearer password' &&
       /usr/bin/mc admin service restart meet --wait --json &&
       sleep 15 &&
-      /usr/bin/mc event add meet/meet-media-storage arn:minio:sqs::meet-webhook:webhook --event put &&
+      /usr/bin/mc event add meet/meet-media-storage arn:minio:sqs::meet-webhook:webhook --event put --prefix "recordings" &&
       exit 0;"
 
   app-dev:
@@ -80,6 +80,7 @@ services:
     volumes:
       - ./src/backend:/app
       - ./data/static:/data/static
+      - /app/.venv
     depends_on:
         - postgresql
         - mailcatcher
@@ -105,6 +106,7 @@ services:
     volumes:
       - ./src/backend:/app
       - ./data/static:/data/static
+      - /app/.venv
     depends_on:
       - app-dev
 
@@ -166,8 +168,7 @@ services:
       - "3000:8080"
 
   dockerize:
-    image: jwilder/dockerize
-    platform: linux/x86_64
+    image: powerman/dockerize:0.19.0
 
   crowdin:
     image: crowdin/cli:4.0.0
@@ -244,6 +245,60 @@ services:
       depends_on:
         - redis
 
+  # SIP gateway. Built from the sibling livekit-sip checkout so any dev
+  # cloning both repos gets a working `docker compose up`. TODO: replace
+  # the build: block with `image: livekit/sip` once upstream ships an
+  # image with the team's video bridging.
+  sip:
+    build:
+      context: ../livekit-sip
+      dockerfile: build/sip/Dockerfile
+    ports:
+      - "5060:5060/udp"
+      - "5060:5060/tcp"
+      - "10000-10020:10000-10020/udp"
+    environment:
+      SIP_CONFIG_BODY: |
+        api_key: 'devkey'
+        api_secret: 'secret'
+        ws_url: 'ws://livekit:7880'
+        redis:
+          address: 'redis:6379'
+        sip_port: 5060
+        rtp_port: 10000-10020
+        use_external_ip: false
+        logging:
+          level: debug
+    depends_on:
+      - livekit
+      - redis
+
+  # Janus WebRTC gateway with the SIP plugin. Bridges a browser SIP demo
+  # tab to the SIP gateway above. ICE-TCP enabled (janus.jcfg) so media
+  # works under Lima port-forwarding without vmnet.
+  sip-web-janus:
+    build: ./docker/janus
+    ports:
+      - "10100-10120:10100-10120/tcp"
+    volumes:
+      - ./docker/janus/conf/janus.jcfg:/usr/local/etc/janus/janus.jcfg:ro
+      - ./docker/janus/conf/janus.transport.http.jcfg:/usr/local/etc/janus/janus.transport.http.jcfg:ro
+      - ./docker/janus/conf/janus.plugin.sip.jcfg:/usr/local/etc/janus/janus.plugin.sip.jcfg:ro
+    depends_on:
+      - sip
+
+  # Serves docker/janus/web/{index.html,janus.js} and proxies /janus to
+  # the Janus container so the demo is single-origin.
+  sip-web:
+    image: nginx:alpine
+    ports:
+      - "8088:80"
+    volumes:
+      - ./docker/janus/web:/usr/share/nginx/html:ro
+      - ./docker/janus/conf/nginx.conf:/etc/nginx/conf.d/default.conf:ro
+    depends_on:
+      - sip-web-janus
+
   redis-summary:
     image: redis
     ports:

docker/auth/realm.json

@@ -60,7 +60,7 @@
     },
     {
       "username": "user-e2e-chromium",
-      "email": "user@chromium.e2e",
+      "email": "user.test@chromium.test",
       "firstName": "E2E",
       "lastName": "Chromium",
       "enabled": "true",
@@ -74,7 +74,7 @@
     },
     {
       "username": "user-e2e-webkit",
-      "email": "user@webkit.e2e",
+      "email": "user.test@webkit.test",
       "firstName": "E2E",
       "lastName": "Webkit",
       "enabled": "true",
@@ -88,7 +88,7 @@
     },
     {
       "username": "user-e2e-firefox",
-      "email": "user@firefox.e2e",
+      "email": "user.test@firefox.test",
       "firstName": "E2E",
       "lastName": "Firefox",
       "enabled": "true",
@@ -845,6 +845,23 @@
         "offline_access",
         "microprofile-jwt"
       ]
+    },
+    {
+      "clientId": "encryption",
+      "name": "Encryption Service",
+      "enabled": true,
+      "publicClient": true,
+      "standardFlowEnabled": true,
+      "directAccessGrantsEnabled": false,
+      "redirectUris": [
+        "http://encryption.localhost:7200/auth/callback"
+      ],
+      "webOrigins": [
+        "http://encryption.localhost:7200",
+        "http://data.encryption.localhost:7200"
+      ],
+      "protocol": "openid-connect",
+      "fullScopeAllowed": true
     }
   ],
   "clientScopes": [

docker/janus/Dockerfile

@@ -0,0 +1,58 @@
+# Build Janus from source so ICE-TCP support is present (the canyan image
+# was compiled against libnice 0.1.16, which lacks the runtime ICE-TCP
+# capability Janus 1.1.x feature-detects at startup). Debian 13 ships
+# libnice 0.1.21+ which has ICE-TCP. Also: builds natively on arm64, so
+# no QEMU emulation overhead.
+FROM debian:13-slim AS builder
+
+ARG JANUS_VERSION=v1.1.4
+
+RUN apt-get update && apt-get install -y --no-install-recommends \
+    build-essential ca-certificates git pkg-config \
+    autoconf automake libtool gengetopt \
+    libssl-dev libsrtp2-dev libglib2.0-dev libopus-dev libogg-dev \
+    libcurl4-openssl-dev libconfig-dev libnice-dev \
+    libmicrohttpd-dev libjansson-dev libsofia-sip-ua-dev \
+ && rm -rf /var/lib/apt/lists/*
+
+WORKDIR /src
+RUN git clone --depth 1 --branch ${JANUS_VERSION} \
+    https://github.com/meetecho/janus-gateway.git janus
+
+WORKDIR /src/janus
+RUN ./autogen.sh && \
+    ./configure \
+      --prefix=/opt/janus \
+      --disable-rabbitmq --disable-mqtt --disable-nanomsg --disable-unix-sockets \
+      --disable-data-channels \
+      --disable-all-plugins \
+      --enable-plugin-sip \
+      --disable-all-handlers \
+      --disable-all-transports --enable-rest && \
+    make -j$(nproc) && \
+    make install && \
+    make configs
+
+FROM debian:13-slim
+
+# Debian 13 (trixie) renamed several libs in the time_t-64 transition:
+# libglib2.0-0t64, libcurl4t64. libconfig9 → libconfig11.
+RUN apt-get update && apt-get install -y --no-install-recommends \
+    ca-certificates libssl3 libsrtp2-1 libglib2.0-0t64 libopus0 libogg0 \
+    libcurl4t64 libconfig11 libnice10 libmicrohttpd12 libjansson4 \
+    libsofia-sip-ua0 \
+ && rm -rf /var/lib/apt/lists/*
+
+COPY --from=builder /opt/janus /opt/janus
+
+# Make paths match canyan's so the rest of the compose mounts (configs, demos)
+# Just-Work without changes. The configs we mount in docker/janus/conf/ assume
+# /usr/local/etc/janus and /usr/local/lib/janus.
+RUN ln -s /opt/janus/bin/janus /usr/local/bin/janus && \
+    ln -s /opt/janus/etc/janus /usr/local/etc/janus && \
+    ln -s /opt/janus/lib/janus /usr/local/lib/janus && \
+    ln -s /opt/janus/share/janus /usr/local/share/janus
+
+EXPOSE 8088 10100-10120/tcp 10100-10120/udp
+
+CMD ["/usr/local/bin/janus"]

docker/janus/conf/janus.jcfg

@@ -0,0 +1,42 @@
+// Minimal Janus config for browser-↔-SIP demo. Trimmed from the upstream
+// sample to the bits we actually need.
+general: {
+    configs_folder = "/usr/local/etc/janus"
+    plugins_folder = "/usr/local/lib/janus/plugins"
+    transports_folder = "/usr/local/lib/janus/transports"
+    events_folder = "/usr/local/lib/janus/events"
+    log_to_stdout = true
+    debug_level = 4
+    server_name = "meet-sip-demo"
+}
+
+media: {
+    // Janus ↔ Browser media (WebRTC over TCP — Lima only forwards TCP).
+    rtp_port_range = "10100-10120"
+    ipv6 = false
+}
+
+nat: {
+    // The whole reason this works without vmnet — Janus offers TCP ICE
+    // candidates the Mac browser can actually connect to.
+    ice_tcp = true
+    // libnice quirk: ICE-TCP needs ICE Lite mode on the server side or
+    // the connectivity check state machine deadlocks. Janus warns about
+    // this at startup if Lite is off while TCP is on.
+    ice_lite = true
+    // Janus advertises this IP in ICE candidates. From the Mac browser's
+    // perspective, the Janus daemon lives at 127.0.0.1:<port> (Lima
+    // forwards Mac:127.0.0.1:<port> → VM → docker port-map → container).
+    nat_1_1_mapping = "127.0.0.1"
+    keep_private_host = true
+}
+
+plugins: {
+    // Only keep the SIP plugin. Everything else trimmed for boot time.
+    disable = "libjanus_audiobridge.so,libjanus_videoroom.so,libjanus_streaming.so,libjanus_textroom.so,libjanus_recordplay.so,libjanus_voicemail.so,libjanus_echotest.so,libjanus_videocall.so,libjanus_nosip.so,libjanus_duktape.so,libjanus_lua.so"
+}
+
+transports: {
+    // Only HTTP. WS is overkill for the demo and adds another port.
+    disable = "libjanus_websockets.so,libjanus_mqtt.so,libjanus_nanomsg.so,libjanus_rabbitmq.so,libjanus_pfunix.so"
+}

docker/janus/conf/janus.plugin.sip.jcfg

@@ -0,0 +1,8 @@
+// SIP plugin defaults. RTP range for the SIP leg (Janus ↔ livekit/sip)
+// is kept separate from WebRTC range — both legs are inside the docker
+// bridge network, so any UDP range works.
+general: {
+    local_ip = "0.0.0.0"
+    rtp_port_range = "20000-20100"
+    events = true
+}

docker/janus/conf/janus.transport.http.jcfg

@@ -0,0 +1,24 @@
+// HTTP transport: bind 0.0.0.0:8088 inside the container, served to the
+// browser through the nginx sidecar that also hosts the demo HTML.
+general: {
+    json = "indented"
+    base_path = "/janus"
+    http = true
+    port = 8088
+    https = false
+    mhd_connection_limit = 1020
+}
+
+admin: {
+    admin_base_path = "/admin"
+    admin_http = false
+    admin_https = false
+}
+
+certificates: {
+}
+
+cors: {
+    // Same-origin via nginx proxy; demo page and API share a host.
+    # allow_origin = "*"
+}

docker/janus/conf/nginx.conf

@@ -0,0 +1,33 @@
+server {
+    listen 80;
+    server_name _;
+
+    # Docker's embedded DNS (127.0.0.11). Without this, nginx resolves
+    # upstreams once at startup and breaks the moment a peer container is
+    # recreated with a new bridge IP. The `valid=10s` plus a variable in
+    # proxy_pass forces per-request re-resolution.
+    resolver 127.0.0.11 valid=10s ipv6=off;
+
+    # Serve the Janus demo HTML/JS extracted from the canyan image.
+    root /usr/share/nginx/html;
+    index index.html;
+
+    # Janus HTTP API — same origin as the demo pages so the default
+    # settings.js URL ("http://<host>:8088/janus") just works. Regex so
+    # /janus and /janus/<session>/... proxy, but /janus.js still hits
+    # the static file root.
+    location ~ ^/janus(/|$) {
+        # Variable upstream + the resolver above = re-DNS on each request.
+        # Plain `proxy_pass http://sip-web-janus:8088` would cache the IP
+        # for the lifetime of the worker process.
+        set $janus_upstream sip-web-janus;
+        proxy_pass http://$janus_upstream:8088;
+        proxy_http_version 1.1;
+        proxy_buffering off;
+        proxy_read_timeout 120s;
+    }
+
+    location / {
+        try_files $uri $uri/ =404;
+    }
+}

docker/janus/web/index.html

@@ -0,0 +1,405 @@
+<!DOCTYPE html>
+<!--
+Minimal SIP-via-Janus demo. Replaces the upstream siptest.html bundle with
+a single self-contained page. Everything is auto-driven: page load creates
+the Janus session, attaches to the SIP plugin, registers as guest, places
+the call. The user just needs to type the room PIN on the dialpad.
+
+Co-located only with janus.js (vendor lib, ~113KB) — no settings.js, no
+navbar/footer, no shared CSS, no logos. nginx serves these two files.
+-->
+<html lang="en">
+<head>
+<meta charset="utf-8">
+<title>SIP Demo</title>
+<style>
+	* { box-sizing: border-box; }
+	html, body { margin: 0; padding: 0; height: 100%; background: #1b1b1f; color: #e8e8e8;
+	             font: 14px/1.4 -apple-system, BlinkMacSystemFont, "Segoe UI", sans-serif; }
+	#app { display: flex; flex-direction: column; height: 100vh; max-width: 720px; margin: 0 auto; padding: 16px; gap: 12px; }
+	h1 { margin: 0; font-size: 18px; font-weight: 600; }
+	#status { padding: 8px 12px; border-radius: 6px; background: #2c2c33; font-family: ui-monospace, monospace; font-size: 13px; }
+	#video-wrap { position: relative; flex: 1; background: #000; border-radius: 8px; overflow: hidden; min-height: 240px; }
+	#remoteVideo { width: 100%; height: 100%; object-fit: contain; }
+	#noVideo { position: absolute; inset: 0; display: flex; align-items: center; justify-content: center; color: #555; font-size: 14px; }
+	.row { display: flex; gap: 8px; flex-wrap: wrap; }
+	button { font: inherit; padding: 8px 14px; border: 0; border-radius: 6px; background: #4a90e2; color: #fff; cursor: pointer; }
+	button:hover:not(:disabled) { background: #357ec0; }
+	button:disabled { opacity: 0.4; cursor: not-allowed; }
+	button.danger { background: #dc3545; }
+	button.danger:hover:not(:disabled) { background: #b62733; }
+	button.success { background: #28a745; }
+	button.success:hover:not(:disabled) { background: #1f8035; }
+	.dialpad { display: grid; grid-template-columns: repeat(4, 1fr); gap: 6px; }
+	.dialpad button { padding: 14px 0; font-size: 16px; background: #3a3a44; }
+	.dialpad button:hover:not(:disabled) { background: #4a4a55; }
+	#pin-row input { flex: 1; padding: 8px 12px; border: 1px solid #444; border-radius: 6px; background: #2c2c33; color: #fff; font: inherit; font-family: ui-monospace, monospace; letter-spacing: 0.2em; }
+	#log { font-family: ui-monospace, monospace; font-size: 11px; max-height: 120px; overflow-y: auto; background: #15151a; padding: 8px; border-radius: 6px; color: #888; }
+	.log-line { white-space: pre-wrap; word-break: break-word; }
+	.log-err { color: #ff7373; }
+	.disabled { opacity: 0.35; pointer-events: none; transition: opacity 0.2s; }
+</style>
+</head>
+<body>
+<div id="app">
+	<h1>SIP demo (browser → Janus → livekit-sip → room)</h1>
+	<div id="status">Loading…</div>
+
+	<div id="video-wrap">
+		<video id="remoteVideo" autoplay playsinline muted></video>
+		<audio id="remoteAudio" autoplay></audio>
+		<div id="noVideo">No remote video yet</div>
+	</div>
+
+	<div id="pin-row" class="row" style="display:none">
+		<input type="text" id="pin" placeholder="Enter PIN then press # on the pad" inputmode="numeric" pattern="[0-9]*">
+		<button id="sendPin" class="success">Send PIN</button>
+	</div>
+
+	<div id="dialpad" class="dialpad" style="display:none">
+		<button data-d="1">1</button><button data-d="2">2</button><button data-d="3">3</button><button data-d="A">A</button>
+		<button data-d="4">4</button><button data-d="5">5</button><button data-d="6">6</button><button data-d="B">B</button>
+		<button data-d="7">7</button><button data-d="8">8</button><button data-d="9">9</button><button data-d="C">C</button>
+		<button data-d="*">*</button><button data-d="0">0</button><button data-d="#">#</button><button data-d="D">D</button>
+	</div>
+
+	<div id="controls" class="row">
+		<button id="muteBtn" class="danger">🔇 Mic muted</button>
+		<button id="cameraBtn" class="success">📷 Camera on</button>
+		<button id="speakerBtn" class="success">🔊 Speaker on</button>
+		<button id="hangupBtn" class="danger" disabled>Hangup</button>
+		<button id="rejoinBtn" style="display:none">Re-join</button>
+	</div>
+
+	<details><summary style="cursor:pointer; opacity:0.7; font-size:12px">debug log</summary>
+		<div id="log"></div>
+	</details>
+</div>
+
+<!-- webrtc-adapter is required by janus.js (cross-browser WebRTC API
+     normalizer). The upstream siptest pulls it from CDN; we do the same.
+     Without it Janus.init() silently fails. -->
+<script src="https://cdn.jsdelivr.net/npm/webrtc-adapter@9.0.1/out/adapter.min.js"></script>
+<script src="janus.js"></script>
+<script>
+// ============================================================================
+// Configuration (hard-coded; this is a dev demo)
+// ============================================================================
+const JANUS_SERVER  = location.origin + "/janus";   // nginx proxies to janus
+const SIP_PROXY     = "sip:sip:5060";               // docker service name
+const SIP_IDENTITY  = "sip:demo@example.invalid";   // no registrar, guest
+const SIP_PEER      = "sip:phone@sip:5060";         // user-part irrelevant
+                                                    // (Direct+PIN rule)
+const DISPLAY_NAME  = "test-user";
+const ICE_SERVERS   = [];                           // ICE-TCP via janus.jcfg
+
+// ============================================================================
+// UI helpers
+// ============================================================================
+const $ = id => document.getElementById(id);
+function setStatus(text) { $("status").textContent = text; log(text); }
+function log(msg, isErr = false) {
+	const line = document.createElement("div");
+	line.className = "log-line" + (isErr ? " log-err" : "");
+	line.textContent = "[" + new Date().toLocaleTimeString() + "] " + msg;
+	$("log").appendChild(line);
+	$("log").scrollTop = $("log").scrollHeight;
+}
+
+// ============================================================================
+// Janus state
+// ============================================================================
+let janus = null;
+let sipcall = null;
+let inCall = false;
+
+// ============================================================================
+// Init: create Janus → session → SIP handle → register → call
+// ============================================================================
+Janus.init({
+	debug: false,
+	callback: () => {
+		if (!Janus.isWebrtcSupported()) {
+			setStatus("WebRTC not supported in this browser.");
+			return;
+		}
+		createSession();
+	}
+});
+
+function createSession() {
+	setStatus("Connecting to Janus…");
+	janus = new Janus({
+		server: JANUS_SERVER,
+		iceServers: ICE_SERVERS,
+		success: () => {
+			setStatus("Connected. Attaching SIP plugin…");
+			attachSip();
+		},
+		error: (err) => setStatus("Janus error: " + err),
+		destroyed: () => setStatus("Janus session destroyed."),
+	});
+}
+
+function attachSip() {
+	janus.attach({
+		plugin: "janus.plugin.sip",
+		opaqueId: "sip-demo-" + Janus.randomString(8),
+		success: (handle) => {
+			sipcall = handle;
+			window.sipcall = handle; // for ad-hoc console debugging
+			registerAsGuest();
+		},
+		error: (err) => setStatus("Plugin attach error: " + err),
+		onmessage: handleMessage,
+		onlocaltrack: (track, on) => {
+			// We don't render local preview — Meet tab is already showing it.
+		},
+		onremotetrack: (track, mid, on, meta) => {
+			if (!on) return;
+			const stream = new MediaStream([track]);
+			if (track.kind === "audio") {
+				$("remoteAudio").srcObject = stream;
+			} else if (track.kind === "video") {
+				$("remoteVideo").srcObject = stream;
+				$("noVideo").style.display = "none";
+			}
+		},
+		oncleanup: () => { setStatus("Call cleaned up."); endCallUi(); },
+	});
+}
+
+function registerAsGuest() {
+	setStatus("Registering as guest…");
+	sipcall.send({
+		message: {
+			request: "register",
+			type: "guest",
+			proxy: SIP_PROXY,
+			username: SIP_IDENTITY,
+			display_name: DISPLAY_NAME,
+		},
+	});
+}
+
+function placeCall() {
+	setStatus("Calling " + SIP_PEER + "…");
+	const tracks = [
+		{ type: "audio", capture: true, recv: true },
+		{ type: "video", capture: true, recv: true },
+	];
+	sipcall.createOffer({
+		tracks: tracks,
+		success: (jsep) => {
+			sipcall.send({
+				message: { request: "call", uri: SIP_PEER, autoaccept_reinvites: false },
+				jsep: jsep,
+			});
+		},
+		error: (err) => setStatus("createOffer failed: " + err),
+	});
+}
+
+// ============================================================================
+// Plugin event router
+// ============================================================================
+function handleMessage(msg, jsep) {
+	const result = msg && msg.result;
+	const event  = result && result.event;
+	if (event) log("event: " + event);
+
+	if (event === "registered") {
+		setStatus("Registered. Placing call…");
+		// Small delay to settle the registration
+		setTimeout(placeCall, 100);
+	}
+	else if (event === "calling") {
+		setStatus("Calling…");
+	}
+	else if (event === "accepted") {
+		setStatus("Call accepted. You should hear the IVR — enter PIN on the dialpad.");
+		startCallUi();
+		if (jsep) sipcall.handleRemoteJsep({ jsep: jsep });
+	}
+	else if (event === "hangup") {
+		setStatus("Call ended: " + (result.reason || result.code || ""));
+		endCallUi();
+	}
+	else if (event === "missed_call") {
+		setStatus("Missed call.");
+		endCallUi();
+	}
+	else if (event === "registration_failed") {
+		setStatus("Registration failed: " + result.code + " " + result.reason, true);
+	}
+	else if (msg && msg.error) {
+		setStatus("Plugin error: " + msg.error, true);
+	}
+
+	if (jsep && event !== "accepted") {
+		sipcall.handleRemoteJsep({ jsep: jsep });
+	}
+}
+
+// ============================================================================
+// In-call UI: mute, hangup, dialpad, PIN entry
+// ============================================================================
+function startCallUi() {
+	inCall = true;
+	$("pin-row").style.display = "flex";
+	$("pin-row").classList.remove("disabled");
+	$("dialpad").style.display = "grid";
+	$("dialpad").classList.remove("disabled");
+	$("hangupBtn").disabled = false;
+	$("rejoinBtn").style.display = "none";
+	// Auto-mute mic so two tabs on the same Mac don't feedback-howl.
+	if (sipcall.isAudioMuted && !sipcall.isAudioMuted()) {
+		sipcall.muteAudio();
+	}
+	updateMuteButton();
+	updateCameraButton();
+	updateSpeakerButton();
+}
+
+function endCallUi() {
+	inCall = false;
+	$("pin-row").style.display = "none";
+	$("pin-row").classList.remove("disabled");
+	$("dialpad").style.display = "none";
+	$("dialpad").classList.remove("disabled");
+	$("hangupBtn").disabled = true;
+	$("rejoinBtn").style.display = "inline-block";
+	$("remoteVideo").srcObject = null;
+	$("remoteAudio").srcObject = null;
+	$("noVideo").style.display = "flex";
+}
+
+function updateMuteButton() {
+	const b = $("muteBtn");
+	if (!sipcall || !sipcall.isAudioMuted) return;
+	if (sipcall.isAudioMuted()) {
+		b.textContent = "🔇 Mic muted";
+		b.className = "danger";
+	} else {
+		b.textContent = "🎤 Mic on";
+		b.className = "success";
+	}
+}
+
+function updateCameraButton() {
+	const b = $("cameraBtn");
+	if (!sipcall || !sipcall.isVideoMuted) return;
+	if (sipcall.isVideoMuted()) {
+		b.textContent = "📷 Camera off";
+		b.className = "danger";
+	} else {
+		b.textContent = "📷 Camera on";
+		b.className = "success";
+	}
+}
+
+function updateSpeakerButton() {
+	const b = $("speakerBtn");
+	const audio = $("remoteAudio");
+	if (audio.muted) {
+		b.textContent = "🔇 Speaker off";
+		b.className = "danger";
+	} else {
+		b.textContent = "🔊 Speaker on";
+		b.className = "success";
+	}
+}
+
+$("muteBtn").addEventListener("click", () => {
+	if (!sipcall) return;
+	if (sipcall.isAudioMuted()) sipcall.unmuteAudio();
+	else sipcall.muteAudio();
+	setTimeout(updateMuteButton, 50);
+});
+
+$("cameraBtn").addEventListener("click", () => {
+	if (!sipcall || !sipcall.muteVideo) return;
+	if (sipcall.isVideoMuted()) sipcall.unmuteVideo();
+	else sipcall.muteVideo();
+	setTimeout(updateCameraButton, 50);
+});
+
+$("speakerBtn").addEventListener("click", () => {
+	const audio = $("remoteAudio");
+	audio.muted = !audio.muted;
+	updateSpeakerButton();
+});
+
+$("hangupBtn").addEventListener("click", () => {
+	if (!sipcall) return;
+	sipcall.send({ message: { request: "hangup" } });
+	sipcall.hangup();
+});
+
+$("rejoinBtn").addEventListener("click", () => location.reload());
+
+// ============================================================================
+// DTMF — try the in-band RTP-event path first (RFC 4733 via the handle's
+// dtmf() method), which is what livekit-sip's IVR actually listens for.
+// Fall back to SIP INFO if RTP DTMF isn't available (older Janus, no
+// telephone-event in SDP, etc.).
+// ============================================================================
+function sendDtmf(digit) {
+	if (!sipcall || !inCall) return;
+	log("DTMF → " + digit);
+	let sent = false;
+	try {
+		if (typeof sipcall.dtmf === "function") {
+			sipcall.dtmf({
+				dtmf: { tones: String(digit), duration: 200, gap: 70 },
+				success: () => {},
+				error: (err) => log("dtmf() error: " + err, true),
+			});
+			sent = true;
+		}
+	} catch (e) {
+		log("dtmf() threw: " + e, true);
+	}
+	if (!sent) {
+		// Fallback: SIP INFO method
+		sipcall.send({
+			message: { request: "dtmf_info", digit: String(digit) },
+		});
+	}
+}
+
+document.querySelectorAll(".dialpad button").forEach(b => {
+	b.addEventListener("click", () => sendDtmf(b.dataset.d));
+});
+
+$("sendPin").addEventListener("click", () => {
+	const pin = $("pin").value.replace(/[^\d#*]/g, "");
+	if (!pin) return;
+	const tones = (pin.endsWith("#") ? pin : pin + "#");
+	log("DTMF batch → " + tones);
+	// Send all tones in ONE call. Per-digit looping with setTimeout races
+	// the WebRTC DTMF sender's internal queue and drops digits (we lost
+	// the trailing "0" before "#" doing it digit-by-digit). The browser's
+	// RTCDTMFSender paces them itself given duration/gap.
+	try {
+		sipcall.dtmf({
+			dtmf: { tones: tones, duration: 400, gap: 100 },
+			success: () => log("DTMF batch sent"),
+			error: (err) => log("dtmf() error: " + err, true),
+		});
+	} catch (e) {
+		log("dtmf() threw, falling back to SIP INFO per digit: " + e, true);
+		for (const ch of tones) {
+			sipcall.send({ message: { request: "dtmf_info", digit: String(ch) } });
+		}
+	}
+	$("pin").value = "";
+	// PIN + dialpad are no longer needed once you've submitted. Gateway
+	// either bridges you in (correct PIN) or hangs up with wrong-pin
+	// (the hangup event re-resets everything via endCallUi).
+	$("pin-row").classList.add("disabled");
+	$("dialpad").classList.add("disabled");
+});
+</script>
+</body>
+</html>

