🔒️(backend) add application validation when consuming external JWT

Token generation already verifies that the application is active, but this guarantee was not enforced when the token was used. This change adds a runtime check to ensure the client_id claim matches an existing and active application when evaluating permissions. This also introduces an emergency revocation mechanism, allowing all previously issued tokens for a given application to be invalidated if the application is disabled.
2026-02-09 13:56:15 +01:00
116 changed files with 1725 additions and 23030 deletions
@@ -13,7 +13,7 @@ jobs:
    runs-on: ubuntu-latest
    steps:
      - name: Checkout
-        uses: actions/checkout@v6
+        uses: actions/checkout@v4

      - name: Download Crowdin files
        uses: crowdin/github-action@v2
@@ -23,13 +23,7 @@ jobs:
    steps:
      -
        name: Checkout repository
-        uses: actions/checkout@v6
-      -
-        name: Set up QEMU
-        uses: docker/setup-qemu-action@v3
-      -
-        name: Set up Docker Buildx
-        uses: docker/setup-buildx-action@v3
+        uses: actions/checkout@v4
      -
        name: Docker meta
        id: meta
@@ -55,7 +49,6 @@ jobs:
        with:
          context: .
          target: backend-production
-          platforms: linux/amd64,linux/arm64
          build-args: DOCKER_USER=${{ env.DOCKER_USER }}:-1000
          push: ${{ github.event_name != 'pull_request' }}
          tags: ${{ steps.meta.outputs.tags }}
@@ -66,13 +59,7 @@ jobs:
    steps:
      -
        name: Checkout repository
-        uses: actions/checkout@v6
-      -
-        name: Set up QEMU
-        uses: docker/setup-qemu-action@v3
-      -
-        name: Set up Docker Buildx
-        uses: docker/setup-buildx-action@v3
+        uses: actions/checkout@v4
      -
        name: Docker meta
        id: meta
@@ -99,7 +86,6 @@ jobs:
          context: .
          file: ./src/frontend/Dockerfile
          target: frontend-production
-          platforms: linux/amd64,linux/arm64
          build-args: DOCKER_USER=${{ env.DOCKER_USER }}:-1000
          push: ${{ github.event_name != 'pull_request' }}
          tags: ${{ steps.meta.outputs.tags }}
@@ -110,13 +96,7 @@ jobs:
    steps:
      -
        name: Checkout repository
-        uses: actions/checkout@v6
-      -
-        name: Set up QEMU
-        uses: docker/setup-qemu-action@v3
-      -
-        name: Set up Docker Buildx
-        uses: docker/setup-buildx-action@v3
+        uses: actions/checkout@v4
      -
        name: Docker meta
        id: meta
@@ -143,7 +123,6 @@ jobs:
          context: .
          file: ./docker/dinum-frontend/Dockerfile
          target: frontend-production
-          platforms: linux/amd64,linux/arm64
          build-args: DOCKER_USER=${{ env.DOCKER_USER }}:-1000
          push: ${{ github.event_name != 'pull_request' }}
          tags: ${{ steps.meta.outputs.tags }}
@@ -154,13 +133,7 @@ jobs:
    steps:
      -
        name: Checkout repository
-        uses: actions/checkout@v6
-      -
-        name: Set up QEMU
-        uses: docker/setup-qemu-action@v3
-      -
-        name: Set up Docker Buildx
-        uses: docker/setup-buildx-action@v3
+        uses: actions/checkout@v4
      -
        name: Docker meta
        id: meta
@@ -189,7 +162,6 @@ jobs:
          context: ./src/summary
          file: ./src/summary/Dockerfile
          target: production
-          platforms: linux/amd64,linux/arm64
          build-args: DOCKER_USER=${{ env.DOCKER_USER }}:-1000
          push: ${{ github.event_name != 'pull_request' }}
          tags: ${{ steps.meta.outputs.tags }}
@@ -200,13 +172,7 @@ jobs:
    steps:
      -
        name: Checkout repository
-        uses: actions/checkout@v6
-      -
-        name: Set up QEMU
-        uses: docker/setup-qemu-action@v3
-      -
-        name: Set up Docker Buildx
-        uses: docker/setup-buildx-action@v3
+        uses: actions/checkout@v4
      -
        name: Docker meta
        id: meta
@@ -235,7 +201,6 @@ jobs:
          context: ./src/agents
          file: ./src/agents/Dockerfile
          target: production
-          platforms: linux/amd64,linux/arm64
          build-args: DOCKER_USER=${{ env.DOCKER_USER }}:-1000
          push: ${{ github.event_name != 'pull_request' }}
          tags: ${{ steps.meta.outputs.tags }}
@@ -7,18 +7,14 @@ on:
  pull_request:
    branches:
      - "*"
-permissions:
-  contents: read

 jobs:
  lint-git:
    runs-on: ubuntu-latest
    if: github.event_name == 'pull_request' # Makes sense only for pull requests
-    permissions:
-      contents: read
    steps:
      - name: Checkout repository
-        uses: actions/checkout@v6
+        uses: actions/checkout@v4
        with:
          fetch-depth: 0
      - name: show
@@ -43,11 +39,9 @@ jobs:
    if: |
      contains(github.event.pull_request.labels.*.name, 'noChangeLog') == false &&
      github.event_name == 'pull_request'
-    permissions:
-        contents: read
    steps:
      - name: Checkout repository
-        uses: actions/checkout@v6
+        uses: actions/checkout@v4
        with:
          fetch-depth: 50
      - name: Check that the CHANGELOG has been modified in the current branch
@@ -55,11 +49,9 @@ jobs:

  lint-changelog:
    runs-on: ubuntu-latest
-    permissions:
-      contents: read
    steps:
      - name: Checkout repository
-        uses: actions/checkout@v6
+        uses: actions/checkout@v4
      - name: Check CHANGELOG max line length
        run: |
          max_line_length=$(cat CHANGELOG.md | grep -Ev "^\[.*\]: https://github.com" | wc -L)
@@ -70,22 +62,20 @@ jobs:

  build-mails:
    runs-on: ubuntu-latest
-    permissions:
-      contents: read
    defaults:
      run:
        working-directory: src/mail
    steps:
      - name: Checkout repository
-        uses: actions/checkout@v6
+        uses: actions/checkout@v4

      - name: Install Node.js
-        uses: actions/setup-node@v6
+        uses: actions/setup-node@v4
        with:
          node-version: "18"

      - name: Restore the mail templates
-        uses: actions/cache@v5
+        uses: actions/cache@v4
        id: mail-templates
        with:
          path: "src/backend/core/templates/mail"
@@ -105,23 +95,21 @@ jobs:

      - name: Cache mail templates
        if: steps.mail-templates.outputs.cache-hit != 'true'
-        uses: actions/cache@v5
+        uses: actions/cache@v4
        with:
          path: "src/backend/core/templates/mail"
          key: mail-templates-${{ hashFiles('src/mail/mjml') }}

  lint-back:
    runs-on: ubuntu-latest
-    permissions:
-      contents: read
    defaults:
      run:
        working-directory: src/backend
    steps:
      - name: Checkout repository
-        uses: actions/checkout@v6
+        uses: actions/checkout@v4
      - name: Install Python
-        uses: actions/setup-python@v6
+        uses: actions/setup-python@v5
        with:
          python-version: "3.13"
          cache: "pip"
@@ -136,16 +124,14 @@ jobs:

  lint-agents:
    runs-on: ubuntu-latest
-    permissions:
-      contents: read
    defaults:
      run:
        working-directory: src/agents
    steps:
      - name: Checkout repository
-        uses: actions/checkout@v6
+        uses: actions/checkout@v4
      - name: Install Python
-        uses: actions/setup-python@v6
+        uses: actions/setup-python@v5
        with:
          python-version: "3.13"
          cache: "pip"
@@ -158,16 +144,14 @@ jobs:

  lint-summary:
    runs-on: ubuntu-latest
-    permissions:
-      contents: read
    defaults:
      run:
        working-directory: src/summary
    steps:
      - name: Checkout repository
-        uses: actions/checkout@v6
+        uses: actions/checkout@v4
      - name: Install Python
-        uses: actions/setup-python@v6
+        uses: actions/setup-python@v5
        with:
          python-version: "3.13"
          cache: "pip"
@@ -181,8 +165,7 @@ jobs:
  test-back:
    runs-on: ubuntu-latest
    needs: build-mails
-    permissions:
-      contents: read
+
    defaults:
      run:
        working-directory: src/backend
@@ -233,7 +216,7 @@ jobs:

    steps:
      - name: Checkout repository
-        uses: actions/checkout@v6
+        uses: actions/checkout@v4

      - name: Create writable /data
        run: |
@@ -241,7 +224,7 @@ jobs:
          sudo mkdir -p /data/static

      - name: Restore the mail templates
-        uses: actions/cache@v5
+        uses: actions/cache@v4
        id: mail-templates
        with:
          path: "src/backend/core/templates/mail"
@@ -275,7 +258,7 @@ jobs:
            mc mb meet/meet-media-storage"

      - name: Install Python
-        uses: actions/setup-python@v6
+        uses: actions/setup-python@v5
        with:
          python-version: "3.13"
          cache: "pip"
@@ -296,11 +279,9 @@ jobs:

  lint-front:
    runs-on: ubuntu-latest
-    permissions:
-      contents: read
    steps:
      - name: Checkout repository
-        uses: actions/checkout@v6
+        uses: actions/checkout@v4

      - name: Install dependencies
        run: cd src/frontend/ && npm ci
@@ -313,14 +294,12 @@ jobs:

  lint-sdk:
    runs-on: ubuntu-latest
-    permissions:
-      contents: read
    defaults:
      run:
        working-directory: src/sdk/library
    steps:
      - name: Checkout repository
-        uses: actions/checkout@v6
+        uses: actions/checkout@v4

      - name: Install dependencies
        run: npm ci
@@ -333,15 +312,13 @@ jobs:

  build-sdk:
    runs-on: ubuntu-latest
-    permissions:
-      contents: read
    needs: lint-sdk
    defaults:
      run:
        working-directory: src/sdk/library
    steps:
      - name: Checkout repository
-        uses: actions/checkout@v6
+        uses: actions/checkout@v4

      - name: Install dependencies
        run: npm ci
@@ -13,7 +13,7 @@ jobs:
    runs-on: ubuntu-latest
    steps:
      - name: Checkout
-        uses: actions/checkout@v6
+        uses: actions/checkout@v4
        with:
          fetch-depth: 0

@@ -8,54 +8,6 @@ and this project adheres to

 ## [Unreleased]

-### Added
-
- 👷(docker) add arm64 platform support for image builds
-
-### Changed
-
- ♻️(frontend) replace custom reactions toolbar with react aria popover #985
- 🔒️(frontend) uninstall curl from the frontend production image #987
- 💄(frontend) add focus ring to reaction emoji buttons
- ✨(frontend) introduce a shortcut settings tab #975
- 🚚(frontend) rename "wellknown" directory to "well-known" #1009
- 🌐(frontend) localize SR modifier labels #1010
- ⬆️(backend) update python dependencies #1011
- ♿️(a11y) fix focus ring on tab container components
-
-
-## [1.8.0] - 2026-02-20
-
-### Changed
-
- 🔒️(agents) uninstall pip from the agents image
- 🔒️(summary) switch to Alpine base image
- 🔒️(backend) uninstall pip in the production image
-
-### Fixed
-
- 🔒️(agents) upgrade OpenSSL to address CVE-2025-15467
- 📌(agents) pin protobuf to 6.33.5 to fix CVE-2026-0994
-
-## [1.7.0] - 2026-02-19
-
-### Added
-
- ✨(frontend) expose Windows app web link #976
- ✨(frontend) support additional shortcuts to broaden accessibility
-
-### Changed
-
- ✨(frontend) add clickable settings general link in idle modal #974
- ♻️(backend) refactor external API token-related items #1006
-
-## [1.6.0] - 2026-02-10
-
-### Added
-
- ✨(backend) monitor throttling rate failure through sentry #964
- 🚀(paas) add PaaS deployment scripts, tested on Scalingo #957
-
 ### Changed

 - ♿️(frontend) improve spinner reduced‑motion fallback #931
@@ -127,9 +127,6 @@ ARG MEET_STATIC_ROOT=/data/static
 RUN mkdir -p /usr/local/etc/gunicorn
 COPY docker/files/usr/local/etc/gunicorn/meet.py /usr/local/etc/gunicorn/meet.py

-# Remove pip to reduce attack surface in production
-RUN pip uninstall -y pip
-
 # Un-privileged user running the application
 ARG DOCKER_USER
 USER ${DOCKER_USER}
@@ -1,2 +0,0 @@
-web: bin/buildpack_start.sh
-postdeploy: python manage.py migrate
@@ -18,7 +18,6 @@ docker_build(
    'localhost:5001/meet-backend:latest',
    context='..',
    dockerfile='../Dockerfile',
-    build_args={'DOCKER_USER': '1001:127'},
    only=['./src/backend', './src/mail', './docker'],
    target = 'backend-production',
    live_update=[
@@ -34,7 +33,6 @@ clean_old_images('localhost:5001/meet-backend')
 docker_build(
    'localhost:5001/meet-frontend-dinum:latest',
    context='..',
-    build_args={'DOCKER_USER': '1001:127'},
    dockerfile='../docker/dinum-frontend/Dockerfile',
    only=['./src/frontend', './docker', './.dockerignore'],
    target = 'frontend-production',
@@ -59,7 +57,6 @@ clean_old_images('localhost:5001/meet-frontend-generic')
 docker_build(
    'localhost:5001/meet-summary:latest',
    context='../src/summary',
-    build_args={'DOCKER_USER': '1001:127'},
    dockerfile='../src/summary/Dockerfile',
    only=['.'],
    target = 'production',
@@ -72,9 +69,8 @@ clean_old_images('localhost:5001/meet-summary')
 docker_build(
    'localhost:5001/meet-agents:latest',
    context='../src/agents',
-    build_args={'DOCKER_USER': '1001:127'},
    dockerfile='../src/agents/Dockerfile',
-    only=['.'],
+   only=['.'],
    target = 'production',
    live_update=[
        sync('../src/agents', '/app'),
@@ -1,9 +0,0 @@
-#!/bin/bash
-
-set -o errexit    # always exit on error
-set -o pipefail   # don't ignore exit codes when piping output
-
-echo "-----> Running post-compile script"
-
-# Cleanup
-rm -rf docker docs env.d gitlint
@@ -1,50 +0,0 @@
-#!/bin/bash
-
-set -o errexit    # always exit on error
-set -o pipefail   # don't ignore exit codes when piping output
-
-echo "-----> Running post-frontend script"
-
-# Move the frontend build to the nginx root and clean up
-mkdir -p build/
-mv src/frontend/dist build/frontend-out
-
-ASSETS_DIR=build/frontend-out/assets
-if [ -n "$CUSTOM_LOGO_URL" ]; then
-    # Ensure https
-    [[ ! "$CUSTOM_LOGO_URL" =~ ^https:// ]] && echo "[custom-logo] ERROR: URL must use HTTPS" >&2 && exit 1
-
-    # Prevent SSRF
-    HOSTNAME=$(echo "$CUSTOM_LOGO_URL" | sed -E 's|^https://([^/:]+).*|\1|')
-    [[ "$HOSTNAME" =~ ^(localhost|127\.|10\.|172\.(1[6-9]|2[0-9]|3[01])\.|192\.168\.|0\.0\.0\.0|\[::1\]) ]] && echo "[custom-logo] ERROR: SSRF blocked: $HOSTNAME" >&2 && exit 1
-
-    LOGO_FILE="${ASSETS_DIR}/logo.svg"
-    TMP_FILE=$(mktemp "${LOGO_FILE}.XXXXXX.tmp")
-
-    # Actual download
-    echo "[custom-logo] INFO: Downloading custom logo from: $CUSTOM_LOGO_URL"
-    curl -fsSL --tlsv1.2 -o "$TMP_FILE" "$CUSTOM_LOGO_URL"
-
-    # Validate filesize
-    FILESIZE=$(stat -c%s "$TMP_FILE" 2>/dev/null || stat -f%z "$TMP_FILE")
-    [[ "$FILESIZE" -eq 0 ]] && echo "[custom-logo] ERROR: empty file" >&2 && exit 1
-    [[ "$FILESIZE" -gt 5242880 ]] && echo "[custom-logo] ERROR: file too large (${FILESIZE}B > 5MB)" >&2 && exit 1
-
-    # Validate file type
-    IS_SVG=false
-
-    HEADER=$(head -c 100 "$TMP_FILE" | tr -d '\0' | tr '[:upper:]' '[:lower:]')
-    [[ "$HEADER" =~ ^.*"<svg".*$ ]] && IS_SVG=true
-    [[ "$HEADER" =~ ^.*"<?xml".*"<svg".*$ ]] && IS_SVG=true
-
-    [[ "$IS_SVG" == false ]] && echo "[custom-logo] ERROR: not a valid SVG file" >&2 && exit 1
-
-    mv -f "$TMP_FILE" "$LOGO_FILE"
-    echo "[custom-logo] INFO: Custom logo downloaded successfuly"
-fi
-
-mv src/backend/* ./
-mv deploy/paas/* ./
-
-echo "3.13" > .python-version
-echo "." > requirements.txt
@@ -1,15 +0,0 @@
-#!/bin/bash
-
-# Start the Django backend server
-gunicorn -b 0.0.0.0:8000 meet.wsgi:application --log-file - &
-
-# Start the Nginx server
-bin/run &
-
-# if the current shell is killed, also terminate all its children     
-trap "pkill SIGTERM -P $$" SIGTERM
-
-# wait for a single child to finish,
-wait -n
-# then kill all the other tasks
-pkill -P $$
@@ -1,52 +0,0 @@
-# ERB templated nginx configuration
-# see https://doc.scalingo.com/platform/deployment/buildpacks/nginx
-
-upstream backend_server {
-	server localhost:8000 fail_timeout=0;
-}
-
-server {
-  listen <%= ENV["PORT"] %>;
-  server_name _;
-  server_tokens off;
-
-  root /app/build/frontend-out;
-
-  # Django rest framework
-  location ^~ /api/ {
-      proxy_set_header X-Forwarded-Proto https;
-      proxy_set_header Host $http_host;
-      proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
-
-      proxy_redirect off;
-      proxy_pass http://backend_server;
-  }
-
-  # Django admin
-  location ^~ /admin/ {
-      proxy_set_header X-Forwarded-Proto https;
-      proxy_set_header Host $http_host;
-      proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
-
-      proxy_redirect off;
-      proxy_pass http://backend_server;
-  }
-
-  # Serve static files with caching
-  location ~* ^/assets/.*\.(css|js|json|png|jpg|jpeg|gif|ico|svg|woff|woff2|ttf|eot)$ {
-      expires 30d;
-      add_header Cache-Control "public, max-age=2592000";
-  }
-
-  # Serve static files
-  location / {
-      try_files $uri $uri/ /index.html;
-      # Add no-cache headers
-      add_header Cache-Control "no-cache, no-store, must-revalidate";
-      add_header Pragma "no-cache";  # HTTP 1.0 header for backward compatibility
-      add_header Expires 0;
-  }
-
-  # Optionally, handle 404 errors by redirecting to index.html
-  error_page 404 =200 /index.html;
-}
@@ -1,9 +1,9 @@
 upstream meet_backend {
-    server ${BACKEND_INTERNAL_HOST}:8000 fail_timeout=0;
+    server ${BACKEND_HOST}:8000 fail_timeout=0;
 }