docs/examples/compose/keycloak/README.md

@@ -61,11 +61,10 @@ services:
 `docker compose up -d`
 ```
 
-Your keycloak instance is now available on https://doc.yourdomain.tld
+Your keycloak instance is now available on https://id.yourdomain.tld
 
 > [!CAUTION]
 > Version of the images are set to latest, you should pin it to the desired version to avoid unwanted upgrades when pulling latest image. You can find available versions on [Keycloak registry](https://quay.io/repository/keycloak/keycloak?tab=tags).
-```
 
 ## Creating an OIDC Client for Meet Application
 
@@ -76,7 +75,7 @@ Your keycloak instance is now available on https://doc.yourdomain.tld
 3. Enter the name of the realm  - `meet`.
 4. Click "Create".
 
-#### Step 2: Create a New Client
+### Step 2: Create a New Client
 
 1. Navigate to the "Clients" tab.
 2. Click on the "Create client" button.
@@ -86,7 +85,7 @@ Your keycloak instance is now available on https://doc.yourdomain.tld
 1. Set the "Web Origins" to the URL of your meet application - e.g. `https://meet.example.com`.
 1. Click "Save".
 
-#### Step 3: Get Client Credentials
+### Step 3: Get Client Credentials
 
 1. Go to the "Credentials" tab.
 2. Copy the client ID (`meet` in this example) and the client secret.

docs/examples/helm/meet.values.yaml

@@ -71,7 +71,7 @@ backend:
   # Extra volume to manage our local custom CA and avoid to set ssl_verify: false
   extraVolumeMounts:
     - name: certs
-      mountPath: /usr/local/lib/python3.12/site-packages/certifi/cacert.pem
+      mountPath: /app/.venv/lib/python3.13/site-packages/certifi/cacert.pem
       subPath: cacert.pem
 
   # Extra volume to manage our local custom CA and avoid to set ssl_verify: false

docs/openapi.yaml

@@ -190,6 +190,7 @@ paths:
         '403':
           $ref: '#/components/responses/ForbiddenError'
 
+  /rooms/:
     post:
       tags:
         - Rooms

docs/resource_server.yaml

@@ -113,6 +113,7 @@ paths:
         '403':
           $ref: '#/components/responses/ForbiddenError'
 
+  /rooms/:
     post:
       tags:
         - Rooms

env.d/development/common.dist

@@ -27,7 +27,8 @@ AWS_S3_DOMAIN_REPLACE=http://localhost:9000
 AWS_S3_ENDPOINT_URL=http://minio:9000
 AWS_S3_ACCESS_KEY_ID=meet
 AWS_S3_SECRET_ACCESS_KEY=password
-MEDIA_BASE_URL=http://localhost:8083
+MEDIA_BASE_URL=http://localhost:3000
+FILE_UPLOAD_ENABLED=True
 
 # OIDC
 OIDC_OP_JWKS_ENDPOINT=http://nginx:8083/realms/meet/protocol/openid-connect/certs

renovate.json

@@ -36,6 +36,12 @@
         "matchPackageNames": ["django"],
         "allowedVersions": "<6.0.0"
     },
+    {
+        "groupName": "allowed brevo versions",
+        "matchManagers": ["pep621"],
+        "matchPackageNames": ["brevo-python"],
+        "allowedVersions": "<3.0.0"
+    },
     {
       "enabled": false,
       "groupName": "ignored js dependencies",

src/agents/Dockerfile

@@ -4,8 +4,6 @@ FROM python:3.13-slim AS base
 RUN apt-get update && apt-get install -y \
     libglib2.0-0 \
     libgobject-2.0-0 \
-    "openssl=3.5.4-1~deb13u2" \
-    "libssl3t64=3.5.4-1~deb13u2" \
     && rm -rf /var/lib/apt/lists/*
 
 FROM base AS builder

src/agents/pyproject.toml

@@ -1,20 +1,20 @@
 
 [project]
 name = "agents"
-version = "1.10.0"
+version = "1.12.0"
 requires-python = ">=3.12"
 dependencies = [
-    "livekit-agents==1.3.10",
-    "livekit-plugins-deepgram==1.3.10",
-    "livekit-plugins-silero==1.3.10",
+    "livekit-agents==1.4.5",
+    "livekit-plugins-deepgram==1.4.5",
+    "livekit-plugins-silero==1.4.5",
     "livekit-plugins-kyutai-lasuite==0.0.6",
-    "python-dotenv==1.2.1",
+    "python-dotenv==1.2.2",
     "protobuf==6.33.5"
 ]
 
 [project.optional-dependencies]
 dev = [
-    "ruff==0.14.4",
+    "ruff==0.15.6",
 ]
 
 [build-system]

src/backend/core/admin.py

@@ -197,6 +197,38 @@ def resend_notification(modeladmin, request, queryset):  # pylint: disable=unuse
         )
 
 
+@admin.action(description=_("Mark selected recordings as 'Failed to Stop'"))
+def mark_as_failed_to_stop(modeladmin, request, queryset):
+    """Force selected recordings status to failed_to_stop."""
+
+    eligible_statuses = [
+        models.RecordingStatusChoices.ACTIVE,
+        models.RecordingStatusChoices.INITIATED,
+        models.RecordingStatusChoices.STOPPED,
+    ]
+
+    eligible = queryset.filter(status__in=eligible_statuses)
+    skipped = queryset.exclude(status__in=eligible_statuses).count()
+
+    updated = eligible.update(status=models.RecordingStatusChoices.FAILED_TO_STOP)
+
+    if updated > 0:
+        modeladmin.message_user(
+            request,
+            _("%(count)s recording(s) successfully marked as 'Failed to Stop'.")
+            % {"count": updated},
+            level=messages.SUCCESS,
+        )
+
+    if skipped > 0:
+        modeladmin.message_user(
+            request,
+            _("Skipped %(count)s recording(s) with an ineligible status.")
+            % {"count": skipped},
+            level=messages.WARNING,
+        )
+
+
 @admin.register(models.Recording)
 class RecordingAdmin(admin.ModelAdmin):
     """Recording admin interface declaration."""
@@ -224,7 +256,7 @@ class RecordingAdmin(admin.ModelAdmin):
         "updated_at",
         "worker_id",
     )
-    actions = [resend_notification]
+    actions = [resend_notification, mark_as_failed_to_stop]
 
     def get_queryset(self, request):
         """Optimize queries by prefetching related access and user data to avoid N+1 queries."""
@@ -276,7 +308,7 @@ class ApplicationAdmin(admin.ModelAdmin):
 
     form = ApplicationAdminForm
 
-    list_display = ("id", "name", "client_id", "get_scopes_display")
+    list_display = ("id", "name", "client_id", "get_scopes_display", "is_active")
     fields = [
         "name",
         "id",
@@ -285,6 +317,7 @@ class ApplicationAdmin(admin.ModelAdmin):
         "scopes",
         "client_id",
         "client_secret",
+        "is_active",
     ]
     readonly_fields = ["id", "created_at", "updated_at"]
     inlines = [ApplicationDomainInline]

src/backend/core/api/__init__.py

@@ -43,6 +43,21 @@ def get_frontend_configuration(request):
             "expiration_days": settings.RECORDING_EXPIRATION_DAYS,
             "max_duration": settings.RECORDING_MAX_DURATION,
         },
+        "background_image": {
+            "upload_is_enabled": settings.FILE_UPLOAD_ENABLED,
+            "max_count_by_user": settings.FILE_UPLOAD_RESTRICTIONS["background_image"][
+                "max_count_by_user"
+            ],
+            "max_size": settings.FILE_UPLOAD_RESTRICTIONS["background_image"][
+                "max_size"
+            ],
+            "allowed_extensions": settings.FILE_UPLOAD_RESTRICTIONS["background_image"][
+                "allowed_extensions"
+            ],
+            "allowed_mimetypes": settings.FILE_UPLOAD_RESTRICTIONS["background_image"][
+                "allowed_mimetypes"
+            ],
+        },
         "telephony": {
             "enabled": settings.ROOM_TELEPHONY_ENABLED,
             "phone_number": settings.ROOM_TELEPHONY_PHONE_NUMBER
@@ -58,5 +73,8 @@ def get_frontend_configuration(request):
             "default_sources": settings.LIVEKIT_DEFAULT_SOURCES,
         },
     }
+    frontend_configuration["encryption"] = {
+        "enabled": settings.ENCRYPTION_ENABLED,
+    }
     frontend_configuration.update(settings.FRONTEND_CONFIGURATION)
     return Response(frontend_configuration)

src/backend/core/api/feature_flag.py

@@ -13,6 +13,7 @@ class FeatureFlag:
         "recording": "RECORDING_ENABLE",
         "storage_event": "RECORDING_STORAGE_EVENT_ENABLE",
         "subtitle": "ROOM_SUBTITLE_ENABLED",
+        "file_upload": "FILE_UPLOAD_ENABLED",
     }
 
     @classmethod

src/backend/core/api/permissions.py

@@ -1,5 +1,6 @@
 """Permission handlers for the Meet core app."""
 
+from django.conf import settings
 from django.http import Http404
 
 from rest_framework import permissions
@@ -116,6 +117,13 @@ class FilePermission(IsAuthenticated):
     Handling soft deletions specificities
     """
 
+    def has_permission(self, request, view):
+        """Allow access only to authenticated users."""
+        if not settings.FILE_UPLOAD_ENABLED:
+            raise Http404
+
+        return super().has_permission(request, view)
+
     def has_object_permission(self, request, view, obj):
         """
         Return a 404 on deleted files or if the user is not the owner

src/backend/core/api/serializers.py

@@ -13,7 +13,7 @@ from django.core.exceptions import SuspiciousOperation
 from django.utils.translation import gettext_lazy as _
 
 from django_pydantic_field.rest_framework import SchemaField
-from pydantic import BaseModel, Field, ValidationError
+from pydantic import BaseModel, Field
 from rest_framework import serializers
 from rest_framework.exceptions import PermissionDenied
 from timezone_field.rest_framework import TimeZoneSerializerField
@@ -30,8 +30,17 @@ class UserSerializer(serializers.ModelSerializer):
 
     class Meta:
         model = models.User
-        fields = ["id", "email", "full_name", "short_name", "timezone", "language"]
-        read_only_fields = ["id", "email", "full_name", "short_name"]
+        fields = [
+            "id",
+            "sub",
+            "email",
+            "full_name",
+            "short_name",
+            "timezone",
+            "language",
+            "default_encryption",
+        ]
+        read_only_fields = ["id", "sub", "email", "full_name", "short_name"]
 
 
 class UserLightSerializer(serializers.ModelSerializer):
@@ -74,6 +83,7 @@ class ResourceAccessSerializerMixin:
             raise PermissionDenied(
                 "Only owners of a room can assign other users as owners."
             )
+
         return data
 
     def validate_resource(self, resource):
@@ -123,37 +133,49 @@ class ListRoomSerializer(serializers.ModelSerializer):
         read_only_fields = ["id", "slug"]
 
 
-class RoomConfiguration(BaseModel):
-    """Wip"""
-
-    can_publish_sources: list[Literal[
-        "microphone", "screen_share", "screen_share_audio", "camera"
-    ]] | None = None
-
-    model_config = {"extra": "forbid"}
-
-
 class RoomSerializer(serializers.ModelSerializer):
     """Serialize Room model for the API."""
 
     class Meta:
         model = models.Room
-        fields = ["id", "name", "slug", "configuration", "access_level", "pin_code"]
+        fields = [
+            "id",
+            "name",
+            "slug",
+            "configuration",
+            "access_level",
+            "pin_code",
+            "is_encrypted",
+            "encryption_paused",
+        ]
         read_only_fields = ["id", "slug", "pin_code"]
 
-    def validate_configuration(self, configuration):
-        """Wip."""
-
-        if configuration is None:
-            return configuration
-
-        try:
-            RoomConfiguration.model_validate(configuration)
-        except ValidationError as e:
-            raise SuspiciousOperation("Wip, invalid room configuration")
-
-        return configuration
+    def validate_is_encrypted(self, value):
+        """is_encrypted is set at creation and is part of the link's identity
+        (copy-link always carries the hash for an encrypted room). Mid-call
+        toggling is done via encryption_paused, not by mutating this flag."""
+        instance = self.instance
+        if instance and instance.is_encrypted != value:
+            raise serializers.ValidationError(
+                "Encryption mode cannot be changed after room creation. "
+                "Use encryption_paused to temporarily suspend encryption."
+            )
+        return value
 
+    def validate_encryption_paused(self, value):
+        """encryption_paused only makes sense on encrypted rooms. Allow either
+        direction (True ↔ False) post-creation: admins suspend E2EE so a
+        SIP/device caller can join, then resume once they hang up."""
+        is_encrypted = (
+            self.instance.is_encrypted
+            if self.instance is not None
+            else self.initial_data.get("is_encrypted", False)
+        )
+        if value and not is_encrypted:
+            raise serializers.ValidationError(
+                "Cannot pause encryption on a non-encrypted room."
+            )
+        return value
 
     def to_representation(self, instance):
         """
@@ -196,6 +218,7 @@ class RoomSerializer(serializers.ModelSerializer):
         if should_access_room:
             room_id = f"{instance.id!s}"
             username = request.query_params.get("username", None)
+
             output["livekit"] = utils.generate_livekit_config(
                 room_id=room_id,
                 user=request.user,
@@ -289,7 +312,7 @@ class StartRecordingSerializer(BaseValidationOnlySerializer):
 class RequestEntrySerializer(BaseValidationOnlySerializer):
     """Validate request entry data."""
 
-    username = serializers.CharField(required=True)
+    username = serializers.CharField(required=True, allow_blank=True)
 
 
 class ParticipantEntrySerializer(BaseValidationOnlySerializer):
@@ -327,6 +350,9 @@ class MuteParticipantSerializer(BaseParticipantsManagementSerializer):
     )
 
 
+TrackSource = Literal["SCREEN_SHARE", "SCREEN_SHARE_AUDIO", "CAMERA", "MICROPHONE"]
+
+
 class ParticipantPermission(BaseModel):
     """Mirror the LiveKit ParticipantPermission protobuf.
 
@@ -337,9 +363,7 @@ class ParticipantPermission(BaseModel):
     can_subscribe: bool | None = None
     can_publish: bool | None = None
     can_publish_data: bool | None = None
-    can_publish_sources: list[int] = Field(
-        default_factory=list
-    )  # TrackSource enum values
+    can_publish_sources: list[TrackSource] = Field(default_factory=list)
     hidden: bool | None = None
     recorder: bool | None = None
     can_update_metadata: bool | None = None
@@ -390,14 +414,6 @@ class UpdateParticipantSerializer(BaseParticipantsManagementSerializer):
                 f"Setting the following participant permissions is not allowed: "
                 f"{', '.join(suspicious_fields)}."
             )
-        if permission.can_subscribe_metrics is not None:
-            raise serializers.ValidationError(
-                {
-                    "permission": {
-                        "can_subscribe_metrics": "This permission is not implemented."
-                    }
-                }
-            )
 
         return permission
 

src/backend/core/api/viewsets.py

@@ -1,7 +1,6 @@
 """API endpoints"""
 # pylint: disable=too-many-lines
 
-import re
 import uuid
 from logging import getLogger
 from urllib.parse import unquote, urlparse
@@ -12,6 +11,7 @@ from django.db.models import Q
 from django.http import Http404
 from django.shortcuts import get_object_or_404
 from django.utils.text import slugify
+from django.utils.translation import gettext_lazy as _
 
 from django_filters import rest_framework as django_filters
 from rest_framework import (
@@ -33,10 +33,12 @@ from rest_framework import (
 
 from core import enums, models, utils
 from core.api.filters import ListFileFilter
+from core.enums import MEDIA_STORAGE_URL_PATTERN
 from core.recording.enums import FileExtension
 from core.recording.event.authentication import StorageEventAuthentication
 from core.recording.event.exceptions import (
     InvalidBucketError,
+    InvalidFilepathError,
     InvalidFileTypeError,
     ParsingEventDataError,
 )
@@ -78,17 +80,6 @@ from .feature_flag import FeatureFlag
 logger = getLogger(__name__)
 
 
-FILE_FOLDER = settings.FILE_UPLOAD_PATH
-UUID_REGEX = (
-    r"[a-fA-F0-9]{8}-[a-fA-F0-9]{4}-[a-fA-F0-9]{4}-[a-fA-F0-9]{4}-[a-fA-F0-9]{12}"
-)
-FILE_EXT_REGEX = r"[\d\w]+"
-MEDIA_STORAGE_URL_PATTERN = re.compile(
-    f"{settings.MEDIA_URL:s}"
-    rf"(?P<key>{FILE_FOLDER:s}/(?P<pk>{UUID_REGEX:s})/\.{FILE_EXT_REGEX:s})$"
-)
-
-
 class NestedGenericViewSet(viewsets.GenericViewSet):
     """
     A generic Viewset aims to be used in a nested route context.
@@ -290,6 +281,14 @@ class RoomViewSet(
 
     def perform_create(self, serializer):
         """Set the current user as owner of the newly created room."""
+        is_encrypted = serializer.validated_data.get("is_encrypted", False)
+
+        # Block encrypted room creation if encryption is not enabled on this instance
+        if is_encrypted and not settings.ENCRYPTION_ENABLED:
+            raise drf_exceptions.ValidationError(
+                {"is_encrypted": "Encryption is not enabled on this server."}
+            )
+
         room = serializer.save()
         models.ResourceAccess.objects.create(
             resource=room,
@@ -315,8 +314,16 @@ class RoomViewSet(
         serializer = serializers.StartRecordingSerializer(data=request.data)
 
         if not serializer.is_valid():
+            print(
+                "[start-recording] body=",
+                request.data,
+                "errors=",
+                serializer.errors,
+                flush=True,
+            )
             return drf_response.Response(
-                {"detail": "Invalid request."}, status=drf_status.HTTP_400_BAD_REQUEST
+                {"detail": "Invalid request.", "errors": serializer.errors},
+                status=drf_status.HTTP_400_BAD_REQUEST,
             )
 
         mode = serializer.validated_data["mode"]
@@ -405,12 +412,14 @@ class RoomViewSet(
         serializer.is_valid(raise_exception=True)
 
         room = self.get_object()
+        validated_data = serializer.validated_data
+
         lobby_service = LobbyService()
 
         participant, livekit = lobby_service.request_entry(
             room=room,
             request=request,
-            **serializer.validated_data,
+            **validated_data,
         )
         response = drf_response.Response({**participant.to_dict(), "livekit": livekit})
         lobby_service.prepare_response(response, participant.id)
@@ -473,6 +482,7 @@ class RoomViewSet(
         lobby_service = LobbyService()
 
         participants = lobby_service.list_waiting_participants(room.id)
+
         return drf_response.Response({"participants": participants})
 
     @decorators.action(
@@ -497,9 +507,7 @@ class RoomViewSet(
             if status_code == drf_status.HTTP_500_INTERNAL_SERVER_ERROR:
                 raise e
 
-            return drf_response.Response(
-                {"status": "error", "message": str(e)}, status=status_code
-            )
+            return drf_response.Response({"status": "error"}, status=status_code)
 
     @decorators.action(
         detail=False,
@@ -766,14 +774,19 @@ class RecordingViewSet(
             recording_id = parser.get_recording_id(request.data)
 
         except ParsingEventDataError as e:
-            raise drf_exceptions.PermissionDenied(f"Invalid request data: {e}") from e
+            raise drf_exceptions.PermissionDenied("Invalid request data.") from e
 
         except InvalidBucketError as e:
-            raise drf_exceptions.PermissionDenied("Invalid bucket specified") from e
+            raise drf_exceptions.PermissionDenied("Invalid bucket specified.") from e
 
-        except InvalidFileTypeError as e:
+        except InvalidFilepathError:
             return drf_response.Response(
-                {"message": f"Ignore this file type, {e}"},
+                {"message": "Notification ignored."},
+            )
+
+        except InvalidFileTypeError:
+            return drf_response.Response(
+                {"message": "Notification ignored."},
             )
 
         try:
@@ -973,6 +986,26 @@ class FileViewSet(
 
     def perform_create(self, serializer):
         """Set the current user as creator of the newly created file."""
+
+        if settings.FILE_UPLOAD_APPLY_RESTRICTIONS:
+            file_type = serializer.validated_data["type"]
+            config_for_file_type = settings.FILE_UPLOAD_RESTRICTIONS[file_type]
+
+            count = models.File.objects.filter(
+                creator=self.request.user,
+                deleted_at__isnull=True,
+                type=file_type,
+            ).count()
+
+            if count >= config_for_file_type["max_count_by_user"]:
+                logger.info(
+                    "create_item: user reached max files per user for type %s",
+                    file_type,
+                )
+                raise serializers.PermissionDenied(
+                    _("You have reached the maximum number of files for this type.")
+                )
+
         serializer.save(creator=self.request.user)
 
     def perform_destroy(self, instance):
@@ -980,6 +1013,7 @@ class FileViewSet(
         instance.soft_delete()
 
     @decorators.action(detail=True, methods=["post"], url_path="upload-ended")
+    @FeatureFlag.require("file_upload")
     def upload_ended(self, request, *args, **kwargs):
         """
         Check the actual uploaded file and mark it as ready.
@@ -1162,6 +1196,7 @@ class FileViewSet(
         return url_params, request.user.id, file
 
     @decorators.action(detail=False, methods=["get"], url_path="media-auth")
+    @FeatureFlag.require("file_upload")
     def media_auth(self, request, *args, **kwargs):
         """
         This view is used by an Nginx subrequest to control access to an file's

src/backend/core/enums.py

@@ -14,9 +14,15 @@ FILE_EXT_REGEX = r"[a-zA-Z0-9]{1,10}"
 
 # pylint: disable=line-too-long
 RECORDING_STORAGE_URL_PATTERN = re.compile(
-    f"/media/{settings.RECORDING_OUTPUT_FOLDER}/(?P<recording_id>{UUID_REGEX:s}).(?P<extension>{FILE_EXT_REGEX:s})"
+    rf"{settings.MEDIA_URL:s}{settings.RECORDING_OUTPUT_FOLDER}/(?P<recording_id>{UUID_REGEX:s})\.(?P<extension>{FILE_EXT_REGEX:s})"
 )
 
+MEDIA_STORAGE_URL_PATTERN = re.compile(
+    f"{settings.MEDIA_URL:s}"
+    rf"(?P<key>{settings.FILE_UPLOAD_PATH:s}/(?P<pk>{UUID_REGEX:s})\.{FILE_EXT_REGEX:s})$"
+)
+
+
 # Django sets `LANGUAGES` by default with all supported languages. We can use it for
 # the choice of languages which should not be limited to the few languages active in
 # the app.

src/backend/core/external_api/authentication.py

@@ -203,7 +203,7 @@ class ApplicationJWTAuthentication(BaseJWTAuthentication):
             logger.warning("Application not found: %s", client_id)
             raise exceptions.AuthenticationFailed("Application not found.") from e
 
-        if not application.active:
+        if not application.is_active:
             logger.warning(
                 "Inactive application attempted authentication: %s", client_id
             )

src/backend/core/external_api/viewsets.py

@@ -61,12 +61,12 @@ class ApplicationViewSet(viewsets.ViewSet):
         except models.Application.DoesNotExist as e:
             raise drf_exceptions.AuthenticationFailed("Invalid credentials") from e
 
-        if not application.active:
-            raise drf_exceptions.AuthenticationFailed("Application is inactive")
-
         if not check_password(client_secret, application.client_secret):
             raise drf_exceptions.AuthenticationFailed("Invalid credentials")
 
+        if not application.is_active:
+            raise drf_exceptions.AuthenticationFailed("Application is inactive")
+
         email = serializer.validated_data["scope"]
         try:
             validate_email(email)

src/backend/core/factories.py

@@ -129,7 +129,7 @@ class ApplicationFactory(factory.django.DjangoModelFactory):
         model = models.Application
 
     name = factory.Faker("company")
-    active = True
+    is_active = True
     client_id = factory.LazyFunction(utils.generate_client_id)
     client_secret = factory.LazyFunction(utils.generate_client_secret)
     scopes = []

src/backend/core/migrations/0018_rename_active_application_is_active.py

@@ -0,0 +1,18 @@
+# Generated by Django 5.2.12 on 2026-03-11 14:39
+
+from django.db import migrations
+
+
+class Migration(migrations.Migration):
+
+    dependencies = [
+        ('core', '0017_file'),
+    ]
+
+    operations = [
+        migrations.RenameField(
+            model_name='application',
+            old_name='active',
+            new_name='is_active',
+        ),
+    ]

src/backend/core/migrations/0019_room_is_encrypted_user_default_encryption.py

@@ -0,0 +1,36 @@
+"""Add Room.is_encrypted and User.default_encryption.
+
+`is_encrypted` is a boolean for now because passphrase-in-URL is the only
+supported mode. A future migration may turn it into a CharField/enum if a
+local-keys (vault) mode is reintroduced.
+"""
+
+from django.db import migrations, models
+
+
+class Migration(migrations.Migration):
+
+    dependencies = [
+        ("core", "0018_rename_active_application_is_active"),
+    ]
+
+    operations = [
+        migrations.AddField(
+            model_name="room",
+            name="is_encrypted",
+            field=models.BooleanField(
+                default=False,
+                help_text="Whether end-to-end encryption is enabled for this room.",
+                verbose_name="Encryption enabled",
+            ),
+        ),
+        migrations.AddField(
+            model_name="user",
+            name="default_encryption",
+            field=models.BooleanField(
+                default=False,
+                help_text="Whether new meetings created by this user are end-to-end encrypted by default.",
+                verbose_name="Default to end-to-end encryption",
+            ),
+        ),
+    ]

src/backend/core/migrations/0020_room_encryption_paused.py

@@ -0,0 +1,18 @@
+# Generated by Django 5.2.12 on 2026-05-12 08:33
+
+from django.db import migrations, models
+
+
+class Migration(migrations.Migration):
+
+    dependencies = [
+        ('core', '0019_room_is_encrypted_user_default_encryption'),
+    ]
+
+    operations = [
+        migrations.AddField(
+            model_name='room',
+            name='encryption_paused',
+            field=models.BooleanField(default=False, help_text='Temporarily suspend E2EE so external devices can join.', verbose_name='Encryption paused'),
+        ),
+    ]

src/backend/core/models.py

@@ -200,6 +200,14 @@ class User(AbstractBaseUser, BaseModel, auth_models.PermissionsMixin):
             "Unselect this instead of deleting accounts."
         ),
     )
+    default_encryption = models.BooleanField(
+        _("Default to end-to-end encryption"),
+        default=False,
+        help_text=_(
+            "Whether new meetings created by this user are "
+            "end-to-end encrypted by default."
+        ),
+    )
 
     objects = auth_models.UserManager()
 
@@ -388,6 +396,25 @@ class Room(Resource):
         choices=RoomAccessLevel.choices,
         default=settings.RESOURCE_DEFAULT_ACCESS_LEVEL,
     )
+    # Boolean for now: today the only encryption mode is the passphrase-in-URL
+    # one. If a follow-up adds a stronger "local-keys" mode (private keys held
+    # in a vault iframe), this can grow into a CharField with choices like
+    # `none / passphrase / local_keys`. Set at creation; never mutated after —
+    # changing it would change the link's semantics (copy-link / hash carry).
+    is_encrypted = models.BooleanField(
+        default=False,
+        verbose_name=_("Encryption enabled"),