 upstream meet_frontend {
-    server ${FRONTEND_INTERNAL_HOST}:8080 fail_timeout=0;
+    server ${FRONTEND_HOST}:8080 fail_timeout=0;
 }

 server {
@@ -1,4 +1,4 @@
-FROM livekit/livekit-server:v1.9.4
+FROM livekit/livekit-server:v1.9.0

 # We inject the nip.io certificate manually because the livekit chart doesn't support volume mounting
 COPY rootCA.pem /etc/ssl/certs/
@@ -20,8 +20,8 @@ services:
    user: ${DOCKER_USER:-1000}
    restart: always
    env_file:
-    - .env
    - env.d/common
+    - env.d/backend
    - env.d/postgresql
    healthcheck:
      test: ["CMD", "python", "manage.py", "check"]
@@ -45,7 +45,6 @@ services:
    - /docker-entrypoint.sh
    command: ["nginx", "-g", "daemon off;"]
    env_file:
-    - .env
    - env.d/common
    # Uncomment and set your values if using our nginx proxy example
    # environment:
@@ -9,10 +9,6 @@ La Suite Meet maintainers use only the Kubernetes deployment method in productio
 We understand that not everyone has a Kubernetes cluster available, please follow the instructions provided [here](/docs/installation/compose.md) to set up a docker compose instance.
 We also provide [Docker images](https://hub.docker.com/u/lasuite?page=1&search=meet) that can be deployed using Compose.

-## Scalingo
-
-La Suite Meet can be deployed on Scalingo PaaS using the Suite Numérique buildpack. See the [Scalingo deployment guide](./scalingo.md) for detailed instructions.
-
 ## Other ways to install La Suite Meet
 Community members have contributed alternative ways to install La Suite Meet 🙏. While maintainers may not provide direct support, we help keep these instructions up to date, and you can reach out to contributors or the community for assistance.