+        help_text=_("Whether end-to-end encryption is enabled for this room."),
+    )
+    # Mid-call admin override: when True on an `is_encrypted` room, the active
+    # encryption is suspended so a phone/SIP/device caller can join in plaintext.
+    # The link still carries the hash; toggling back to False resumes E2EE.
+    # Always False on non-encrypted rooms (enforced by the serializer).
+    encryption_paused = models.BooleanField(
+        default=False,
+        verbose_name=_("Encryption paused"),
+        help_text=_("Temporarily suspend E2EE so external devices can join."),
+    )
     configuration = models.JSONField(
         blank=True,
         default=dict,
@@ -413,13 +440,44 @@ class Room(Resource):
         return capfirst(self.name)
 
     def save(self, *args, **kwargs):
-        """Generate a unique n-digit pin code for new rooms."""
         if settings.ROOM_TELEPHONY_ENABLED and not self.pk and not self.pin_code:
             self.pin_code = self.generate_unique_pin_code(
                 length=settings.ROOM_TELEPHONY_PIN_LENGTH
             )
+
+        previous = None
+        if self.pk:
+            try:
+                previous = Room.objects.only(
+                    "is_encrypted", "encryption_paused"
+                ).get(pk=self.pk)
+            except Room.DoesNotExist:
+                previous = None
+
         super().save(*args, **kwargs)
 
+        # Sync encryption state to LiveKit room metadata so the SIP gateway can
+        # decide between bridge mode and placeholder mode. Best-effort: if no
+        # LiveKit room exists yet, the call is a no-op.
+        encryption_changed = previous is None or (
+            previous.is_encrypted != self.is_encrypted
+            or previous.encryption_paused != self.encryption_paused
+        )
+        if encryption_changed:
+            try:
+                from core import utils as core_utils  # local import: avoid cycle
+
+                core_utils.update_room_metadata(
+                    room_name=str(self.pk),
+                    metadata={
+                        "is_encrypted": bool(self.is_encrypted),
+                        "encryption_paused": bool(self.encryption_paused),
+                    },
+                )
+            except Exception:  # pylint: disable=broad-except
+                # Metadata sync is advisory — never break Room.save() over it.
+                pass
+
     def clean_fields(self, exclude=None):
         """
         Automatically generate the slug from the name and make sure it does not look like a UUID.
@@ -759,7 +817,7 @@ class Application(BaseModel):
         verbose_name=_("Application name"),
         help_text=_("Descriptive name for this application."),
     )
-    active = models.BooleanField(default=True)
+    is_active = models.BooleanField(default=True)
     client_id = models.CharField(
         max_length=100, unique=True, default=utils.generate_client_id
     )
@@ -952,7 +1010,7 @@ class File(BaseModel):
         _, extension = splitext(self.filename)
         # We store only the extension in the storage system to avoid
         # leaking Personal Information in logs, etc.
-        return f"{self.key_base}/{extension!s}"
+        return f"{self.key_base}{extension!s}"
 
     def get_abilities(self, user):
         """

src/backend/core/recording/event/parsers.py

@@ -9,6 +9,8 @@ from typing import Any, Dict, Optional, Protocol
 from django.conf import settings
 from django.utils.module_loading import import_string
 
+from core.enums import FILE_EXT_REGEX, UUID_REGEX
+
 from .exceptions import (
     InvalidBucketError,
     InvalidFilepathError,
@@ -86,7 +88,7 @@ class MinioParser:
 
         # pylint: disable=line-too-long
         self._filepath_regex = re.compile(
-            r"(?P<url_encoded_folder_path>(?:[^%]+%2F)+)?(?P<recording_id>[0-9a-fA-F\-]{36})\.(?P<extension>[a-zA-Z0-9]+)"
+            rf"(?P<url_encoded_folder_path>(?:[^%]+%2F)+)?{settings.RECORDING_OUTPUT_FOLDER}%2F(?P<recording_id>{UUID_REGEX})\.(?P<extension>{FILE_EXT_REGEX})"
         )
 
     @staticmethod

src/backend/core/services/invitation.py

@@ -4,7 +4,7 @@ import smtplib
 from logging import getLogger
 
 from django.conf import settings
-from django.core.mail import send_mail
+from django.core.mail import EmailMultiAlternatives
 from django.template.loader import render_to_string
 from django.utils.translation import get_language, override
 from django.utils.translation import gettext_lazy as _
@@ -45,15 +45,18 @@ class InvitationService:
                 )
             )  # Force translation
 
+            email = EmailMultiAlternatives(
+                subject=subject,
+                body=msg_plain,
+                from_email=settings.EMAIL_FROM,
+                to=[],
+                bcc=emails,
+            )
+
+            email.attach_alternative(msg_html, "text/html")
+
             try:
-                send_mail(
-                    subject,
-                    msg_plain,
-                    settings.EMAIL_FROM,
-                    emails,
-                    html_message=msg_html,
-                    fail_silently=False,
-                )
+                email.send()
             except smtplib.SMTPException as e:
-                logger.error("invitation to %s was not sent: %s", emails, e)
+                logger.error("invitations were not sent: %s", e)
                 raise InvitationError("Could not send invitation") from e

src/backend/core/services/livekit_events.py

@@ -18,6 +18,10 @@ from core.recording.services.recording_events import (
 )
 
 from .lobby import LobbyService
+from .participants_management import (
+    ParticipantsManagement,
+    ParticipantsManagementException,
+)
 from .telephony import TelephonyException, TelephonyService
 
 logger = getLogger(__name__)
@@ -185,6 +189,72 @@ class LiveKitEventsService:
                     f"Failed to process limit reached event for recording {recording}"
                 ) from e
 
+    def _handle_participant_joined(self, data):
+        """Handle 'participant_joined' event.
+
+        When a SIP/phone participant joins an end-to-end encrypted room they
+        cannot decrypt anything. We:
+          1. Send an in-band notification so admins see a snackbar with an
+             "Open settings" CTA.
+          2. Leave the participant connected — the gateway is responsible for
+             holding them on a placeholder prompt loop ("this meeting is
+             encrypted, ask the host to disable it") until either the admin
+             turns encryption off (we update LiveKit room metadata, gateway
+             reacts) or the user hangs up.
+
+        See README "Phone / SIP participants" for the full flow.
+        """
+
+        participant = getattr(data, "participant", None)
+        if participant is None:
+            return
+
+        # LiveKit ParticipantInfo.Kind: 0 = STANDARD, 1 = INGRESS, 2 = EGRESS,
+        # 3 = SIP, 4 = AGENT. We treat both SIP and INGRESS as "external
+        # device that can't run our E2EE code".
+        kind = getattr(participant, "kind", 0)
+        is_external_device = kind in (1, 3)
+        if not is_external_device:
+            return
+
+        try:
+            room_id = uuid.UUID(data.room.name)
+        except ValueError:
+            return
+
+        try:
+            room = models.Room.objects.get(id=room_id)
+        except models.Room.DoesNotExist:
+            return
+
+        # Live encryption: is_encrypted set AND not currently paused.
+        # If the admin has already paused encryption, the gateway will bridge
+        # the call normally — no need to surface a blocked notification.
+        if not room.is_encrypted or room.encryption_paused:
+            return
+
+        # 1. Broadcast a system notice — frontends decode this on the
+        #    "encryption-state" or notifications channel and show a snackbar.
+        try:
+            utils.notify_participants(
+                room_name=str(room_id),
+                notification_data={
+                    "type": "external_device_blocked",
+                    "participant_identity": participant.identity,
+                    "participant_name": participant.name or participant.identity,
+                },
+            )
+        except utils.NotificationError:
+            logger.exception(
+                "Failed to notify room about blocked external device"
+            )
+
+        # No eject. The gateway reads LiveKit room metadata
+        # (`{is_encrypted, encryption_paused}` — see `Room.save()`) and stays
+        # in placeholder-prompt mode for the SIP leg as long as encryption is
+        # live. When the admin sets encryption_paused=true, the gateway
+        # transitions to a normal bridge without dropping the call.
+
     def _handle_room_started(self, data):
         """Handle 'room_started' event."""
 
@@ -202,6 +272,22 @@ class LiveKitEventsService:
         except models.Room.DoesNotExist as err:
             raise ActionFailedError(f"Room with ID {room_id} does not exist") from err
 
+        # Now that the LiveKit room object exists, push the encryption flags
+        # into its metadata so the SIP gateway can read them as soon as a SIP
+        # caller joins. Room.save() also tries this on every change, but at
+        # *creation* time the LiveKit room didn't exist yet — this is the
+        # first reliable opportunity.
+        try:
+            utils.update_room_metadata(
+                str(room_id),
+                {
+                    "is_encrypted": bool(room.is_encrypted),
+                    "encryption_paused": bool(room.encryption_paused),
+                },
+            )
+        except utils.MetadataUpdateException as e:
+            logger.exception("Failed to seed encryption metadata: %s", e)
+
         if settings.ROOM_TELEPHONY_ENABLED:
             try:
                 self.telephony_service.create_dispatch_rule(room)

src/backend/core/services/lobby.py

@@ -46,14 +46,18 @@ class LobbyParticipant:
     username: str
     color: str
     id: str
+    # Whether the user signed in (e.g. via ProConnect). Surfaced to admins so
+    # they can decide whether to accept self-declared identities.
+    is_authenticated: bool = False
 
-    def to_dict(self) -> Dict[str, str]:
+    def to_dict(self) -> Dict[str, object]:
         """Serialize the participant object to a dict representation."""
         return {
             "status": self.status.value,
             "username": self.username,
             "id": self.id,
             "color": self.color,
+            "is_authenticated": self.is_authenticated,
         }
 
     @classmethod
@@ -68,6 +72,7 @@ class LobbyParticipant:
                 username=data["username"],
                 id=data["id"],
                 color=data["color"],
+                is_authenticated=bool(data.get("is_authenticated", False)),
             )
         except (KeyError, ValueError) as e:
             logger.exception("Error creating Participant from dict:")
@@ -99,7 +104,7 @@ class LobbyService:
                 key=settings.LOBBY_COOKIE_NAME,
                 value=participant_id,
                 httponly=True,
-                secure=True,
+                secure=not settings.DEBUG,
                 samesite="Lax",
             )
 
@@ -152,6 +157,7 @@ class LobbyService:
                     username=username,
                     id=participant_id,
                     color=utils.generate_color(participant_id),
+                    is_authenticated=request.user.is_authenticated,
                 )
             else:
                 participant.status = LobbyParticipantStatus.ACCEPTED
@@ -170,13 +176,17 @@ class LobbyService:
         livekit_config = None
 
         if participant is None:
-            participant = self.enter(room.id, participant_id, username)
+            participant = self.enter(
+                room.id,
+                participant_id,
+                username,
+                is_authenticated=request.user.is_authenticated,
+            )
 
         elif participant.status == LobbyParticipantStatus.WAITING:
             self.refresh_waiting_status(room.id, participant_id)
 
         elif participant.status == LobbyParticipantStatus.ACCEPTED:
-            # wrongly named, contains access token to join a room
             livekit_config = utils.generate_livekit_config(
                 room_id=room_id,
                 user=request.user,
@@ -201,7 +211,11 @@ class LobbyService:
         )
 
     def enter(
-        self, room_id: UUID, participant_id: str, username: str
+        self,
+        room_id: UUID,
+        participant_id: str,
+        username: str,
+        is_authenticated: bool = False,
     ) -> LobbyParticipant:
         """Add participant to waiting lobby.
 
@@ -216,6 +230,7 @@ class LobbyService:
             username=username,
             id=participant_id,
             color=color,
+            is_authenticated=is_authenticated,
         )
 
         try:

src/backend/core/tests/files/test_api_files_create.py

@@ -118,7 +118,7 @@ def test_api_files_create_file_authenticated_success():
 
     assert policy_parsed.scheme == "http"
     assert policy_parsed.netloc == "localhost:9000"
-    assert policy_parsed.path == f"/meet-media-storage/files/{file.id!s}/.png"
+    assert policy_parsed.path == f"/meet-media-storage/files/{file.id!s}.png"
 
     query_params = parse_qs(policy_parsed.query)
 
@@ -174,6 +174,26 @@ def test_api_files_create_file_authenticated_extension_case_insensitive():
     assert file.title == "file"
 
 
+def test_api_files_create_file_disabled(settings):
+    """
+    Creating a file is denied if file upload is disabled
+    """
+    settings.FILE_UPLOAD_ENABLED = False
+    user = factories.UserFactory()
+    client = APIClient()
+    client.force_login(user)
+    response = client.post(
+        "/api/v1.0/files/",
+        {
+            "type": FileTypeChoices.BACKGROUND_IMAGE,
+            "filename": "file.JPG",
+        },
+        format="json",
+    )
+    assert response.status_code == 404
+    assert not File.objects.exists()
+
+
 def test_api_files_create_file_authenticated_not_checking_extension(settings):
     """
     Creating a file with an extension not allowed should not fail when restrictions are disabled.
@@ -239,6 +259,48 @@ def test_api_files_create_file_authenticated_hidden_file_but_checking_extension_
     assert response.json() == {"filename": ["This file extension is not allowed."]}
 
 
+def test_api_files_create_file_too_many(
+    settings,
+):
+    """
+    Creating a file is forbidden if above user limit.
+    """
+    settings.FILE_UPLOAD_APPLY_RESTRICTIONS = True
+    settings.FILE_UPLOAD_RESTRICTIONS = {
+        "background_image": {
+            **settings.FILE_UPLOAD_RESTRICTIONS["background_image"],
+            "max_count_by_user": 1,
+        },
+    }
+
+    user = factories.UserFactory()
+    client = APIClient()
+    client.force_login(user)
+    response = client.post(
+        "/api/v1.0/files/",
+        {
+            "type": FileTypeChoices.BACKGROUND_IMAGE,
+            "filename": "1.png",
+        },
+    )
+
+    assert response.status_code == 201
+
+    response = client.post(
+        "/api/v1.0/files/",
+        {
+            "type": FileTypeChoices.BACKGROUND_IMAGE,
+            "filename": "2.png",
+        },
+    )
+
+    assert response.status_code == 403
+    assert response.json() == {
+        "detail": "You have reached the maximum number of files for this type."
+    }
+    assert File.objects.count() == 1
+
+
 def test_api_files_create_force_id_success():
     """It should be possible to force the item ID when creating a   item."""
     user = factories.UserFactory()

src/backend/core/tests/files/test_api_files_update.py

@@ -39,7 +39,7 @@ def test_api_files_update_anonymous_forbidden():
 
 def test_api_files_update_description_and_title():
     """
-    Test the description and title of an file can be updated.
+    Test the description and title of a file can be updated.
     """
     user = factories.UserFactory()
 

src/backend/core/tests/recording/event/test_parsers.py

@@ -32,7 +32,7 @@ def valid_minio_event():
                 "s3": {
                     "bucket": {"name": "test-bucket"},
                     "object": {
-                        "key": "recording%2F46d1a121-2426-484d-8fb3-09b5d886f7a8.ogg",
+                        "key": "recordings%2F46d1a121-2426-484d-8fb3-09b5d886f7a8.ogg",
                         "contentType": "audio/ogg",
                     },
                 }
@@ -51,7 +51,7 @@ def test_parse_valid_event(minio_parser, valid_minio_event):
     """Test parsing a valid Minio event."""
     event = minio_parser.parse(valid_minio_event)
     assert isinstance(event, StorageEvent)
-    assert event.filepath == "recording%2F46d1a121-2426-484d-8fb3-09b5d886f7a8.ogg"
+    assert event.filepath == "recordings%2F46d1a121-2426-484d-8fb3-09b5d886f7a8.ogg"
     assert event.filetype == "audio/ogg"
     assert event.bucket_name == "test-bucket"
     assert event.metadata is None
@@ -130,11 +130,13 @@ def test_validate_invalid_filetype(minio_parser):
     "invalid_filepath",
     [
         "invalid_filepath",  # totally invalid string
-        "recording/46d1a121-2426-484d-8fb3-09b5d886f7a8.ogg",
-        "recording/46d1a121-2426-484d-8fb3-09b5d886f7a8",  # missing extension
+        "recordings/46d1a121-2426-484d-8fb3-09b5d886f7a8.ogg",
+        "recordings/46d1a121-2426-484d-8fb3-09b5d886f7a8",  # missing extension
         "46d1a121-2426-484d-8fb3-09b5d886f7a8",  # missing url_encoded_folder_path and extension
         "",  # empty string
-        "recording%2F46d1a1212426484d8fb309b5d886f7a8.ogg",
+        "46d1a121-2426-484d-8fb3-09b5d886f7a8.ogg",  # no folder at all
+        "uploads%2F46d1a121-2426-484d-8fb3-09b5d886f7a8.ogg",  # wrong folder name
+        "folder%2Fuploads%2F46d1a121-2426-484d-8fb3-09b5d886f7a8.ogg",  # nested but no recordings/
     ],
 )
 def test_validate_invalid_filepath(invalid_filepath, minio_parser):
@@ -152,7 +154,7 @@ def test_validate_invalid_filepath(invalid_filepath, minio_parser):
 def test_validate_valid_event(minio_parser):
     """Test validation with valid event data."""
     event = StorageEvent(
-        filepath="recording%2F46d1a121-2426-484d-8fb3-09b5d886f7a8.ogg",
+        filepath="recordings%2F46d1a121-2426-484d-8fb3-09b5d886f7a8.ogg",
         filetype="audio/ogg",
         bucket_name="test-bucket",
         metadata=None,
@@ -170,7 +172,7 @@ def test_get_recording_id_success(minio_parser, valid_minio_event):
 def test_validate_filepath_with_folder(minio_parser):
     """Test validation of filepath with folder structure."""
     event = StorageEvent(
-        filepath="parent_folder%2Ffolder%2F46d1a121-2426-484d-8fb3-09b5d886f7a8.ogg",
+        filepath="parent_folder%2Frecordings%2F46d1a121-2426-484d-8fb3-09b5d886f7a8.ogg",
         filetype="audio/ogg",
         bucket_name="test-bucket",
         metadata=None,
@@ -219,7 +221,7 @@ def test_validate_custom_filetypes():
     parser = MinioParser(bucket_name="test-bucket", allowed_filetypes={"audio/mp3"})
 
     event = StorageEvent(
-        filepath="parent_folder%2Ffolder%2F46d1a121-2426-484d-8fb3-09b5d886f7a8.ogg",
+        filepath="parent_folder%2Frecordings%2F46d1a121-2426-484d-8fb3-09b5d886f7a8.ogg",
         filetype="audio/mp3",
         bucket_name="test-bucket",
         metadata=None,

src/backend/core/tests/recording/test_api_recordings_storage_hook.py

@@ -14,6 +14,7 @@ from ...factories import RecordingFactory
 from ...models import Recording, RecordingStatusChoices
 from ...recording.event.exceptions import (
     InvalidBucketError,
+    InvalidFilepathError,
     InvalidFileTypeError,
     ParsingEventDataError,
 )
@@ -94,7 +95,7 @@ def test_save_recording_parsing_error(recording_settings, mock_get_parser, clien
     )
 
     assert response.status_code == 403
-    assert response.json() == {"detail": "Invalid request data: Error message"}
+    assert response.json() == {"detail": "Invalid request data."}
 
 
 def test_save_recording_bucket_error(recording_settings, mock_get_parser, client):
@@ -111,7 +112,7 @@ def test_save_recording_bucket_error(recording_settings, mock_get_parser, client
     )
 
     assert response.status_code == 403
-    assert response.json() == {"detail": "Invalid bucket specified"}
+    assert response.json() == {"detail": "Invalid bucket specified."}
 
 
 def test_save_recording_filetype_error(recording_settings, mock_get_parser):
@@ -132,7 +133,28 @@ def test_save_recording_filetype_error(recording_settings, mock_get_parser):
     )
 
     assert response.status_code == 200
-    assert response.json() == {"message": "Ignore this file type, unsupported '.json'"}
+    assert response.json() == {"message": "Notification ignored."}
+
+
+def test_save_recording_filepath_error(recording_settings, mock_get_parser):
+    """Test handling of unsupported filepath in recording event data."""
+
+    mock_parser = mock.Mock()
+    mock_parser.get_recording_id.side_effect = InvalidFilepathError(
+        "Invalid filepath structure: parent/folder/recording.jpeg"
+    )
+    mock_get_parser.return_value = mock_parser
+
+    client = APIClient()
+
+    response = client.post(
+        "/api/v1.0/recordings/storage-hook/",
+        {"recording_data": "valid-data"},
+        HTTP_AUTHORIZATION="Bearer testAuthToken",
+    )
+
+    assert response.status_code == 200
+    assert response.json() == {"message": "Notification ignored."}
 
 
 def test_save_recording_unknown_recording(recording_settings, mock_get_parser, client):

src/backend/core/tests/rooms/test_api_rooms_invite.py

@@ -240,10 +240,9 @@ def test_api_rooms_invite_error(mock_invite_to_room):
     mock_invite_to_room.assert_called_once()
 
 
-@mock.patch("core.services.invitation.send_mail")
-def test_api_rooms_invite_success(mock_send_mail, settings):
+@mock.patch("core.services.invitation.EmailMultiAlternatives")
+def test_api_rooms_invite_success(mock_email_class, settings):
     """Test privileged users should successfully send invitation emails."""
-
     settings.EMAIL_BRAND_NAME = "ACME"
     settings.EMAIL_LOGO_IMG = "https://acme.com/logo"
     settings.EMAIL_APP_BASE_URL = "https://acme.com"
@@ -255,7 +254,6 @@ def test_api_rooms_invite_success(mock_send_mail, settings):
     user = UserFactory()
 
     room.accesses.create(user=user, role=random.choice(["administrator", "owner"]))
-
     client.force_login(user)
 
     data = {"emails": ["fabien@yopmail.com", "gerald@yopmail.com"]}
@@ -269,26 +267,38 @@ def test_api_rooms_invite_success(mock_send_mail, settings):
     assert response.status_code == 200
     assert response.json() == {"status": "success", "message": "invitations sent"}
 
-    mock_send_mail.assert_called_once()
+    mock_email_class.assert_called_once()
 
-    subject, body, sender, recipients = mock_send_mail.call_args[0]
+    # Check constructor arguments
+    call_kwargs = mock_email_class.call_args[1]  # EmailMultiAlternatives(**kwargs)
 
-    assert (
-        subject == f"Video call in progress: {user.email} is waiting for you to connect"
+    assert call_kwargs["subject"] == (
+        f"Video call in progress: {user.email} is waiting for you to connect"
+    )
+    assert call_kwargs["from_email"] == "notifications@acme.com"
+    assert call_kwargs["to"] == []
+    assert sorted(call_kwargs["bcc"]) == sorted(
+        ["fabien@yopmail.com", "gerald@yopmail.com"]
     )
 
-    # Verify email contains expected content
+    # Check plain text body
+    plain_body = call_kwargs["body"]
     required_content = [
-        "ACME",  # Brand name
-        "https://acme.com/logo",  # Logo URL
-        f"https://acme.com/{room.slug}",  # Room url
-        f"acme.com/{room.slug}",  # Room link
+        "ACME",
+        "https://acme.com/logo",
+        f"https://acme.com/{room.slug}",
+        f"acme.com/{room.slug}",
     ]
-
     for content in required_content:
-        assert content in body
+        assert content in plain_body
 
-    assert sender == "notifications@acme.com"
+    # Check HTML alternative was attached
+    mock_instance = mock_email_class.return_value
+    mock_instance.attach_alternative.assert_called_once()
+    html_body, mimetype = mock_instance.attach_alternative.call_args[0]
+    assert mimetype == "text/html"
+    for content in required_content:
+        assert content in html_body
 
-    # Verify all owners received the email (order-independent comparison)
-    assert sorted(recipients) == sorted(["fabien@yopmail.com", "gerald@yopmail.com"])
+    # Check send was called
+    mock_instance.send.assert_called_once()

src/backend/core/tests/rooms/test_api_rooms_participants_management.py

@@ -130,10 +130,11 @@ def test_update_participant_success(mock_livekit_client):
             "can_publish": True,
             "can_publish_data": True,
             "can_publish_sources": [
-                1,
-                2,
-            ],  # [TrackSource.CAMERA, TrackSource.MICROPHONE]
+                "CAMERA",
+                "MICROPHONE",
+            ],
             "can_update_metadata": True,
+            "can_subscribe_metrics": True,
         },
         "name": "John Doe",
     }
@@ -155,8 +156,14 @@ def test_update_participant_success(mock_livekit_client):
         {"can_subscribe": True},
         {"can_publish": True},
         {"can_publish_data": True},
-        {"can_publish_sources": [1, 2]},
+        {
+            "can_publish_sources": [
+                "CAMERA",
+                "MICROPHONE",
+            ]
+        },
         {"can_update_metadata": True},
+        {"can_subscribe_metrics": False},
     ],
 )
 def test_update_participant_permission_fields_are_optional(
@@ -264,35 +271,6 @@ def test_update_participant_suspicious_permission_multiple(mock_suspicious):
     )
 
 
-@pytest.mark.parametrize("value", (False, True))
-def test_update_participant_unimplemented_can_subscribe_metrics(value):
-    """Test update participant raises 400 when can_subscribe_metrics is set."""
-    client = APIClient()
-    room = RoomFactory()
-    user = UserFactory()
-    UserResourceAccessFactory(
-        resource=room, user=user, role=random.choice(["administrator", "owner"])
-    )
-    client.force_authenticate(user=user)
-
-    payload = {
-        "participant_identity": str(uuid4()),
-        "permission": {
-            "can_subscribe": True,
-            "can_publish": True,
-            "can_publish_data": True,
-            "can_update_metadata": False,
-            "can_subscribe_metrics": value,
-        },
-    }
-
-    url = reverse("rooms-update-participant", kwargs={"pk": room.id})
-    response = client.post(url, payload, format="json")
-
-    assert response.status_code == status.HTTP_400_BAD_REQUEST
-    assert "can_subscribe_metrics" in str(response.data)
-
-
 def test_update_participant_forbidden_without_access():
     """Test update participant returns 403 when user lacks room privileges."""
     client = APIClient()

src/backend/core/tests/rooms/test_api_rooms_retrieve.py