@@ -1,185 +0,0 @@
-# Deployment on Scalingo
-
-This guide explains how to deploy La Suite Meet on [Scalingo](https://scalingo.com/) using the [Suite Numérique buildpack](https://github.com/suitenumerique/buildpack).
-
-## Overview
-
-Scalingo is a Platform-as-a-Service (PaaS) that simplifies application deployment. This setup uses a custom buildpack to handle both the frontend (Vite) and backend (Django) builds, serving them through Nginx.
-
-## Prerequisites
-
- A Scalingo account
- Scalingo CLI installed (optional but recommended)
- A PostgreSQL database addon
- A Redis addon (for caching and sessions)
-
-## Step 1: Create Your App
-
-Create a new app on Scalingo using `scalingo` cli or using the [Scalingo dashboard](https://dashboard.scalingo.com/).
-
-## Step 2: Provision Addons
-
-Add the required PostgreSQL and Redis services.
-
-This will set the following environment variables automatically:
- `SCALINGO_POSTGRESQL_URL` - Database connection string
- `SCALINGO_REDIS_URL` - Redis connection string
-
-## Step 3: Configure Environment Variables
-
-Set the following environment variables in your Scalingo app:
-
-### Buildpack Configuration
-
-```bash
-scalingo env-set BUILDPACK_URL="https://github.com/suitenumerique/buildpack#main"
-scalingo env-set LASUITE_APP_NAME="meet"
-scalingo env-set LASUITE_BACKEND_DIR="."
-scalingo env-set LASUITE_FRONTEND_DIR="src/frontend/"
-scalingo env-set LASUITE_NGINX_DIR="."
-scalingo env-set LASUITE_SCRIPT_POSTCOMPILE="bin/buildpack_postcompile.sh"
-scalingo env-set LASUITE_SCRIPT_POSTFRONTEND="bin/buildpack_postfrontend.sh"
-```
-
-### Database and Cache
-
-```bash
-scalingo env-set DATABASE_URL="\$SCALINGO_POSTGRESQL_URL"
-scalingo env-set REDIS_URL="\$SCALINGO_REDIS_URL"
-```
-
-### Django Settings
-
-```bash
-scalingo env-set DJANGO_SETTINGS_MODULE="meet.settings"
-scalingo env-set DJANGO_CONFIGURATION="Production"
-scalingo env-set DJANGO_SECRET_KEY="<generate-a-secure-secret-key>"
-scalingo env-set DJANGO_ALLOWED_HOSTS="my-meet-app.osc-fr1.scalingo.io"
-```
-
-### OIDC Authentication
-
-Configure your OIDC provider (e.g., Keycloak, Authentik):
-
-```bash
-scalingo env-set OIDC_OP_BASE_URL="https://auth.yourdomain.com/realms/meet"
-scalingo env-set OIDC_RP_CLIENT_ID="meet-client-id"
-scalingo env-set OIDC_RP_CLIENT_SECRET="<your-client-secret>"
-scalingo env-set OIDC_RP_SIGN_ALGO="RS256"
-```
-
-### LiveKit Configuration
-
-Meet requires a LiveKit server for video conferencing:
-
-```bash
-scalingo env-set LIVEKIT_API_URL="wss://livekit.yourdomain.com"
-scalingo env-set LIVEKIT_API_KEY="<your-livekit-api-key>"
-scalingo env-set LIVEKIT_API_SECRET="<your-livekit-api-secret>"
-```
-
-### Email Configuration (Optional)
-
-For email notifications see https://doc.scalingo.com/platform/app/sending-emails:
-
-```bash
-scalingo env-set DJANGO_EMAIL_HOST="smtp.example.org"
-scalingo env-set DJANGO_EMAIL_PORT="587"
-scalingo env-set DJANGO_EMAIL_HOST_USER="<smtp-user>"
-scalingo env-set DJANGO_EMAIL_HOST_PASSWORD="<smtp-password>"
-scalingo env-set DJANGO_EMAIL_USE_TLS="True"
-scalingo env-set DJANGO_EMAIL_FROM="meet@yourdomain.com"
-```
-
-## Step 4: Deploy
-
-Deploy your application:
-
-```bash
-git push scalingo main
-```
-
-The Procfile will automatically:
-1. Build the frontend (Vite)
-2. Build the backend (Django)
-3. Run the post-compile script (cleanup)
-4. Run the post-frontend script (move assets and prepare for deployment)
-5. Start Nginx and Gunicorn
-6. Run django migrations
-
-## Step 5: Create superuser
-
-After the first deployment, create an admin user:
-
-```bash
-scalingo run python manage.py createsuperuser
-```
-
-## Custom Domain (Optional)
-
-To use a custom domain:
-
-1. Add the domain in Scalingo dashboard
-2. Update `DJANGO_ALLOWED_HOSTS` with your custom domain
-3. Configure your DNS to point to Scalingo
-
-```bash
-scalingo domains-add meet.yourdomain.com
-scalingo env-set DJANGO_ALLOWED_HOSTS="meet.yourdomain.com,my-meet-app.osc-fr1.scalingo.io"
-```
-
-## Custom Logo (Optional)
-
-To use a custom logo, set the `CUSTOM_LOGO_URL` environment variable with an HTTPS URL pointing to an SVG item (max 5MB):
-
-```bash
-scalingo env-set CUSTOM_LOGO_URL="https://cdn.yourdomain.com/logo.svg"
-```
-
-## Troubleshooting
-
-### Check Logs
-
-```bash
-scalingo logs --tail
-```
-
-### Common Issues
-
-1. **Build fails**: Check that all required environment variables are set
-2. **Database connection error**: Verify `DATABASE_URL` is correctly set to `$SCALINGO_POSTGRESQL_URL`
-3. **Static files not served**: Ensure the buildpack post-frontend script ran successfully
-4. **OIDC errors**: Verify your OIDC provider configuration and callback URLs
-
-### Useful Commands
-
-```bash
-# Open a console
-scalingo run bash
-
-# Restart the app
-scalingo restart
-
-# Scale containers
-scalingo scale web:2
-
-# One-off command
-scalingo run python manage.py shell
-```
-
-## Architecture
-
-On Scalingo, the application runs as follows:
-
-1. **Build Phase**: The buildpack compiles both frontend and backend
-2. **Runtime**:
-   - Nginx serves static files and proxies to the backend
-   - Gunicorn runs the Django WSGI application
-   - Both processes are managed by the `bin/buildpack_start.sh` script
-
-## Additional Resources
-
- [Scalingo Documentation](https://doc.scalingo.com/)
- [Suite Numérique Buildpack](https://github.com/suitenumerique/buildpack)
- [Meet Environment Variables](../../src/helm/meet/README.md)
- [Django Configurations Documentation](https://django-configurations.readthedocs.io/)
@@ -3,21 +3,6 @@
  "dependencyDashboard": true,
  "labels": ["dependencies", "noChangeLog"],
  "packageRules": [
-    {
-        "groupName": "js dependencies",
-        "matchManagers": ["npm"],
-        "schedule": ["on the first day of the month"],
-        "matchPackagePatterns": ["*"],
-        "minimumReleaseAge": "7 days",
-        "internalChecksFilter": "strict"
-      },
-      {
-        "groupName": "python dependencies",
-        "matchManagers": ["setup-cfg", "pep621"],
-        "schedule": ["on the first day of the month"],
-        "matchPackagePatterns": ["*"],
-        "minimumReleaseAge": "7 days"
-      },
    {
      "enabled": false,
      "groupName": "ignored python dependencies",
@@ -30,12 +15,6 @@
      "matchPackageNames": ["pylint"],
      "allowedVersions": "<4.0.0"
    },
-    {
-        "groupName": "allowed django versions",
-        "matchManagers": ["pep621"],
-        "matchPackageNames": ["django"],
-        "allowedVersions": "<6.0.0"
-    },
    {
      "enabled": false,
      "groupName": "ignored js dependencies",
@@ -1,8 +0,0 @@
-{
-  "plugins": [
-    "office-addins"
-  ],
-  "extends": [
-    "plugin:office-addins/recommended"
-  ]
-}
@@ -1,12 +0,0 @@
-{
-  "presets": [
-    [
-      "@babel/preset-env",
-      {
-        "targets": {
-          "esmodules": false
-        }
-      }
-    ],
-  ]
-}
@@ -1,173 +0,0 @@
-<?xml version="1.0" encoding="UTF-8" standalone="yes"?>
-<OfficeApp xmlns="http://schemas.microsoft.com/office/appforoffice/1.1" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xmlns:bt="http://schemas.microsoft.com/office/officeappbasictypes/1.0" xmlns:mailappor="http://schemas.microsoft.com/office/mailappversionoverrides/1.0" xsi:type="MailApp">
-  <Id>a025f0f6-757a-4790-97f3-99c66c4a5795</Id>
-  <Version>0.0.1.0</Version>
-  <ProviderName>Visio</ProviderName>
-  <DefaultLocale>en-US</DefaultLocale>
-  <DisplayName DefaultValue="Visio"/>
-  <Description DefaultValue="Ajoutez facilement un lien de réunion Visio à vos emails et événements Outlook."/>
-  <IconUrl DefaultValue="https://localhost:3000/assets/icon-64.png"/>
-  <HighResolutionIconUrl DefaultValue="https://localhost:3000/assets/icon-128.png"/>
-  <SupportUrl DefaultValue="https://www.contoso.com/help"/>
-  <AppDomains>
-    <AppDomain>https://localhost:3000</AppDomain>
-    <AppDomain>https://meet.127.0.0.1.nip.io</AppDomain>
-  </AppDomains>
-  <Hosts>
-    <Host Name="Mailbox"/>
-  </Hosts>
-  <Requirements>
-    <Sets>
-      <Set Name="Mailbox" MinVersion="1.1"/>
-    </Sets>
-  </Requirements>
-  <FormSettings>
-    <Form xsi:type="ItemRead">
-      <DesktopSettings>
-        <SourceLocation DefaultValue="https://localhost:3000/taskpane.html"/>
-        <RequestedHeight>250</RequestedHeight>
-      </DesktopSettings>
-    </Form>
-    <Form xsi:type="ItemEdit">
-      <DesktopSettings>
-        <SourceLocation DefaultValue="https://localhost:3000/taskpane.html"/>
-      </DesktopSettings>
-    </Form>
-  </FormSettings>
-  <Permissions>ReadWriteItem</Permissions>
-  <Rule xsi:type="RuleCollection" Mode="Or">
-    <Rule xsi:type="ItemIs" ItemType="Message" FormType="Read"/>
-    <Rule xsi:type="ItemIs" ItemType="Message" FormType="Edit"/>
-    <Rule xsi:type="ItemIs" ItemType="Appointment" FormType="Edit"/>
-  </Rule>
-  <DisableEntityHighlighting>false</DisableEntityHighlighting>
-  <VersionOverrides xmlns="http://schemas.microsoft.com/office/mailappversionoverrides" xsi:type="VersionOverridesV1_0">
-    <Requirements>
-      <bt:Sets DefaultMinVersion="1.3">
-        <bt:Set Name="Mailbox"/>
-      </bt:Sets>
-    </Requirements>
-    <Hosts>
-      <Host xsi:type="MailHost">
-        <DesktopFormFactor>
-          <FunctionFile resid="Commands.Url"/>
-
-          <!-- ─── Mail: Read ─────────────────────────────────────────── -->
-          <ExtensionPoint xsi:type="MessageReadCommandSurface">
-            <OfficeTab id="TabDefault">
-              <Group id="msgReadGroup">
-                <Label resid="GroupLabel"/>
-                <Control xsi:type="Button" id="msgReadOpenPaneButton">
-                  <Label resid="TaskpaneButton.Label"/>
-                  <Supertip>
-                    <Title resid="TaskpaneButton.Label"/>
-                    <Description resid="TaskpaneButton.Tooltip"/>
-                  </Supertip>
-                  <Icon>
-                    <bt:Image size="16" resid="Icon.16x16"/>
-                    <bt:Image size="32" resid="Icon.32x32"/>
-                    <bt:Image size="80" resid="Icon.80x80"/>
-                  </Icon>
-                  <Action xsi:type="ShowTaskpane">
-                    <SourceLocation resid="Taskpane.Url"/>
-                  </Action>
-                </Control>
-              </Group>
-            </OfficeTab>
-          </ExtensionPoint>
-
-          <!-- ─── Mail: Compose ─────────────────────────────────────── -->
-          <ExtensionPoint xsi:type="MessageComposeCommandSurface">
-            <OfficeTab id="TabDefault">
-              <Group id="msgComposeGroup">
-                <Label resid="GroupLabel"/>
-                <Control xsi:type="Button" id="msgComposeOpenPaneButton">
-                  <Label resid="TaskpaneButton.Label"/>
-                  <Supertip>
-                    <Title resid="TaskpaneButton.Label"/>
-                    <Description resid="TaskpaneButton.Tooltip"/>
-                  </Supertip>
-                  <Icon>
-                    <bt:Image size="16" resid="Icon.16x16"/>
-                    <bt:Image size="32" resid="Icon.32x32"/>
-                    <bt:Image size="80" resid="Icon.80x80"/>
-                  </Icon>
-                  <Action xsi:type="ShowTaskpane">
-                    <SourceLocation resid="Taskpane.Url"/>
-                  </Action>
-                </Control>
-              </Group>
-            </OfficeTab>
-          </ExtensionPoint>
-
-          <!-- ─── Calendar: Compose (New/Edit appointment) ──────────── -->
-          <ExtensionPoint xsi:type="AppointmentOrganizerCommandSurface">
-            <OfficeTab id="TabDefault">
-              <Group id="apptComposeGroup">
-                <Label resid="GroupLabel"/>
-
-                <!-- Button 1: Generate meeting link (function call) -->
-                <Control xsi:type="Button" id="apptGenerateLinkButton">
-                  <Label resid="GenerateLink.Label"/>
-                  <Supertip>
-                    <Title resid="GenerateLink.Label"/>
-                    <Description resid="GenerateLink.Tooltip"/>
-                  </Supertip>
-                  <Icon>
-                    <bt:Image size="16" resid="Icon.16x16"/>
-                    <bt:Image size="32" resid="Icon.32x32"/>
-                    <bt:Image size="80" resid="Icon.80x80"/>
-                  </Icon>
-                  <Action xsi:type="ExecuteFunction">
-                    <FunctionName>generateMeetingLinkFromCalendar</FunctionName>
-                  </Action>
-                </Control>
-
-                <!-- Button 2: Open settings taskpane -->
-                <Control xsi:type="Button" id="apptOpenSettingsButton">
-                  <Label resid="OpenSettings.Label"/>
-                  <Supertip>
-                    <Title resid="OpenSettings.Label"/>
-                    <Description resid="OpenSettings.Tooltip"/>
-                  </Supertip>
-                  <Icon>
-                    <bt:Image size="16" resid="Icon.16x16"/>
-                    <bt:Image size="32" resid="Icon.32x32"/>
-                    <bt:Image size="80" resid="Icon.80x80"/>
-                  </Icon>
-                  <Action xsi:type="ShowTaskpane">
-                    <SourceLocation resid="Taskpane.Url"/>
-                  </Action>
-                </Control>
-
-              </Group>
-            </OfficeTab>
-          </ExtensionPoint>
-
-        </DesktopFormFactor>
-      </Host>
-    </Hosts>
-    <Resources>
-      <bt:Images>
-        <bt:Image id="Icon.16x16" DefaultValue="https://localhost:3000/assets/icon-16.png"/>
-        <bt:Image id="Icon.32x32" DefaultValue="https://localhost:3000/assets/icon-32.png"/>
-        <bt:Image id="Icon.80x80" DefaultValue="https://localhost:3000/assets/icon-80.png"/>
-      </bt:Images>
-      <bt:Urls>
-        <bt:Url id="Commands.Url" DefaultValue="https://localhost:3000/commands.html"/>
-        <bt:Url id="Taskpane.Url" DefaultValue="https://localhost:3000/taskpane.html"/>
-      </bt:Urls>
-      <bt:ShortStrings>
-        <bt:String id="GroupLabel" DefaultValue="Visio"/>
-        <bt:String id="TaskpaneButton.Label" DefaultValue="Ouvrir le panneau"/>
-        <bt:String id="GenerateLink.Label" DefaultValue="Générer un lien de réunion"/>
-        <bt:String id="OpenSettings.Label" DefaultValue="Paramètres"/>
-      </bt:ShortStrings>
-      <bt:LongStrings>
-        <bt:String id="TaskpaneButton.Tooltip" DefaultValue="Ouvre le panneau de connexion Visio."/>
-        <bt:String id="GenerateLink.Tooltip" DefaultValue="Génère un lien de réunion Visio et l'insère dans l'événement."/>
-        <bt:String id="OpenSettings.Tooltip" DefaultValue="Ouvre les paramètres de connexion Visio."/>
-      </bt:LongStrings>
-    </Resources>
-  </VersionOverrides>
-</OfficeApp>
@@ -1,62 +0,0 @@
-{
-  "name": "office-addin-taskpane-js",
-  "version": "0.0.1",
-  "repository": {
-    "type": "git",
-    "url": "https://github.com/OfficeDev/Office-Addin-TaskPane-JS.git"
-  },
-  "license": "MIT",
-  "config": {
-    "app_to_debug": "outlook",
-    "app_type_to_debug": "desktop",
-    "dev_server_port": 3000
-  },
-  "scripts": {
-    "build": "webpack --mode production",
-    "build:dev": "webpack --mode development",
-    "dev-server": "webpack serve --mode development",
-    "lint": "office-addin-lint check",
-    "lint:fix": "office-addin-lint fix",
-    "prettier": "office-addin-lint prettier",
-    "signin": "office-addin-dev-settings m365-account login",
-    "signout": "office-addin-dev-settings m365-account logout",
-    "start": "office-addin-debugging start manifest.xml",
-    "stop": "office-addin-debugging stop manifest.xml",
-    "validate": "office-addin-manifest validate manifest.xml",
-    "watch": "webpack --mode development --watch"
-  },
-  "dependencies": {
-    "core-js": "^3.36.0",
-    "regenerator-runtime": "^0.14.1"
-  },
-  "devDependencies": {
-    "@babel/core": "^7.24.0",
-    "@babel/preset-env": "^7.25.4",
-    "@types/office-js": "^1.0.377",
-    "@types/office-runtime": "^1.0.35",
-    "acorn": "^8.11.3",
-    "babel-loader": "^9.1.3",
-    "copy-webpack-plugin": "^12.0.2",
-    "eslint-plugin-office-addins": "^4.0.3",
-    "file-loader": "^6.2.0",
-    "html-loader": "^5.0.0",
-    "html-webpack-plugin": "^5.6.0",
-    "office-addin-cli": "^2.0.3",
-    "office-addin-debugging": "^6.0.3",
-    "office-addin-dev-certs": "^2.0.3",
-    "office-addin-lint": "^3.0.3",
-    "office-addin-manifest": "^2.0.3",
-    "office-addin-prettier-config": "^2.0.1",
-    "os-browserify": "^0.3.0",
-    "process": "^0.11.10",
-    "source-map-loader": "^5.0.0",
-    "webpack": "^5.95.0",
-    "webpack-cli": "^5.1.4",
-    "webpack-dev-server": "5.1.0"
-  },
-  "prettier": "office-addin-prettier-config",
-  "browserslist": [
-    "last 2 versions",
-    "ie 11"
-  ]
-}
@@ -1,9 +0,0 @@
-<!DOCTYPE html>
-<html>
-<head>
-    <meta charset="UTF-8" />
-    <meta http-equiv="X-UA-Compatible" content="IE=Edge" />
-    <script src="https://appsforoffice.microsoft.com/lib/1/hosted/office.js"></script>
-</head>
-<body></body>
-</html>
@@ -1,80 +0,0 @@
-/* global Office */
-const { loadSession, buildMeetingMessage, BASE_URL } = require("../common");
-
-Office.onReady(() => {});
-
-function generateMeetingLinkFromCalendar(event) {
-  const session = loadSession();
-
-  if (!session?.access_token) {
-    Office.context.mailbox.item.notificationMessages.replaceAsync("meetNotif", {
-      type: Office.MailboxEnums.ItemNotificationMessageType.ErrorMessage,
-      message: "Vous n'êtes pas connecté. Ouvrez les paramètres pour vous connecter.",
-    });
-    event.completed();
-    return;
-  }
-
-  fetch(`${BASE_URL}/external-api/v1.0/rooms/`, {
-    method: "POST",
-    headers: {
-      "Content-Type": "application/json",
-      "Authorization": "Bearer " + session.access_token,
-    },
-  })
-    .then((res) => res.json())
-    .then((data) => {
-      console.log("Room created:", data);
-
-      const { url, message } = buildMeetingMessage(data);
-      const item = Office.context.mailbox.item;
-
-      item.body.getAsync(Office.CoercionType.Html, (getResult) => {
-        if (getResult.status !== Office.AsyncResultStatus.Succeeded) {
-          item.notificationMessages.replaceAsync("meetNotif", {
-            type: Office.MailboxEnums.ItemNotificationMessageType.ErrorMessage,
-            message: `Erreur de lecture: ${getResult.error.message}`,
-          });
-          event.completed();
-          return;
-        }
-
-        item.body.setAsync(getResult.value + message, { coercionType: Office.CoercionType.Html }, (setResult) => {
-          if (setResult.status !== Office.AsyncResultStatus.Succeeded) {
-            item.notificationMessages.replaceAsync("meetNotif", {
-              type: Office.MailboxEnums.ItemNotificationMessageType.ErrorMessage,
-              message: `Erreur d'insertion: ${setResult.error.message}`,
-            });
-            event.completed();
-            return;
-          }
-
-          item.location.setAsync(url, (locationResult) => {
-            if (locationResult.status === Office.AsyncResultStatus.Succeeded) {
-              item.notificationMessages.replaceAsync("meetNotif", {
-                type: Office.MailboxEnums.ItemNotificationMessageType.InformationalMessage,
-                message: "Lien de réunion inséré !",
-                icon: "Icon.80x80",
-                persistent: false,
-              });
-            } else {
-              item.notificationMessages.replaceAsync("meetNotif", {
-                type: Office.MailboxEnums.ItemNotificationMessageType.ErrorMessage,
-                message: `Erreur de localisation: ${locationResult.error.message}`,
-              });
-            }
-            event.completed();
-          });
-        });
-      });
-    })
-    .catch((err) => {
-      Office.context.mailbox.item.notificationMessages.replaceAsync("meetNotif", {
-        type: Office.MailboxEnums.ItemNotificationMessageType.ErrorMessage,
-        message: `Erreur: ${err.message}`,
-      });
-      event.completed();
-    });
-}
-
-Office.actions.associate("generateMeetingLinkFromCalendar", generateMeetingLinkFromCalendar);
@@ -1,99 +0,0 @@
-/* global Office */
-
-const BASE_URL = "https://meet.127.0.0.1.nip.io";
-
-// ─── Session Storage ──────────────────────────────────────────────────────
-
-function saveSession(data) {
-  const expiresAt = data.expires_in
-    ? new Date(Date.now() + data.expires_in * 1000).toISOString()
-    : null;
-
-  const payload = JSON.stringify({
-    ...data,
-    expiresAt,
-    savedAt: new Date().toISOString(),
-  });
-
-  localStorage.setItem("meetSession", payload);
-
-  const rs = Office.context.roamingSettings;
-  rs.set("meetSession", payload);
-  rs.saveAsync((result) => {
-    if (result.status !== Office.AsyncResultStatus.Succeeded) {
-      console.error("RoamingSettings save failed:", result.error.message);
-    }
-  });
-}
-
-function loadSession() {
-  let session = null;
-
-  try {
-    const stored = Office.context.roamingSettings.get("meetSession");
-    if (stored) session = JSON.parse(stored);
-  } catch (e) {
-    console.warn("RoamingSettings read failed:", e);
-  }
-
-  if (!session) {
-    try {
-      const stored = localStorage.getItem("meetSession");
-      if (stored) session = JSON.parse(stored);
-    } catch (e) {
-      console.warn("localStorage read failed:", e);
-    }
-  }
-
-  if (!session) return null;
-
-  if (session.expiresAt && new Date() > new Date(session.expiresAt)) {
-    console.warn("Token expired, clearing session.");
-    clearSession();
-    return null;
-  }
-
-  return session;
-}
-
-function clearSession() {
-  localStorage.removeItem("meetSession");
-  try {
-    const rs = Office.context.roamingSettings;
-    rs.remove("meetSession");
-    rs.saveAsync(() => console.log("RoamingSettings cleared."));
-  } catch (e) {
-    console.warn("Could not clear RoamingSettings:", e);
-  }
-}
-
-// ─── Meeting Message Builder ───────────────────────────────────────────────
-
-function buildMeetingMessage(data) {
-  const url   = data.url;
-  const phone = data.telephony?.phone_number;
-  const pin   = data.telephony?.pin_code;
-
-  const formattedPin = pin
-    ? pin.replace(/(\d{3})(\d{3})(\d{4})/, "$1 $2 $3") + "#"
-    : "";
-
-  const formattedPhone = phone
-    ? phone.replace(/^\+33(\d)(\d{2})(\d{2})(\d{2})(\d{2})$/, "+33 $1 $2 $3 $4 $5")
-    : phone;
-
-  const message = `<pre style="font-family:inherit; font-size:inherit; border:none; background:none; margin:16px 0;">
-────────────────────────────────────────
-Rejoindre la réunion LaSuite Meet
-
-<a href="${url}">${url}</a>
-
-Ou appelez (audio uniquement)
-(FR) ${formattedPhone}
-Code : ${formattedPin}
-────────────────────────────────────────</pre>`;
-
-  return { url, message };
-}
-
-module.exports = { BASE_URL, saveSession, loadSession, clearSession, buildMeetingMessage };
@@ -1,58 +0,0 @@
-<!DOCTYPE html>
-<html>
-<head>
-    <meta charset="UTF-8" />
-    <meta http-equiv="X-UA-Compatible" content="IE=Edge" />
-    <meta name="viewport" content="width=device-width, initial-scale=1">
-    <title>Visio</title>
-    <link rel="stylesheet" href="taskpane.css" />
-    <script src="https://appsforoffice.microsoft.com/lib/1/hosted/office.js"></script>
-</head>
-<body>
-<div id="sideload-msg">Veuillez charger le complément.</div>
-
-<div id="app-body">
-
-    <!-- Loading -->
-    <div id="view-loading">
-        <p class="intro-text">Chargement...</p>
-    </div>
-
-    <!-- Unauthenticated -->
-    <div id="view-unauth" style="display:none;">
-        <p class="intro-text">
-            <span>Ajoutez facilement un lien de réunion Visio à vos événements Outlook.</span>
-            <a href="https://meet.numerique.gouv.fr" target="_blank" class="learn-more">En savoir plus</a>
-        </p>
-
-        <hr class="divider" />
-
-        <button class="proconnect-button" id="btn-connect">
-            <span class="proconnect-sr-only">S'identifier avec ProConnect</span>
-        </button>
-
-        <p>
-            <a
-                    href="https://www.proconnect.gouv.fr/"
-                    target="_blank"
-                    rel="noopener noreferrer"
-                    title="Qu’est-ce que ProConnect ? - nouvelle fenêtre"
-            >
-                Qu’est-ce que ProConnect ?
-            </a>
-        </p>
-    </div>
-
-    <!-- Authenticated -->
-    <div id="view-auth" style="display:none;">
-        <div id="btn-container">
-            <button id="btn-generate">Ajouter une réunion Visio</button>
-            <button id="btn-disconnect">Se déconnecter</button>
-        </div>
-    </div>
-
-    <p id="status"></p>
-
-</div>
-</body>
-</html>
@@ -1,196 +0,0 @@
-
-const { BASE_URL, loadSession, saveSession, clearSession, buildMeetingMessage } = require("../common");
-
-// ─── Views ────────────────────────────────────────────────────────────────
-
-function showView(name) {
-  document.getElementById("view-loading").style.display = "none";
-  document.getElementById("view-unauth").style.display  = "none";
-  document.getElementById("view-auth").style.display    = "none";
-  document.getElementById(`view-${name}`).style.display = "block";
-}
-
-function setStatus(msg) {
-  document.getElementById("status").textContent = msg;
-}
-
-// ─── Auth Flow ────────────────────────────────────────────────────────────
-
-function connect() {
-  setStatus("Démarrage de la session...");
-
-  fetch(`${BASE_URL}/api/v1.0/addons/sessions/`, {
-    method: "POST",
-    headers: { "Content-Type": "application/json" },
-  })
-    .then((res) => res.json())
-    .then((data) => {
-      const session_id = data.session_id;
-      setStatus("En attente d'authentification...");
-
-      let dialog       = null;
-      let pollInterval = null;
-      let pollCount    = 0;
-
-      pollInterval = setInterval(() => {
-
-        // ─── Timeout after 3 minutes ──────────────────────────────
-        if (pollCount++ > 180) {
-          clearInterval(pollInterval);
-          if (dialog) dialog.close();
-          setStatus("Délai d'authentification dépassé. Veuillez réessayer.");
-          showView("unauth");
-          return;
-        }
-
-        fetch(`${BASE_URL}/api/v1.0/addons/sessions/${session_id}`, {
-          method: "GET",
-          headers: { "Content-Type": "application/json" },
-        })
-          .then((res) => res.json())
-          .then((sessionData) => {
-            console.log("Polling:", sessionData);
-            if (sessionData.state === "authenticated" && sessionData.access_token) {
-              clearInterval(pollInterval);
-              // if (dialog) dialog.close();
-              saveSession(sessionData);
-              setStatus("Connecté !");
-              showView("auth");
-            }
-          })
-          .catch((err) => {
-            clearInterval(pollInterval);
-            setStatus(`Erreur de polling: ${err.message}`);
-          });
-      }, 1000);
-
-      // ─── Open transit dialog ──────────────────────────────────────
-      const meetUrl = `${BASE_URL}/addons/transit/?session_id=${session_id}`;
-      Office.context.ui.displayDialogAsync(
-        meetUrl,
-        { height: 60, width: 50, displayInIframe: false },
-        (asyncResult) => {
-          if (asyncResult.status === Office.AsyncResultStatus.Failed) {
-            clearInterval(pollInterval);
-            setStatus(`Erreur dialog: ${asyncResult.error.message}`);
-            return;
-          }
-
-          dialog = asyncResult.value;
-
-          dialog.addEventHandler(Office.EventType.DialogMessageReceived, () => {
-            clearInterval(pollInterval);
-            dialog.close();
-          });
-
-          dialog.addEventHandler(Office.EventType.DialogEventReceived, (arg) => {
-            if (arg.error === 12006) {
-              setStatus("Dialog fermé. En attente d'authentification...");
-            }
-          });
-        }
-      );
-    })
-    .catch((err) => {
-      setStatus(`Erreur de connexion: ${err.message}`);
-    });
-}
-
-function disconnect() {
-  clearSession();
-  setStatus("Déconnecté.");
-  showView("unauth");
-}
-
-function generateMeetingLink() {
-  const session = loadSession();
-  if (!session?.access_token) {
-    setStatus("Session introuvable. Veuillez vous reconnecter.");
-    showView("unauth");
-    return;
-  }
-
-  const btn = document.getElementById("btn-generate");
-  btn.disabled    = true;
-  btn.textContent = "Génération...";
-
-  fetch(`${BASE_URL}/external-api/v1.0/rooms/`, {
-    method: "POST",
-    headers: {
-      "Content-Type": "application/json",
-      "Authorization": "Bearer " + session.access_token,
-    },
-  })
-    .then((res) => res.json())
-    .then((data) => {
-      console.log("Room created:", data);
-
-      const { url, message } = buildMeetingMessage(data);
-      const item = Office.context.mailbox.item;
-
-      item.body.getAsync(Office.CoercionType.Html, (getResult) => {
-        if (getResult.status !== Office.AsyncResultStatus.Succeeded) {
-          setStatus(`Erreur de lecture: ${getResult.error.message}`);
-          btn.disabled    = false;
-          btn.textContent = "Ajouter une réunion Visio";
-          return;
-        }
-
-        item.body.setAsync(
-          getResult.value + message,
-          { coercionType: Office.CoercionType.Html },
-          (setResult) => {
-            if (setResult.status !== Office.AsyncResultStatus.Succeeded) {
-              setStatus(`Erreur d'insertion: ${setResult.error.message}`);
-              btn.disabled    = false;
-              btn.textContent = "Ajouter une réunion Visio";
-              return;
-            }
-
-            // ─── If calendar event, also set location ──────────────
-            if (item.itemType === Office.MailboxEnums.ItemType.Appointment) {
-              item.location.setAsync(url, (locationResult) => {
-                btn.disabled    = false;
-                btn.textContent = "Ajouter une réunion Visio";
-                if (locationResult.status === Office.AsyncResultStatus.Succeeded) {
-                  setStatus("Lien de réunion inséré !");
-                } else {
-                  setStatus(`Erreur de localisation: ${locationResult.error.message}`);
-                }
-              });
-            } else {
-              btn.disabled    = false;
-              btn.textContent = "Ajouter une réunion Visio";
-              setStatus("Lien de réunion inséré !");
-            }
-          }
-        );
-      });
-    })
-    .catch((err) => {
-      btn.disabled    = false;
-      btn.textContent = "Ajouter une réunion Visio";
-      setStatus(`Erreur: ${err.message}`);
-    });
-}
-
-// ─── Init ─────────────────────────────────────────────────────────────────
-
-Office.onReady((info) => {
-  if (info.host === Office.HostType.Outlook) {
-    document.getElementById("sideload-msg").style.display = "none";
-    document.getElementById("app-body").style.display     = "flex";
-
-    document.getElementById("btn-connect").onclick    = connect;
-    document.getElementById("btn-disconnect").onclick = disconnect;
-    document.getElementById("btn-generate").onclick   = generateMeetingLink;
-
-    const session = loadSession();
-    if (session?.state === "authenticated" && session?.access_token) {
-      setStatus("Connecté.");
-      showView("auth");
-    } else {
-      showView("unauth");
-    }
-  }
-});
@@ -1,97 +0,0 @@
-/* eslint-disable no-undef */
-
-const devCerts = require("office-addin-dev-certs");
-const CopyWebpackPlugin = require("copy-webpack-plugin");
-const HtmlWebpackPlugin = require("html-webpack-plugin");
-
-const urlDev = "https://localhost:3000/";
-const urlProd = "https://meet.127.0.0.1.nip.io/outlook-addin/";
-
-async function getHttpsOptions() {
-  const httpsOptions = await devCerts.getHttpsServerOptions();
-  return { ca: httpsOptions.ca, key: httpsOptions.key, cert: httpsOptions.cert };
-}
-
-module.exports = async (env, options) => {
-  const dev = options.mode === "development";
-  const config = {
-    devtool: "source-map",
-    entry: {
-      polyfill: ["core-js/stable", "regenerator-runtime/runtime"],
-      taskpane: ["./src/taskpane/taskpane.js", "./src/taskpane/taskpane.html"],
-      commands: "./src/commands/commands.js",
-    },
-    output: {
-      clean: true,
-    },
-    resolve: {
-      extensions: [".html", ".js"],
-    },
-    module: {
-      rules: [
-        {
-          test: /\.js$/,
-          exclude: /node_modules/,
-          use: {
-            loader: "babel-loader",
-          },
-        },
-        {
-          test: /\.html$/,
-          exclude: /node_modules/,
-          use: "html-loader",
-        },
-        {
-          test: /\.(png|jpg|jpeg|gif|ico)$/,
-          type: "asset/resource",
-          generator: {
-            filename: "assets/[name][ext][query]",
-          },
-        },
-      ],
-    },
-    plugins: [
-      new HtmlWebpackPlugin({
-        filename: "taskpane.html",
-        template: "./src/taskpane/taskpane.html",
-        chunks: ["polyfill", "taskpane"],
-      }),
-      new CopyWebpackPlugin({
-        patterns: [
-          {
-            from: "assets/*",
-            to: "assets/[name][ext][query]",
-          },
-          {
-            from: "manifest*.xml",
-            to: "[name]" + "[ext]",
-            transform(content) {
-              if (dev) {
-                return content;
-              } else {
-                return content.toString().replace(new RegExp(urlDev, "g"), urlProd);
-              }
-            },
-          },
-        ],
-      }),
-      new HtmlWebpackPlugin({
-        filename: "commands.html",
-        template: "./src/commands/commands.html",
-        chunks: ["polyfill", "commands"],
-      }),
-    ],
-    devServer: {
-      headers: {
-        "Access-Control-Allow-Origin": "*",
-      },
-      server: {
-        type: "https",
-        options: env.WEBPACK_BUILD || options.https !== undefined ? options.https : await getHttpsOptions(),
-      },
-      port: process.env.npm_package_config_dev_server_port || 3000,
-    },
-  };
-
-  return config;
-};
@@ -4,8 +4,6 @@ FROM python:3.13-slim AS base
 RUN apt-get update && apt-get install -y \
    libglib2.0-0 \
    libgobject-2.0-0 \
-    "openssl=3.5.4-1~deb13u2" \
-    "libssl3t64=3.5.4-1~deb13u2" \
    && rm -rf /var/lib/apt/lists/*