@@ -232,7 +232,7 @@ def test_api_rooms_retrieve_authenticated_public(mock_token):
     """
     room = RoomFactory(
         access_level=RoomAccessLevel.PUBLIC,
-        configuration={"can_publish_sources": ["camera"]},
+        configuration={"can_publish_sources": ["mock-source"]},
     )
 
     user = UserFactory()
@@ -264,7 +264,7 @@ def test_api_rooms_retrieve_authenticated_public(mock_token):
         user=user,
         username=None,
         color=None,
-        sources=["camera"],
+        sources=["mock-source"],
         is_admin_or_owner=False,
         participant_id=None,
     )
@@ -363,7 +363,7 @@ def test_api_rooms_retrieve_members(mock_token, django_assert_num_queries, setti
     other_user = UserFactory()
 
     room = RoomFactory(
-        configuration={"can_publish_sources": ["camera"]},
+        configuration={"can_publish_sources": ["mock-source"]},
     )
     UserResourceAccessFactory(resource=room, user=user, role="member")
     UserResourceAccessFactory(resource=room, user=other_user, role="member")
@@ -401,7 +401,7 @@ def test_api_rooms_retrieve_members(mock_token, django_assert_num_queries, setti
         user=user,
         username=None,
         color=None,
-        sources=["camera"],
+        sources=["mock-source"],
         is_admin_or_owner=False,
         participant_id=None,
     )

src/backend/core/tests/rooms/test_api_rooms_update.py

@@ -95,7 +95,7 @@ def test_api_rooms_update_administrators():
             "name": "New name",
             "slug": "should-be-ignored",
             "access_level": RoomAccessLevel.PUBLIC,
-            "configuration": {"can_publish_sources": ["camera"]},
+            "configuration": {"the_key": "the_value"},
         },
         format="json",
     )
@@ -104,7 +104,7 @@ def test_api_rooms_update_administrators():
     assert room.name == "New name"
     assert room.slug == "new-name"
     assert room.access_level == RoomAccessLevel.PUBLIC
-    assert room.configuration == {"can_publish_sources": ["camera"]}
+    assert room.configuration == {"the_key": "the_value"}
 
 
 def test_api_rooms_update_administrators_of_another():

src/backend/core/tests/rooms/test_api_rooms_webhook.py

@@ -77,7 +77,6 @@ def test_missing_auth_header(client, serialized_event_data, mock_livekit_config)
     assert response.status_code == 401
     assert response.json() == {
         "status": "error",
-        "message": "Authorization header missing",
     }
 
 
@@ -91,7 +90,7 @@ def test_invalid_payload(client, auth_token, mock_livekit_config):
     )
 
     assert response.status_code == 400
-    assert response.json() == {"status": "error", "message": "Invalid webhook payload"}
+    assert response.json() == {"status": "error"}
 
 
 def test_unknown_event_type(client, mock_livekit_config):
@@ -116,7 +115,6 @@ def test_unknown_event_type(client, mock_livekit_config):
     assert response.status_code == 422
     assert response.json() == {
         "status": "error",
-        "message": "Unknown webhook type: unknown_event_type",
     }
 
 

src/backend/core/tests/test_external_api_rooms.py

@@ -904,7 +904,7 @@ def test_api_rooms_token_unknown_application(settings):
 
 def test_api_rooms_token_inactive_application(settings):
     """Token for inactive application should be rejected."""
-    application = ApplicationFactory(active=False)
+    application = ApplicationFactory(is_active=False)
 
     now = datetime.now(timezone.utc)
     payload = {

src/backend/core/tests/test_external_api_token.py

@@ -23,7 +23,7 @@ def test_api_applications_generate_token_success(settings):
     """Valid credentials should return a JWT token."""
     UserFactory(email="User.Family@example.com")
     application = ApplicationFactory(
-        active=True,
+        is_active=True,
         scopes=[ApplicationScope.ROOMS_LIST, ApplicationScope.ROOMS_CREATE],
     )
 
@@ -79,7 +79,7 @@ def test_api_applications_generate_token_invalid_client_id():
 def test_api_applications_generate_token_invalid_client_secret():
     """Invalid client_secret should return 401."""
     user = UserFactory(email="user@example.com")
-    application = ApplicationFactory(active=True)
+    application = ApplicationFactory(is_active=True)
 
     client = APIClient()
     response = client.post(
@@ -100,7 +100,7 @@ def test_api_applications_generate_token_invalid_client_secret():
 def test_api_applications_generate_token_inactive_application():
     """Inactive application should return 401."""
     user = UserFactory(email="user@example.com")
-    application = ApplicationFactory(active=False)
+    application = ApplicationFactory(is_active=False)
 
     plain_secret = "test-secret-123"
     application.client_secret = plain_secret
@@ -122,9 +122,31 @@ def test_api_applications_generate_token_inactive_application():
     assert "Application is inactive" in str(response.data)
 
 
+def test_api_applications_generate_token_inactive_application_wrong_secret():
+    """An inactive application with a wrong secret should return 401."""
+    user = UserFactory(email="user@example.com")
+    application = ApplicationFactory(is_active=False)
+
+    client = APIClient()
+    response = client.post(
+        "/external-api/v1.0/application/token/",
+        {
+            "client_id": application.client_id,
+            "client_secret": "wrong-secret",
+            "grant_type": "client_credentials",
+            "scope": user.email,
+        },
+        format="json",
+    )
+
+    assert response.status_code == 401
+    assert "Invalid credentials" in str(response.data)
+    assert "inactive" not in str(response.data).lower()
+
+
 def test_api_applications_generate_token_invalid_email_format():
     """Invalid email format should return 400."""
-    application = ApplicationFactory(active=True)
+    application = ApplicationFactory(is_active=True)
 
     plain_secret = "test-secret-123"
     application.client_secret = plain_secret
@@ -149,7 +171,7 @@ def test_api_applications_generate_token_invalid_email_format():
 def test_api_applications_generate_token_domain_not_authorized():
     """Application without domain authorization should return 403."""
     user = UserFactory(email="user@denied.com")
-    application = ApplicationFactory(active=True)
+    application = ApplicationFactory(is_active=True)
     ApplicationDomainFactory(application=application, domain="allowed.com")
 
     plain_secret = "test-secret-123"
@@ -176,7 +198,7 @@ def test_api_applications_generate_token_domain_authorized():
     """Application with domain authorization should succeed."""
     user = UserFactory(email="user@allowed.com")
     application = ApplicationFactory(
-        active=True,
+        is_active=True,
         scopes=[ApplicationScope.ROOMS_LIST],
     )
     ApplicationDomainFactory(application=application, domain="allowed.com")
@@ -203,7 +225,7 @@ def test_api_applications_generate_token_domain_authorized():
 
 def test_api_applications_generate_token_user_not_found():
     """Non-existent user should return 404."""
-    application = ApplicationFactory(active=True)
+    application = ApplicationFactory(is_active=True)
 
     plain_secret = "test-secret-123"
     application.client_secret = plain_secret
@@ -231,7 +253,7 @@ def test_api_applications_token_payload_structure(settings):
     user = UserFactory(email="user@example.com")
 
     application = ApplicationFactory(
-        active=True,
+        is_active=True,
         scopes=[ApplicationScope.ROOMS_LIST, ApplicationScope.ROOMS_CREATE],
     )
 
@@ -284,7 +306,7 @@ def test_api_applications_token_new_user(settings):
     assert len(User.objects.all()) == 0
 
     application = ApplicationFactory(
-        active=True,
+        is_active=True,
         scopes=[ApplicationScope.ROOMS_LIST, ApplicationScope.ROOMS_CREATE],
     )
 
@@ -342,7 +364,7 @@ def test_api_applications_token_existing_user(settings):
     assert len(User.objects.all()) == 1
 
     application = ApplicationFactory(
-        active=True,
+        is_active=True,
         scopes=[ApplicationScope.ROOMS_LIST, ApplicationScope.ROOMS_CREATE],
     )
 

src/backend/core/tests/test_models_applications.py

@@ -41,7 +41,7 @@ def test_models_application_name_maxlength():
 def test_models_application_active_default():
     """An application should be active by default."""
     application = Application.objects.create(name="Test App")
-    assert application.active is True
+    assert application.is_active is True
 
 
 def test_models_application_scopes_default():

src/backend/core/utils.py

@@ -112,6 +112,12 @@ def generate_token(
     if color is None:
         color = generate_color(identity)
 
+    attributes = {
+        "color": color,
+        "room_admin": "true" if is_admin_or_owner else "false",
+        "is_authenticated": "true" if not user.is_anonymous else "false",
+    }
+
     token = (
         AccessToken(
             api_key=settings.LIVEKIT_CONFIGURATION["api_key"],
@@ -120,9 +126,7 @@ def generate_token(
         .with_grants(video_grants)
         .with_identity(identity)
         .with_name(username or default_username)
-        .with_attributes(
-            {"color": color, "room_admin": "true" if is_admin_or_owner else "false"}
-        )
+        .with_attributes(attributes)
     )
 
     return token.to_jwt()

src/backend/locale/de_DE/LC_MESSAGES/django.po

@@ -8,7 +8,7 @@ msgid ""
 msgstr ""
 "Project-Id-Version: PACKAGE VERSION\n"
 "Report-Msgid-Bugs-To: \n"
-"POT-Creation-Date: 2026-02-26 17:34+0000\n"
+"POT-Creation-Date: 2026-03-12 13:46+0000\n"
 "PO-Revision-Date: YEAR-MO-DA HO:MI+ZONE\n"
 "Last-Translator: FULL NAME <EMAIL@ADDRESS>\n"
 "Language-Team: LANGUAGE <LL@li.org>\n"
@@ -29,11 +29,11 @@ msgstr "Berechtigungen"
 msgid "Important dates"
 msgstr "Wichtige Daten"
 
-#: core/admin.py:132 core/admin.py:243
+#: core/admin.py:132 core/admin.py:275
 msgid "No owner"
 msgstr "Kein Eigentümer"
 
-#: core/admin.py:135 core/admin.py:246
+#: core/admin.py:135 core/admin.py:278
 msgid "Multiple owners"
 msgstr "Mehrere Eigentümer"
 
@@ -61,117 +61,136 @@ msgstr "Benachrichtigungen für %(count)s Aufnahme(n) erfolgreich gesendet."
 msgid "Skipped %(count)s expired recording(s)."
 msgstr "%(count)s abgelaufene Aufnahme(n) übersprungen."
 
-#: core/admin.py:309
+#: core/admin.py:200
+msgid "Mark selected recordings as 'Failed to Stop'"
+msgstr "Ausgewählte Aufnahmen als ‚Fehler beim Stoppen‘ markieren"
+
+#: core/admin.py:218
+#, python-format
+msgid "%(count)s recording(s) successfully marked as 'Failed to Stop'."
+msgstr "%(count)s Aufnahme(n) erfolgreich als ‚Fehler beim Stoppen‘ markiert."
+
+#: core/admin.py:226
+#, fuzzy, python-format
+#| msgid "Skipped %(count)s expired recording(s)."
+msgid "Skipped %(count)s recording(s) with an ineligible status."
+msgstr "%(count)s abgelaufene Aufnahme(n) übersprungen."
+
+#: core/admin.py:342
 msgid "No scopes"
 msgstr "Keine Scopes"
 
-#: core/admin.py:311
+#: core/admin.py:344
 msgid "Scopes"
 msgstr "Scopes"
 
-#: core/api/filters.py:24
+#: core/api/filters.py:25
 msgid "Creator is me"
 msgstr "Ersteller bin ich"
 
-#: core/api/serializers.py:84
+#: core/api/serializers.py:88
 msgid "You must be administrator or owner of a room to add accesses to it."
 msgstr ""
 "Sie müssen Administrator oder Eigentümer eines Raums sein, um Zugriffe "
 "hinzuzufügen."
 
-#: core/api/serializers.py:443
+#: core/api/serializers.py:516
 msgid "This file extension is not allowed."
 msgstr "Diese Dateiendung ist nicht erlaubt."
 
-#: core/models.py:35
+#: core/api/serializers.py:533
+msgid "You have reached the maximum number of files for this type."
+msgstr "Sie haben die maximale Anzahl an Dateien dieses Typs erreicht."
+
+#: core/models.py:37
 msgid "Member"
 msgstr "Mitglied"
 
-#: core/models.py:36
+#: core/models.py:38
 msgid "Administrator"
 msgstr "Administrator"
 
-#: core/models.py:37
+#: core/models.py:39
 msgid "Owner"
 msgstr "Eigentümer"
 
-#: core/models.py:53
+#: core/models.py:55
 msgid "Initiated"
 msgstr "Gestartet"
 
-#: core/models.py:54
+#: core/models.py:56
 msgid "Active"
 msgstr "Aktiv"
 
-#: core/models.py:55
+#: core/models.py:57
 msgid "Stopped"
 msgstr "Beendet"
 
-#: core/models.py:56
+#: core/models.py:58
 msgid "Saved"
 msgstr "Gespeichert"
 
-#: core/models.py:57
+#: core/models.py:59
 msgid "Aborted"
 msgstr "Abgebrochen"
 
-#: core/models.py:58
+#: core/models.py:60
 msgid "Failed to Start"
 msgstr "Start fehlgeschlagen"
 
-#: core/models.py:59
+#: core/models.py:61
 msgid "Failed to Stop"
 msgstr "Stopp fehlgeschlagen"
 
-#: core/models.py:60
+#: core/models.py:62
 msgid "Notification succeeded"
 msgstr "Benachrichtigung erfolgreich"
 
-#: core/models.py:87
+#: core/models.py:89
 msgid "SCREEN_RECORDING"
 msgstr "BILDSCHIRMAUFZEICHNUNG"
 
-#: core/models.py:88
+#: core/models.py:90
 msgid "TRANSCRIPT"
 msgstr "TRANSKRIPT"
 
-#: core/models.py:94
+#: core/models.py:96
 msgid "Public Access"
 msgstr "Öffentlicher Zugriff"
 
-#: core/models.py:95
+#: core/models.py:97
 msgid "Trusted Access"
 msgstr "Vertrauenswürdiger Zugriff"
 
-#: core/models.py:96
+#: core/models.py:98
 msgid "Restricted Access"
 msgstr "Eingeschränkter Zugriff"
 
-#: core/models.py:108
+#: core/models.py:110
 msgid "id"
 msgstr "ID"
 
-#: core/models.py:109
+#: core/models.py:111
 msgid "primary key for the record as UUID"
 msgstr "Primärschlüssel des Eintrags als UUID"
 
-#: core/models.py:115
+#: core/models.py:117
 msgid "created on"
 msgstr "erstellt am"
 
-#: core/models.py:116
+#: core/models.py:118
 msgid "date and time at which a record was created"
 msgstr "Datum und Uhrzeit der Erstellung eines Eintrags"
 
-#: core/models.py:121
+#: core/models.py:123
 msgid "updated on"
 msgstr "aktualisiert am"
 
-#: core/models.py:122
+#: core/models.py:124
 msgid "date and time at which a record was last updated"
 msgstr "Datum und Uhrzeit der letzten Aktualisierung eines Eintrags"
 
-#: core/models.py:142
+#: core/models.py:144
 msgid ""
 "Enter a valid sub. This value may contain only letters, numbers, and @/./+/-/"
 "_ characters."
@@ -179,11 +198,11 @@ msgstr ""
 "Geben Sie einen gültigen Sub ein. Dieser Wert darf nur Buchstaben, Zahlen "
 "und die Zeichen @/./+/-/_ enthalten."
 
-#: core/models.py:148
+#: core/models.py:150
 msgid "sub"
 msgstr "Sub"
 
-#: core/models.py:150
+#: core/models.py:152
 msgid ""
 "Optional for pending users; required upon account activation. 255 characters "
 "or fewer. Letters, numbers, and @/./+/-/_ characters only."
@@ -191,55 +210,55 @@ msgstr ""
 "Optional für ausstehende Benutzer; erforderlich nach Kontoaktivierung. "
 "Maximal 255 Zeichen. Nur Buchstaben, Zahlen und @/./+/-/_ Zeichen erlaubt."
 
-#: core/models.py:159
+#: core/models.py:161
 msgid "identity email address"
 msgstr "Identitäts-E-Mail-Adresse"
 
-#: core/models.py:164
+#: core/models.py:166
 msgid "admin email address"
 msgstr "Administrator-E-Mail-Adresse"
 
-#: core/models.py:166
+#: core/models.py:168
 msgid "full name"
 msgstr "Vollständiger Name"
 
-#: core/models.py:168
+#: core/models.py:170
 msgid "short name"
 msgstr "Kurzname"
 
-#: core/models.py:174
+#: core/models.py:176
 msgid "language"
 msgstr "Sprache"
 
-#: core/models.py:175
+#: core/models.py:177
 msgid "The language in which the user wants to see the interface."
 msgstr "Die Sprache, in der der Benutzer die Oberfläche sehen möchte."
 
-#: core/models.py:181
+#: core/models.py:183
 msgid "The timezone in which the user wants to see times."
 msgstr "Die Zeitzone, in der der Benutzer die Zeiten sehen möchte."
 
-#: core/models.py:184
+#: core/models.py:186
 msgid "device"
 msgstr "Gerät"
 
-#: core/models.py:186
+#: core/models.py:188
 msgid "Whether the user is a device or a real user."
 msgstr "Ob es sich um ein Gerät oder einen echten Benutzer handelt."
 
-#: core/models.py:189
+#: core/models.py:191
 msgid "staff status"
 msgstr "Mitarbeiterstatus"
 
-#: core/models.py:191
+#: core/models.py:193
 msgid "Whether the user can log into this admin site."
 msgstr "Ob der Benutzer sich bei dieser Admin-Seite anmelden kann."
 
-#: core/models.py:194
+#: core/models.py:196
 msgid "active"
 msgstr "aktiv"
 
-#: core/models.py:197
+#: core/models.py:199
 msgid ""
 "Whether this user should be treated as active. Unselect this instead of "
 "deleting accounts."
@@ -247,66 +266,66 @@ msgstr ""
 "Ob dieser Benutzer als aktiv behandelt werden soll. Deaktivieren Sie dies "
 "anstelle des Löschens des Kontos."
 
-#: core/models.py:210
+#: core/models.py:212
 msgid "user"
 msgstr "Benutzer"
 
-#: core/models.py:211
+#: core/models.py:213
 msgid "users"
 msgstr "Benutzer"
 
-#: core/models.py:270
+#: core/models.py:272
 msgid "Resource"
 msgstr "Ressource"
 
-#: core/models.py:271
+#: core/models.py:273
 msgid "Resources"
 msgstr "Ressourcen"
 
-#: core/models.py:329
+#: core/models.py:331
 msgid "Resource access"
 msgstr "Ressourcenzugriff"
 
-#: core/models.py:330
+#: core/models.py:332
 msgid "Resource accesses"
 msgstr "Ressourcenzugriffe"
 
-#: core/models.py:336
+#: core/models.py:338
 msgid "Resource access with this User and Resource already exists."
 msgstr ""
 "Ein Ressourcenzugriff mit diesem Benutzer und dieser Ressource existiert "
 "bereits."
 
-#: core/models.py:392
+#: core/models.py:394
 msgid "Visio room configuration"
 msgstr "Visio-Raumkonfiguration"
 
-#: core/models.py:393
+#: core/models.py:395
 msgid "Values for Visio parameters to configure the room."
 msgstr "Werte für Visio-Parameter zur Konfiguration des Raums."
 
-#: core/models.py:400
+#: core/models.py:402
 msgid "Room PIN code"
 msgstr "PIN-Code für den Raum"
 
-#: core/models.py:401
+#: core/models.py:403
 msgid "Unique n-digit code that identifies this room in telephony mode."
 msgstr ""
 "Eindeutiger n-stelliger Code, der diesen Raum im Telephonmodus identifiziert."
 
-#: core/models.py:407 core/models.py:561
+#: core/models.py:409 core/models.py:563
 msgid "Room"
 msgstr "Raum"
 
-#: core/models.py:408
+#: core/models.py:410
 msgid "Rooms"
 msgstr "Räume"
 
-#: core/models.py:572
+#: core/models.py:574
 msgid "Worker ID"
 msgstr "Worker-ID"
 
-#: core/models.py:574
+#: core/models.py:576
 msgid ""
 "Enter an identifier for the worker recording.This ID is retained even when "
 "the worker stops, allowing for easy tracking."
@@ -315,120 +334,120 @@ msgstr ""
 "erhalten, auch wenn der Worker stoppt, was ein einfaches Nachverfolgen "
 "ermöglicht."
 
-#: core/models.py:582
+#: core/models.py:584
 msgid "Recording mode"
 msgstr "Aufzeichnungsmodus"
 
-#: core/models.py:583
+#: core/models.py:585
 msgid "Defines the mode of recording being called."
 msgstr "Definiert den aufgerufenen Aufzeichnungsmodus."
 
-#: core/models.py:588 core/models.py:589
+#: core/models.py:590 core/models.py:591
 msgid "Recording options"
 msgstr "Aufnahmeoptionen"
 
-#: core/models.py:595
+#: core/models.py:597
 msgid "Recording"
 msgstr "Aufzeichnung"
 
-#: core/models.py:596
+#: core/models.py:598
 msgid "Recordings"
 msgstr "Aufzeichnungen"
 
-#: core/models.py:704
+#: core/models.py:706
 msgid "Recording/user relation"
 msgstr "Beziehung Aufzeichnung/Benutzer"
 
-#: core/models.py:705
+#: core/models.py:707
 msgid "Recording/user relations"
 msgstr "Beziehungen Aufzeichnung/Benutzer"
 
-#: core/models.py:711
+#: core/models.py:713
 msgid "This user is already in this recording."
 msgstr "Dieser Benutzer ist bereits Teil dieser Aufzeichnung."
 
-#: core/models.py:717
+#: core/models.py:719
 msgid "This team is already in this recording."
 msgstr "Dieses Team ist bereits Teil dieser Aufzeichnung."
 
-#: core/models.py:723
+#: core/models.py:725
 msgid "Either user or team must be set, not both."
 msgstr "Entweder Benutzer oder Team muss festgelegt werden, nicht beides."
 
-#: core/models.py:740
+#: core/models.py:742
 msgid "Create rooms"
 msgstr "Räume erstellen"
 
-#: core/models.py:741
+#: core/models.py:743
 msgid "List rooms"
 msgstr "Räume auflisten"
 
-#: core/models.py:742
+#: core/models.py:744
 msgid "Retrieve room details"
 msgstr "Raumdetails abrufen"
 
-#: core/models.py:743
+#: core/models.py:745
 msgid "Update rooms"
 msgstr "Räume aktualisieren"
 
-#: core/models.py:744
+#: core/models.py:746
 msgid "Delete rooms"
 msgstr "Räume löschen"
 
-#: core/models.py:757
+#: core/models.py:759
 msgid "Application name"
 msgstr "Anwendungsname"
 
-#: core/models.py:758
+#: core/models.py:760
 msgid "Descriptive name for this application."
 msgstr "Beschreibender Name für diese Anwendung."
 
-#: core/models.py:768
+#: core/models.py:770
 msgid "Hashed on Save. Copy it now if this is a new secret."
 msgstr ""
 "Beim Speichern gehasht. Jetzt kopieren, wenn dies ein neues Geheimnis ist."
 
-#: core/models.py:779
+#: core/models.py:781
 msgid "Application"
 msgstr "Anwendung"
 
-#: core/models.py:780
+#: core/models.py:782
 msgid "Applications"
 msgstr "Anwendungen"
 
-#: core/models.py:803
+#: core/models.py:805
 msgid "Enter a valid domain"
 msgstr "Geben Sie eine gültige Domain ein"
 
-#: core/models.py:806
+#: core/models.py:808
 msgid "Domain"
 msgstr "Domain"
 
-#: core/models.py:807
+#: core/models.py:809
 msgid "Email domain this application can act on behalf of."
 msgstr "E-Mail-Domain, im Namen der diese Anwendung handeln kann."
 
-#: core/models.py:819
+#: core/models.py:821
 msgid "Application domain"
 msgstr "Anwendungsdomain"
 
-#: core/models.py:820
+#: core/models.py:822
 msgid "Application domains"
 msgstr "Anwendungsdomains"
 
-#: core/models.py:838
+#: core/models.py:840
 msgid "Pending"
 msgstr "Ausstehend"
 
-#: core/models.py:846
+#: core/models.py:848
 msgid "Ready"
 msgstr "Bereit"
 
-#: core/models.py:852
+#: core/models.py:854
 msgid "Background image"
 msgstr "Hintergrundbild"
 
-#: core/models.py:864
+#: core/models.py:866
 msgid "title"
 msgstr "Titel"
 
@@ -445,11 +464,11 @@ msgstr "Datei"
 msgid "Files"
 msgstr "Dateien"
 
-#: core/models.py:970
+#: core/models.py:1000
 msgid "This file is already hard deleted."
 msgstr "Diese Datei wurde bereits endgültig gelöscht."
 
-#: core/models.py:980
+#: core/models.py:1010
 #, fuzzy
 #| msgid "To hard delete a file, it must first be soft deleted."
 msgid "To hard delete a file, it must first be soft deleted."
@@ -585,18 +604,18 @@ msgstr ""
 " Wenn Sie Fragen haben oder Unterstützung benötigen, wenden Sie sich bitte "
 "an unser Support-Team unter %(support_email)s. "
 
-#: meet/settings.py:224
+#: meet/settings.py:223
 msgid "English"
 msgstr "Englisch"
 
-#: meet/settings.py:225
+#: meet/settings.py:224
 msgid "French"
 msgstr "Französisch"
 
-#: meet/settings.py:226
+#: meet/settings.py:225
 msgid "Dutch"
 msgstr "Niederländisch"
 
-#: meet/settings.py:227
+#: meet/settings.py:226
 msgid "German"
 msgstr "Deutsch"

src/backend/locale/en_US/LC_MESSAGES/django.po

@@ -8,7 +8,7 @@ msgid ""
 msgstr ""
 "Project-Id-Version: PACKAGE VERSION\n"
 "Report-Msgid-Bugs-To: \n"
-"POT-Creation-Date: 2026-02-26 17:26+0000\n"
+"POT-Creation-Date: 2026-03-12 13:46+0000\n"
 "PO-Revision-Date: YEAR-MO-DA HO:MI+ZONE\n"
 "Last-Translator: FULL NAME <EMAIL@ADDRESS>\n"
 "Language-Team: LANGUAGE <LL@li.org>\n"
@@ -29,11 +29,11 @@ msgstr "Permissions"
 msgid "Important dates"
 msgstr "Important dates"
 
-#: core/admin.py:132 core/admin.py:243
+#: core/admin.py:132 core/admin.py:275
 msgid "No owner"
 msgstr "No owner"
 
-#: core/admin.py:135 core/admin.py:246
+#: core/admin.py:135 core/admin.py:278
 msgid "Multiple owners"
 msgstr "Multiple owners"
 
@@ -61,115 +61,134 @@ msgstr "Successfully sent notifications for %(count)s recording(s)."
 msgid "Skipped %(count)s expired recording(s)."
 msgstr "Skipped %(count)s expired recording(s)."
 
-#: core/admin.py:309
+#: core/admin.py:200
+msgid "Mark selected recordings as 'Failed to Stop'"
+msgstr "Mark selected recordings as 'Failed to Stop'"
+
+#: core/admin.py:218
+#, python-format
+msgid "%(count)s recording(s) successfully marked as 'Failed to Stop'."
+msgstr "%(count)s recording(s) successfully marked as 'Failed to Stop'."
+
+#: core/admin.py:226
+#, fuzzy, python-format
+#| msgid "Skipped %(count)s expired recording(s)."
+msgid "Skipped %(count)s recording(s) with an ineligible status."
+msgstr "Skipped %(count)s expired recording(s)."
+
+#: core/admin.py:342
 msgid "No scopes"
 msgstr "No scopes"
 
-#: core/admin.py:311
+#: core/admin.py:344
 msgid "Scopes"
 msgstr "Scopes"
 
-#: core/api/filters.py:24
+#: core/api/filters.py:25
 msgid "Creator is me"
 msgstr "Creator is me"
 
-#: core/api/serializers.py:84
+#: core/api/serializers.py:88
 msgid "You must be administrator or owner of a room to add accesses to it."
 msgstr "You must be administrator or owner of a room to add accesses to it."
 
-#: core/api/serializers.py:443
+#: core/api/serializers.py:516
 msgid "This file extension is not allowed."
 msgstr "This file extension is not allowed."
 
-#: core/models.py:35
+#: core/api/serializers.py:533
+msgid "You have reached the maximum number of files for this type."
+msgstr "You have reached the maximum number of files for this type."
+
+#: core/models.py:37
 msgid "Member"
 msgstr "Member"
 
-#: core/models.py:36
+#: core/models.py:38
 msgid "Administrator"
 msgstr "Administrator"
 
-#: core/models.py:37
+#: core/models.py:39
 msgid "Owner"
 msgstr "Owner"
 
-#: core/models.py:53
+#: core/models.py:55
 msgid "Initiated"
 msgstr "Initiated"
 
-#: core/models.py:54
+#: core/models.py:56
 msgid "Active"
 msgstr "Active"
 
-#: core/models.py:55
+#: core/models.py:57
 msgid "Stopped"
 msgstr "Stopped"
 
-#: core/models.py:56
+#: core/models.py:58
 msgid "Saved"
 msgstr "Saved"
 
-#: core/models.py:57
+#: core/models.py:59
 msgid "Aborted"
 msgstr "Aborted"
 
-#: core/models.py:58
+#: core/models.py:60
 msgid "Failed to Start"
 msgstr "Failed to Start"
 
-#: core/models.py:59
+#: core/models.py:61
 msgid "Failed to Stop"
 msgstr "Failed to Stop"
 
-#: core/models.py:60
+#: core/models.py:62
 msgid "Notification succeeded"
 msgstr "Notification succeeded"
 
-#: core/models.py:87
+#: core/models.py:89
 msgid "SCREEN_RECORDING"
 msgstr "SCREEN_RECORDING"
 
-#: core/models.py:88
+#: core/models.py:90
 msgid "TRANSCRIPT"
 msgstr "TRANSCRIPT"
 
-#: core/models.py:94
+#: core/models.py:96
 msgid "Public Access"
 msgstr "Public Access"
 
-#: core/models.py:95
+#: core/models.py:97
 msgid "Trusted Access"
 msgstr "Trusted Access"
 
-#: core/models.py:96
+#: core/models.py:98
 msgid "Restricted Access"
 msgstr "Restricted Access"
 
-#: core/models.py:108
+#: core/models.py:110
 msgid "id"
 msgstr "id"
 
-#: core/models.py:109
+#: core/models.py:111
 msgid "primary key for the record as UUID"
 msgstr "primary key for the record as UUID"
 
-#: core/models.py:115
+#: core/models.py:117
 msgid "created on"
 msgstr "created on"
 
-#: core/models.py:116
+#: core/models.py:118
 msgid "date and time at which a record was created"
 msgstr "date and time at which a record was created"
 
-#: core/models.py:121
+#: core/models.py:123
 msgid "updated on"
 msgstr "updated on"
 
-#: core/models.py:122
+#: core/models.py:124
 msgid "date and time at which a record was last updated"
 msgstr "date and time at which a record was last updated"
 
-#: core/models.py:142
+#: core/models.py:144
 msgid ""