 FROM base AS builder
@@ -21,9 +19,6 @@ FROM base AS production

 WORKDIR /app

-# Remove pip to reduce attack surface in production
-RUN pip uninstall -y pip
-
 ARG DOCKER_USER
 USER ${DOCKER_USER}

@@ -1,15 +1,14 @@

 [project]
 name = "agents"
-version = "1.8.0"
+version = "1.5.0"
 requires-python = ">=3.12"
 dependencies = [
    "livekit-agents==1.3.10",
    "livekit-plugins-deepgram==1.3.10",
    "livekit-plugins-silero==1.3.10",
    "livekit-plugins-kyutai-lasuite==0.0.6",
-    "python-dotenv==1.2.1",
-    "protobuf==6.33.5"
+    "python-dotenv==1.2.1"
 ]

 [project.optional-dependencies]
@@ -1 +0,0 @@
-"""Meet core add-ons module."""
@@ -1,124 +0,0 @@
-"""Authentication session management for add-ons using temporary cache-based sessions."""
-
-import secrets
-from datetime import datetime, timedelta, timezone
-from enum import Enum
-from logging import getLogger
-
-from django.conf import settings
-from django.core.cache import cache
-from django.core.exceptions import SuspiciousOperation
-
-from core.models import User
-from core.services.jwt_token import JwtTokenService
-
-logger = getLogger(__name__)
-
-
-class SessionState(str, Enum):
-    """Add-on authentication session states."""
-
-    PENDING = "pending"
-    AUTHENTICATED = "authenticated"
-
-
-class TokenExchangeService:
-    """Manage temporary authentication sessions for add-on JWT token exchange."""
-
-    def __init__(self):
-        """Initialize the service with the configured token service."""
-
-        self._token_service = JwtTokenService(
-            secret_key=settings.ADDONS_JWT_SECRET_KEY,
-            algorithm=settings.ADDONS_JWT_ALG,
-            issuer=settings.ADDONS_JWT_ISSUER,
-            audience=settings.ADDONS_JWT_AUDIENCE,
-            expiration_seconds=settings.ADDONS_JWT_EXPIRATION_SECONDS,
-            token_type=settings.ADDONS_JWT_TOKEN_TYPE,
-        )
-
-    def _get_cache_key(self, session_id: str) -> str:
-        """Generate cache key for a session ID."""
-        return f"{settings.ADDONS_SESSION_KEY_PREFIX}_{session_id}"
-
-    def init_session(self) -> str:
-        """Create a new pending authentication session and return its ID."""
-
-        session_id = secrets.token_urlsafe(settings.ADDONS_SESSION_ID_LENGTH)
-        expires_at = datetime.now(timezone.utc) + timedelta(
-            seconds=settings.ADDONS_SESSION_TIMEOUT
-        )
-
-        session_data = {
-            "state": SessionState.PENDING,
-            "expires_at": expires_at.isoformat(),
-        }
-
-        cache_key = self._get_cache_key(session_id)
-        cache.set(
-            cache_key,
-            session_data,
-            timeout=settings.ADDONS_SESSION_TIMEOUT,
-        )
-
-        return session_id
-
-    def get_session(self, session_id: str) -> dict:
-        """Retrieve session data and clear it if authenticated."""
-
-        cache_key = self._get_cache_key(session_id)
-        data = cache.get(cache_key)
-
-        if not data:
-            return {}
-
-        if data.get("state") == SessionState.AUTHENTICATED:
-            self.clear_session(session_id)
-
-        # Return copy without internal fields
-        internal_fields = {"expires_at"}
-        return {k: v for k, v in data.items() if k not in internal_fields}
-
-    def clear_session(self, session_id: str) -> None:
-        """Remove session data from cache."""
-
-        cache_key = self._get_cache_key(session_id)
-        cache.delete(cache_key)
-
-    def set_access_token(self, user: User, session_id: str):
-        """Generate and store access token for an authenticated user session."""
-
-        cache_key = self._get_cache_key(session_id)
-        existing_data = cache.get(cache_key)
-
-        if not existing_data:
-            raise SuspiciousOperation("Session not found.")
-
-        expires_at = existing_data.get("expires_at", None)
-
-        if not expires_at:
-            self.clear_session(session_id)
-            raise SuspiciousOperation("Invalid session data.")
-
-        remaining_seconds = int(
-            (
-                datetime.fromisoformat(expires_at) - datetime.now(timezone.utc)
-            ).total_seconds()
-        )
-
-        if remaining_seconds <= 0:
-            self.clear_session(session_id)
-            raise SuspiciousOperation("Session expired.")
-
-        if existing_data.get("state") != SessionState.PENDING:
-            self.clear_session(session_id)
-            raise SuspiciousOperation("Access token already set.")
-
-        response = self._token_service.generate_jwt(user, settings.ADDONS_SCOPES)
-        new_data = {
-            **existing_data,
-            **response,
-            "state": SessionState.AUTHENTICATED,
-        }
-
-        cache.set(cache_key, new_data, timeout=remaining_seconds)
@@ -1,57 +0,0 @@
-"""Add-ons views."""
-
-from django.conf import settings
-from django.core.exceptions import SuspiciousOperation
-from django.shortcuts import redirect, render
-from django.utils.translation import gettext_lazy as _
-from django.views.decorators.http import require_http_methods
-
-from core.addons.service import SessionState, TokenExchangeService
-
-
-def render_error(request, message, status=400):
-    """Render simple error page."""
-    return render(request, "addons/error.html", {"message": message}, status=status)
-
-
-@require_http_methods(["GET"])
-def transit_page(request):
-    """Initialize authentication flow for add-on session."""
-
-    session_id = request.GET.get("session_id")
-
-    if not session_id:
-        return render_error(request, _("Session ID is required."), status=400)
-
-    data = TokenExchangeService().get_session(session_id)
-
-    if not data:
-        return render_error(request, _("Session not found or expired."), status=404)
-
-    if data.get("state") != SessionState.PENDING:
-        return render_error(request, _("Invalid session state."), status=400)
-
-    request.session[settings.ADDONS_SESSION_KEY_AUTH] = session_id
-
-    return_to = f"{settings.APPLICATION_BASE_URL}/addons/redirect"
-    return redirect(f"/api/{settings.API_VERSION}/authenticate/?returnTo={return_to}")
-
-
-@require_http_methods(["GET"])
-def redirect_page(request):
-    """Complete authentication and close the popup window."""
-
-    if not request.user.is_authenticated:
-        return render_error(request, _("Authentication required."), status=401)
-
-    session_id = request.session.pop(settings.ADDONS_SESSION_KEY_AUTH, None)
-
-    if not session_id:
-        return render_error(request, _("No active session found."), status=404)
-
-    try:
-        TokenExchangeService().set_access_token(request.user, session_id)
-    except SuspiciousOperation:
-        return render_error(request, _("Invalid or expired session."), status=400)
-
-    return render(request, "addons/redirect_success.html")
@@ -1,47 +0,0 @@
-"""Add-ons API endpoints"""
-
-from logging import getLogger
-
-from rest_framework import (
-    response as drf_response,
-)
-from rest_framework import status as drf_status
-from rest_framework import viewsets
-
-from core.addons.service import TokenExchangeService
-
-logger = getLogger(__name__)
-
-
-class AuthSessionViewSet(viewsets.ViewSet):
-    """ViewSet for managing add-on authentication sessions via token exchange."""
-
-    authentication_classes = []
-    permission_classes = []
-    throttle_classes = []
-
-    def create(self, request):
-        """Create a new pending authentication session."""
-        session_id = TokenExchangeService().init_session()
-        return drf_response.Response(
-            {"session_id": session_id}, status=drf_status.HTTP_201_CREATED
-        )
-
-    def retrieve(self, request, pk=None):
-        """Retrieve authentication session data by session ID."""
-        data = TokenExchangeService().get_session(pk)
-
-        if not data:
-            return drf_response.Response(
-                {"detail": "Session not found or expired."},
-                status=drf_status.HTTP_404_NOT_FOUND,
-            )
-
-        return drf_response.Response(data, status=drf_status.HTTP_200_OK)
-
-    def destroy(self, request, pk=None):
-        """Delete an authentication session by session ID."""
-        TokenExchangeService().clear_session(pk)
-        return drf_response.Response(
-            {"status": "ok"}, status=drf_status.HTTP_204_NO_CONTENT
-        )
@@ -1,26 +0,0 @@
-"""Throttling modules for the API."""
-
-from lasuite.drf.throttling import MonitoredThrottleMixin
-from rest_framework.throttling import AnonRateThrottle
-from sentry_sdk import capture_message
-
-
-def sentry_monitoring_throttle_failure(message):
-    """Log when a failure occurs to detect rate limiting issues."""
-    capture_message(message, "warning")
-
-
-class MonitoredAnonRateThrottle(MonitoredThrottleMixin, AnonRateThrottle):
-    """Throttle for the monitored scoped rate throttle."""
-
-
-class RequestEntryAnonRateThrottle(MonitoredAnonRateThrottle):
-    """Throttle Anonymous user requesting room entry"""
-
-    scope = "request_entry"
-
-
-class CreationCallbackAnonRateThrottle(MonitoredAnonRateThrottle):
-    """Throttle Anonymous user requesting room generation callback"""
-
-    scope = "creation_callback"
@@ -10,7 +10,7 @@ from django.http import Http404
 from django.shortcuts import get_object_or_404
 from django.utils.text import slugify

-from rest_framework import decorators, mixins, pagination, viewsets
+from rest_framework import decorators, mixins, pagination, throttling, viewsets
 from rest_framework import (
    exceptions as drf_exceptions,
 )
@@ -58,7 +58,7 @@ from core.services.room_creation import RoomCreation
 from core.services.subtitle import SubtitleException, SubtitleService

 from ..authentication.livekit import LiveKitTokenAuthentication
-from . import permissions, serializers, throttling
+from . import permissions, serializers
 from .feature_flag import FeatureFlag

 # pylint: disable=too-many-ancestors
@@ -191,6 +191,18 @@ class UserViewSet(
        )


+class RequestEntryAnonRateThrottle(throttling.AnonRateThrottle):
+    """Throttle Anonymous user requesting room entry"""
+
+    scope = "request_entry"
+
+
+class CreationCallbackAnonRateThrottle(throttling.AnonRateThrottle):
+    """Throttle Anonymous user requesting room generation callback"""
+
+    scope = "creation_callback"
+
+
 class RoomViewSet(
    mixins.CreateModelMixin,
    mixins.DestroyModelMixin,
@@ -367,7 +379,7 @@ class RoomViewSet(
        methods=["post"],
        url_path="request-entry",
        permission_classes=[],
-        throttle_classes=[throttling.RequestEntryAnonRateThrottle],
+        throttle_classes=[RequestEntryAnonRateThrottle],
    )
    def request_entry(self, request, pk=None):  # pylint: disable=unused-argument
        """Request entry to a room"""
@@ -477,7 +489,7 @@ class RoomViewSet(
        methods=["post"],
        url_path="creation-callback",
        permission_classes=[],
-        throttle_classes=[throttling.CreationCallbackAnonRateThrottle],
+        throttle_classes=[CreationCallbackAnonRateThrottle],
    )
    def creation_callback(self, request):
        """Retrieve cached room data via an unauthenticated request with a unique ID.
@@ -1,51 +1,27 @@
 """Authentication Backends for external application to the Meet core app."""