 "Enter a valid sub. This value may contain only letters, numbers, and @/./+/-/"
 "_ characters."
@@ -177,11 +196,11 @@ msgstr ""
 "Enter a valid sub. This value may contain only letters, numbers, and @/./+/-/"
 "_ characters."
 
-#: core/models.py:148
+#: core/models.py:150
 msgid "sub"
 msgstr "sub"
 
-#: core/models.py:150
+#: core/models.py:152
 msgid ""
 "Optional for pending users; required upon account activation. 255 characters "
 "or fewer. Letters, numbers, and @/./+/-/_ characters only."
@@ -189,55 +208,55 @@ msgstr ""
 "Required. 255 characters or fewer. Letters, numbers, and @/./+/-/_ "
 "characters only."
 
-#: core/models.py:159
+#: core/models.py:161
 msgid "identity email address"
 msgstr "identity email address"
 
-#: core/models.py:164
+#: core/models.py:166
 msgid "admin email address"
 msgstr "admin email address"
 
-#: core/models.py:166
+#: core/models.py:168
 msgid "full name"
 msgstr "full name"
 
-#: core/models.py:168
+#: core/models.py:170
 msgid "short name"
 msgstr "short name"
 
-#: core/models.py:174
+#: core/models.py:176
 msgid "language"
 msgstr "language"
 
-#: core/models.py:175
+#: core/models.py:177
 msgid "The language in which the user wants to see the interface."
 msgstr "The language in which the user wants to see the interface."
 
-#: core/models.py:181
+#: core/models.py:183
 msgid "The timezone in which the user wants to see times."
 msgstr "The timezone in which the user wants to see times."
 
-#: core/models.py:184
+#: core/models.py:186
 msgid "device"
 msgstr "device"
 
-#: core/models.py:186
+#: core/models.py:188
 msgid "Whether the user is a device or a real user."
 msgstr "Whether the user is a device or a real user."
 
-#: core/models.py:189
+#: core/models.py:191
 msgid "staff status"
 msgstr "staff status"
 
-#: core/models.py:191
+#: core/models.py:193
 msgid "Whether the user can log into this admin site."
 msgstr "Whether the user can log into this admin site."
 
-#: core/models.py:194
+#: core/models.py:196
 msgid "active"
 msgstr "active"
 
-#: core/models.py:197
+#: core/models.py:199
 msgid ""
 "Whether this user should be treated as active. Unselect this instead of "
 "deleting accounts."
@@ -245,63 +264,63 @@ msgstr ""
 "Whether this user should be treated as active. Unselect this instead of "
 "deleting accounts."
 
-#: core/models.py:210
+#: core/models.py:212
 msgid "user"
 msgstr "user"
 
-#: core/models.py:211
+#: core/models.py:213
 msgid "users"
 msgstr "users"
 
-#: core/models.py:270
+#: core/models.py:272
 msgid "Resource"
 msgstr "Resource"
 
-#: core/models.py:271
+#: core/models.py:273
 msgid "Resources"
 msgstr "Resources"
 
-#: core/models.py:329
+#: core/models.py:331
 msgid "Resource access"
 msgstr "Resource access"
 
-#: core/models.py:330
+#: core/models.py:332
 msgid "Resource accesses"
 msgstr "Resource accesses"
 
-#: core/models.py:336
+#: core/models.py:338
 msgid "Resource access with this User and Resource already exists."
 msgstr "Resource access with this User and Resource already exists."
 
-#: core/models.py:392
+#: core/models.py:394
 msgid "Visio room configuration"
 msgstr "Visio room configuration"
 
-#: core/models.py:393
+#: core/models.py:395
 msgid "Values for Visio parameters to configure the room."
 msgstr "Values for Visio parameters to configure the room."
 
-#: core/models.py:400
+#: core/models.py:402
 msgid "Room PIN code"
 msgstr "Room PIN code"
 
-#: core/models.py:401
+#: core/models.py:403
 msgid "Unique n-digit code that identifies this room in telephony mode."
 msgstr "Unique n-digit code that identifies this room in telephony mode."
 
-#: core/models.py:407 core/models.py:561
+#: core/models.py:409 core/models.py:563
 msgid "Room"
 msgstr "Room"
 
-#: core/models.py:408
+#: core/models.py:410
 msgid "Rooms"
 msgstr "Rooms"
 
-#: core/models.py:572
+#: core/models.py:574
 msgid "Worker ID"
 msgstr "Worker ID"
 
-#: core/models.py:574
+#: core/models.py:576
 msgid ""
 "Enter an identifier for the worker recording.This ID is retained even when "
 "the worker stops, allowing for easy tracking."
@@ -309,125 +328,125 @@ msgstr ""
 "Enter an identifier for the worker recording.This ID is retained even when "
 "the worker stops, allowing for easy tracking."
 
-#: core/models.py:582
+#: core/models.py:584
 msgid "Recording mode"
 msgstr "Recording mode"
 
-#: core/models.py:583
+#: core/models.py:585
 msgid "Defines the mode of recording being called."
 msgstr "Defines the mode of recording being called."
 
-#: core/models.py:588 core/models.py:589
+#: core/models.py:590 core/models.py:591
 msgid "Recording options"
 msgstr "Recording options"
 
-#: core/models.py:595
+#: core/models.py:597
 msgid "Recording"
 msgstr "Recording"
 
-#: core/models.py:596
+#: core/models.py:598
 msgid "Recordings"
 msgstr "Recordings"
 
-#: core/models.py:704
+#: core/models.py:706
 msgid "Recording/user relation"
 msgstr "Recording/user relation"
 
-#: core/models.py:705
+#: core/models.py:707
 msgid "Recording/user relations"
 msgstr "Recording/user relations"
 
-#: core/models.py:711
+#: core/models.py:713
 msgid "This user is already in this recording."
 msgstr "This user is already in this recording."
 
-#: core/models.py:717
+#: core/models.py:719
 msgid "This team is already in this recording."
 msgstr "This team is already in this recording."
 
-#: core/models.py:723
+#: core/models.py:725
 msgid "Either user or team must be set, not both."
 msgstr "Either user or team must be set, not both."
 
-#: core/models.py:740
+#: core/models.py:742
 #, fuzzy
 #| msgid "created on"
 msgid "Create rooms"
 msgstr "Create rooms"
 
-#: core/models.py:741
+#: core/models.py:743
 msgid "List rooms"
 msgstr "List rooms"
 
-#: core/models.py:742
+#: core/models.py:744
 msgid "Retrieve room details"
 msgstr "Retrieve room details"
 
-#: core/models.py:743
+#: core/models.py:745
 #, fuzzy
 #| msgid "updated on"
 msgid "Update rooms"
 msgstr "Update rooms"
 
-#: core/models.py:744
+#: core/models.py:746
 msgid "Delete rooms"
 msgstr "Delete rooms"
 
-#: core/models.py:757
+#: core/models.py:759
 msgid "Application name"
 msgstr "Application name"
 
-#: core/models.py:758
+#: core/models.py:760
 msgid "Descriptive name for this application."
 msgstr "Descriptive name for this application."
 
-#: core/models.py:768
+#: core/models.py:770
 msgid "Hashed on Save. Copy it now if this is a new secret."
 msgstr "Hashed on Save. Copy it now if this is a new secret."
 
-#: core/models.py:779
+#: core/models.py:781
 msgid "Application"
 msgstr "Application"
 
-#: core/models.py:780
+#: core/models.py:782
 msgid "Applications"
 msgstr "Applications"
 
-#: core/models.py:803
+#: core/models.py:805
 msgid "Enter a valid domain"
 msgstr "Enter a valid domain"
 
-#: core/models.py:806
+#: core/models.py:808
 msgid "Domain"
 msgstr "Domain"
 
-#: core/models.py:807
+#: core/models.py:809
 msgid "Email domain this application can act on behalf of."
 msgstr "Email domain this application can act on behalf of."
 
-#: core/models.py:819
+#: core/models.py:821
 msgid "Application domain"
 msgstr "Application domain"
 
-#: core/models.py:820
+#: core/models.py:822
 msgid "Application domains"
 msgstr "Application domains"
 
-#: core/models.py:838
+#: core/models.py:840
 #, fuzzy
 #| msgid "Recording"
 msgid "Pending"
 msgstr "Pending"
 
-#: core/models.py:846
+#: core/models.py:848
 msgid "Ready"
 msgstr "Ready"
 
-#: core/models.py:852
+#: core/models.py:854
 msgid "Background image"
 msgstr "Background image"
 
-#: core/models.py:864
+#: core/models.py:866
 msgid "title"
 msgstr "title"
 
@@ -443,13 +462,13 @@ msgstr "File"
 msgid "Files"
 msgstr "Files"
 
-#: core/models.py:970
+#: core/models.py:1000
 #, fuzzy
 #| msgid "This user is already in this recording."
 msgid "This file is already hard deleted."
 msgstr "This file is already hard deleted."
 
-#: core/models.py:980
+#: core/models.py:1010
 msgid "To hard delete a file, it must first be soft deleted."
 msgstr "To hard delete a file, it must first be soft deleted."
 
@@ -581,18 +600,18 @@ msgstr ""
 " If you have any questions or need assistance, please contact our support "
 "team at %(support_email)s. "
 
-#: meet/settings.py:224
+#: meet/settings.py:223
 msgid "English"
 msgstr "English"
 
-#: meet/settings.py:225
+#: meet/settings.py:224
 msgid "French"
 msgstr "French"
 
-#: meet/settings.py:226
+#: meet/settings.py:225
 msgid "Dutch"
 msgstr "Dutch"
 
-#: meet/settings.py:227
+#: meet/settings.py:226
 msgid "German"
 msgstr "German"

src/backend/locale/fr_FR/LC_MESSAGES/django.po

@@ -8,7 +8,7 @@ msgid ""
 msgstr ""
 "Project-Id-Version: PACKAGE VERSION\n"
 "Report-Msgid-Bugs-To: \n"
-"POT-Creation-Date: 2026-02-26 17:26+0000\n"
+"POT-Creation-Date: 2026-03-12 13:46+0000\n"
 "PO-Revision-Date: YEAR-MO-DA HO:MI+ZONE\n"
 "Last-Translator: antoine.lebaud@mail.numerique.gouv.fr\n"
 "Language-Team: LANGUAGE <LL@li.org>\n"
@@ -29,11 +29,11 @@ msgstr "Permissions"
 msgid "Important dates"
 msgstr "Dates importantes"
 
-#: core/admin.py:132 core/admin.py:243
+#: core/admin.py:132 core/admin.py:275
 msgid "No owner"
 msgstr "Pas de propriétaire"
 
-#: core/admin.py:135 core/admin.py:246
+#: core/admin.py:135 core/admin.py:278
 msgid "Multiple owners"
 msgstr "Plusieurs propriétaires"
 
@@ -61,119 +61,139 @@ msgstr "Notifications envoyées avec succès pour %(count)s enregistrement(s)."
 msgid "Skipped %(count)s expired recording(s)."
 msgstr "%(count)s enregistrement(s) expiré(s) ignoré(s)."
 
-#: core/admin.py:309
+#: core/admin.py:200
+msgid "Mark selected recordings as 'Failed to Stop'"
+msgstr "Marquer les enregistrements sélectionnés comme « Échec d’arrêt »"
+
+#: core/admin.py:218
+#, python-format
+msgid "%(count)s recording(s) successfully marked as 'Failed to Stop'."
+msgstr ""
+"%(count)s enregistrement(s) marqué(s) avec succès comme « Échec d’arrêt »."
+
+#: core/admin.py:226
+#, fuzzy, python-format
+#| msgid "Skipped %(count)s expired recording(s)."
+msgid "Skipped %(count)s recording(s) with an ineligible status."
+msgstr "%(count)s enregistrement(s) avec un statut inéligible ignoré(s)."
+
+#: core/admin.py:342
 msgid "No scopes"
 msgstr "Aucun scopes"
 
-#: core/admin.py:311
+#: core/admin.py:344
 msgid "Scopes"
 msgstr "Scopes"
 
-#: core/api/filters.py:24
+#: core/api/filters.py:25
 msgid "Creator is me"
 msgstr "Je suis le créateur"
 
-#: core/api/serializers.py:84
+#: core/api/serializers.py:88
 msgid "You must be administrator or owner of a room to add accesses to it."
 msgstr ""
 "Vous devez être administrateur ou propriétaire d'une salle pour y ajouter "
 "des accès."
 
-#: core/api/serializers.py:443
+#: core/api/serializers.py:516
 msgid "This file extension is not allowed."
 msgstr "Cette extension n'est pas autorisée"
 
-#: core/models.py:35
+#: core/api/serializers.py:533
+msgid "You have reached the maximum number of files for this type."
+msgstr "Vous avez atteint le nombre maximum de fichiers de ce type"
+
+#: core/models.py:37
 msgid "Member"
 msgstr "Membre"
 
-#: core/models.py:36
+#: core/models.py:38
 msgid "Administrator"
 msgstr "Administrateur"
 
-#: core/models.py:37
+#: core/models.py:39
 msgid "Owner"
 msgstr "Propriétaire"
 
-#: core/models.py:53
+#: core/models.py:55
 msgid "Initiated"
 msgstr "Initié"
 
-#: core/models.py:54
+#: core/models.py:56
 msgid "Active"
 msgstr "Actif"
 
-#: core/models.py:55
+#: core/models.py:57
 msgid "Stopped"
 msgstr "Arrêté"
 
-#: core/models.py:56
+#: core/models.py:58
 msgid "Saved"
 msgstr "Enregistré"
 
-#: core/models.py:57
+#: core/models.py:59
 msgid "Aborted"
 msgstr "Abandonné"
 
-#: core/models.py:58
+#: core/models.py:60
 msgid "Failed to Start"
 msgstr "Échec au démarrage"
 
-#: core/models.py:59
+#: core/models.py:61
 msgid "Failed to Stop"
 msgstr "Échec à l'arrêt"
 
-#: core/models.py:60
+#: core/models.py:62
 msgid "Notification succeeded"
 msgstr "Notification réussie"
 
-#: core/models.py:87
+#: core/models.py:89
 msgid "SCREEN_RECORDING"
 msgstr "ENREGISTREMENT_ÉCRAN"
 
-#: core/models.py:88
+#: core/models.py:90
 msgid "TRANSCRIPT"
 msgstr "TRANSCRIPTION"
 
-#: core/models.py:94
+#: core/models.py:96
 msgid "Public Access"
 msgstr "Accès public"
 
-#: core/models.py:95
+#: core/models.py:97
 msgid "Trusted Access"
 msgstr "Accès de confiance"
 
-#: core/models.py:96
+#: core/models.py:98
 msgid "Restricted Access"
 msgstr "Accès restreint"
 
-#: core/models.py:108
+#: core/models.py:110
 msgid "id"
 msgstr "id"
 
-#: core/models.py:109
+#: core/models.py:111
 msgid "primary key for the record as UUID"
 msgstr "clé primaire pour l'enregistrement sous forme d'UUID"
 
-#: core/models.py:115
+#: core/models.py:117
 msgid "created on"
 msgstr "créé le"
 
-#: core/models.py:116
+#: core/models.py:118
 msgid "date and time at which a record was created"
 msgstr "date et heure auxquelles un enregistrement a été créé"
 
-#: core/models.py:121
+#: core/models.py:123
 msgid "updated on"
 msgstr "mis à jour le"
 
-#: core/models.py:122
+#: core/models.py:124
 msgid "date and time at which a record was last updated"
 msgstr ""
 "date et heure auxquelles un enregistrement a été mis à jour pour la dernière "
 "fois"
 
-#: core/models.py:142
+#: core/models.py:144
 msgid ""
 "Enter a valid sub. This value may contain only letters, numbers, and @/./+/-/"
 "_ characters."
@@ -181,11 +201,11 @@ msgstr ""
 "Entrez un sub valide. Cette valeur ne peut contenir que des lettres, des "
 "chiffres et les caractères @/./+/-/_."
 
-#: core/models.py:148
+#: core/models.py:150
 msgid "sub"
 msgstr "sub"
 
-#: core/models.py:150
+#: core/models.py:152
 msgid ""
 "Optional for pending users; required upon account activation. 255 characters "
 "or fewer. Letters, numbers, and @/./+/-/_ characters only."
@@ -193,55 +213,55 @@ msgstr ""
 "Optionnel pour les utilisateurs en attente ; requis lors de l'activation du "
 "compte. 255 caractères maximum. Lettres, chiffres et @/./+/-/_ uniquement."
 
-#: core/models.py:159
+#: core/models.py:161
 msgid "identity email address"
 msgstr "adresse e-mail d'identité"
 
-#: core/models.py:164
+#: core/models.py:166
 msgid "admin email address"
 msgstr "adresse e-mail d'administrateur"
 
-#: core/models.py:166
+#: core/models.py:168
 msgid "full name"
 msgstr "nom complet"
 
-#: core/models.py:168
+#: core/models.py:170
 msgid "short name"
 msgstr "nom court"
 
-#: core/models.py:174
+#: core/models.py:176
 msgid "language"
 msgstr "langue"
 
-#: core/models.py:175
+#: core/models.py:177
 msgid "The language in which the user wants to see the interface."
 msgstr "La langue dans laquelle l'utilisateur souhaite voir l'interface."
 
-#: core/models.py:181
+#: core/models.py:183
 msgid "The timezone in which the user wants to see times."
 msgstr "Le fuseau horaire dans lequel l'utilisateur souhaite voir les heures."
 
-#: core/models.py:184
+#: core/models.py:186
 msgid "device"
 msgstr "appareil"
 
-#: core/models.py:186
+#: core/models.py:188
 msgid "Whether the user is a device or a real user."
 msgstr "Si l'utilisateur est un appareil ou un utilisateur réel."
 
-#: core/models.py:189
+#: core/models.py:191
 msgid "staff status"
 msgstr "statut du personnel"
 
-#: core/models.py:191
+#: core/models.py:193
 msgid "Whether the user can log into this admin site."
 msgstr "Si l'utilisateur peut se connecter à ce site d'administration."
 
-#: core/models.py:194
+#: core/models.py:196
 msgid "active"
 msgstr "actif"
 
-#: core/models.py:197
+#: core/models.py:199
 msgid ""
 "Whether this user should be treated as active. Unselect this instead of "
 "deleting accounts."
@@ -249,65 +269,65 @@ msgstr ""
 "Si cet utilisateur doit être traité comme actif. Désélectionnez cette option "
 "au lieu de supprimer des comptes."
 
-#: core/models.py:210
+#: core/models.py:212
 msgid "user"
 msgstr "utilisateur"
 
-#: core/models.py:211
+#: core/models.py:213
 msgid "users"
 msgstr "utilisateurs"
 
-#: core/models.py:270
+#: core/models.py:272
 msgid "Resource"
 msgstr "Ressource"
 
-#: core/models.py:271
+#: core/models.py:273
 msgid "Resources"
 msgstr "Ressources"
 
-#: core/models.py:329
+#: core/models.py:331
 msgid "Resource access"
 msgstr "Accès aux ressources"
 
-#: core/models.py:330
+#: core/models.py:332
 msgid "Resource accesses"
 msgstr "Accès aux ressources"
 
-#: core/models.py:336
+#: core/models.py:338
 msgid "Resource access with this User and Resource already exists."
 msgstr ""
 "L'accès à la ressource avec cet utilisateur et cette ressource existe déjà."
 
-#: core/models.py:392
+#: core/models.py:394
 msgid "Visio room configuration"
 msgstr "Configuration de la salle de visioconférence"
 
-#: core/models.py:393
+#: core/models.py:395
 msgid "Values for Visio parameters to configure the room."
 msgstr "Valeurs des paramètres de visioconférence pour configurer la salle."
 
-#: core/models.py:400
+#: core/models.py:402
 msgid "Room PIN code"
 msgstr "Code PIN de la salle"
 
-#: core/models.py:401
+#: core/models.py:403
 msgid "Unique n-digit code that identifies this room in telephony mode."
 msgstr ""
 "Code unique à n chiffres qui identifie cette salle en mode téléphonique."
 
-#: core/models.py:407 core/models.py:561
+#: core/models.py:409 core/models.py:563
 msgid "Room"
 msgstr "Salle"
 
-#: core/models.py:408
+#: core/models.py:410
 msgid "Rooms"
 msgstr "Salles"
 
-#: core/models.py:572
+#: core/models.py:574
 msgid "Worker ID"
 msgstr "ID du Worker"
 
-#: core/models.py:574
+#: core/models.py:576
 msgid ""
 "Enter an identifier for the worker recording.This ID is retained even when "
 "the worker stops, allowing for easy tracking."
@@ -315,127 +335,128 @@ msgstr ""
 "Entrez un identifiant pour l'enregistrement du Worker. Cet identifiant est "
 "conservé même lorsque le Worker s'arrête, permettant un suivi facile."
 
-#: core/models.py:582
+#: core/models.py:584
 msgid "Recording mode"
 msgstr "Mode d'enregistrement"
 
-#: core/models.py:583
+#: core/models.py:585
 msgid "Defines the mode of recording being called."
 msgstr "Définit le mode d'enregistrement appelé."
 
-#: core/models.py:588 core/models.py:589
+#: core/models.py:590 core/models.py:591
 msgid "Recording options"
 msgstr "Options d'enregistrement"
 
-#: core/models.py:595
+#: core/models.py:597
 msgid "Recording"
 msgstr "Enregistrement"
 
-#: core/models.py:596
+#: core/models.py:598
 msgid "Recordings"
 msgstr "Enregistrements"
 
-#: core/models.py:704
+#: core/models.py:706
 msgid "Recording/user relation"
 msgstr "Relation enregistrement/utilisateur"
 
-#: core/models.py:705
+#: core/models.py:707
 msgid "Recording/user relations"
 msgstr "Relations enregistrement/utilisateur"
 
-#: core/models.py:711
+#: core/models.py:713
 msgid "This user is already in this recording."
 msgstr "Cet utilisateur est déjà dans cet enregistrement."
 
-#: core/models.py:717
+#: core/models.py:719
 msgid "This team is already in this recording."
 msgstr "Cette équipe est déjà dans cet enregistrement."
 
-#: core/models.py:723
+#: core/models.py:725
 msgid "Either user or team must be set, not both."
 msgstr "Soit l'utilisateur, soit l'équipe doit être défini, pas les deux."
 
-#: core/models.py:740
+#: core/models.py:742
 msgid "Create rooms"
 msgstr "Créer des salles"
 
-#: core/models.py:741
+#: core/models.py:743
 msgid "List rooms"
 msgstr "Lister les salles"
 
-#: core/models.py:742
+#: core/models.py:744
 msgid "Retrieve room details"
 msgstr "Afficher les détails d’une salle"
 
-#: core/models.py:743
+#: core/models.py:745
 msgid "Update rooms"
 msgstr "Mettre à jour les salles"
 
-#: core/models.py:744
+#: core/models.py:746
 msgid "Delete rooms"
 msgstr "Supprimer les salles"
 
-#: core/models.py:757
+#: core/models.py:759
 msgid "Application name"
 msgstr "Nom de l’application"
 
-#: core/models.py:758
+#: core/models.py:760
 msgid "Descriptive name for this application."
 msgstr "Nom descriptif de cette application."
 
-#: core/models.py:768
+#: core/models.py:770
 msgid "Hashed on Save. Copy it now if this is a new secret."
 msgstr ""
 "Haché lors de l’enregistrement. Copiez-le maintenant s’il s’agit d’un "
 "nouveau secret."
 
-#: core/models.py:779
+#: core/models.py:781
 msgid "Application"
 msgstr "Application"
 
-#: core/models.py:780
+#: core/models.py:782
 msgid "Applications"
 msgstr "Applications"
 
-#: core/models.py:803
+#: core/models.py:805
 msgid "Enter a valid domain"
 msgstr "Saisissez un domaine valide"
 
-#: core/models.py:806
+#: core/models.py:808
 msgid "Domain"
 msgstr "Domaine"
 
-#: core/models.py:807
+#: core/models.py:809
 msgid "Email domain this application can act on behalf of."
 msgstr "Domaine de messagerie au nom duquel cette application peut agir."
 
-#: core/models.py:819
+#: core/models.py:821
 msgid "Application domain"
 msgstr "Domaine d’application"
 
-#: core/models.py:820
+#: core/models.py:822
 msgid "Application domains"
 msgstr "Domaines d’application"
 
-#: core/models.py:838
+#: core/models.py:840
 msgid "Pending"
 msgstr "En attente"
 
-#: core/models.py:846
+#: core/models.py:848
 msgid "Ready"
 msgstr "Prêt"
 
-#: core/models.py:852
+#: core/models.py:854
 msgid "Background image"
 msgstr "Image de fond"
 
-#: core/models.py:864
+#: core/models.py:866
 msgid "title"
 msgstr "Titre"
 
 #: core/models.py:890
 msgid "Malware detection info when the analysis status is unsafe."
-msgstr "Information concernant la détection de Malware cand le statut n'est pas sain"
+msgstr ""
+"Information concernant la détection de Malware cand le statut n'est pas sain"
 
 #: core/models.py:895
 msgid "File"
@@ -445,15 +466,17 @@ msgstr "Fichier"
 msgid "Files"
 msgstr "Fichiers"
 
-#: core/models.py:970
+#: core/models.py:1000
 #, fuzzy
 #| msgid "This user is already in this recording."
 msgid "This file is already hard deleted."
 msgstr "Ce fichier a été supprimé."
 
-#: core/models.py:980
+#: core/models.py:1010
 msgid "To hard delete a file, it must first be soft deleted."
-msgstr "Pour supprimer définitivement un fichier il doit d'abord avoir été marqué comme supprimé (soft delete)"
+msgstr ""
+"Pour supprimer définitivement un fichier il doit d'abord avoir été marqué "
+"comme supprimé (soft delete)"
 
 #: core/recording/event/notification.py:116
 msgid "Your recording is ready"
@@ -583,18 +606,18 @@ msgstr ""
 " Si vous avez des questions ou besoin d'assistance, veuillez contacter notre "
 "équipe d'assistance à %(support_email)s. "
 
-#: meet/settings.py:224
+#: meet/settings.py:223
 msgid "English"
 msgstr "Anglais"
 
-#: meet/settings.py:225
+#: meet/settings.py:224
 msgid "French"
 msgstr "Français"
 
-#: meet/settings.py:226
+#: meet/settings.py:225
 msgid "Dutch"
 msgstr "Néerlandais"
 
-#: meet/settings.py:227
+#: meet/settings.py:226
 msgid "German"
 msgstr "Allemand"

src/backend/locale/nl_NL/LC_MESSAGES/django.po

@@ -8,7 +8,7 @@ msgid ""
 msgstr ""
 "Project-Id-Version: PACKAGE VERSION\n"
 "Report-Msgid-Bugs-To: \n"
-"POT-Creation-Date: 2026-02-26 17:34+0000\n"
+"POT-Creation-Date: 2026-03-12 13:46+0000\n"
 "PO-Revision-Date: YEAR-MO-DA HO:MI+ZONE\n"
 "Last-Translator: FULL NAME <EMAIL@ADDRESS>\n"
 "Language-Team: LANGUAGE <LL@li.org>\n"
@@ -29,11 +29,11 @@ msgstr "Rechten"
 msgid "Important dates"
 msgstr "Belangrijke datums"
 
-#: core/admin.py:132 core/admin.py:243
+#: core/admin.py:132 core/admin.py:275
 msgid "No owner"
 msgstr "Geen eigenaar"
 
-#: core/admin.py:135 core/admin.py:246
+#: core/admin.py:135 core/admin.py:278
 msgid "Multiple owners"
 msgstr "Meerdere eigenaren"
 
@@ -61,116 +61,135 @@ msgstr "Meldingen succesvol verzonden voor %(count)s opname(n)."
 msgid "Skipped %(count)s expired recording(s)."
 msgstr "%(count)s verlopen opname(n) overgeslagen."
 
-#: core/admin.py:309
+#: core/admin.py:200
+msgid "Mark selected recordings as 'Failed to Stop'"
+msgstr "Geselecteerde opnames markeren als 'Mislukt bij stoppen'"
+
+#: core/admin.py:218
+#, python-format
+msgid "%(count)s recording(s) successfully marked as 'Failed to Stop'."
+msgstr "%(count)s opname(s) succesvol gemarkeerd als 'Mislukt bij stoppen'."
+
+#: core/admin.py:226
+#, fuzzy, python-format
+#| msgid "Skipped %(count)s expired recording(s)."
+msgid "Skipped %(count)s recording(s) with an ineligible status."
+msgstr "%(count)s opname(s) met een niet-toegestane status overgeslagen."
+
+#: core/admin.py:342
 msgid "No scopes"
 msgstr "Geen scopes"
 
-#: core/admin.py:311
+#: core/admin.py:344
 msgid "Scopes"
 msgstr "Scopes"
 
-#: core/api/filters.py:24
+#: core/api/filters.py:25
 msgid "Creator is me"
 msgstr "Maker ben ik"
 
-#: core/api/serializers.py:84
+#: core/api/serializers.py:88
 msgid "You must be administrator or owner of a room to add accesses to it."
 msgstr ""
 "Je moet beheerder of eigenaar van een ruimte zijn om toegang toe te voegen."
 
-#: core/api/serializers.py:443
+#: core/api/serializers.py:516
 msgid "This file extension is not allowed."
 msgstr "Deze bestandsextensie is niet toegestaan."
 
-#: core/models.py:35
+#: core/api/serializers.py:533
+msgid "You have reached the maximum number of files for this type."
+msgstr "Het maximale aantal bestanden voor dit type is bereikt."
+
+#: core/models.py:37
 msgid "Member"
 msgstr "Lid"
 
-#: core/models.py:36
+#: core/models.py:38
 msgid "Administrator"
 msgstr "Beheerder"
 
-#: core/models.py:37
+#: core/models.py:39
 msgid "Owner"
 msgstr "Eigenaar"
 
-#: core/models.py:53
+#: core/models.py:55
 msgid "Initiated"
 msgstr "Gestart"
 
-#: core/models.py:54
+#: core/models.py:56
 msgid "Active"
 msgstr "Actief"
 
-#: core/models.py:55
+#: core/models.py:57
 msgid "Stopped"
 msgstr "Gestopt"
 
-#: core/models.py:56
+#: core/models.py:58
 msgid "Saved"
 msgstr "Opgeslagen"
 
-#: core/models.py:57
+#: core/models.py:59
 msgid "Aborted"
 msgstr "Afgebroken"
 
-#: core/models.py:58
+#: core/models.py:60
 msgid "Failed to Start"
 msgstr "Starten mislukt"
 
-#: core/models.py:59
+#: core/models.py:61
 msgid "Failed to Stop"
 msgstr "Stoppen mislukt"
 
-#: core/models.py:60
+#: core/models.py:62
 msgid "Notification succeeded"
 msgstr "Notificatie geslaagd"
 
-#: core/models.py:87
+#: core/models.py:89
 msgid "SCREEN_RECORDING"
 msgstr "SCHERM_OPNAME"
 
-#: core/models.py:88
+#: core/models.py:90
 msgid "TRANSCRIPT"
 msgstr "TRANSCRIPT"
 
-#: core/models.py:94
+#: core/models.py:96
 msgid "Public Access"
 msgstr "Openbare toegang"
 
-#: core/models.py:95
+#: core/models.py:97
 msgid "Trusted Access"
 msgstr "Vertrouwde toegang"
 
-#: core/models.py:96
+#: core/models.py:98
 msgid "Restricted Access"
 msgstr "Beperkte toegang"
 
-#: core/models.py:108
+#: core/models.py:110
 msgid "id"
 msgstr "id"
 
-#: core/models.py:109
+#: core/models.py:111
 msgid "primary key for the record as UUID"
 msgstr "primaire sleutel voor het record als UUID"
 
-#: core/models.py:115
+#: core/models.py:117
 msgid "created on"
 msgstr "aangemaakt op"
 
-#: core/models.py:116
+#: core/models.py:118
 msgid "date and time at which a record was created"
 msgstr "datum en tijd waarop een record werd aangemaakt"
 
-#: core/models.py:121
+#: core/models.py:123
 msgid "updated on"
 msgstr "bijgewerkt op"
 
-#: core/models.py:122
+#: core/models.py:124
 msgid "date and time at which a record was last updated"
 msgstr "datum en tijd waarop een record voor het laatst werd bijgewerkt"
 