-# pylint: disable=R0913,R0917
-# ruff: noqa: PLR0913
-
 import logging

 from django.conf import settings
 from django.contrib.auth import get_user_model
 from django.core.exceptions import SuspiciousOperation

+import jwt as pyJwt
 from lasuite.oidc_resource_server.backend import ResourceServerBackend as LaSuiteBackend
 from rest_framework import authentication, exceptions

 from core.models import Application
-from core.services import jwt_token

 User = get_user_model()
 logger = logging.getLogger(__name__)


-class BaseJWTAuthentication(authentication.BaseAuthentication):
-    """Base JWT authentication class."""
+class ApplicationJWTAuthentication(authentication.BaseAuthentication):
+    """JWT authentication for application-delegated API access.

-    def __init__(
-        self, secret_key, algorithm, issuer, audience, expiration_seconds, token_type
-    ):
-        """Initialize the JWT authentication backend with the given token service configuration.
-
-        Args:
-            secret_key: Secret key for JWT encoding/decoding
-            algorithm: JWT algorithm (e.g. HS256)
-            issuer: Expected token issuer identifier
-            audience: Expected token audience identifier
-            expiration_seconds: Token expiration time in seconds
-            token_type: Token type (e.g. Bearer)
-        """
-
-        super().__init__()
-
-        self._token_service = jwt_token.JwtTokenService(
-            secret_key=secret_key,
-            algorithm=algorithm,
-            issuer=issuer,
-            audience=audience,
-            expiration_seconds=expiration_seconds,
-            token_type=token_type,
-        )
+    Validates JWT tokens issued to applications that are acting on behalf
+    of users. Tokens must include user_id, client_id, and delegation flag.
+    """

    def authenticate(self, request):
        """Extract and validate JWT from Authorization header.
@@ -72,78 +48,6 @@ class BaseJWTAuthentication(authentication.BaseAuthentication):

        return self.authenticate_credentials(token)

-    def decode_jwt(self, token):
-        """Decode and validate JWT token.
-
-        Args:
-            token: JWT token string
-
-        Returns:
-            Decoded payload dict, or None if token is invalid
-
-        Raises:
-            AuthenticationFailed: If token is expired or has invalid issuer/audience
-        """
-
-        try:
-            payload = self._token_service.decode_jwt(token)
-            return payload
-        except jwt_token.TokenExpiredError as e:
-            logger.warning("Token expired")
-            raise exceptions.AuthenticationFailed("Token expired.") from e
-        except jwt_token.TokenInvalidError as e:
-            logger.warning("Invalid JWT issuer or audience: %s", e)
-            raise exceptions.AuthenticationFailed("Invalid token.") from e
-        except jwt_token.TokenDecodeError:
-            # Invalid JWT token - defer to next authentication backend
-            return None
-
-    def validate_payload(self, payload):
-        """Validate JWT payload claims.
-
-        Override in subclasses to add custom validation.
-
-        Args:
-            payload: Decoded JWT payload
-
-        Raises:
-            AuthenticationFailed: If required claims are missing or invalid
-        """
-
-    def get_user(self, payload):
-        """Retrieve and validate user from payload.
-
-        Args:
-            payload: Decoded JWT payload
-
-        Returns:
-            User instance
-
-        Raises:
-            AuthenticationFailed: If user not found or inactive
-        """
-        user_id = payload.get("user_id")
-
-        if not user_id:
-            logger.warning("Missing 'user_id' in JWT payload")
-            raise exceptions.AuthenticationFailed("Invalid token claims.")
-
-        try:
-            user = User.objects.get(id=user_id)
-        except User.DoesNotExist as e:
-            logger.warning("User not found: %s", user_id)
-            raise exceptions.AuthenticationFailed("User not found.") from e
-
-        if not user.is_active:
-            logger.warning("Inactive user attempted authentication: %s", user_id)
-            raise exceptions.AuthenticationFailed("User account is disabled.")
-
-        return user
-
-    def authenticate_header(self, request):
-        """Return authentication scheme for WWW-Authenticate header."""
-        return "Bearer"
-
    def authenticate_credentials(self, token):
        """Validate JWT token and return authenticated user.

@@ -158,41 +62,36 @@ class BaseJWTAuthentication(authentication.BaseAuthentication):
        Raises:
            AuthenticationFailed: If token is expired, or user not found
        """
-
-        payload = self.decode_jwt(token)
-
-        if payload is None:
+        # Decode and validate JWT
+        try:
+            payload = pyJwt.decode(
+                token,
+                settings.APPLICATION_JWT_SECRET_KEY,
+                algorithms=[settings.APPLICATION_JWT_ALG],
+                issuer=settings.APPLICATION_JWT_ISSUER,
+                audience=settings.APPLICATION_JWT_AUDIENCE,
+            )
+        except pyJwt.ExpiredSignatureError as e:
+            logger.warning("Token expired")
+            raise exceptions.AuthenticationFailed("Token expired.") from e
+        except pyJwt.InvalidIssuerError as e:
+            logger.warning("Invalid JWT issuer: %s", e)
+            raise exceptions.AuthenticationFailed("Invalid token.") from e
+        except pyJwt.InvalidAudienceError as e:
+            logger.warning("Invalid JWT audience: %s", e)
+            raise exceptions.AuthenticationFailed("Invalid token.") from e
+        except pyJwt.InvalidTokenError:
+            # Invalid JWT token - defer to next authentication backend
            return None

-        self.validate_payload(payload)
-        user = self.get_user(payload)
-
-        return (user, payload)
-
-
-class ApplicationJWTAuthentication(BaseJWTAuthentication):
-    """JWT authentication for application-delegated API access.
-
-    Validates JWT tokens issued to applications that are acting on behalf
-    of users. Tokens must include user_id, client_id, and delegation flag.
-    """
-
-    def __init__(self):
-        """Initialize authentication backend with application JWT settings from Django settings."""
-        super().__init__(
-            secret_key=settings.APPLICATION_JWT_SECRET_KEY,
-            algorithm=settings.APPLICATION_JWT_ALG,
-            issuer=settings.APPLICATION_JWT_ISSUER,
-            audience=settings.APPLICATION_JWT_AUDIENCE,
-            expiration_seconds=settings.APPLICATION_JWT_EXPIRATION_SECONDS,
-            token_type=settings.APPLICATION_JWT_TOKEN_TYPE,
-        )
-
-    def validate_payload(self, payload):
-        """Validate application-specific claims."""
+        user_id = payload.get("user_id")
        client_id = payload.get("client_id")
        is_delegated = payload.get("delegated", False)

+        if not user_id:
+            logger.warning("Missing 'user_id' in JWT payload")
+            raise exceptions.AuthenticationFailed("Invalid token claims.")
+
        if not client_id:
            logger.warning("Missing 'client_id' in JWT payload")
            raise exceptions.AuthenticationFailed("Invalid token claims.")
@@ -213,24 +112,21 @@ class ApplicationJWTAuthentication(BaseJWTAuthentication):
            logger.warning("Token is not marked as delegated")
            raise exceptions.AuthenticationFailed("Invalid token type.")

+        try:
+            user = User.objects.get(id=user_id)
+        except User.DoesNotExist as e:
+            logger.warning("User not found: %s", user_id)
+            raise exceptions.AuthenticationFailed("User not found.") from e

-class AddonsJWTAuthentication(BaseJWTAuthentication):
-    """JWT authentication for addons API access.
+        if not user.is_active:
+            logger.warning("Inactive user attempted authentication: %s", user_id)
+            raise exceptions.AuthenticationFailed("User account is disabled.")

-    Validates JWT tokens issued by addons for authenticating users.
-    Tokens must include user_id to identify the authenticated user.
-    """
+        return (user, payload)

-    def __init__(self):
-        """Initialize authentication backend with application JWT settings from Django settings."""
-        super().__init__(
-            secret_key=settings.ADDONS_JWT_SECRET_KEY,
-            algorithm=settings.ADDONS_JWT_ALG,
-            issuer=settings.ADDONS_JWT_ISSUER,
-            audience=settings.ADDONS_JWT_AUDIENCE,
-            expiration_seconds=settings.ADDONS_JWT_EXPIRATION_SECONDS,
-            token_type=settings.ADDONS_JWT_TOKEN_TYPE,
-        )
+    def authenticate_header(self, request):
+        """Return authentication scheme for WWW-Authenticate header."""
+        return "Bearer"


 class ResourceServerBackend(LaSuiteBackend):
@@ -1,5 +1,6 @@
 """External API endpoints"""

+from datetime import datetime, timedelta, timezone
 from logging import getLogger

 from django.conf import settings
@@ -7,6 +8,7 @@ from django.contrib.auth.hashers import check_password
 from django.core.exceptions import SuspiciousOperation, ValidationError
 from django.core.validators import validate_email

+import jwt
 from lasuite.oidc_resource_server.authentication import ResourceServerAuthentication
 from rest_framework import decorators, mixins, viewsets
 from rest_framework import (
@@ -20,7 +22,6 @@ from rest_framework import (
 )

 from core import api, models
-from core.services.jwt_token import JwtTokenService

 from . import authentication, permissions, serializers

@@ -127,28 +128,33 @@ class ApplicationViewSet(viewsets.ViewSet):
                "Multiple user accounts share a common email."
            ) from e

+        now = datetime.now(timezone.utc)
        scope = " ".join(application.scopes or [])

-        token_service = JwtTokenService(
-            secret_key=settings.APPLICATION_JWT_SECRET_KEY,
-            algorithm=settings.APPLICATION_JWT_ALG,
-            issuer=settings.APPLICATION_JWT_ISSUER,
-            audience=settings.APPLICATION_JWT_AUDIENCE,
-            expiration_seconds=settings.APPLICATION_JWT_EXPIRATION_SECONDS,
-            token_type=settings.APPLICATION_JWT_TOKEN_TYPE,
-        )
+        payload = {
+            "iss": settings.APPLICATION_JWT_ISSUER,
+            "aud": settings.APPLICATION_JWT_AUDIENCE,
+            "iat": now,
+            "exp": now + timedelta(seconds=settings.APPLICATION_JWT_EXPIRATION_SECONDS),
+            "client_id": client_id,
+            "scope": scope,
+            "user_id": str(user.id),
+            "delegated": True,
+        }

-        data = token_service.generate_jwt(
-            user,
-            scope,
-            {
-                "client_id": client_id,
-                "delegated": True,
-            },
+        token = jwt.encode(
+            payload,
+            settings.APPLICATION_JWT_SECRET_KEY,
+            algorithm=settings.APPLICATION_JWT_ALG,
        )

        return drf_response.Response(
-            data,
+            {
+                "access_token": token,
+                "token_type": settings.APPLICATION_JWT_TOKEN_TYPE,
+                "expires_in": settings.APPLICATION_JWT_EXPIRATION_SECONDS,
+                "scope": scope,
+            },
            status=drf_status.HTTP_200_OK,
        )

@@ -173,7 +179,6 @@ class RoomViewSet(

    authentication_classes = [
        authentication.ApplicationJWTAuthentication,
-        authentication.AddonsJWTAuthentication,
        ResourceServerAuthentication,
    ]
    permission_classes = [
@@ -1,153 +0,0 @@
-"""JWT token service."""
-
-# pylint: disable=R0913,R0917
-# ruff: noqa: PLR0913
-
-from datetime import datetime, timedelta, timezone
-from typing import Optional
-
-from django.core.exceptions import ImproperlyConfigured
-
-import jwt
-
-
-class JWTError(Exception):
-    """Base exception for all JWT token errors."""
-
-
-class TokenExpiredError(JWTError):
-    """Raised when the JWT token has expired."""
-
-
-class TokenInvalidError(JWTError):
-    """Raised when the JWT token has an invalid issuer or audience."""
-
-
-class TokenDecodeError(JWTError):
-    """Raised for any other unrecoverable JWT decode failure."""
-
-
-class JwtTokenService:
-    """Generic JWT token service with configurable settings."""
-
-    def __init__(
-        self,
-        secret_key: str,
-        algorithm: str,
-        issuer: str,
-        audience: str,
-        expiration_seconds: int,
-        token_type: str,
-    ):
-        """
-        Initialize the token service with custom settings.
-
-        Args:
-            secret_key: Secret key for JWT encoding/decoding
-            algorithm: JWT algorithm
-            issuer: Token issuer identifier
-            audience: Token audience identifier
-            expiration_seconds: Token expiration time in seconds
-            token_type: Token type
-
-        Raises:
-            ImproperlyConfigured: If secret_key is None or empty
-        """
-        if not secret_key:
-            raise ImproperlyConfigured("Secret key is required.")
-        if not algorithm:
-            raise ImproperlyConfigured("Algorithm is required.")
-        if not token_type:
-            raise ImproperlyConfigured("Token's type is required.")
-        if expiration_seconds is None:
-            raise ImproperlyConfigured("Expiration's seconds is required.")
-
-        self._key = secret_key
-        self._algorithm = algorithm
-        self._issuer = issuer
-        self._audience = audience
-        self._expiration_seconds = expiration_seconds
-        self._token_type = token_type
-
-    def generate_jwt(
-        self, user, scope: str, extra_payload: Optional[dict] = None
-    ) -> dict:
-        """
-        Generate an access token for the given user.
-
-        Note: any extra_payload variables named iat, exp, or user_id will
-        be overwritten by this service
-
-        Args:
-            user: User instance for whom to generate the token
-            scope: Space-separated scope string
-
-        Returns:
-            Dictionary containing access_token, token_type, expires_in, and scope optionally
-        """
-        now = datetime.now(timezone.utc)
-
-        payload = extra_payload.copy() if extra_payload else {}
-
-        payload.update(
-            {
-                "iat": now,
-                "exp": now + timedelta(seconds=self._expiration_seconds),
-                "user_id": str(user.id),
-            }
-        )
-
-        if self._issuer:
-            payload["iss"] = self._issuer
-        if self._audience:
-            payload["aud"] = self._audience
-        if scope:
-            payload["scope"] = scope
-
-        token = jwt.encode(
-            payload,
-            self._key,
-            algorithm=self._algorithm,
-        )
-
-        response = {
-            "access_token": token,
-            "token_type": self._token_type,
-            "expires_in": self._expiration_seconds,
-        }
-
-        if scope:
-            response["scope"] = scope
-
-        return response
-
-    def decode_jwt(self, token):
-        """Decode and validate JWT token.
-
-        Args:
-            token: JWT token string
-
-        Returns:
-            Decoded payload dict.
-
-        Raises:
-            TokenExpiredError: If the token has expired.
-            TokenInvalidError: If the token has an invalid issuer or audience.
-            TokenDecodeError: If the token is malformed or cannot be decoded.
-        """
-
-        try:
-            payload = jwt.decode(
-                token,
-                self._key,
-                algorithms=[self._algorithm],
-                issuer=self._issuer,
-                audience=self._audience,
-            )
-            return payload
-        except jwt.ExpiredSignatureError as e:
-            raise TokenExpiredError("Token expired.") from e
-        except (jwt.InvalidIssuerError, jwt.InvalidAudienceError) as e:
-            raise TokenInvalidError("Invalid token.") from e
-        except jwt.InvalidTokenError as e:
-            raise TokenDecodeError("Token decode error.") from e
@@ -1,17 +0,0 @@
-{% load i18n %}
-{% get_current_language as LANGUAGE %}
-<!DOCTYPE html>
-<html lang="{{ LANGUAGE }}">
-<head>
-    <meta charset="UTF-8">
-    <title>{% trans "Error" %}</title>
-</head>
-<body>
-    <div class="container">
-        <h1>{{ title|default:_("Error") }}</h1>
-        <p>{{ message|default:_("Something went wrong.") }}</p>
-        <button onclick="window.close()">{% trans "Close" %}</button>
-    </div>
-</body>
-</html>
-
@@ -1,17 +0,0 @@
-{% load i18n %}
-{% get_current_language as LANGUAGE %}
-<!DOCTYPE html>
-<html lang="{{ LANGUAGE }}">
-<head>
-    <meta charset="UTF-8">
-    <title>{% trans "Authentication Success" %}</title>
-</head>
-<body>
-    <script>
-      window.close();
-    </script>
-    <p>{% trans "Session stored successfully. This window will close automatically." %}</p>
-    <p>{% trans "If it doesn't close" %}, <a href="javascript:window.close()">{% trans "click here" %}</a>.</p>
-</body>
-</html>
-
@@ -55,8 +55,9 @@ def test_api_rooms_list_requires_authentication():
    assert response.status_code == 401


-def test_api_rooms_list_inactive_user():
+def test_api_rooms_list_inactive_user(settings):
    """List should return 401 if user is inactive."""
+    settings.APPLICATION_JWT_SECRET_KEY = "devKey"

    user1 = UserFactory(is_active=False)
    RoomFactory(users=[(user1, RoleChoices.OWNER)])
@@ -71,9 +72,11 @@ def test_api_rooms_list_inactive_user():
    assert "user account is disabled" in str(response.data).lower()


-def test_api_rooms_list_with_valid_token():
+def test_api_rooms_list_with_valid_token(settings):
    """Listing rooms with valid token should succeed."""