-#: core/models.py:142
+#: core/models.py:144
 msgid ""
 "Enter a valid sub. This value may contain only letters, numbers, and @/./+/-/"
 "_ characters."
@@ -178,11 +197,11 @@ msgstr ""
 "Voer een geldige sub in. Deze waarde mag alleen letters, cijfers en @/./+/-/"
 "_ tekens bevatten."
 
-#: core/models.py:148
+#: core/models.py:150
 msgid "sub"
 msgstr "sub"
 
-#: core/models.py:150
+#: core/models.py:152
 msgid ""
 "Optional for pending users; required upon account activation. 255 characters "
 "or fewer. Letters, numbers, and @/./+/-/_ characters only."
@@ -190,55 +209,55 @@ msgstr ""
 "Optioneel voor gebruikers in afwachting; vereist bij accountactivering. "
 "Maximum 255 tekens. Alleen letters, cijfers en @/./+/-/_ toegestaan."
 
-#: core/models.py:159
+#: core/models.py:161
 msgid "identity email address"
 msgstr "identiteit e-mailadres"
 
-#: core/models.py:164
+#: core/models.py:166
 msgid "admin email address"
 msgstr "beheerder e-mailadres"
 
-#: core/models.py:166
+#: core/models.py:168
 msgid "full name"
 msgstr "volledige naam"
 
-#: core/models.py:168
+#: core/models.py:170
 msgid "short name"
 msgstr "korte naam"
 
-#: core/models.py:174
+#: core/models.py:176
 msgid "language"
 msgstr "taal"
 
-#: core/models.py:175
+#: core/models.py:177
 msgid "The language in which the user wants to see the interface."
 msgstr "De taal waarin de gebruiker de interface wil zien."
 
-#: core/models.py:181
+#: core/models.py:183
 msgid "The timezone in which the user wants to see times."
 msgstr "De tijdzone waarin de gebruiker tijden wil zien."
 
-#: core/models.py:184
+#: core/models.py:186
 msgid "device"
 msgstr "apparaat"
 
-#: core/models.py:186
+#: core/models.py:188
 msgid "Whether the user is a device or a real user."
 msgstr "Of de gebruiker een apparaat is of een echte gebruiker."
 
-#: core/models.py:189
+#: core/models.py:191
 msgid "staff status"
 msgstr "personeelsstatus"
 
-#: core/models.py:191
+#: core/models.py:193
 msgid "Whether the user can log into this admin site."
 msgstr "Of de gebruiker kan inloggen op deze beheersite."
 
-#: core/models.py:194
+#: core/models.py:196
 msgid "active"
 msgstr "actief"
 
-#: core/models.py:197
+#: core/models.py:199
 msgid ""
 "Whether this user should be treated as active. Unselect this instead of "
 "deleting accounts."
@@ -246,64 +265,64 @@ msgstr ""
 "Of deze gebruiker als actief moet worden behandeld. Deselecteer dit in "
 "plaats van accounts te verwijderen."
 
-#: core/models.py:210
+#: core/models.py:212
 msgid "user"
 msgstr "gebruiker"
 
-#: core/models.py:211
+#: core/models.py:213
 msgid "users"
 msgstr "gebruikers"
 
-#: core/models.py:270
+#: core/models.py:272
 msgid "Resource"
 msgstr "Bron"
 
-#: core/models.py:271
+#: core/models.py:273
 msgid "Resources"
 msgstr "Bronnen"
 
-#: core/models.py:329
+#: core/models.py:331
 msgid "Resource access"
 msgstr "Brontoegang"
 
-#: core/models.py:330
+#: core/models.py:332
 msgid "Resource accesses"
 msgstr "Brontoegangsrechten"
 
-#: core/models.py:336
+#: core/models.py:338
 msgid "Resource access with this User and Resource already exists."
 msgstr "Brontoegang met deze gebruiker en bron bestaat al."
 
-#: core/models.py:392
+#: core/models.py:394
 msgid "Visio room configuration"
 msgstr "Visio-ruimteconfiguratie"
 
-#: core/models.py:393
+#: core/models.py:395
 msgid "Values for Visio parameters to configure the room."
 msgstr "Waarden voor Visio-parameters om de ruimte te configureren."
 
-#: core/models.py:400
+#: core/models.py:402
 msgid "Room PIN code"
 msgstr "Pincode van de kamer"
 
-#: core/models.py:401
+#: core/models.py:403
 msgid "Unique n-digit code that identifies this room in telephony mode."
 msgstr ""
 "Unieke n-cijferige code die deze kamer identificeert in telefonie-modus."
 
-#: core/models.py:407 core/models.py:561
+#: core/models.py:409 core/models.py:563
 msgid "Room"
 msgstr "Ruimte"
 
-#: core/models.py:408
+#: core/models.py:410
 msgid "Rooms"
 msgstr "Ruimtes"
 
-#: core/models.py:572
+#: core/models.py:574
 msgid "Worker ID"
 msgstr "Worker ID"
 
-#: core/models.py:574
+#: core/models.py:576
 msgid ""
 "Enter an identifier for the worker recording.This ID is retained even when "
 "the worker stops, allowing for easy tracking."
@@ -311,120 +330,120 @@ msgstr ""
 "Voer een identificatie in voor de worker-opname. Deze ID blijft behouden, "
 "zelfs wanneer de worker stopt, waardoor eenvoudige tracking mogelijk is."
 
-#: core/models.py:582
+#: core/models.py:584
 msgid "Recording mode"
 msgstr "Opnamemodus"
 
-#: core/models.py:583
+#: core/models.py:585
 msgid "Defines the mode of recording being called."
 msgstr "Definieert de modus van opname die wordt aangeroepen."
 
-#: core/models.py:588 core/models.py:589
+#: core/models.py:590 core/models.py:591
 msgid "Recording options"
 msgstr "Opnameopties"
 
-#: core/models.py:595
+#: core/models.py:597
 msgid "Recording"
 msgstr "Opname"
 
-#: core/models.py:596
+#: core/models.py:598
 msgid "Recordings"
 msgstr "Opnames"
 
-#: core/models.py:704
+#: core/models.py:706
 msgid "Recording/user relation"
 msgstr "Opname/gebruiker-relatie"
 
-#: core/models.py:705
+#: core/models.py:707
 msgid "Recording/user relations"
 msgstr "Opname/gebruiker-relaties"
 
-#: core/models.py:711
+#: core/models.py:713
 msgid "This user is already in this recording."
 msgstr "Deze gebruiker is al in deze opname."
 
-#: core/models.py:717
+#: core/models.py:719
 msgid "This team is already in this recording."
 msgstr "Dit team is al in deze opname."
 
-#: core/models.py:723
+#: core/models.py:725
 msgid "Either user or team must be set, not both."
 msgstr "Ofwel gebruiker of team moet worden ingesteld, niet beide."
 
-#: core/models.py:740
+#: core/models.py:742
 msgid "Create rooms"
 msgstr "Ruimtes aanmaken"
 
-#: core/models.py:741
+#: core/models.py:743
 msgid "List rooms"
 msgstr "Ruimtes weergeven"
 
-#: core/models.py:742
+#: core/models.py:744
 msgid "Retrieve room details"
 msgstr "Details van een ruimte ophalen"
 
-#: core/models.py:743
+#: core/models.py:745
 msgid "Update rooms"
 msgstr "Ruimtes bijwerken"
 
-#: core/models.py:744
+#: core/models.py:746
 msgid "Delete rooms"
 msgstr "Ruimtes verwijderen"
 
-#: core/models.py:757
+#: core/models.py:759
 msgid "Application name"
 msgstr "Naam van de applicatie"
 
-#: core/models.py:758
+#: core/models.py:760
 msgid "Descriptive name for this application."
 msgstr "Beschrijvende naam voor deze applicatie."
 
-#: core/models.py:768
+#: core/models.py:770
 msgid "Hashed on Save. Copy it now if this is a new secret."
 msgstr ""
 "Wordt gehasht bij het opslaan. Kopieer het nu als dit een nieuw geheim is."
 
-#: core/models.py:779
+#: core/models.py:781
 msgid "Application"
 msgstr "Applicatie"
 
-#: core/models.py:780
+#: core/models.py:782
 msgid "Applications"
 msgstr "Applicaties"
 
-#: core/models.py:803
+#: core/models.py:805
 msgid "Enter a valid domain"
 msgstr "Voer een geldig domein in"
 
-#: core/models.py:806
+#: core/models.py:808
 msgid "Domain"
 msgstr "Domein"
 
-#: core/models.py:807
+#: core/models.py:809
 msgid "Email domain this application can act on behalf of."
 msgstr "E-maildomein namens welke deze applicatie kan handelen."
 
-#: core/models.py:819
+#: core/models.py:821
 msgid "Application domain"
 msgstr "Applicatiedomein"
 
-#: core/models.py:820
+#: core/models.py:822
 msgid "Application domains"
 msgstr "Applicatiedomeinen"
 
-#: core/models.py:838
+#: core/models.py:840
 msgid "Pending"
 msgstr "In afwachting"
 
-#: core/models.py:846
+#: core/models.py:848
 msgid "Ready"
 msgstr "Klaar"
 
-#: core/models.py:852
+#: core/models.py:854
 msgid "Background image"
 msgstr "Achtergrondafbeelding"
 
-#: core/models.py:864
+#: core/models.py:866
 msgid "title"
 msgstr "Titel"
 
@@ -440,11 +459,11 @@ msgstr "Bestand"
 msgid "Files"
 msgstr "Bestanden"
 
-#: core/models.py:970
+#: core/models.py:1000
 msgid "This file is already hard deleted."
 msgstr "Dit bestand is al definitief verwijderd."
 
-#: core/models.py:980
+#: core/models.py:1010
 #, fuzzy
 #| msgid "To hard delete a file, it must first be soft deleted."
 msgid "To hard delete a file, it must first be soft deleted."
@@ -580,18 +599,18 @@ msgstr ""
 " Als je vragen hebt of hulp nodig hebt, neem dan contact op met ons support "
 "team via %(support_email)s. "
 
-#: meet/settings.py:224
+#: meet/settings.py:223
 msgid "English"
 msgstr "Engels"
 
-#: meet/settings.py:225
+#: meet/settings.py:224
 msgid "French"
 msgstr "Frans"
 
-#: meet/settings.py:226
+#: meet/settings.py:225
 msgid "Dutch"
 msgstr "Nederlands"
 
-#: meet/settings.py:227
+#: meet/settings.py:226
 msgid "German"
 msgstr "Duits"

src/backend/meet/settings.py

@@ -176,6 +176,13 @@ class Base(Configuration):
         environ_prefix=None,
     )
 
+    FILE_UPLOAD_ENABLED = values.BooleanValue(
+        # False to avoid a breaking change for now
+        default=False,
+        environ_name="FILE_UPLOAD_ENABLED",
+        environ_prefix=None,
+    )
+
     FILE_UPLOAD_PATH = values.Value(
         "files", environ_name="FILE_UPLOAD_PATH", environ_prefix=None
     )
@@ -188,6 +195,7 @@ class Base(Configuration):
         {
             "background_image": {
                 "max_size": 2 * MB,
+                "max_count_by_user": 10,
                 "allowed_extensions": [".jpeg", ".jpg", ".png"],
                 "allowed_mimetypes": ["image/jpeg", "image/png"],
             },
@@ -444,7 +452,11 @@ class Base(Configuration):
     CELERY_BROKER_TRANSPORT_OPTIONS = values.DictValue({}, environ_prefix=None)
 
     # Session
-    SESSION_ENGINE = "django.contrib.sessions.backends.cache"
+    SESSION_ENGINE = values.Value(
+        default="django.contrib.sessions.backends.cache",
+        environ_name="SESSION_ENGINE",
+        environ_prefix=None,
+    )
     SESSION_CACHE_ALIAS = "default"
     SESSION_COOKIE_AGE = values.PositiveIntegerValue(
         default=60 * 60 * 12, environ_name="SESSION_COOKIE_AGE", environ_prefix=None
@@ -549,12 +561,12 @@ class Base(Configuration):
         "returnTo", environ_name="OIDC_REDIRECT_FIELD_NAME", environ_prefix=None
     )
     OIDC_USERINFO_FULLNAME_FIELDS = values.ListValue(
-        default=["given_name", "usual_name"],
+        default=["first_name", "last_name"],
         environ_name="OIDC_USERINFO_FULLNAME_FIELDS",
         environ_prefix=None,
     )
     OIDC_USERINFO_SHORTNAME_FIELD = values.Value(
-        default="given_name",
+        default="first_name",
         environ_name="OIDC_USERINFO_SHORTNAME_FIELD",
         environ_prefix=None,
     )
@@ -796,6 +808,13 @@ class Base(Configuration):
         environ_prefix=None,
     )
 
+    # End-to-end encryption (passphrase-in-URL-hash mode).
+    # When True, users may opt in (account preference) to have their meetings
+    # created as end-to-end encrypted by default.
+    ENCRYPTION_ENABLED = values.BooleanValue(
+        False, environ_name="ENCRYPTION_ENABLED", environ_prefix=None
+    )
+
     # External Applications
     APPLICATION_CLIENT_ID_LENGTH = values.PositiveIntegerValue(
         40,
@@ -973,6 +992,7 @@ class Test(Base):
     APPLICATION_JWT_AUDIENCE = "Test inc."
 
     CELERY_TASK_ALWAYS_EAGER = True
+    FILE_UPLOAD_ENABLED = True
 
     def __init__(self):
         # pylint: disable=invalid-name

src/backend/pyproject.toml

@@ -2,12 +2,12 @@
 # Meet package
 #
 [build-system]
-requires = ["setuptools"]
-build-backend = "setuptools.build_meta"
+requires = ["uv_build>=0.10.9,<0.11.0"]
+build-backend = "uv_build"
 
 [project]
 name = "meet"
-version = "1.10.0"
+version = "1.12.0"
 authors = [{ "name" = "DINUM", "email" = "dev@mail.numerique.gouv.fr" }]
 classifiers = [
     "Development Status :: 5 - Production/Stable",
@@ -21,20 +21,19 @@ classifiers = [
 ]
 description = "A simple video and phone conferencing tool, powered by LiveKit"
 keywords = ["Django", "Contacts", "Templates", "RBAC"]
-license = { file = "LICENSE" }
-readme = "README.md"
+license = "MIT"
 requires-python = ">=3.13"
 dependencies = [
-    "boto3==1.42.49",
+    "boto3==1.42.68",
     "Brotli==1.2.0",
     "brevo-python==1.2.0",
     "celery[redis]==5.6.2",
-    "dj-database-url==3.1.0",
+    "dj-database-url==3.1.2",
     "django-configurations==2.5.1",
     "django-cors-headers==4.9.0",
     "django-countries==8.2.0",
     "django-filter==25.2",
-    "django-lasuite[all]==0.0.24",
+    "django-lasuite[all]==0.0.25",
     "django-parler==2.3",
     "redis==5.2.1",
     "django-redis==6.0.0",
@@ -44,21 +43,21 @@ dependencies = [
     "django==5.2.12",
     "djangorestframework==3.16.1",
     "drf_spectacular==0.29.0",
-    "dockerflow==2026.1.26",
+    "dockerflow==2026.3.4",
     "easy_thumbnails==2.10.1",
     "factory_boy==3.3.3",
     "gunicorn==25.1.0",
     "jsonschema==4.26.0",
     "markdown==3.10.2",
     "nested-multipart-parser==1.6.0",
-    "psycopg[binary]==3.3.2",
-    "pydantic==2.12.4",
-    "PyJWT==2.11.0",
+    "psycopg[binary]==3.3.3",
+    "pydantic==2.12.5",
+    "PyJWT==2.12.1",
     "python-frontmatter==1.1.0",
     "python-magic==0.4.27",
     "requests==2.32.5",
-    "sentry-sdk==2.53.0",
-    "whitenoise==6.11.0",
+    "sentry-sdk==2.54.0",
+    "whitenoise==6.12.0",
     "mozilla-django-oidc==5.0.2",
     "livekit-api==1.1.0",
     "aiohttp==3.13.3",
@@ -70,14 +69,14 @@ dependencies = [
 "Homepage" = "https://github.com/suitenumerique/meet"
 "Repository" = "https://github.com/suitenumerique/meet"
 
-[project.optional-dependencies]
+[dependency-groups]
 dev = [
     "django-extensions==4.1",
-    "drf-spectacular-sidecar==2026.1.1",
+    "drf-spectacular-sidecar==2026.3.1",
     "freezegun==1.5.5",
     "ipdb==0.13.13",
-    "ipython==9.10.0",
-    "pyfakefs==6.1.1",
+    "ipython==9.11.0",
+    "pyfakefs==6.1.5",
     "pylint-django==2.7.0",
     "pylint<4.0.0",
     "pytest-cov==7.0.0",
@@ -85,17 +84,23 @@ dev = [
     "pytest==9.0.2",
     "pytest-icdiff==0.9",
     "pytest-xdist==3.8.0",
-    "responses==0.25.8",
-    "ruff==0.15.1",
+    "responses==0.26.0",
+    "ruff==0.15.6",
     "types-requests==2.32.4.20260107",
 ]
 
-[tool.setuptools]
-packages = { find = { where = ["."], exclude = ["tests"] } }
-zip-safe = true
-
-[tool.distutils.bdist_wheel]
-universal = true
+[tool.uv.build-backend]
+module-name = [
+    "core",
+    "demo",
+    "meet"
+]
+module-root = ""
+source-exclude = [
+    "**/tests/**",
+    "**/test_*.py",
+    "**/tests.py",
+]
 
 [tool.ruff]
 exclude = [

src/frontend/package.json

@@ -1,7 +1,7 @@
 {
   "name": "meet",
   "private": true,
-  "version": "1.10.0",
+  "version": "1.12.0",
   "type": "module",
   "scripts": {
     "dev": "panda codegen && vite",
@@ -10,7 +10,9 @@
     "preview": "vite preview",
     "i18n:extract": "npx i18next -c i18next-parser.config.json",
     "format": "prettier --write ./src",
-    "check": "prettier --check ./src"
+    "check": "prettier --check ./src",
+    "test": "vitest run",
+    "test:watch": "vitest"
   },
   "dependencies": {
     "@fontsource-variable/material-symbols-outlined": "5.2.34",
@@ -59,10 +61,12 @@
     "eslint-plugin-jsx-a11y": "6.10.2",
     "eslint-plugin-react-hooks": "5.2.0",
     "eslint-plugin-react-refresh": "0.4.20",
+    "jsdom": "^29.0.2",
     "postcss": "8.5.6",
     "prettier": "3.8.1",
     "typescript": "5.8.3",
     "vite": "7.3.1",
-    "vite-tsconfig-paths": "6.1.1"
+    "vite-tsconfig-paths": "6.1.1",
+    "vitest": "^4.1.3"
   }
 }

src/frontend/src/api/fetchApi.ts

@@ -15,7 +15,19 @@ export const fetchApi = async <T = Record<string, unknown>>(
       ...options?.headers,
     },
   })
-  const result = await response.json()
+
+  let result: T
+  if (response.status === 204) {
+    result = undefined as T
+  } else {
+    const contentType = response.headers.get('content-type') ?? ''
+    if (!contentType.includes('application/json')) {
+      result = undefined as T
+    } else {
+      result = (await response.json()) as T
+    }
+  }
+
   if (!response.ok) {
     throw new ApiError(response.status, result)
   }

src/frontend/src/api/queryKeys.ts

@@ -5,4 +5,5 @@ export const keys = {
   requestEntry: 'requestEntry',
   waitingParticipants: 'waitingParticipants',
   roomCreationCallback: 'roomCreationCallback',
+  files: 'files',
 }

src/frontend/src/api/useConfig.ts

@@ -30,6 +30,13 @@ export interface ApiConfig {
     expiration_days?: number
     max_duration?: number
   }
+  background_image: {
+    upload_is_enabled: boolean
+    max_size: number
+    max_count_by_user: number
+    allowed_extensions: string[]
+    allowed_mimetypes: string[]
+  }
   subtitle: {
     enabled: boolean
   }
@@ -45,6 +52,9 @@ export interface ApiConfig {
     enable_firefox_proxy_workaround: boolean
     default_sources: string[]
   }
+  encryption?: {
+    enabled: boolean
+  }
   transcription_destination?: string
 }
 

src/frontend/src/components/Avatar.tsx

@@ -57,7 +57,7 @@ export const Avatar = ({
   style,
   ...props
 }: AvatarProps) => {
-  const initial = name?.trim()?.charAt(0) ?? ''
+  const initial = name?.trim()?.charAt(0)?.toUpperCase() ?? ''
   return (
     <div
       style={{
@@ -70,7 +70,7 @@ export const Avatar = ({
       <span
         aria-hidden="true"
         className={css({
-          marginTop: '-0.3rem',
+          lineHeight: 1,
         })}
       >
         {initial}

src/frontend/src/features/auth/api/ApiUser.ts

@@ -3,8 +3,10 @@ import { BackendLanguage } from '@/utils/languages'
 export type ApiUser = {
   id: string
   email: string
-  full_name: string
+  full_name: string | null
+  short_name: string | null
   last_name: string
   language: BackendLanguage
   timezone: string
+  default_encryption: boolean
 }

src/frontend/src/features/auth/api/updateUserPreferences.ts

@@ -1,15 +1,18 @@
 import { type ApiUser } from './ApiUser'
 import { fetchApi } from '@/api/fetchApi'
 
-export type ApiUserPreferences = Pick<ApiUser, 'id' | 'timezone' | 'language'>
+export type ApiUserPreferences = Partial<
+  Pick<ApiUser, 'timezone' | 'language' | 'default_encryption'>
+> & { id: string }
 
 export const updateUserPreferences = async ({
   user,
 }: {
   user: ApiUserPreferences
 }): Promise<ApiUser> => {
-  return await fetchApi(`/users/${user.id}/`, {
-    method: 'PUT',
-    body: JSON.stringify({ timezone: user.timezone, language: user.language }),
+  const { id, ...payload } = user
+  return await fetchApi(`/users/${id}/`, {
+    method: 'PATCH',
+    body: JSON.stringify(payload),
   })
 }

src/frontend/src/features/encryption/DecryptionFailedTileOverlay.tsx

@@ -0,0 +1,100 @@
+/**
+ * Small banner shown on a participant tile when LiveKit raises an
+ * EncryptionError for that participant — typically a passphrase/key
+ * mismatch ("you and they don't share the same encryption key"). The
+ * avatar stays visible behind the banner.
+ *
+ * Cleared automatically once frames decrypt again
+ * (ParticipantEncryptionStatusChanged with encrypted=true).
+ */
+import { useEffect, useState } from 'react'
+import { useTranslation } from 'react-i18next'
+import { Participant, RoomEvent } from 'livekit-client'
+import { useRoomContext } from '@livekit/components-react'
+import { RiLockFill } from '@remixicon/react'
+
+import { useRoomData } from '@/features/rooms/livekit/hooks/useRoomData'
+
+interface Props {
+  participant: Participant
+}
+
+export function DecryptionFailedTileOverlay({ participant }: Props) {
+  const { t } = useTranslation('rooms', {
+    keyPrefix: 'encryption.decryptionFailed',
+  })
+  const room = useRoomContext()
+  const roomData = useRoomData()
+
+  const [failed, setFailed] = useState(false)
+
+  useEffect(() => {
+    if (!roomData?.is_encrypted) return
+    if (participant.isLocal) return
+
+    const identity = participant.identity
+
+    const onError = (_err: Error, p?: Participant) => {
+      if (p?.identity === identity) setFailed(true)
+    }
+    const onStatus = (encrypted: boolean, p?: Participant) => {
+      if (p?.identity === identity && encrypted) setFailed(false)
+    }
+
+    room.on(RoomEvent.EncryptionError, onError)
+    room.on(RoomEvent.ParticipantEncryptionStatusChanged, onStatus)
+    return () => {
+      room.off(RoomEvent.EncryptionError, onError)
+      room.off(RoomEvent.ParticipantEncryptionStatusChanged, onStatus)
+    }
+  }, [room, roomData?.is_encrypted, participant])
+
+  if (!failed) return null
+
+  return (
+    <div
+      style={{
+        position: 'absolute',
+        bottom: '2.5rem',
+        left: '50%',
+        transform: 'translateX(-50%)',
+        backgroundColor: 'rgba(0, 0, 0, 0.75)',
+        borderRadius: '0.5rem',
+        padding: '0.6rem 1rem',
+        display: 'flex',
+        flexDirection: 'column',
+        alignItems: 'center',
+        gap: '0.3rem',
+        maxWidth: '85%',
+        zIndex: 4,
+        pointerEvents: 'none',
+      }}
+      role="status"
+    >
+      <div
+        style={{
+          display: 'flex',
+          alignItems: 'center',
+          gap: '0.4rem',
+          color: '#f87171',
+          fontSize: '0.85rem',
+          fontWeight: 600,
+        }}
+      >
+        <RiLockFill size={14} />
+        <span>{t('title')}</span>
+      </div>
+      <div
+        style={{
+          color: '#d1d5db',
+          fontSize: '0.75rem',
+          textAlign: 'center',
+          lineHeight: 1.4,
+          maxWidth: '22rem',
+        }}
+      >
+        {t('body')}
+      </div>
+    </div>
+  )
+}

src/frontend/src/features/encryption/EncryptionAutoResumeWatcher.tsx

@@ -0,0 +1,46 @@
+/**
+ * When the participant who paused encryption sees that *both* recording and
+ * transcription have stopped, automatically broadcast `ENCRYPTION_RESUMED`.
+ *
+ * Other participants don't run this watcher: only the pauser can resume
+ * (they're the one with `pausedByMe=true`). If they leave the room, the next
+ * leader/admin can manually resume from the Settings panel — or in v1 the
+ * room simply stays paused for the rest of the session.
+ */
+import { useEffect, useRef } from 'react'
+import { useIsRecording } from '@livekit/components-react'
+import { RecordingMode, useRecordingStatuses } from '@/features/recording'
+import { EncryptionPhase } from './encryptionStatusTypes'
+import { useEncryptionStatus } from './useEncryptionStatus'
+
+export function EncryptionAutoResumeWatcher() {
+  const { phase, pausedByMe, resumeEncryption } = useEncryptionStatus()
+  const isLiveKitRecording = useIsRecording()
+  const transcriptStatuses = useRecordingStatuses(RecordingMode.Transcript)
+  const screenRecStatuses = useRecordingStatuses(RecordingMode.ScreenRecording)
+
+  // Edge guard: avoid resuming on the initial render before anything has
+  // actually started. We only resume after we've observed an active state.
+  const wasActiveRef = useRef(false)
+  const isAnyActive =
+    isLiveKitRecording ||
+    transcriptStatuses.isActive ||
+    screenRecStatuses.isActive
+
+  useEffect(() => {
+    if (isAnyActive) {
+      wasActiveRef.current = true
+    }
+  }, [isAnyActive])
+
+  useEffect(() => {
+    if (phase !== EncryptionPhase.PAUSED) return
+    if (!pausedByMe) return
+    if (!wasActiveRef.current) return
+    if (isAnyActive) return
+
+    void resumeEncryption()
+  }, [phase, pausedByMe, isAnyActive, resumeEncryption])
+
+  return null
+}

src/frontend/src/features/encryption/EncryptionMismatchScreen.tsx

@@ -0,0 +1,104 @@
+/**
+ * Shown when the URL hash and the room's `is_encrypted` flag disagree.
+ *
+ *  - missingPassphrase: room is encrypted on the server, but the URL has no
+ *    (or an invalid) passphrase. The user opened the wrong link.
+ *  - unexpectedPassphrase: the URL has a passphrase, but the server says the
+ *    room is not encrypted. Either the room was created differently or the
+ *    link looks tampered with — either way, joining as "encrypted" would
+ *    leave the user alone in an encrypted bubble. Better to bail.
+ */
+import { css } from '@/styled-system/css'
+import { Center } from '@/styled-system/jsx'
+import { useTranslation } from 'react-i18next'
+import { RiAlertLine, RiLockUnlockLine } from '@remixicon/react'
+import { Button, Text } from '@/primitives'
+import { Screen } from '@/layout/Screen'
+import { CenteredContent } from '@/layout/CenteredContent'
+import { navigateTo } from '@/navigation/navigateTo'
+import {
+  generateRoomId,
+  useCreateRoom,
+} from '@/features/rooms'
+import { generatePassphrase } from './passphrase'
+
+interface Props {
+  reason: 'missingPassphrase' | 'unexpectedPassphrase'
+}
+
+export function EncryptionMismatchScreen({ reason }: Props) {
+  const { t } = useTranslation('rooms', { keyPrefix: 'encryption.mismatch' })
+  const { mutateAsync: createRoom } = useCreateRoom()
+
+  const handleCreateFresh = async () => {
+    const slug = generateRoomId()
+    const hash = generatePassphrase()
+    const room = await createRoom({ slug, isEncrypted: true })
+    navigateTo('room', room.slug, {
+      state: { create: true, initialRoomData: room },
+    })
+    window.history.replaceState(
+      window.history.state,
+      '',
+      `${window.location.pathname}#${hash}`
+    )
+  }
+
+  return (
+    <Screen layout="centered">
+      <CenteredContent withBackButton>
+        <Center>
+          <div
+            className={css({
+              maxWidth: '420px',
+              padding: '2rem',
+              borderRadius: '1rem',
+              backgroundColor: 'white',
+              border: '1px solid',
+              borderColor: 'greyscale.200',
+              boxShadow: '0 4px 16px rgba(0,0,0,0.06)',
+              display: 'flex',
+              flexDirection: 'column',
+              alignItems: 'center',
+              gap: '1rem',
+              textAlign: 'center',
+            })}
+          >
+            <div
+              className={css({
+                width: '3.5rem',
+                height: '3.5rem',
+                borderRadius: '50%',
+                backgroundColor: '#fffbeb',
+                display: 'flex',
+                alignItems: 'center',
+                justifyContent: 'center',
+              })}
+            >
+              {reason === 'missingPassphrase' ? (
+                <RiLockUnlockLine size={28} color="#b45309" />
+              ) : (
+                <RiAlertLine size={28} color="#b45309" />
+              )}
+            </div>
+            <Text
+              as="h2"
+              className={css({ fontWeight: 700, fontSize: '1.15rem' })}
+            >
+              {t(`${reason}.title`)}
+            </Text>
+            <Text
+              as="p"
+              className={css({ fontSize: '0.9rem', color: 'greyscale.700' })}
+            >
+              {t(`${reason}.body`)}
+            </Text>
+            <Button variant="primary" onPress={handleCreateFresh}>
+              {t('createFresh')}
+            </Button>
+          </div>
+        </Center>
+      </CenteredContent>
+    </Screen>
+  )
+}

src/frontend/src/features/encryption/EncryptionStatusContext.tsx

@@ -0,0 +1,384 @@
+/**
+ * In-call encryption state machine and pause protocol.
+ *
+ * Three phases:
+ *  - UNENCRYPTED   — the room is not end-to-end encrypted.