+    settings.APPLICATION_JWT_SECRET_KEY = "devKey"
+
    user = UserFactory()
    room = RoomFactory(users=[(user, RoleChoices.OWNER)])

@@ -89,8 +92,9 @@ def test_api_rooms_list_with_valid_token():
    assert response.data["results"][0]["id"] == str(room.id)


-def test_api_rooms_list_with_no_rooms():
+def test_api_rooms_list_with_no_rooms(settings):
    """Listing rooms with a valid token returns an empty list when there are no rooms."""
+    settings.APPLICATION_JWT_SECRET_KEY = "devKey"

    user = UserFactory()

@@ -108,6 +112,7 @@ def test_api_rooms_list_with_no_rooms():

 def test_api_rooms_list_with_expired_token(settings):
    """Listing rooms with expired token should return 401."""
+    settings.APPLICATION_JWT_SECRET_KEY = "devKey"
    settings.APPLICATION_JWT_EXPIRATION_SECONDS = 0

    user = UserFactory()
@@ -148,8 +153,9 @@ def test_api_rooms_list_with_invalid_rs_token(settings):
    assert response.status_code == 400


-def test_api_rooms_list_missing_scope():
+def test_api_rooms_list_missing_scope(settings):
    """Listing rooms without required scope should return 403."""
+    settings.APPLICATION_JWT_SECRET_KEY = "devKey"

    user = UserFactory()

@@ -167,8 +173,9 @@ def test_api_rooms_list_missing_scope():
    )


-def test_api_rooms_list_no_scope():
+def test_api_rooms_list_no_scope(settings):
    """Listing rooms without any scope should return 403."""
+    settings.APPLICATION_JWT_SECRET_KEY = "devKey"

    user = UserFactory()

@@ -183,8 +190,9 @@ def test_api_rooms_list_no_scope():
    assert "insufficient permissions." in str(response.data).lower()


-def test_api_rooms_list_filters_by_user():
+def test_api_rooms_list_filters_by_user(settings):
    """List should only return rooms accessible to the authenticated user."""
+    settings.APPLICATION_JWT_SECRET_KEY = "devKey"

    user1 = UserFactory()
    user2 = UserFactory()
@@ -209,9 +217,11 @@ def test_api_rooms_list_filters_by_user():
    assert str(room2.id) not in returned_ids


-def test_api_rooms_retrieve_requires_authentication():
+def test_api_rooms_retrieve_requires_authentication(settings):
    """Retrieving rooms without authentication should return 401."""

+    settings.APPLICATION_JWT_SECRET_KEY = "devKey"
+
    user1 = UserFactory()
    room1 = RoomFactory(users=[(user1, RoleChoices.OWNER)])

@@ -221,8 +231,9 @@ def test_api_rooms_retrieve_requires_authentication():
    assert response.status_code == 401


-def test_api_rooms_retrieve_inactive_user():
+def test_api_rooms_retrieve_inactive_user(settings):
    """Retrieve should return 401 if user is inactive."""
+    settings.APPLICATION_JWT_SECRET_KEY = "devKey"

    user1 = UserFactory(is_active=False)
    room1 = RoomFactory(users=[(user1, RoleChoices.OWNER)])
@@ -239,6 +250,7 @@ def test_api_rooms_retrieve_inactive_user():

 def test_api_rooms_retrieve_with_expired_token(settings):
    """Retrieving rooms with expired token should return 401."""
+    settings.APPLICATION_JWT_SECRET_KEY = "devKey"
    settings.APPLICATION_JWT_EXPIRATION_SECONDS = 0

    user = UserFactory()
@@ -283,8 +295,9 @@ def test_api_rooms_retrieve_with_invalid_rs_token(settings):
    assert response.status_code == 400


-def test_api_rooms_retrieve_requires_scope():
+def test_api_rooms_retrieve_requires_scope(settings):
    """Retrieving a room requires ROOMS_RETRIEVE scope."""
+    settings.APPLICATION_JWT_SECRET_KEY = "devKey"

    user = UserFactory()
    room = RoomFactory(users=[(user, RoleChoices.OWNER)])
@@ -302,8 +315,9 @@ def test_api_rooms_retrieve_requires_scope():
    )


-def test_api_rooms_retrieve_no_scope():
+def test_api_rooms_retrieve_no_scope(settings):
    """Retrieving rooms without any scope should return 403."""
+    settings.APPLICATION_JWT_SECRET_KEY = "devKey"

    user = UserFactory()

@@ -321,6 +335,7 @@ def test_api_rooms_retrieve_no_scope():

 def test_api_rooms_retrieve_success(settings):
    """Retrieving a room with correct scope should succeed."""
+    settings.APPLICATION_JWT_SECRET_KEY = "devKey"
    settings.APPLICATION_BASE_URL = "http://your-application.com"
    settings.ROOM_TELEPHONY_ENABLED = True
    settings.ROOM_TELEPHONY_PHONE_NUMBER = "+1-555-0100"
@@ -352,8 +367,9 @@ def test_api_rooms_retrieve_success(settings):
    }


-def test_api_rooms_retrieve_success_by_user():
+def test_api_rooms_retrieve_success_by_user(settings):
    """Retrieve should only return rooms accessible to the authenticated user."""
+    settings.APPLICATION_JWT_SECRET_KEY = "devKey"

    user1 = UserFactory()
    user2 = UserFactory()
@@ -392,8 +408,9 @@ def test_api_rooms_retrieve_success_by_user():
    assert response.status_code == 200


-def test_api_rooms_retrieve_not_found():
+def test_api_rooms_retrieve_not_found(settings):
    """Retrieving a non-existing room with correct scope should return a 404."""
+    settings.APPLICATION_JWT_SECRET_KEY = "devKey"

    user = UserFactory()
    token = generate_test_token(user, [ApplicationScope.ROOMS_RETRIEVE])
@@ -406,9 +423,11 @@ def test_api_rooms_retrieve_not_found():
    assert "no room matches the given query." in str(response.data).lower()


-def test_api_rooms_create_requires_authentication():
+def test_api_rooms_create_requires_authentication(settings):
    """Creating rooms without authentication should return 401."""

+    settings.APPLICATION_JWT_SECRET_KEY = "devKey"
+
    client = APIClient()
    response = client.post("/external-api/v1.0/rooms/")

@@ -417,6 +436,7 @@ def test_api_rooms_create_requires_authentication():

 def test_api_rooms_create_with_expired_token(settings):
    """Creating rooms with expired token should return 401."""
+    settings.APPLICATION_JWT_SECRET_KEY = "devKey"
    settings.APPLICATION_JWT_EXPIRATION_SECONDS = 0

    user = UserFactory()
@@ -457,8 +477,9 @@ def test_api_rooms_create_with_invalid_rs_token(settings):
    assert response.status_code == 400


-def test_api_rooms_create_inactive_user():
+def test_api_rooms_create_inactive_user(settings):
    """Create should return 401 if user is inactive."""
+    settings.APPLICATION_JWT_SECRET_KEY = "devKey"

    user1 = UserFactory(is_active=False)

@@ -472,8 +493,9 @@ def test_api_rooms_create_inactive_user():
    assert "user account is disabled" in str(response.data).lower()


-def test_api_rooms_create_requires_scope():
+def test_api_rooms_create_requires_scope(settings):
    """Creating a room requires ROOMS_CREATE scope."""
+    settings.APPLICATION_JWT_SECRET_KEY = "devKey"
    user = UserFactory()

    # Token without ROOMS_CREATE scope
@@ -490,8 +512,9 @@ def test_api_rooms_create_requires_scope():
    )


-def test_api_rooms_create_no_scope():
+def test_api_rooms_create_no_scope(settings):
    """Creating rooms without any scope should return 403."""
+    settings.APPLICATION_JWT_SECRET_KEY = "devKey"

    user = UserFactory()

@@ -506,8 +529,9 @@ def test_api_rooms_create_no_scope():
    assert "insufficient permissions." in str(response.data).lower()


-def test_api_rooms_create_success():
+def test_api_rooms_create_success(settings):
    """Creating a room with correct scope should succeed."""
+    settings.APPLICATION_JWT_SECRET_KEY = "devKey"

    user = UserFactory()

@@ -531,8 +555,9 @@ def test_api_rooms_create_success():
    assert room.access_level == "trusted"


-def test_api_rooms_create_readonly_enforcement():
+def test_api_rooms_create_readonly_enforcement(settings):
    """Creating a room succeeds and any provided read-only fields are ignored."""
+    settings.APPLICATION_JWT_SECRET_KEY = "devKey"

    user = UserFactory()

@@ -565,8 +590,9 @@ def test_api_rooms_create_readonly_enforcement():
    assert room.access_level == "trusted"


-def test_api_rooms_unknown_actions():
+def test_api_rooms_unknown_actions(settings):
    """Updating or deleting a room are not supported yet."""
+    settings.APPLICATION_JWT_SECRET_KEY = "devKey"

    user = UserFactory()
    room = RoomFactory(users=[(user, RoleChoices.OWNER)])
@@ -597,6 +623,7 @@ def test_api_rooms_unknown_actions():

 def test_api_rooms_response_no_url(settings):
    """Response should not include url field when APPLICATION_BASE_URL is None."""
+    settings.APPLICATION_JWT_SECRET_KEY = "devKey"
    settings.APPLICATION_BASE_URL = None

    user = UserFactory()
@@ -615,6 +642,7 @@ def test_api_rooms_response_no_url(settings):

 def test_api_rooms_response_no_telephony(settings):
    """Response should not include telephony field when ROOM_TELEPHONY_ENABLED is False."""
+    settings.APPLICATION_JWT_SECRET_KEY = "devKey"
    settings.ROOM_TELEPHONY_ENABLED = False

    user = UserFactory()
@@ -633,6 +661,7 @@ def test_api_rooms_response_no_telephony(settings):

 def test_api_rooms_token_scope_case_insensitive(settings):
    """Token's scope should be case-insensitive."""
+    settings.APPLICATION_JWT_SECRET_KEY = "devKey"
    user = UserFactory()
    application = ApplicationFactory()

@@ -664,6 +693,7 @@ def test_api_rooms_token_scope_case_insensitive(settings):

 def test_api_rooms_token_without_delegated_flag(settings):
    """Token without delegated flag should be rejected."""
+    settings.APPLICATION_JWT_SECRET_KEY = "devKey"
    user = UserFactory()
    application = ApplicationFactory()

@@ -696,6 +726,7 @@ def test_api_rooms_token_without_delegated_flag(settings):
@mock.patch.object(ResourceServerAuthentication, "authenticate", return_value=None)
 def test_api_rooms_token_invalid_signature(mock_rs_authenticate, settings):
    """Token signed with an invalid key should defer to the next authentication."""
+    settings.APPLICATION_JWT_SECRET_KEY = "devKey"
    user = UserFactory()
    application = ApplicationFactory()

@@ -728,6 +759,7 @@ def test_api_rooms_token_invalid_signature(mock_rs_authenticate, settings):
@mock.patch.object(ResourceServerAuthentication, "authenticate", return_value=None)
 def test_api_rooms_token_invalid_alg(mock_rs_authenticate, settings):
    """Token signed with an invalid alg should defer to the next authentication."""
+    settings.APPLICATION_JWT_SECRET_KEY = "devKey"
    settings.APPLICATION_JWT_ALG = "RS256"
    user = UserFactory()

@@ -759,6 +791,7 @@ def test_api_rooms_token_invalid_alg(mock_rs_authenticate, settings):

 def test_api_rooms_token_missing_client_id(settings):
    """Token without client_id should be rejected."""
+    settings.APPLICATION_JWT_SECRET_KEY = "devKey"
    user = UserFactory()

    now = datetime.now(timezone.utc)
@@ -788,6 +821,7 @@ def test_api_rooms_token_missing_client_id(settings):

 def test_api_rooms_token_missing_user_id(settings):
    """Token without user_id should be rejected."""
+    settings.APPLICATION_JWT_SECRET_KEY = "devKey"
    application = ApplicationFactory()

    now = datetime.now(timezone.utc)
@@ -817,6 +851,7 @@ def test_api_rooms_token_missing_user_id(settings):

 def test_api_rooms_token_invalid_audience(settings):
    """Token with an invalid audience should be rejected."""
+    settings.APPLICATION_JWT_SECRET_KEY = "devKey"
    user = UserFactory()
    application = ApplicationFactory()

@@ -847,6 +882,7 @@ def test_api_rooms_token_invalid_audience(settings):

 def test_api_rooms_token_unknown_user(settings):
    """Token for unknown user should be rejected."""
+    settings.APPLICATION_JWT_SECRET_KEY = "devKey"
    application = ApplicationFactory()

    now = datetime.now(timezone.utc)
@@ -876,6 +912,7 @@ def test_api_rooms_token_unknown_user(settings):

 def test_api_rooms_token_unknown_application(settings):
    """Token for unknown application should be rejected."""
+    settings.APPLICATION_JWT_SECRET_KEY = "devKey"

    now = datetime.now(timezone.utc)
    payload = {
@@ -904,6 +941,7 @@ def test_api_rooms_token_unknown_application(settings):

 def test_api_rooms_token_inactive_application(settings):
    """Token for inactive application should be rejected."""
+    settings.APPLICATION_JWT_SECRET_KEY = "devKey"
    application = ApplicationFactory(active=False)

    now = datetime.now(timezone.utc)
@@ -21,6 +21,7 @@ pytestmark = pytest.mark.django_db

 def test_api_applications_generate_token_success(settings):
    """Valid credentials should return a JWT token."""
+    settings.APPLICATION_JWT_SECRET_KEY = "devKey"
    UserFactory(email="User.Family@example.com")
    application = ApplicationFactory(
        active=True,
@@ -172,8 +173,9 @@ def test_api_applications_generate_token_domain_not_authorized():
    assert "not authorized for this email domain" in str(response.data)


-def test_api_applications_generate_token_domain_authorized():
+def test_api_applications_generate_token_domain_authorized(settings):
    """Application with domain authorization should succeed."""
+    settings.APPLICATION_JWT_SECRET_KEY = "devKey"
    user = UserFactory(email="user@allowed.com")
    application = ApplicationFactory(
        active=True,
@@ -228,6 +230,7 @@ def test_api_applications_generate_token_user_not_found():
@freeze_time("2023-01-15 12:00:00")
 def test_api_applications_token_payload_structure(settings):
    """Generated token should have correct payload structure."""
+    settings.APPLICATION_JWT_SECRET_KEY = "devKey"
    user = UserFactory(email="user@example.com")

    application = ApplicationFactory(
@@ -277,6 +280,7 @@ def test_api_applications_token_payload_structure(settings):
 def test_api_applications_token_new_user(settings):
    """Should create a new pending user when creation is allowed and user doesn't exist."""

+    settings.APPLICATION_JWT_SECRET_KEY = "devKey"
    settings.APPLICATION_ALLOW_USER_CREATION = True
    settings.OIDC_FALLBACK_TO_EMAIL_FOR_IDENTIFICATION = True
    settings.OIDC_USER_SUB_FIELD_IMMUTABLE = False
@@ -333,6 +337,7 @@ def test_api_applications_token_new_user(settings):
 def test_api_applications_token_existing_user(settings):
    """Application should not create a new user when user exist."""

+    settings.APPLICATION_JWT_SECRET_KEY = "devKey"
    user = UserFactory(email="user@example.com")

    settings.APPLICATION_ALLOW_USER_CREATION = True
@@ -6,8 +6,6 @@ from django.urls import include, path
 from lasuite.oidc_login.urls import urlpatterns as oidc_urls
 from rest_framework.routers import DefaultRouter

-from core.addons import views as addons_views
-from core.addons import viewsets as addons_viewsets
 from core.api import get_frontend_configuration, viewsets
 from core.external_api import viewsets as external_viewsets

@@ -28,24 +26,12 @@ external_router.register(
    basename="external_application",
 )

-# - Addons API
-addons_router = DefaultRouter()
-addons_router.register(
-    "addons/sessions",
-    addons_viewsets.AuthSessionViewSet,
-    basename="addons_auth_sessions",
-)
-
 external_router.register(
    "rooms",
    external_viewsets.RoomViewSet,
    basename="external_room",
 )

-
-addons_urls = addons_router.urls if settings.ADDONS_ENABLED else []
-
-
 urlpatterns = [
    path(
        f"api/{settings.API_VERSION}/",
@@ -53,26 +39,12 @@ urlpatterns = [
            [
                *router.urls,
                *oidc_urls,
-                *addons_urls,
                path("config/", get_frontend_configuration, name="config"),
            ]
        ),
    ),
 ]

-if settings.ADDONS_ENABLED:
-    urlpatterns.append(
-        path(
-            "addons/",
-            include(
-                [
-                    path("transit/", addons_views.transit_page, name="transit_page"),
-                    path("redirect/", addons_views.redirect_page, name="redirect_page"),
-                ]
-            ),
-        ),
-    )
-
 if settings.EXTERNAL_API_ENABLED:
    urlpatterns.append(
        path(
@@ -8,7 +8,7 @@ msgid ""
 msgstr ""
 "Project-Id-Version: PACKAGE VERSION\n"
 "Report-Msgid-Bugs-To: \n"
-"POT-Creation-Date: 2026-01-26 15:40+0000\n"
+"POT-Creation-Date: 2025-12-29 15:15+0000\n"
 "PO-Revision-Date: YEAR-MO-DA HO:MI+ZONE\n"
 "Last-Translator: FULL NAME <EMAIL@ADDRESS>\n"
 "Language-Team: LANGUAGE <LL@li.org>\n"
@@ -17,30 +17,6 @@ msgstr ""
 "Content-Type: text/plain; charset=UTF-8\n"
 "Content-Transfer-Encoding: 8bit\n"

-#: core/addons/views.py:24
-msgid "Session ID is required."
-msgstr "Sitzungs-ID ist erforderlich."
-
-#: core/addons/views.py:29
-msgid "Session not found or expired."
-msgstr "Sitzung nicht gefunden oder abgelaufen."
-
-#: core/addons/views.py:32
-msgid "Invalid session state."
-msgstr "Ungültiger Sitzungsstatus."
-
-#: core/addons/views.py:45
-msgid "Authentication required."
-msgstr "Authentifizierung erforderlich."
-
-#: core/addons/views.py:50
-msgid "No active session found."
-msgstr "Keine aktive Sitzung gefunden."
-
-#: core/addons/views.py:55
-msgid "Invalid or expired session."
-msgstr "Ungültige oder abgelaufene Sitzung."
-
 #: core/admin.py:29
 msgid "Personal info"
 msgstr "Persönliche Informationen"
@@ -432,7 +408,7 @@ msgstr "Anwendungsdomain"
 msgid "Application domains"
 msgstr "Anwendungsdomains"

-#: core/recording/event/notification.py:116
+#: core/recording/event/notification.py:94
 msgid "Your recording is ready"
 msgstr "Ihre Aufzeichnung ist bereit"

@@ -441,30 +417,6 @@ msgstr "Ihre Aufzeichnung ist bereit"
 msgid "Video call in progress: {sender.email} is waiting for you to connect"
 msgstr "Videoanruf läuft: {sender.email} wartet auf Ihre Teilnahme"

-#: core/templates/addons/error.html:7 core/templates/addons/error.html:11
-msgid "Error"
-msgstr "Fehler"
-
-#: core/templates/addons/error.html:12
-msgid "Something went wrong."
-msgstr "Etwas ist schiefgelaufen."
-
-#: core/templates/addons/error.html:13
-msgid "Close"
-msgstr "Schließen"
-
-#: core/templates/addons/redirect_success.html:7
-msgid "Authentication Success"
-msgstr "Authentifizierung erfolgreich"
-
-#: core/templates/addons/redirect_success.html:13
-msgid "Session stored successfully. This window will close automatically."
-msgstr "Sitzung erfolgreich gespeichert. Dieses Fenster wird automatisch geschlossen."
-
-#: core/templates/addons/redirect_success.html:14
-msgid "If it doesn't close"
-msgstr "Falls es sich nicht schließt"
-
 #: core/templates/mail/html/invitation.html:159
 #: core/templates/mail/html/screen_recording.html:159
 #: core/templates/mail/text/invitation.txt:3
@@ -8,7 +8,7 @@ msgid ""
 msgstr ""
 "Project-Id-Version: PACKAGE VERSION\n"
 "Report-Msgid-Bugs-To: \n"
-"POT-Creation-Date: 2026-01-26 15:40+0000\n"
+"POT-Creation-Date: 2025-12-29 15:15+0000\n"
 "PO-Revision-Date: YEAR-MO-DA HO:MI+ZONE\n"
 "Last-Translator: FULL NAME <EMAIL@ADDRESS>\n"
 "Language-Team: LANGUAGE <LL@li.org>\n"
@@ -17,30 +17,6 @@ msgstr ""
 "Content-Type: text/plain; charset=UTF-8\n"
 "Content-Transfer-Encoding: 8bit\n"

-#: core/addons/views.py:24
-msgid "Session ID is required."
-msgstr "Session ID is required."
-
-#: core/addons/views.py:29
-msgid "Session not found or expired."
-msgstr "Session not found or expired."
-
-#: core/addons/views.py:32
-msgid "Invalid session state."
-msgstr "Invalid session state."
-
-#: core/addons/views.py:45
-msgid "Authentication required."
-msgstr "Authentication required."
-
-#: core/addons/views.py:50
-msgid "No active session found."
-msgstr "No active session found."
-
-#: core/addons/views.py:55
-msgid "Invalid or expired session."
-msgstr "Invalid or expired session."
-
 #: core/admin.py:29
 msgid "Personal info"
 msgstr "Personal info"
@@ -429,7 +405,7 @@ msgstr "Application domain"
 msgid "Application domains"
 msgstr "Application domains"

-#: core/recording/event/notification.py:116
+#: core/recording/event/notification.py:94
 msgid "Your recording is ready"
 msgstr "Your recording is ready"

@@ -438,30 +414,6 @@ msgstr "Your recording is ready"
 msgid "Video call in progress: {sender.email} is waiting for you to connect"
 msgstr "Video call in progress: {sender.email} is waiting for you to connect"

-#: core/templates/addons/error.html:7 core/templates/addons/error.html:11
-msgid "Error"
-msgstr "Error"
-
-#: core/templates/addons/error.html:12
-msgid "Something went wrong."
-msgstr "Something went wrong."
-
-#: core/templates/addons/error.html:13
-msgid "Close"
-msgstr "Close"
-
-#: core/templates/addons/redirect_success.html:7
-msgid "Authentication Success"
-msgstr "Authentication Success"
-
-#: core/templates/addons/redirect_success.html:13
-msgid "Session stored successfully. This window will close automatically."
-msgstr "Session stored successfully. This window will close automatically."
-
-#: core/templates/addons/redirect_success.html:14
-msgid "If it doesn't close"
-msgstr "If it doesn't close"
-
 #: core/templates/mail/html/invitation.html:159
 #: core/templates/mail/html/screen_recording.html:159
 #: core/templates/mail/text/invitation.txt:3
@@ -8,7 +8,7 @@ msgid ""
 msgstr ""
 "Project-Id-Version: PACKAGE VERSION\n"
 "Report-Msgid-Bugs-To: \n"
-"POT-Creation-Date: 2026-01-26 15:40+0000\n"
+"POT-Creation-Date: 2025-12-29 15:15+0000\n"
 "PO-Revision-Date: YEAR-MO-DA HO:MI+ZONE\n"
 "Last-Translator: antoine.lebaud@mail.numerique.gouv.fr\n"
 "Language-Team: LANGUAGE <LL@li.org>\n"
@@ -17,30 +17,6 @@ msgstr ""
 "Content-Type: text/plain; charset=UTF-8\n"
 "Content-Transfer-Encoding: 8bit\n"

-#: core/addons/views.py:24
-msgid "Session ID is required."
-msgstr "L'identifiant de session est requis."
-
-#: core/addons/views.py:29
-msgid "Session not found or expired."
-msgstr "Session introuvable ou expirée."
-
-#: core/addons/views.py:32
-msgid "Invalid session state."
-msgstr "État de session invalide."
-
-#: core/addons/views.py:45
-msgid "Authentication required."
-msgstr "Authentification requise."
-
-#: core/addons/views.py:50
-msgid "No active session found."
-msgstr "Aucune session active trouvée."
-
-#: core/addons/views.py:55
-msgid "Invalid or expired session."
-msgstr "Session invalide ou expirée."
-
 #: core/admin.py:29
 msgid "Personal info"
 msgstr "Informations personnelles"
@@ -433,7 +409,7 @@ msgstr "Domaine d’application"
 msgid "Application domains"
 msgstr "Domaines d’application"

-#: core/recording/event/notification.py:116
+#: core/recording/event/notification.py:94
 msgid "Your recording is ready"
 msgstr "Votre enregistrement est prêt"

@@ -442,30 +418,6 @@ msgstr "Votre enregistrement est prêt"
 msgid "Video call in progress: {sender.email} is waiting for you to connect"
 msgstr "Appel vidéo en cours : {sender.email} attend que vous vous connectiez"

-#: core/templates/addons/error.html:7 core/templates/addons/error.html:11
-msgid "Error"
-msgstr "Erreur"
-
-#: core/templates/addons/error.html:12
-msgid "Something went wrong."
-msgstr "Une erreur s'est produite."
-
-#: core/templates/addons/error.html:13
-msgid "Close"
-msgstr "Fermer"
-
-#: core/templates/addons/redirect_success.html:7
-msgid "Authentication Success"
-msgstr "Authentification réussie"
-
-#: core/templates/addons/redirect_success.html:13
-msgid "Session stored successfully. This window will close automatically."
-msgstr "Session enregistrée avec succès. Cette fenêtre se fermera automatiquement."
-
-#: core/templates/addons/redirect_success.html:14
-msgid "If it doesn't close"
-msgstr "Si elle ne se ferme pas"
-
 #: core/templates/mail/html/invitation.html:159
 #: core/templates/mail/html/screen_recording.html:159
 #: core/templates/mail/text/invitation.txt:3
@@ -8,7 +8,7 @@ msgid ""
 msgstr ""
 "Project-Id-Version: PACKAGE VERSION\n"
 "Report-Msgid-Bugs-To: \n"
-"POT-Creation-Date: 2026-01-26 15:40+0000\n"
+"POT-Creation-Date: 2025-12-29 15:15+0000\n"
 "PO-Revision-Date: YEAR-MO-DA HO:MI+ZONE\n"
 "Last-Translator: FULL NAME <EMAIL@ADDRESS>\n"
 "Language-Team: LANGUAGE <LL@li.org>\n"
@@ -17,30 +17,6 @@ msgstr ""
 "Content-Type: text/plain; charset=UTF-8\n"
 "Content-Transfer-Encoding: 8bit\n"

-#: core/addons/views.py:24
-msgid "Session ID is required."
-msgstr "Sessie-ID is vereist."
-
-#: core/addons/views.py:29
-msgid "Session not found or expired."
-msgstr "Sessie niet gevonden of verlopen."
-
-#: core/addons/views.py:32
-msgid "Invalid session state."
-msgstr "Ongeldige sessiestatus."
-
-#: core/addons/views.py:45
-msgid "Authentication required."
-msgstr "Authenticatie vereist."
-
-#: core/addons/views.py:50
-msgid "No active session found."
-msgstr "Geen actieve sessie gevonden."
-
-#: core/addons/views.py:55
-msgid "Invalid or expired session."
-msgstr "Ongeldige of verlopen sessie."
-
 #: core/admin.py:29
 msgid "Personal info"
 msgstr "Persoonlijke informatie"
@@ -428,7 +404,7 @@ msgstr "Applicatiedomein"
 msgid "Application domains"
 msgstr "Applicatiedomeinen"

-#: core/recording/event/notification.py:116
+#: core/recording/event/notification.py:94
 msgid "Your recording is ready"
 msgstr "Je opname is klaar"

@@ -437,30 +413,6 @@ msgstr "Je opname is klaar"
 msgid "Video call in progress: {sender.email} is waiting for you to connect"
 msgstr "Video-oproep bezig: {sender.email} wacht op je verbinding"

-#: core/templates/addons/error.html:7 core/templates/addons/error.html:11
-msgid "Error"
-msgstr "Fout"
-
-#: core/templates/addons/error.html:12
-msgid "Something went wrong."
-msgstr "Er is iets misgegaan."
-
-#: core/templates/addons/error.html:13
-msgid "Close"
-msgstr "Sluiten"
-
-#: core/templates/addons/redirect_success.html:7
-msgid "Authentication Success"
-msgstr "Authenticatie geslaagd"
-
-#: core/templates/addons/redirect_success.html:13
-msgid "Session stored successfully. This window will close automatically."
-msgstr "Sessie succesvol opgeslagen. Dit venster wordt automatisch gesloten."
-
-#: core/templates/addons/redirect_success.html:14
-msgid "If it doesn't close"
-msgstr "Als het niet sluit"
-
 #: core/templates/mail/html/invitation.html:159
 #: core/templates/mail/html/screen_recording.html:159
 #: core/templates/mail/text/invitation.txt:3
@@ -18,7 +18,6 @@ from socket import gethostbyname, gethostname

 from django.utils.translation import gettext_lazy as _

-import dj_database_url
 import sentry_sdk
 from configurations import Configuration, values
 from lasuite.configuration.values import SecretFileValue
@@ -93,11 +92,7 @@ class Base(Configuration):

    # Database
    DATABASES = {
-        "default": dj_database_url.config()
-        if values.DatabaseURLValue(
-            None, environ_name="DATABASE_URL", environ_prefix=None
-        )
-        else {
+        "default": {
            "ENGINE": values.Value(
                "django.db.backends.postgresql_psycopg2",
                environ_name="DB_ENGINE",
@@ -297,9 +292,6 @@ class Base(Configuration):
            ),
        },
    }
-    MONITORED_THROTTLE_FAILURE_CALLBACK = (
-        "core.api.throttling.sentry_monitoring_throttle_failure"
-    )

    SPECTACULAR_SETTINGS = {
        "TITLE": "Meet API",
@@ -667,7 +659,7 @@ class Base(Configuration):
        [],
        environ_name="BREVO_API_CONTACT_LIST_IDS",
        environ_prefix=None,
-        converter=int,
+        converter=lambda x: int(x),  # pylint: disable=unnecessary-lambda
    )
    BREVO_API_CONTACT_ATTRIBUTES = values.DictValue({"VISIO_USER": True})
    BREVO_API_TIMEOUT = values.PositiveIntegerValue(
@@ -797,66 +789,6 @@ class Base(Configuration):
        environ_prefix=None,
    )

-    # Addons
-    ADDONS_ENABLED = values.BooleanValue(
-        False,
-        environ_name="ADDONS_ENABLED",
-        environ_prefix=None,
-    )
-    ADDONS_SESSION_ID_LENGTH = values.PositiveIntegerValue(
-        32,
-        environ_name="ADDONS_SESSION_ID_LENGTH",
-        environ_prefix=None,
-    )
-    # Used in cache key generation
-    ADDONS_SESSION_KEY_PREFIX = values.Value(
-        "addons_session_id",
-        environ_name="ADDONS_SESSION_KEY_PREFIX",
-        environ_prefix=None,
-    )
-    # Used as the Django session key in transit page
-    ADDONS_SESSION_KEY_AUTH = values.Value(
-        "addons_session_id",
-        environ_name="ADDONS_SESSION_KEY_AUTH",
-        environ_prefix=None,
-    )
-    ADDONS_SESSION_TIMEOUT = values.PositiveIntegerValue(
-        600, environ_name="ADDONS_SESSION_TIMEOUT", environ_prefix=None
-    )
-    ADDONS_JWT_SECRET_KEY = SecretFileValue(
-        None, environ_name="ADDONS_JWT_SECRET_KEY", environ_prefix=None
-    )
-    ADDONS_JWT_ALG = values.Value(
-        "HS256",
-        environ_name="ADDONS_JWT_ALG",
-        environ_prefix=None,
-    )
-    ADDONS_SCOPES = values.Value(
-        "rooms:create rooms:list",
-        environ_name="ADDONS_SCOPES",
-        environ_prefix=None,
-    )
-    ADDONS_JWT_ISSUER = values.Value(
-        "lasuite-meet",
-        environ_name="ADDONS_JWT_ISSUER",
-        environ_prefix=None,
-    )
-    ADDONS_JWT_AUDIENCE = values.Value(
-        None,
-        environ_name="ADDONS_JWT_AUDIENCE",
-        environ_prefix=None,
-    )
-    ADDONS_JWT_EXPIRATION_SECONDS = values.PositiveIntegerValue(
-        3600,
-        environ_name="ADDONS_JWT_EXPIRATION_SECONDS",
-        environ_prefix=None,
-    )
-    ADDONS_JWT_TOKEN_TYPE = values.Value(
-        "Bearer",
-        environ_name="ADDONS_JWT_TOKEN_TYPE",
-        environ_prefix=None,
-    )
-
    # pylint: disable=invalid-name
    @property
    def ENVIRONMENT(self):
@@ -977,9 +909,6 @@ class Test(Base):
    USE_SWAGGER = True
    EXTERNAL_API_ENABLED = True