+ *  - ENCRYPTED     — E2EE is active; frames are encrypted with the URL passphrase.
+ *  - PAUSED        — encryption is temporarily paused for this session, typically
+ *                    so the SFU can record / transcribe.
+ *
+ * The "paused" state is intentionally ephemeral: it is never persisted in the
+ * database. The truth source for "this call is encrypted" is the presence of
+ * the passphrase in the URL hash, not a server-side flag — a hacked server
+ * cannot fabricate a passphrase that all participants happen to share.
+ *
+ * Pause is broadcast over a LiveKit reliable data channel. While the sender
+ * has not yet flipped its own state, the message itself travels encrypted,
+ * which is the trust anchor: only callers who hold the passphrase can produce
+ * frames everyone can decrypt.
+ *
+ * Pause is reversible: when both recording and transcription have stopped,
+ * the participant who initiated the pause broadcasts ENCRYPTION_RESUMED and
+ * everyone re-enables E2EE with the same URL passphrase.
+ *
+ * Initiation: admins can always pause/resume. If no admin is in the room and
+ * a pause has already been observed in this session (everSeenPause), the
+ * leader (oldest non-SIP participant) may also pause/resume — this covers
+ * the "the admin left mid-call" edge case without granting unsolicited
+ * pause power to non-admins.
+ */
+import {
+  ReactNode,
+  useCallback,
+  useEffect,
+  useMemo,
+  useRef,
+  useState,
+} from 'react'
+import { useRoomContext } from '@livekit/components-react'
+import {
+  DataPacket_Kind,
+  Participant,
+  ParticipantKind,
+  RemoteParticipant,
+  RoomEvent,
+} from 'livekit-client'
+import { EncryptionStatusContext } from './encryptionStatusContextValue'
+import { EncryptionPhase, PauseReason } from './encryptionStatusTypes'
+
+const ENCRYPTION_TOPIC = 'encryption-state'
+const PROBE_RESPONSE_GRACE_MS = 2500
+
+const textEncoder = new TextEncoder()
+const textDecoder = new TextDecoder()
+
+interface ProtocolMessage {
+  type:
+    | 'ENCRYPTION_PAUSED'
+    | 'ENCRYPTION_RESUMED'
+    | 'ENCRYPTION_STATUS_PROBE'
+  reason?: PauseReason
+  /** Sender's `joinedAt` timestamp; used in leader election. */
+  senderJoinedAt?: number
+  /** Whether the sender is a room admin/owner. */
+  senderIsAdmin?: boolean
+}
+
+function encodeMessage(msg: ProtocolMessage): Uint8Array {
+  return textEncoder.encode(JSON.stringify(msg))
+}
+
+function decodeMessage(payload: Uint8Array): ProtocolMessage | null {
+  try {
+    return JSON.parse(textDecoder.decode(payload)) as ProtocolMessage
+  } catch {
+    return null
+  }
+}
+
+function isParticipantAdmin(participant: Participant | undefined): boolean {
+  return participant?.attributes?.room_admin === 'true'
+}
+
+function isParticipantPhoneOrSip(p: Participant): boolean {
+  return p.kind === ParticipantKind.SIP
+}
+
+interface EncryptionStatusProviderProps {
+  children: ReactNode
+  /** Whether this room is end-to-end encrypted. */
+  isEncrypted: boolean
+  /** Called when the local client should toggle E2EE on/off. */
+  onPhaseChange?: (phase: EncryptionPhase) => void
+  /**
+   * Optional hook to mirror local pause/resume to the room's
+   * server-side encryption_paused field. When provided, recording and
+   * transcription pauses also propagate to the SIP gateway (so phone
+   * callers transition out of placeholder mode automatically).
+   */
+  setServerEncryptionPaused?: (paused: boolean) => Promise<void> | void
+}
+
+export function EncryptionStatusProvider({
+  children,
+  isEncrypted,
+  onPhaseChange,
+  setServerEncryptionPaused,
+}: EncryptionStatusProviderProps) {
+  const room = useRoomContext()
+  const initialPhase = isEncrypted
+    ? EncryptionPhase.ENCRYPTED
+    : EncryptionPhase.UNENCRYPTED
+  const [phase, setPhase] = useState<EncryptionPhase>(initialPhase)
+  const [pauseReason, setPauseReason] = useState<PauseReason | undefined>()
+  const [pausedByMe, setPausedByMe] = useState(false)
+  const everSeenPauseRef = useRef(false)
+  const phaseRef = useRef(phase)
+  phaseRef.current = phase
+
+  // When the encrypted flag changes (e.g. on initial room data load), align
+  // the local phase. The pause path keeps phase=PAUSED across updates.
+  useEffect(() => {
+    if (!isEncrypted && phaseRef.current !== EncryptionPhase.UNENCRYPTED) {
+      setPhase(EncryptionPhase.UNENCRYPTED)
+      setPauseReason(undefined)
+      setPausedByMe(false)
+    } else if (
+      isEncrypted &&
+      phaseRef.current === EncryptionPhase.UNENCRYPTED
+    ) {
+      setPhase(EncryptionPhase.ENCRYPTED)
+    }
+  }, [isEncrypted])
+
+  // Push phase transitions to LiveKit (E2EE on/off + republish).
+  useEffect(() => {
+    onPhaseChange?.(phase)
+  }, [phase, onPhaseChange])
+
+  const sendProtocolMessage = useCallback(
+    async (msg: ProtocolMessage, destination?: string[]) => {
+      try {
+        await room.localParticipant.publishData(encodeMessage(msg), {
+          reliable: true,
+          topic: ENCRYPTION_TOPIC,
+          destinationIdentities: destination,
+        })
+      } catch (err) {
+        console.error('[encryption] failed to publish protocol message', err)
+      }
+    },
+    [room]
+  )
+
+  /**
+   * Determine whether we (locally) consider `sender` legitimate to issue
+   * pause/resume messages.
+   *
+   * Always true for admins. For non-admins, true only if there is no admin
+   * currently in the room AND the sender is the oldest non-SIP participant
+   * we know of (deterministic across peers via joinedAt+identity).
+   */
+  const isLegitimatePauseSender = useCallback(
+    (sender: RemoteParticipant | undefined): boolean => {
+      if (!sender) return false
+      if (isParticipantAdmin(sender)) return true
+
+      const everyone: Participant[] = [
+        room.localParticipant,
+        ...Array.from(room.remoteParticipants.values()),
+      ]
+      const adminPresent = everyone.some(isParticipantAdmin)
+      if (adminPresent) return false
+
+      const eligible = everyone.filter((p) => !isParticipantPhoneOrSip(p))
+      const sorted = eligible.sort((a, b) => {
+        const aJ = a.joinedAt?.getTime() ?? Number.MAX_SAFE_INTEGER
+        const bJ = b.joinedAt?.getTime() ?? Number.MAX_SAFE_INTEGER
+        if (aJ !== bJ) return aJ - bJ
+        return a.identity.localeCompare(b.identity)
+      })
+      const leader = sorted[0]
+      return !!leader && leader.identity === sender.identity
+    },
+    [room]
+  )
+
+  /** Same logic but applied to the local participant (am I allowed to act?). */
+  const localCanInitiate = useCallback((): boolean => {
+    if (isParticipantAdmin(room.localParticipant)) return true
+    if (!everSeenPauseRef.current) return false
+
+    const everyone: Participant[] = [
+      room.localParticipant,
+      ...Array.from(room.remoteParticipants.values()),
+    ]
+    if (everyone.some(isParticipantAdmin)) return false
+
+    const eligible = everyone.filter((p) => !isParticipantPhoneOrSip(p))
+    const sorted = eligible.sort((a, b) => {
+      const aJ = a.joinedAt?.getTime() ?? Number.MAX_SAFE_INTEGER
+      const bJ = b.joinedAt?.getTime() ?? Number.MAX_SAFE_INTEGER
+      if (aJ !== bJ) return aJ - bJ
+      return a.identity.localeCompare(b.identity)
+    })
+    return sorted[0]?.identity === room.localParticipant.identity
+  }, [room])
+
+  const handlePauseAnnouncement = useCallback(
+    (msg: ProtocolMessage, sender?: RemoteParticipant) => {
+      if (!isLegitimatePauseSender(sender)) return
+      everSeenPauseRef.current = true
+      if (phaseRef.current !== EncryptionPhase.ENCRYPTED) return
+
+      setPhase(EncryptionPhase.PAUSED)
+      setPauseReason(msg.reason)
+      setPausedByMe(false)
+    },
+    [isLegitimatePauseSender]
+  )
+
+  const handleResumeAnnouncement = useCallback(
+    (sender?: RemoteParticipant) => {
+      if (!isLegitimatePauseSender(sender)) return
+      if (phaseRef.current !== EncryptionPhase.PAUSED) return
+
+      setPhase(EncryptionPhase.ENCRYPTED)
+      setPauseReason(undefined)
+      setPausedByMe(false)
+    },
+    [isLegitimatePauseSender]
+  )
+
+  const handleProbe = useCallback(
+    (sender: RemoteParticipant) => {
+      if (phaseRef.current !== EncryptionPhase.PAUSED) return
+      // We respond if we ourselves are a legitimate sender for this room.
+      if (!localCanInitiate()) return
+
+      void sendProtocolMessage(
+        {
+          type: 'ENCRYPTION_PAUSED',
+          reason: pauseReason,
+          senderIsAdmin: isParticipantAdmin(room.localParticipant),
+          senderJoinedAt:
+            room.localParticipant.joinedAt?.getTime() ?? Date.now(),
+        },
+        [sender.identity]
+      )
+    },
+    [room, pauseReason, sendProtocolMessage, localCanInitiate]
+  )
+
+  // Subscribe to encryption-channel data messages.
+  useEffect(() => {
+    if (!isEncrypted) return
+
+    const handler = (
+      payload: Uint8Array,
+      participant?: RemoteParticipant,
+      _kind?: DataPacket_Kind,
+      topic?: string
+    ) => {
+      if (topic !== ENCRYPTION_TOPIC) return
+      const msg = decodeMessage(payload)
+      if (!msg) return
+      if (msg.type === 'ENCRYPTION_PAUSED') {
+        handlePauseAnnouncement(msg, participant)
+      } else if (msg.type === 'ENCRYPTION_RESUMED') {
+        handleResumeAnnouncement(participant)
+      } else if (msg.type === 'ENCRYPTION_STATUS_PROBE' && participant) {
+        handleProbe(participant)
+      }
+    }
+
+    room.on(RoomEvent.DataReceived, handler)
+    return () => {
+      room.off(RoomEvent.DataReceived, handler)
+    }
+  }, [
+    room,
+    isEncrypted,
+    handlePauseAnnouncement,
+    handleResumeAnnouncement,
+    handleProbe,
+  ])
+
+  // On join, ask the room whether encryption is currently paused.
+  useEffect(() => {
+    if (!isEncrypted) return
+    if (phase !== EncryptionPhase.ENCRYPTED) return
+
+    let cancelled = false
+    const timer = setTimeout(() => {
+      if (cancelled) return
+      void sendProtocolMessage({ type: 'ENCRYPTION_STATUS_PROBE' })
+    }, 0)
+    const cleanup = setTimeout(() => {
+      // Nothing to do — if no answer arrived, we stay encrypted.
+    }, PROBE_RESPONSE_GRACE_MS)
+
+    return () => {
+      cancelled = true
+      clearTimeout(timer)
+      clearTimeout(cleanup)
+    }
+    // we intentionally only run this when joining the encrypted state
+    // eslint-disable-next-line react-hooks/exhaustive-deps
+  }, [isEncrypted])
+
+  const pauseEncryption = useCallback(
+    async (reason: PauseReason) => {
+      if (phaseRef.current !== EncryptionPhase.ENCRYPTED) return false
+      if (!localCanInitiate()) return false
+
+      everSeenPauseRef.current = true
+      setPhase(EncryptionPhase.PAUSED)
+      setPauseReason(reason)
+      setPausedByMe(true)
+
+      // Mirror to the server's encryption_paused field if a setter was
+      // wired through. This is what makes the SIP gateway transition out
+      // of placeholder mode for recording/transcription too, not just
+      // for an explicit admin pause from the Admin panel.
+      if (setServerEncryptionPaused) {
+        try {
+          await setServerEncryptionPaused(true)
+        } catch (err) {
+          console.error('[encryption] server-side pause failed', err)
+        }
+      }
+
+      await sendProtocolMessage({
+        type: 'ENCRYPTION_PAUSED',
+        reason,
+        senderIsAdmin: isParticipantAdmin(room.localParticipant),
+        senderJoinedAt:
+          room.localParticipant.joinedAt?.getTime() ?? Date.now(),
+      })
+      return true
+    },
+    [room, sendProtocolMessage, localCanInitiate, setServerEncryptionPaused]
+  )
+
+  const resumeEncryption = useCallback(async () => {
+    if (phaseRef.current !== EncryptionPhase.PAUSED) return false
+    if (!localCanInitiate()) return false
+
+    setPhase(EncryptionPhase.ENCRYPTED)
+    setPauseReason(undefined)
+    setPausedByMe(false)
+
+    if (setServerEncryptionPaused) {
+      try {
+        await setServerEncryptionPaused(false)
+      } catch (err) {
+        console.error('[encryption] server-side resume failed', err)
+      }
+    }
+
+    await sendProtocolMessage({
+      type: 'ENCRYPTION_RESUMED',
+      senderIsAdmin: isParticipantAdmin(room.localParticipant),
+      senderJoinedAt: room.localParticipant.joinedAt?.getTime() ?? Date.now(),
+    })
+    return true
+  }, [room, sendProtocolMessage, localCanInitiate, setServerEncryptionPaused])
+
+  const value = useMemo(
+    () => ({
+      phase,
+      pauseReason,
+      pausedByMe,
+      pauseEncryption,
+      resumeEncryption,
+    }),
+    [phase, pauseReason, pausedByMe, pauseEncryption, resumeEncryption]
+  )
+
+  return (
+    <EncryptionStatusContext.Provider value={value}>
+      {children}
+    </EncryptionStatusContext.Provider>
+  )
+}

src/frontend/src/features/encryption/EncryptionStatusSnackbars.tsx

@@ -0,0 +1,212 @@
+/**
+ * Transient bottom snackbars announcing encryption state changes:
+ *  - "Encryption paused while transcription is on"
+ *  - "Encryption was turned off for this meeting"
+ *  - "A participant can't decrypt this meeting" (admin only, with CTA)
+ */
+import { useEffect, useRef, useState } from 'react'
+import { useTranslation } from 'react-i18next'
+import { css } from '@/styled-system/css'
+import { HStack, VStack } from '@/styled-system/jsx'
+import { Button, Text } from '@/primitives'
+import { ParticipantKind, RemoteParticipant } from 'livekit-client'
+import { useRemoteParticipants } from '@livekit/components-react'
+import { useIsAdminOrOwner } from '@/features/rooms/livekit/hooks/useIsAdminOrOwner'
+import { useSidePanel } from '@/features/rooms/livekit/hooks/useSidePanel'
+import { EncryptionPhase, PauseReason } from './encryptionStatusTypes'
+import { useEncryptionStatus } from './useEncryptionStatus'
+
+const DISPLAY_DURATION_MS = 8000
+
+const SnackbarShell = ({ children }: { children: React.ReactNode }) => (
+  <div
+    className={css({
+      position: 'fixed',
+      bottom: '5rem',
+      right: '1rem',
+      zIndex: 1500,
+      maxWidth: '24rem',
+      padding: '0.85rem 1rem',
+      backgroundColor: '#1e3a5f',
+      borderRadius: '0.5rem',
+      boxShadow: '0 10px 30px rgba(0,0,0,0.25)',
+    })}
+    role="status"
+  >
+    {children}
+  </div>
+)
+
+function useTransient<T>(value: T, displayMs: number) {
+  const [shown, setShown] = useState<T | null>(null)
+  const timer = useRef<ReturnType<typeof setTimeout> | null>(null)
+
+  useEffect(() => {
+    if (!value) return
+    setShown(value)
+    if (timer.current) clearTimeout(timer.current)
+    timer.current = setTimeout(() => setShown(null), displayMs)
+    return () => {
+      if (timer.current) clearTimeout(timer.current)
+    }
+  }, [value, displayMs])
+
+  return [shown, () => setShown(null)] as const
+}
+
+export function EncryptionStatusSnackbars() {
+  const { t } = useTranslation('rooms', { keyPrefix: 'encryption.snackbar' })
+  const { phase, pauseReason, pausedByMe } = useEncryptionStatus()
+  const remoteParticipants = useRemoteParticipants()
+  const isAdmin = useIsAdminOrOwner()
+  const { toggleAdmin, isAdminOpen } = useSidePanel()
+
+  const [pauseSignal, setPauseSignal] = useState<{
+    reason?: PauseReason
+    pausedByMe: boolean
+  } | null>(null)
+
+  const previousPhase = useRef(phase)
+  useEffect(() => {
+    if (
+      previousPhase.current !== EncryptionPhase.PAUSED &&
+      phase === EncryptionPhase.PAUSED
+    ) {
+      setPauseSignal({ reason: pauseReason, pausedByMe })
+    }
+    previousPhase.current = phase
+  }, [phase, pauseReason, pausedByMe])
+
+  const [pauseToast, dismissPauseToast] = useTransient(
+    pauseSignal,
+    DISPLAY_DURATION_MS
+  )
+
+  // The SIP-blocked snackbar persists as long as a SIP participant is
+  // present in the encrypted room — admin needs to either pause encryption
+  // (Settings → Security → This meeting) or wait for the SIP user to hang
+  // up. Manual dismiss hides it until a different SIP participant arrives.
+  //
+  // useRemoteParticipants re-renders on participant join/leave/state — that
+  // gives us a reactive participant list without manual event listeners,
+  // which is more reliable than the prior subscribe-on-mount approach.
+  const [sipDismissedIdentity, setSipDismissedIdentity] = useState<string | null>(null)
+
+  const isSip = (p: RemoteParticipant) =>
+    p.kind === ParticipantKind.SIP || p.identity.startsWith('sip_')
+
+  const sipParticipant =
+    isAdmin && phase === EncryptionPhase.ENCRYPTED
+      ? remoteParticipants.find(isSip) ?? null
+      : null
+
+  const sipLabel = sipParticipant
+    ? sipParticipant.name || sipParticipant.identity
+    : null
+
+  const showSipSnack =
+    sipParticipant !== null &&
+    sipDismissedIdentity !== sipParticipant.identity
+
+  return (
+    <>
+      {pauseToast && (
+        <SnackbarShell>
+          <HStack
+            gap="1rem"
+            justify="space-between"
+            alignItems="center"
+            className={css({ width: '100%' })}
+          >
+            <VStack gap="0.15rem" alignItems="start">
+              <Text
+                variant="sm"
+                margin={false}
+                className={css({ color: 'white', fontWeight: 600 })}
+              >
+                {pauseToast.pausedByMe
+                  ? t('pausedByMeTitle')
+                  : t('pausedTitle')}
+              </Text>
+              <Text
+                variant="note"
+                margin={false}
+                className={css({
+                  color: 'rgba(255,255,255,0.85)',
+                  fontSize: '0.8rem',
+                })}
+              >
+                {pauseToast.reason === 'transcript'
+                  ? t('reasonTranscript')
+                  : pauseToast.reason === 'recording'
+                    ? t('reasonRecording')
+                    : pauseToast.reason === 'sip_participant'
+                      ? t('reasonSip')
+                      : t('reasonManual')}
+              </Text>
+            </VStack>
+            <Button
+              size="sm"
+              variant="text"
+              onPress={dismissPauseToast}
+              className={css({ color: 'white !important' })}
+            >
+              {t('dismiss')}
+            </Button>
+          </HStack>
+        </SnackbarShell>
+      )}
+      {showSipSnack && phase === EncryptionPhase.ENCRYPTED && (
+        <SnackbarShell>
+          <HStack
+            gap="1rem"
+            justify="space-between"
+            alignItems="center"
+            className={css({ width: '100%' })}
+          >
+            <VStack gap="0.15rem" alignItems="start">
+              <Text
+                variant="sm"
+                margin={false}
+                className={css({ color: 'white', fontWeight: 600 })}
+              >
+                {t('sipTitle')}
+              </Text>
+              <Text
+                variant="note"
+                margin={false}
+                className={css({
+                  color: 'rgba(255,255,255,0.85)',
+                  fontSize: '0.8rem',
+                })}
+              >
+                {t('sipBody', { name: sipLabel })}
+              </Text>
+            </VStack>
+            {!isAdminOpen && (
+              <Button
+                size="sm"
+                variant="text"
+                className={css({ color: 'white !important' })}
+                onPress={toggleAdmin}
+              >
+                {t('openAdmin')}
+              </Button>
+            )}
+            <Button
+              size="sm"
+              variant="text"
+              className={css({ color: 'white !important' })}
+              onPress={() =>
+                sipParticipant &&
+                setSipDismissedIdentity(sipParticipant.identity)
+              }
+            >
+              {t('dismiss')}
+            </Button>
+          </HStack>
+        </SnackbarShell>
+      )}
+    </>
+  )
+}

src/frontend/src/features/encryption/IdentityBadge.tsx

@@ -0,0 +1,67 @@
+/**
+ * Tiny per-participant identity confidence pill, shown in encrypted meetings.
+ *
+ * - "ProConnect" → server-verified identity (the participant signed in).
+ * - "Anonymous"  → self-declared name; treat with caution.
+ *
+ * Sourced from the `is_authenticated` JWT attribute set in
+ * `core/utils.py::generate_token` (or the equivalent flag on a lobby
+ * participant). No fingerprints, no email — just a one-glance signal.
+ */
+import { css } from '@/styled-system/css'
+import { RiShieldCheckFill, RiUserLine } from '@remixicon/react'
+import { useTranslation } from 'react-i18next'
+import type { Participant } from 'livekit-client'
+
+interface BadgeProps {
+  size?: 'sm' | 'md'
+}
+
+interface FromParticipantProps extends BadgeProps {
+  participant: Participant
+  isAuthenticated?: never
+}
+
+interface FromFlagProps extends BadgeProps {
+  isAuthenticated: boolean
+  participant?: never
+}
+
+export function IdentityBadge(props: FromParticipantProps | FromFlagProps) {
+  const { t } = useTranslation('rooms', { keyPrefix: 'identity' })
+  const isAuthenticated =
+    props.participant !== undefined
+      ? props.participant.attributes?.is_authenticated === 'true'
+      : props.isAuthenticated
+  const px = props.size === 'md' ? 14 : 12
+
+  const label = isAuthenticated ? t('proconnect') : t('anonymous')
+  const color = isAuthenticated ? '#1e40af' : '#b45309'
+  const bg = isAuthenticated ? 'rgba(30,64,175,0.10)' : 'rgba(180,83,9,0.10)'
+
+  return (
+    <span
+      title={label}
+      aria-label={label}
+      className={css({
+        display: 'inline-flex',
+        alignItems: 'center',
+        gap: '0.2rem',
+        padding: '0 0.3rem',
+        borderRadius: '0.25rem',
+        fontSize: '0.65rem',
+        fontWeight: 600,
+        letterSpacing: '0.02em',
+        whiteSpace: 'nowrap',
+      })}
+      style={{ backgroundColor: bg, color }}
+    >
+      {isAuthenticated ? (
+        <RiShieldCheckFill size={px} color={color} />
+      ) : (
+        <RiUserLine size={px} color={color} />
+      )}
+      {label}
+    </span>
+  )
+}

src/frontend/src/features/encryption/PauseEncryptionConfirmDialog.tsx

@@ -0,0 +1,67 @@
+/**
+ * Modal asking the admin to confirm that they accept pausing encryption
+ * to start recording or transcription.
+ */
+import { Button, Dialog, Text } from '@/primitives'
+import { HStack, VStack } from '@/styled-system/jsx'
+import { css } from '@/styled-system/css'
+import { useTranslation } from 'react-i18next'
+
+interface Props {
+  isOpen: boolean
+  onOpenChange: (open: boolean) => void
+  reason: 'recording' | 'transcript'
+  onConfirm: () => void | Promise<void>
+}
+
+export function PauseEncryptionConfirmDialog({
+  isOpen,
+  onOpenChange,
+  reason,
+  onConfirm,
+}: Props) {
+  const { t } = useTranslation('rooms', {
+    keyPrefix: 'encryption.pauseConfirm',
+  })
+
+  return (
+    <Dialog
+      isOpen={isOpen}
+      onOpenChange={onOpenChange}
+      role="dialog"
+      type="flex"
+      title={t(`title.${reason}`)}
+    >
+      <VStack
+        alignItems="start"
+        gap="0.75rem"
+        className={css({ maxWidth: '24rem' })}
+      >
+        <Text variant="sm">{t('description')}</Text>
+        <Text
+          variant="note"
+          className={css({
+            fontSize: '0.8rem',
+            color: 'greyscale.500',
+          })}
+        >
+          {t('learnMore')}
+        </Text>
+        <HStack gap="0.5rem" justify="end" className={css({ width: '100%' })}>
+          <Button variant="secondary" onPress={() => onOpenChange(false)}>
+            {t('cancel')}
+          </Button>
+          <Button
+            variant="primary"
+            onPress={async () => {
+              await onConfirm()
+              onOpenChange(false)
+            }}
+          >
+            {t(`confirm.${reason}`)}
+          </Button>
+        </HStack>
+      </VStack>
+    </Dialog>
+  )
+}

src/frontend/src/features/encryption/RoomStatusBanner.tsx

@@ -0,0 +1,157 @@
+/**
+ * Top-left status banner shown during a meeting.
+ *
+ * Renders a horizontal stack of pills, one per active state:
+ *  - "End-to-end encrypted" / "Encryption paused"
+ *  - "Recording in progress"
+ *  - "Transcription in progress"
+ *
+ * Each pill auto-collapses to its icon a few seconds after appearing,
+ * and expands back on hover.
+ */
+import { css } from '@/styled-system/css'
+import { HStack } from '@/styled-system/jsx'
+import {
+  RiFileTextFill,
+  RiLockFill,
+  RiLockUnlockFill,
+  RiRecordCircleFill,
+} from '@remixicon/react'
+import { useEffect, useState } from 'react'
+import { useTranslation } from 'react-i18next'
+import { useRoomData } from '@/features/rooms/livekit/hooks/useRoomData'
+import {
+  RecordingMode,
+  useRecordingStatuses,
+} from '@/features/recording'
+
+const COLLAPSE_DELAY_MS = 4000
+
+interface PillProps {
+  icon: React.ReactNode
+  label: string
+  background: string
+  pulse?: boolean
+}
+
+function StatusPill({ icon, label, background, pulse }: PillProps) {
+  const [collapsed, setCollapsed] = useState(false)
+
+  useEffect(() => {
+    const t = setTimeout(() => setCollapsed(true), COLLAPSE_DELAY_MS)
+    return () => clearTimeout(t)
+  }, [])
+
+  return (
+    <div
+      onMouseEnter={() => setCollapsed(false)}
+      onMouseLeave={() => setCollapsed(true)}
+      role="status"
+      aria-label={label}
+      className={css({
+        display: 'inline-flex',
+        alignItems: 'center',
+        gap: '0.35rem',
+        padding: '0.3rem 0.6rem',
+        borderRadius: '1rem',
+        border: '2px solid rgba(0, 0, 0, 0.3)',
+        cursor: 'default',
+        overflow: 'hidden',
+        transition: 'max-width 300ms ease, padding-right 200ms ease',
+        whiteSpace: 'nowrap',
+      })}
+      style={{
+        backgroundColor: background,
+        maxWidth: collapsed ? '2.2rem' : '20rem',
+        paddingRight: collapsed ? '0.3rem' : '0.6rem',
+        animation: pulse ? 'pulse_background 1.6s infinite' : undefined,
+      }}
+    >
+      <span className={css({ flexShrink: 0, display: 'inline-flex' })}>
+        {icon}
+      </span>
+      <span
+        className={css({
+          fontSize: '0.7rem',
+          fontWeight: 600,
+          color: 'white',
+          letterSpacing: '0.02em',
+          transition: 'opacity 200ms ease',
+        })}
+        style={{ opacity: collapsed ? 0 : 1 }}
+      >
+        {label}
+      </span>
+    </div>
+  )
+}
+
+export function RoomStatusBanner() {
+  const { t } = useTranslation('rooms', { keyPrefix: 'roomStatus' })
+  const roomData = useRoomData()
+
+  // Use the metadata-driven `isStarted` for both pills — it flips to
+  // false the moment the user clicks stop (recording_status moves to
+  // Saving), so the pill disappears immediately instead of lingering
+  // through LK's 1-2s post-stop callback delay.
+  const screenRec = useRecordingStatuses(RecordingMode.ScreenRecording)
+  const transcript = useRecordingStatuses(RecordingMode.Transcript)
+  const isRecording = screenRec.isStarted
+  const isTranscribing = transcript.isStarted
+
+  // The encryption pill reflects the room's nature plus its current paused
+  // state — never disappears just because encryption is temporarily off
+  // mid-call.
+  const encryptionCapable = !!roomData?.is_encrypted
+  const encryptionPaused = !!roomData?.encryption_paused
+
+  if (!encryptionCapable && !isRecording && !isTranscribing) {
+    return null
+  }
+
+  return (
+    <HStack
+      gap="0.4rem"
+      className={css({
+        position: 'absolute',
+        top: '0.5rem',
+        left: '0.5rem',
+        zIndex: 10,
+      })}
+    >
+      {encryptionCapable && !encryptionPaused && (
+        <StatusPill
+          key="encrypted"
+          icon={<RiLockFill size={13} color="white" />}
+          label={t('encrypted')}
+          background="#1e3a5f"
+        />
+      )}
+      {encryptionCapable && encryptionPaused && (
+        <StatusPill
+          key="paused"
+          icon={<RiLockUnlockFill size={13} color="white" />}
+          label={t('paused')}
+          background="#b45309"
+        />
+      )}
+      {isTranscribing && (
+        <StatusPill
+          key="transcript"
+          icon={<RiFileTextFill size={13} color="white" />}
+          label={t('transcribing')}
+          background="#7c2d12"
+        />
+      )}
+      {isRecording && (
+        <StatusPill
+          key="recording"
+          icon={<RiRecordCircleFill size={13} color="white" />}
+          label={t('recording')}
+          background="#b91c1c"
+          pulse
+        />
+      )}
+    </HStack>
+  )
+}

src/frontend/src/features/encryption/SipBlockedTileOverlay.tsx

@@ -0,0 +1,84 @@
+/**
+ * Small banner shown on top of a SIP/phone participant's tile when the room
+ * is live-encrypted (encrypted AND not paused). The avatar (LiveKit's
+ * ParticipantPlaceholder) stays visible behind it; this is just a callout
+ * near the bottom of the tile so everyone in the room knows why the caller
+ * isn't producing audio/video. Admins get a CTA to pause encryption.
+ *
+ * Detection is kind-then-identity: ParticipantKind.SIP is the canonical
+ * signal but we also accept identities prefixed `sip_` so the UI keeps
+ * working if a gateway revision forgets to set the kind enum.
+ */
+import { useTranslation } from 'react-i18next'
+import { Participant, ParticipantKind } from 'livekit-client'
+import { RiLockFill } from '@remixicon/react'
+
+import { useRoomData } from '@/features/rooms/livekit/hooks/useRoomData'
+import { useIsAdminOrOwner } from '@/features/rooms/livekit/hooks/useIsAdminOrOwner'
+
+function isSipParticipant(p: Participant): boolean {
+  if (p.kind === ParticipantKind.SIP) return true
+  return p.identity.startsWith('sip_')
+}
+
+interface Props {
+  participant: Participant
+}
+
+export function SipBlockedTileOverlay({ participant }: Props) {
+  const { t } = useTranslation('rooms', { keyPrefix: 'encryption.sipBlocked' })
+  const room = useRoomData()
+  const isAdmin = useIsAdminOrOwner()
+
+  const liveEncryption =
+    !!room && !!room.is_encrypted && !room.encryption_paused
+  if (!liveEncryption) return null
+  if (!isSipParticipant(participant)) return null
+
+  return (
+    <div
+      style={{
+        position: 'absolute',
+        bottom: '2.5rem',
+        left: '50%',
+        transform: 'translateX(-50%)',
+        backgroundColor: 'rgba(0, 0, 0, 0.75)',
+        borderRadius: '0.5rem',
+        padding: '0.6rem 1rem',
+        display: 'flex',
+        flexDirection: 'column',
+        alignItems: 'center',
+        gap: '0.4rem',
+        maxWidth: '85%',
+        zIndex: 4,
+        pointerEvents: 'auto',
+      }}
+      role="status"
+    >
+      <div
+        style={{
+          display: 'flex',
+          alignItems: 'center',
+          gap: '0.4rem',
+          color: '#fbbf24',
+          fontSize: '0.85rem',
+          fontWeight: 600,
+        }}
+      >
+        <RiLockFill size={14} />
+        <span>{t('title')}</span>
+      </div>
+      <div
+        style={{
+          color: '#d1d5db',
+          fontSize: '0.75rem',
+          textAlign: 'center',
+          lineHeight: 1.4,
+          maxWidth: '22rem',
+        }}
+      >
+        {isAdmin ? t('bodyAdmin') : t('bodyParticipant')}
+      </div>
+    </div>
+  )
+}

src/frontend/src/features/encryption/encryptionStatusContextValue.ts

@@ -0,0 +1,15 @@
+import { createContext } from 'react'
+import {
+  EncryptionPhase,
+  EncryptionStatusContextValue,
+} from './encryptionStatusTypes'
+
+const noopContext: EncryptionStatusContextValue = {
+  phase: EncryptionPhase.UNENCRYPTED,
+  pausedByMe: false,
+  pauseEncryption: async () => false,
+  resumeEncryption: async () => false,
+}
+
+export const EncryptionStatusContext =
+  createContext<EncryptionStatusContextValue>(noopContext)

src/frontend/src/features/encryption/encryptionStatusTypes.ts

@@ -0,0 +1,32 @@
+export enum EncryptionPhase {
+  UNENCRYPTED = 'unencrypted',
+  ENCRYPTED = 'encrypted',
+  PAUSED = 'paused',
+}
+
+export type PauseReason =
+  | 'recording'
+  | 'transcript'
+  | 'manual'
+  | 'sip_participant'
+
+export interface EncryptionStatus {
+  phase: EncryptionPhase
+  pauseReason?: PauseReason
+  /** True when the local participant initiated the current pause. */
+  pausedByMe: boolean
+}
+
+export interface EncryptionStatusContextValue extends EncryptionStatus {
+  /**
+   * Pause encryption for this session and notify the rest of the room.
+   * Returns true on success.
+   */
+  pauseEncryption: (reason: PauseReason) => Promise<boolean>
+  /**
+   * Resume encryption after a pause. Returns true on success. Only the
+   * participant who initiated the pause (or anyone meeting the legitimacy
+   * rules) can resume.
+   */
+  resumeEncryption: () => Promise<boolean>
+}

src/frontend/src/features/encryption/index.ts

@@ -0,0 +1,18 @@
+export {
+  generatePassphrase,
+  isValidPassphrase,
+  getPassphraseFromHash,
+  PASSPHRASE_LENGTH,
+} from './passphrase'
+export { EncryptionStatusProvider } from './EncryptionStatusContext'
+export { useEncryptionStatus } from './useEncryptionStatus'
+export { EncryptionPhase } from './encryptionStatusTypes'
+export type { EncryptionStatus, PauseReason } from './encryptionStatusTypes'
+export { RoomStatusBanner } from './RoomStatusBanner'
+export { EncryptionStatusSnackbars } from './EncryptionStatusSnackbars'
+export { PauseEncryptionConfirmDialog } from './PauseEncryptionConfirmDialog'
+export { IdentityBadge } from './IdentityBadge'
+export { EncryptionMismatchScreen } from './EncryptionMismatchScreen'
+export { EncryptionAutoResumeWatcher } from './EncryptionAutoResumeWatcher'
+export { SipBlockedTileOverlay } from './SipBlockedTileOverlay'
+export { DecryptionFailedTileOverlay } from './DecryptionFailedTileOverlay'

src/frontend/src/features/encryption/passphrase.ts

@@ -0,0 +1,34 @@
+/**
+ * Passphrase utilities for end-to-end encryption.
+ *
+ * The passphrase is appended to a room URL as the hash fragment
+ * (e.g. `https://meet.example.com/abc-defg-hij#<passphrase>`). The
+ * server never sees it; participants share it by sharing the link.
+ */
+
+/**
+ * Number of random bytes used to seed a passphrase.
+ * Each byte is rendered as 2 base36 characters, so the resulting
+ * passphrase is 48 characters long.
+ */
+const PASSPHRASE_BYTES = 24
+
+/** Length, in characters, of a generated passphrase. */
+export const PASSPHRASE_LENGTH = PASSPHRASE_BYTES * 2
+
+/** Generate a random passphrase suitable for room E2E encryption. */
+export function generatePassphrase(): string {
+  return Array.from(crypto.getRandomValues(new Uint8Array(PASSPHRASE_BYTES)))
+    .map((b) => b.toString(36).padStart(2, '0'))
+    .join('')
+}
+
+/** Whether a string looks like a valid passphrase. */
+export function isValidPassphrase(value: string): boolean {
+  return value.length === PASSPHRASE_LENGTH && /^[a-z0-9]+$/.test(value)
+}
+
+/** Read the current URL hash (without the leading `#`). */
+export function getPassphraseFromHash(): string {
+  return window.location.hash.replace(/^#/, '')
+}

src/frontend/src/features/encryption/useEncryptionStatus.ts

@@ -0,0 +1,4 @@
+import { useContext } from 'react'
+import { EncryptionStatusContext } from './encryptionStatusContextValue'
+
+export const useEncryptionStatus = () => useContext(EncryptionStatusContext)

src/frontend/src/features/files/api/createFile.ts

@@ -0,0 +1,93 @@
+import { fetchApi } from '@/api/fetchApi'
+import { useMutation } from '@tanstack/react-query'
+import { ApiFileItem } from '@/features/files/api/types.ts'
+import { keys } from '@/api/queryKeys.ts'
+import { queryClient } from '@/api/queryClient.ts'
+
+/**
+ * Upload a file, using XHR so we can report on progress through a handler.
+ *
+ * @param url The URL to PUT the file to.
+ * @param file The file to upload.
+ * @param progressHandler A handler that receives progress updates as a single integer `0 <= x <= 100`.
+ */
+export const uploadFile = (
+  url: string,
+  file: File,
+  progressHandler: (progress: number) => void
+) =>
+  new Promise((resolve, reject) => {
+    const xhr = new XMLHttpRequest()
+    xhr.open('PUT', url)
+    xhr.setRequestHeader('X-amz-acl', 'private')
+    xhr.setRequestHeader('Content-Type', file.type)
+
+    xhr.addEventListener('error', reject)
+    xhr.addEventListener('abort', reject)
+
+    xhr.addEventListener('readystatechange', () => {
+      if (xhr.readyState === 4) {
+        if (xhr.status === 200) {
+          // Make sure to always set the progress to 100% when the upload is done.
+          // Because 'progress' event listener is not called when the file size is 0.
+          progressHandler(100)
+          return resolve(true)
+        }
+        reject(new Error(`Failed to perform the upload on ${url}.`))
+      }
+    })
+
+    xhr.upload.addEventListener('progress', (progressEvent) => {
+      if (progressEvent.lengthComputable) {
+        progressHandler(
+          Math.floor((progressEvent.loaded / progressEvent.total) * 100)
+        )
+      }
+    })
+
+    xhr.send(file)
+  })
+
+/**
+ * Asynchronously creates a new file and uploads it to the server.
+ *
+ * @param {object} params - The parameters for the file creation and upload process.
+ * @param {File} params.file - The file object to be uploaded.
+ * @param {function} params.onProgress - A callback function that receives the upload progress as a number (0 to 100).
+ * @returns {Promise<ApiFileItem>} A promise that resolves when the file has been successfully uploaded and the server process is completed.
+ */
+export const createFile = async ({
+  file,
+  onProgress,
+}: {
+  file: File
+  onProgress: (progress: number) => void
+}): Promise<ApiFileItem> => {
+  const res = await fetchApi<ApiFileItem>(`/files/`, {
+    method: 'POST',
+    body: JSON.stringify({ filename: file.name, type: 'background_image' }),
+  })
+  if (res.upload_state !== 'pending') {
+    throw new Error('State should be pending right after creation')
+  }
+  const policy = res.policy
+  await uploadFile(policy, file, onProgress)
+  const createdFile = await fetchApi<ApiFileItem>(
+    `/files/${res.id}/upload-ended/`,
+    {
+      method: 'POST',
+    }
+  )
+
+  // We invalidate the files query to make sure the new file is immediately available.
+  await queryClient.invalidateQueries({
+    queryKey: [keys.files],
+  })
+  return createdFile
+}
+
+export const useCreateFile = () => {
+  return useMutation({
+    mutationFn: createFile,
+  })
+}

src/frontend/src/features/files/api/deleteFile.ts

@@ -0,0 +1,33 @@
+import { fetchApi } from '@/api/fetchApi'
+import { useMutation, useQueryClient } from '@tanstack/react-query'
+import { keys } from '@/api/queryKeys.ts'
+
+/**
+ * Deletes a file specified by its unique identifier.
+ *
+ * @param {Object} params - The parameters required for deleting the file.
+ * @param {string} params.fileId - The unique identifier of the file to be deleted.
+ * @returns {Promise<void>} A promise that resolves when the file is successfully deleted.
+ */
+export const deleteFile = async ({
+  fileId,
+}: {
+  fileId: string
+}): Promise<void> => {
+  await fetchApi<void>(`/files/${fileId}/`, {
+    method: 'DELETE',
+  })
+}
+
+export const useDeleteFile = () => {
+  const queryClient = useQueryClient()
+
+  return useMutation({
+    mutationFn: deleteFile,
+    onSuccess: async () => {
+      await queryClient.invalidateQueries({
+        queryKey: [keys.files],
+      })
+    },
+  })
+}

src/frontend/src/features/files/api/listFiles.ts

@@ -0,0 +1,70 @@
+import { fetchApi } from '@/api/fetchApi'
+import { keepPreviousData, useQuery } from '@tanstack/react-query'
+import { keys } from '@/api/queryKeys'
+import {
+  ApiFileItem,
+  ApiFileType,
+  ApiFileUploadState,
+} from '@/features/files/api/types.ts'
+import { useUser } from '@/features/auth'
+import { useConfig } from '@/api/useConfig.ts'
+
+type ListFilesResponse = {
+  count: number
+  next: string | null
+  previous: string | null
+  results: ApiFileItem[]
+}
+
+type ListFilesFilters = {
+  is_creator_me?: boolean
+  type?: ApiFileType
+  upload_state?: ApiFileUploadState
+  is_deleted?: boolean
+}
+
+export type ListFilesParams = {
+  filters?: ListFilesFilters
+  pagination: {
+    page: number
+    pageSize: number
+  }
+}
+
+export const listMyFiles = async ({
+  filters = {},
+  pagination: { page, pageSize },
+}: ListFilesParams): Promise<ListFilesResponse> => {
+  const query = new URLSearchParams()
+  query.append('page', page.toString())
+  query.append('page_size', pageSize.toString())
+  if (filters?.is_creator_me ?? true) {
+    query.append('is_creator_me', 'true')
+  }
+  if (filters?.type) {
+    query.append('type', filters.type)
+  }
+  if (filters?.upload_state) {
+    query.append('upload_state', filters.upload_state)
+  }
+  if (typeof filters?.is_deleted === 'boolean') {
+    query.append('is_deleted', filters.is_deleted ? 'true' : 'false')
+  }
+
+  return fetchApi<ListFilesResponse>(`/files?${query.toString()}`, {
+    method: 'GET',
+  })
+}
+
+export const useListMyFiles = (params: Parameters<typeof listMyFiles>[0]) => {
+  const { isLoggedIn } = useUser()
+  const { data: appConfig } = useConfig()
+  return useQuery({
+    queryKey: [keys.files, params],
+    queryFn: () => listMyFiles(params),
+    refetchOnMount: 'always',
+    placeholderData: keepPreviousData,
+    enabled:
+      isLoggedIn && appConfig?.background_image?.upload_is_enabled === true,
+  })
+}

src/frontend/src/features/files/api/types.ts

@@ -0,0 +1,34 @@
+export type ApiFileCreator = {
+  id: string // UUID
+  full_name: string | null
+  short_name: string | null
+}
+
+export type ApiFileType = 'background_image'
+export type ApiFileUploadState = 'pending' | 'ready'
+
+export type ApiFileItem = {
+  id: string // UUID
+  created_at: string // ISO datetime string
+  updated_at: string // ISO datetime string
+  title: string
+  type: ApiFileType
+  creator: ApiFileCreator
+  deleted_at: string | null
+  hard_deleted_at: string | null
+  filename: string
+  upload_state: ApiFileUploadState
+  mimetype: string // e.g. "image/png"
+  size: number // file size in bytes
+  description: string | null
+} & (
+  | {
+      upload_state: 'ready'
+      url: string
+    }
+  | {
+      upload_state: 'pending'
+      policy: string
+      url: null
+    }
+)

src/frontend/src/features/home/components/JoinMeetingDialog.tsx

@@ -1,35 +1,146 @@
+import { useState } from 'react'
 import { useTranslation } from 'react-i18next'
 import { Field, Ul, H, P, Form, Dialog } from '@/primitives'
+import { css } from '@/styled-system/css'
 import { navigateTo } from '@/navigation/navigateTo'
 import { isRoomValid } from '@/features/rooms'
+import { normalizeRoomId } from '@/features/rooms/utils/isRoomValid'
+import { fetchRoom } from '@/features/rooms/api/fetchRoom'
 
 export const JoinMeetingDialog = () => {
   const { t } = useTranslation('home')
+  const [step, setStep] = useState<'room' | 'passphrase'>('room')
+  const [roomId, setRoomId] = useState('')
+  const [isLoading, setIsLoading] = useState(false)
 
-  const handleSubmit = (data: { roomId?: FormDataEntryValue }) => {
-    const roomId = (data.roomId as string)
-      .trim()
-      .replace(`${window.location.origin}/`, '')
+  const parseInput = (input: string): { roomId: string; hash: string } => {
+    const trimmed = input.trim()
+    try {
+      const url = new URL(trimmed)
+      const id = url.pathname.replace(/^\//, '')
+      return { roomId: id, hash: url.hash.slice(1) }
+    } catch {
+      // Not a URL — treat as room code, normalize (add hyphens if 10 chars)
+      const raw = trimmed.replace(`${window.location.origin}/`, '')
+      return { roomId: normalizeRoomId(raw), hash: '' }
+    }
+  }
+
+  const handleRoomSubmit = async (data: { roomId?: FormDataEntryValue }) => {
+    const input = data.roomId as string
+    const parsed = parseInput(input)
+
+    if (parsed.hash) {
+      navigateTo('room', parsed.roomId)
+      window.location.hash = parsed.hash
+      return
+    }
+
+    setIsLoading(true)
+    try {
+      const room = await fetchRoom({ roomId: parsed.roomId })
+      if (room.is_encrypted) {
+        setRoomId(parsed.roomId)
+        setStep('passphrase')
+        return
+      }
+      navigateTo('room', parsed.roomId)
+    } catch {
+      // Room doesn't exist yet or error — navigate anyway
+      navigateTo('room', parsed.roomId)
+    } finally {
+      setIsLoading(false)
+    }
+  }
+
+  const handlePassphraseSubmit = (data: { passphrase?: FormDataEntryValue }) => {
+    const passphrase = (data.passphrase as string).trim()
     navigateTo('room', roomId)
+    window.location.hash = passphrase
   }
 
   const validateRoomId = (value: string) => {
     const trimmed = value.trim()
     if (!trimmed) return null
-    return !isRoomValid(trimmed) ? (
+    const { roomId: id } = parseInput(trimmed)
+    return !isRoomValid(id) ? (
       <>
         <p>{t('joinInputError')}</p>
         <Ul>
           <li>{window.location.origin}/uio-azer-jkl</li>
           <li>uio-azer-jkl</li>
+          <li>uioazerjkl</li>
         </Ul>
       </>
     ) : null
   }
 
+  if (step === 'passphrase') {
+    return (
+      <Dialog title={t('joinMeeting')}>
+        <Form onSubmit={handlePassphraseSubmit} submitLabel={t('joinPassphraseSubmit')}>
+          <P
+            dangerouslySetInnerHTML={{
+              __html: t('joinPassphraseDescription', {
+                interpolation: { escapeValue: false },
+              }),
+            }}
+          />
+
+          <div
+            className={css({
+              backgroundColor: 'greyscale.100',
+              borderRadius: '0.5rem',
+              padding: '0.75rem 1rem',
+              marginBottom: '1rem',
+              fontSize: '0.8rem',
+              fontFamily: 'monospace',
+              wordBreak: 'break-all',
+              lineHeight: '1.5',
+              border: '1px solid',
+              borderColor: 'greyscale.200',
+              '& strong': {
+                color: '#16a34a',
+                fontWeight: 700,
+              },
+            })}
+            dangerouslySetInnerHTML={{
+              __html: t('joinPassphraseExample', {
+                origin: window.location.origin,
+                interpolation: { escapeValue: false },
+              }),
+            }}
+          />
+
+          {/* eslint-disable jsx-a11y/no-autofocus */}
+          <Field
+            type="text"
+            autoFocus
+            isRequired
+            name="passphrase"
+            label={t('joinPassphraseLabel')}
+            validate={(value: string) =>
+              !value ? t('joinPassphraseError') : null
+            }
+          />
+
+          <P
+            className={css({
+              fontSize: '0.8rem',
+              color: '#b45309',
+              marginTop: '0.5rem',
+            })}
+          >
+            {t('joinPassphraseWarning')}
+          </P>
+        </Form>
+      </Dialog>
+    )
+  }
+
   return (
     <Dialog title={t('joinMeeting')}>
-      <Form onSubmit={handleSubmit} submitLabel={t('joinInputSubmit')}>
+      <Form onSubmit={handleRoomSubmit} submitLabel={isLoading ? '...' : t('joinInputSubmit')}>
         {/* eslint-disable jsx-a11y/no-autofocus -- Focus on input when modal opens, required for accessibility */}
         <Field
           type="text"

src/frontend/src/features/home/components/LaterMeetingDialog.tsx

@@ -13,11 +13,12 @@ import { useCopyRoomToClipboard } from '@/features/rooms/livekit/hooks/useCopyRo
 // fixme - duplication with the InviteDialog
 export const LaterMeetingDialog = ({
   room,
+  hash,
   ...dialogProps
-}: { room: null | ApiRoom } & Omit<DialogProps, 'title'>) => {
+}: { room: null | ApiRoom; hash?: string } & Omit<DialogProps, 'title'>) => {
   const { t } = useTranslation('home', { keyPrefix: 'laterMeetingDialog' })
 
-  const roomUrl = room && getRouteUrl('room', room?.slug)
+  const roomUrl = room ? `${getRouteUrl('room', room.slug)}${hash ? `#${hash}` : ''}` : null
   const telephony = useTelephony()
 
   const [isHovered, setIsHovered] = useState(false)
@@ -31,7 +32,7 @@ export const LaterMeetingDialog = ({
     copyRoomToClipboard,
     isRoomUrlCopied,
     copyRoomUrlToClipboard,
-  } = useCopyRoomToClipboard(room || undefined)
+  } = useCopyRoomToClipboard(room || undefined, hash)
 
   return (
     <Dialog isOpen={!!room} {...dialogProps} title={t('heading')}>

src/frontend/src/features/home/routes/Home.tsx

@@ -9,6 +9,7 @@ import { useUser, UserAware } from '@/features/auth'
 import { JoinMeetingDialog } from '../components/JoinMeetingDialog'
 import { RiAddLine, RiLink } from '@remixicon/react'
 import { LaterMeetingDialog } from '@/features/home/components/LaterMeetingDialog'
+import { generatePassphrase } from '@/features/encryption'
 import { IntroSlider } from '@/features/home/components/IntroSlider'
 import { MoreLink } from '@/features/home/components/MoreLink'
 import { ReactNode, useEffect, useState } from 'react'
@@ -148,17 +149,27 @@ const IntroText = styled('div', {
 
 export const Home = () => {
   const { t } = useTranslation('home')
-  const { isLoggedIn } = useUser()
+  const { isLoggedIn, user } = useUser()
 
   const {
     userChoices: { username },
   } = usePersistentUserChoices()
 
   const { mutateAsync: createRoom } = useCreateRoom()
-  const [laterRoom, setLaterRoom] = useState<null | ApiRoom>(null)
+  const [laterRoom, setLaterRoom] = useState<null | { room: ApiRoom; hash?: string }>(null)
   const [redirectFailed, setRedirectFailed] = useState(false)
 
   const { data } = useConfig()
+  const encryptionAvailable = !!data?.encryption?.enabled
+  const defaultEncryption = encryptionAvailable && !!user?.default_encryption
+
+  const buildRoomBundle = async () => {
+    const slug = generateRoomId()
+    const isEncrypted = defaultEncryption
+    const hash = isEncrypted ? generatePassphrase() : undefined
+    const room = await createRoom({ slug, username, isEncrypted })
+    return { room, hash }
+  }
 
   useEffect(() => {
     const checkSiteAndRedirect = async () => {
@@ -210,12 +221,17 @@ export const Home = () => {
                         menuRecipe({ icon: true, variant: 'light' }).item
                       }
                       onAction={async () => {
-                        const slug = generateRoomId()
-                        createRoom({ slug, username }).then((data) =>
-                          navigateTo('room', data.slug, {
-                            state: { create: true, initialRoomData: data },
-                          })
-                        )
+                        const { room, hash } = await buildRoomBundle()
+                        navigateTo('room', room.slug, {
+                          state: { create: true, initialRoomData: room },
+                        })
+                        if (hash) {
+                          window.history.replaceState(
+                            window.history.state,
+                            '',
+                            `${window.location.pathname}#${hash}`
+                          )
+                        }
                       }}
                       data-attr="create-option-instant"
                     >
@@ -226,11 +242,9 @@ export const Home = () => {
                       className={
                         menuRecipe({ icon: true, variant: 'light' }).item
                       }
-                      onAction={() => {
-                        const slug = generateRoomId()
-                        createRoom({ slug, username }).then((data) =>
-                          setLaterRoom(data)
-                        )
+                      onAction={async () => {
+                        const { room, hash } = await buildRoomBundle()
+                        setLaterRoom({ room, hash })
                       }}
                       data-attr="create-option-later"
                     >
@@ -265,7 +279,8 @@ export const Home = () => {
           </RightColumn>
         </Columns>
         <LaterMeetingDialog
-          room={laterRoom}
+          room={laterRoom?.room ?? null}
+          hash={laterRoom?.hash}
           onOpenChange={() => setLaterRoom(null)}
         />
       </Screen>

src/frontend/src/features/notifications/components/WaitingParticipantNotification.tsx

@@ -34,7 +34,6 @@ export const WaitingParticipantNotification = () => {
   const isParticipantListEmpty = (p?: WaitingParticipant[]) => p?.length == 0
 
   useEffect(() => {
-    // Show notification when the first participant enters the waiting room
     if (
       !isParticipantListEmpty(waitingParticipants) &&
       isParticipantListEmpty(prevWaitingParticipant) &&
@@ -49,10 +48,9 @@ export const WaitingParticipantNotification = () => {
       }
       timerRef.current = setTimeout(() => {
         setShowQuickActionsMessage(false)
-        timerRef.current = null // Clear the ref when timeout completes
+        timerRef.current = null
       }, NOTIFICATION_DISPLAY_DURATION)
     } else if (waitingParticipants.length !== prevWaitingParticipant?.length) {
-      // Hide notification when the participant count changes
       setShowQuickActionsMessage(false)
     }
   }, [
@@ -63,7 +61,6 @@ export const WaitingParticipantNotification = () => {
   ])
 
   useEffect(() => {
-    // This cleanup function will only run when the component unmounts
     return () => {
       if (timerRef.current !== null) {
         clearTimeout(timerRef.current)
@@ -72,7 +69,6 @@ export const WaitingParticipantNotification = () => {
   }, [])
 
   useEffect(() => {
-    // Hide notification when participants panel is opened
     if (isParticipantsOpen) {
       setShowQuickActionsMessage(false)
     }
@@ -100,7 +96,7 @@ export const WaitingParticipantNotification = () => {
             >
               {t('one')}
             </Text>
-            <HStack gap="1rem">
+            <HStack gap="0.5rem">
               <Avatar
                 name={waitingParticipants[0].username}
                 bgColor={waitingParticipants[0].color}