-    APPLICATION_JWT_SECRET_KEY = "devKey"  # noqa:S105
-    APPLICATION_JWT_AUDIENCE = "Test inc."
-
    CELERY_TASK_ALWAYS_EAGER = values.BooleanValue(True)

    def __init__(self):
@@ -7,7 +7,7 @@ build-backend = "setuptools.build_meta"

 [project]
 name = "meet"
-version = "1.8.0"
+version = "1.5.0"
 authors = [{ "name" = "DINUM", "email" = "dev@mail.numerique.gouv.fr" }]
 classifiers = [
    "Development Status :: 5 - Production/Stable",
@@ -25,15 +25,14 @@ license = { file = "LICENSE" }
 readme = "README.md"
 requires-python = ">=3.10"
 dependencies = [
-    "boto3==1.42.49",
+    "boto3==1.40.69",
    "Brotli==1.2.0",
    "brevo-python==1.2.0",
-    "celery[redis]==5.6.2",
-    "dj-database-url==3.1.0",
+    "celery[redis]==5.5.3",
    "django-configurations==2.5.1",
    "django-cors-headers==4.9.0",
-    "django-countries==8.2.0",
-    "django-lasuite[all]==0.0.24",
+    "django-countries==8.0.0",
+    "django-lasuite[all]==0.0.19",
    "django-parler==2.3",
    "redis==5.2.1",
    "django-redis==6.0.0",
@@ -42,21 +41,21 @@ dependencies = [
    "django==5.2.11",
    "djangorestframework==3.16.1",
    "drf_spectacular==0.29.0",
-    "dockerflow==2026.1.26",
+    "dockerflow==2024.4.2",
    "easy_thumbnails==2.10.1",
    "factory_boy==3.3.3",
-    "gunicorn==25.1.0",
-    "jsonschema==4.26.0",
-    "markdown==3.10.2",
+    "gunicorn==23.0.0",
+    "jsonschema==4.25.1",
+    "markdown==3.10",
    "nested-multipart-parser==1.6.0",
-    "psycopg[binary]==3.3.2",
-    "PyJWT==2.11.0",
+    "psycopg[binary]==3.2.12",
+    "PyJWT==2.10.1",
    "python-frontmatter==1.1.0",
    "requests==2.32.5",
-    "sentry-sdk==2.53.0",
+    "sentry-sdk==2.43.0",
    "whitenoise==6.11.0",
-    "mozilla-django-oidc==5.0.2",
-    "livekit-api==1.1.0",
+    "mozilla-django-oidc==4.0.1",
+    "livekit-api==1.0.7",
    "aiohttp==3.13.3",
 ]

@@ -69,21 +68,21 @@ dependencies = [
 [project.optional-dependencies]
 dev = [
    "django-extensions==4.1",
-    "drf-spectacular-sidecar==2026.1.1",
+    "drf-spectacular-sidecar==2025.10.1",
    "freezegun==1.5.5",
    "ipdb==0.13.13",
-    "ipython==9.10.0",
-    "pyfakefs==6.1.1",
-    "pylint-django==2.7.0",
+    "ipython==9.7.0",
+    "pyfakefs==5.10.2",
+    "pylint-django==2.6.1",
    "pylint<4.0.0",
    "pytest-cov==7.0.0",
-    "pytest-django==4.12.0",
-    "pytest==9.0.2",
+    "pytest-django==4.11.1",
+    "pytest==9.0.0",
    "pytest-icdiff==0.9",
    "pytest-xdist==3.8.0",
    "responses==0.25.8",
-    "ruff==0.15.1",
-    "types-requests==2.32.4.20260107",
+    "ruff==0.14.4",
+    "types-requests==2.32.4.20250913",
 ]

 [tool.setuptools]
@@ -43,8 +43,7 @@ RUN apk update && apk upgrade libssl3 \
    libxml2>=2.12.7-r2 \
    libxslt>=1.1.39-r2 \
    libexpat>=2.7.2-r0 \
-    libpng>=1.6.53-r0 \
-    && apk del curl
+    libpng>=1.6.53-r0

 USER nginx

@@ -5,18 +5,6 @@ server {

  root /usr/share/nginx/html;

-  location = /.well-known/windows-app-web-link {
-      default_type application/json;
-      alias /usr/share/nginx/html/.well-known/windows-app-web-link;
-      add_header Content-Disposition "attachment; filename=windows-app-web-link";
-  }
-
-  location ~ ^/outlook-addin(/.*)?$ {
-      alias /usr/share/nginx/html/outlook-addin$1;
-      add_header Access-Control-Allow-Origin "*";
-      add_header Cache-Control "no-cache, no-store, must-revalidate";
-  }
-
  # Serve static files with caching
  location ~* ^/assets/.*\.(css|js|json|png|jpg|jpeg|gif|ico|svg|woff|woff2|ttf|eot)$ {
      expires 30d;
@@ -1,7 +1,7 @@
 {
  "name": "meet",
  "private": true,
-  "version": "1.8.0",
+  "version": "1.5.0",
  "type": "module",
  "scripts": {
    "dev": "panda codegen && vite",
@@ -13,56 +13,56 @@
    "check": "prettier --check ./src"
  },
  "dependencies": {
-    "@fontsource-variable/material-symbols-outlined": "5.2.34",
+    "@fontsource-variable/material-symbols-outlined": "5.2.30",
    "@fontsource/material-icons-outlined": "5.2.6",
-    "@livekit/components-react": "2.9.19",
-    "@livekit/components-styles": "1.2.0",
-    "@livekit/track-processors": "0.7.0",
-    "@pandacss/preset-panda": "1.8.2",
-    "@react-aria/toast": "3.0.10",
-    "@react-types/overlays": "3.9.3",
+    "@livekit/components-react": "2.9.13",
+    "@livekit/components-styles": "1.1.6",
+    "@livekit/track-processors": "0.6.1",
+    "@pandacss/preset-panda": "0.54.0",
+    "@react-aria/toast": "3.0.5",
+    "@react-types/overlays": "3.9.0",
    "@remixicon/react": "4.6.0",
-    "@tanstack/react-query": "5.90.21",
+    "@tanstack/react-query": "5.81.5",
    "@timephy/rnnoise-wasm": "1.0.0",
-    "crisp-sdk-web": "1.0.27",
+    "crisp-sdk-web": "1.0.25",
    "derive-valtio": "0.2.0",
    "hoofd": "1.7.3",
-    "humanize-duration": "3.33.2",
-    "i18next": "25.8.8",
-    "i18next-browser-languagedetector": "8.2.1",
+    "humanize-duration": "3.33.0",
+    "i18next": "25.3.1",
+    "i18next-browser-languagedetector": "8.2.0",
    "i18next-parser": "9.3.0",
    "i18next-resources-to-backend": "1.2.1",
    "libphonenumber-js": "1.12.10",
-    "livekit-client": "2.17.1",
-    "posthog-js": "1.342.1",
+    "livekit-client": "2.15.7",
+    "posthog-js": "1.256.2",
    "react": "18.3.1",
    "react-aria-components": "1.10.1",
    "react-dom": "18.3.1",
    "react-i18next": "15.1.1",
    "use-sound": "5.0.0",
-    "valtio": "2.3.0",
-    "wouter": "3.9.0"
+    "valtio": "2.1.5",
+    "wouter": "3.7.1"
  },
  "devDependencies": {
-    "@pandacss/dev": "1.8.2",
-    "@tanstack/eslint-plugin-query": "5.91.4",
-    "@tanstack/react-query-devtools": "5.91.3",
+    "@pandacss/dev": "0.54.0",
+    "@tanstack/eslint-plugin-query": "5.81.2",
+    "@tanstack/react-query-devtools": "5.81.5",
    "@types/humanize-duration": "3.27.4",
    "@types/node": "22.16.0",
    "@types/react": "18.3.12",
    "@types/react-dom": "18.3.1",
    "@typescript-eslint/eslint-plugin": "8.35.1",
    "@typescript-eslint/parser": "8.35.1",
-    "@vitejs/plugin-react": "5.1.4",
+    "@vitejs/plugin-react": "4.6.0",
    "eslint": "8.57.0",
    "eslint-config-prettier": "10.1.5",
    "eslint-plugin-jsx-a11y": "6.10.2",
    "eslint-plugin-react-hooks": "5.2.0",
    "eslint-plugin-react-refresh": "0.4.20",
    "postcss": "8.5.6",
-    "prettier": "3.8.1",
+    "prettier": "3.6.2",
    "typescript": "5.8.3",
-    "vite": "7.3.1",
-    "vite-tsconfig-paths": "6.1.1"
+    "vite": "7.0.8",
+    "vite-tsconfig-paths": "5.1.4"
  }
 }
@@ -1,6 +0,0 @@
-[
-{
-  "packageFamilyName" : "Visio_g3z6ba6vek6vg",
-  "paths" : [ "*" ]
-}
-]
@@ -1,4 +1,4 @@
-import { A, Button, Dialog, H, P, ScreenReaderAnnouncer } from '@/primitives'
+import { Button, Dialog, H, P, ScreenReaderAnnouncer } from '@/primitives'
 import { useTranslation } from 'react-i18next'
 import { css } from '@/styled-system/css'
 import { useSnapshot } from 'valtio'
@@ -9,8 +9,6 @@ import { navigateTo } from '@/navigation/navigateTo'
 import humanizeDuration from 'humanize-duration'
 import i18n from 'i18next'
 import { useScreenReaderAnnounce } from '@/hooks/useScreenReaderAnnounce'
-import { useSettingsDialog } from '@/features/settings/hook/useSettingsDialog'
-import { SettingsDialogExtendedKey } from '@/features/settings/type'

 const IDLE_DISCONNECT_TIMEOUT_MS = 120000 // 2 minutes
 const COUNTDOWN_ANNOUNCEMENT_SECONDS = [90, 60, 30]
@@ -20,7 +18,6 @@ export const IsIdleDisconnectModal = () => {
  const connectionObserverSnap = useSnapshot(connectionObserverStore)
  const [timeRemaining, setTimeRemaining] = useState(IDLE_DISCONNECT_TIMEOUT_MS)
  const lastAnnouncementRef = useRef<number | null>(null)
-  const { openSettingsDialog } = useSettingsDialog()

  const { t } = useTranslation('rooms', { keyPrefix: 'isIdleDisconnectModal' })
  const announce = useScreenReaderAnnounce()
@@ -120,19 +117,7 @@ export const IsIdleDisconnectModal = () => {
                }),
              })}
            </P>
-            <P>
-              {t('settingsPrefix')}{' '}
-              <A
-                color="primary"
-                onPress={() => {
-                  connectionObserverStore.isIdleDisconnectModalOpen = false
-                  openSettingsDialog(SettingsDialogExtendedKey.GENERAL)
-                }}
-              >
-                {t('settingsLink')}
-              </A>
-              {t('settingsSuffix')}
-            </P>
+            <P>{t('settings')}</P>
            <HStack marginTop="2rem">
              <Button
                onPress={() => {
@@ -11,7 +11,9 @@ import {
  ProcessorType,
 } from '.'

-export class UnifiedBackgroundTrackProcessor implements BackgroundProcessorInterface {
+export class UnifiedBackgroundTrackProcessor
+  implements BackgroundProcessorInterface
+{
  processor: ProcessorWrapper<BackgroundOptions>
  opts: BackgroundOptions
  processorType: ProcessorType
@@ -13,7 +13,8 @@ export interface ProcessorSerialized {
  options: BackgroundOptions
 }

-export interface BackgroundProcessorInterface extends TrackProcessor<Track.Kind> {
+export interface BackgroundProcessorInterface
+  extends TrackProcessor<Track.Kind> {
  update(opts: BackgroundOptions): Promise<void>
  options: BackgroundOptions
  clone(): BackgroundProcessorInterface
@@ -6,7 +6,6 @@ import { ToggleButton } from '@/primitives'
 import { chatStore } from '@/stores/chat'
 import { useSidePanel } from '../../hooks/useSidePanel'
 import { ToggleButtonProps } from '@/primitives/ToggleButton'
-import { useRegisterKeyboardShortcut } from '@/features/shortcuts/useRegisterKeyboardShortcut'

 export const ChatToggle = ({
  onPress,
@@ -19,11 +18,6 @@ export const ChatToggle = ({
  const { isChatOpen, toggleChat } = useSidePanel()
  const tooltipLabel = isChatOpen ? 'open' : 'closed'

-  useRegisterKeyboardShortcut({
-    id: 'toggle-chat',
-    handler: toggleChat,
-  })
-
  return (
    <div
      className={css({
@@ -18,7 +18,6 @@ import { useCannotUseDevice } from '../../../hooks/useCannotUseDevice'
 import { useDeviceIcons } from '../../../hooks/useDeviceIcons'
 import { useDeviceShortcut } from '../../../hooks/useDeviceShortcut'
 import { ToggleSource, CaptureOptionsBySource } from '@livekit/components-core'
-import { getShortcutDescriptorById } from '@/features/shortcuts/catalog'

 type ToggleDeviceStyleProps = {
  variant?: NonNullable<ButtonRecipeProps>['variant']
@@ -89,14 +88,12 @@ export const ToggleDevice = <T extends ToggleSource>({
  const deviceShortcut = useDeviceShortcut(kind)

  useRegisterKeyboardShortcut({
-    id: deviceShortcut?.id,
+    shortcut: deviceShortcut,
    handler: async () => await toggle(),
    isDisabled: cannotUseDevice,
  })
-
-  const pushToTalkShortcut = getShortcutDescriptorById('push-to-talk')
  useLongPress({
-    keyCode: kind === 'audioinput' ? pushToTalkShortcut?.code : undefined,
+    keyCode: kind === 'audioinput' ? 'KeyV' : undefined,
    onKeyDown,
    onKeyUp,
    isDisabled: cannotUseDevice,
@@ -106,9 +103,7 @@ export const ToggleDevice = <T extends ToggleSource>({
    const label = t(enabled ? 'disable' : 'enable', {
      keyPrefix: `selectDevice.${kind}`,
    })
-    return deviceShortcut?.shortcut
-      ? appendShortcutLabel(label, deviceShortcut.shortcut)
-      : label
+    return deviceShortcut ? appendShortcutLabel(label, deviceShortcut) : label
  }, [enabled, kind, deviceShortcut, t])

  const Icon =
@@ -9,7 +9,6 @@ import {
  closeLowerHandToasts,
  showLowerHandToast,
 } from '@/features/notifications/utils'
-import { useRegisterKeyboardShortcut } from '@/features/shortcuts/useRegisterKeyboardShortcut'

 const SPEAKING_DETECTION_DELAY = 3000

@@ -34,16 +33,6 @@ export const HandToggle = () => {
    closeLowerHandToasts()
  }, [isHandRaised])

-  const handleToggle = () => {
-    toggleRaisedHand()
-    resetToastState()
-  }
-
-  useRegisterKeyboardShortcut({
-    id: 'raise-hand',
-    handler: handleToggle,
-  })
-
  useEffect(() => {
    const shouldShowToast = isSpeaking && isHandRaised && !hasShownToast

@@ -79,7 +68,10 @@ export const HandToggle = () => {
        aria-label={t(tooltipLabel)}
        tooltip={t(tooltipLabel)}
        isSelected={isHandRaised}
-        onPress={handleToggle}
+        onPress={() => {
+          toggleRaisedHand()
+          resetToastState()
+        }}
        data-attr={`controls-hand-${tooltipLabel}`}
      >
        <RiHand />
@@ -6,7 +6,6 @@ import { css } from '@/styled-system/css'
 import { useParticipants } from '@livekit/components-react'
 import { useSidePanel } from '../../../hooks/useSidePanel'
 import { ToggleButtonProps } from '@/primitives/ToggleButton'
-import { useRegisterKeyboardShortcut } from '@/features/shortcuts/useRegisterKeyboardShortcut'

 export const ParticipantsToggle = ({
  onPress,
@@ -28,11 +27,6 @@ export const ParticipantsToggle = ({

  const tooltipLabel = isParticipantsOpen ? 'open' : 'closed'

-  useRegisterKeyboardShortcut({
-    id: 'toggle-participants',
-    handler: toggleParticipants,
-  })
-
  return (
    <div
      className={css({
@@ -1,6 +1,6 @@
 import { useTranslation } from 'react-i18next'
 import { RiEmotionLine } from '@remixicon/react'
-import { useState, useRef } from 'react'
+import { useState, useRef, useEffect } from 'react'
 import { css } from '@/styled-system/css'
 import { useRoomContext } from '@livekit/components-react'
 import { ToggleButton, Button } from '@/primitives'
@@ -11,13 +11,7 @@ import {
  ReactionPortals,
 } from '@/features/rooms/livekit/components/ReactionPortal'
 import { getEmojiLabel } from '@/features/rooms/livekit/utils/reactionUtils'
-import { useRegisterKeyboardShortcut } from '@/features/shortcuts/useRegisterKeyboardShortcut'
-import {
-  Popover as RACPopover,
-  Dialog,
-  DialogTrigger,
-} from 'react-aria-components'
-import { FocusScope } from '@react-aria/focus'
+import { Toolbar as RACToolbar } from 'react-aria-components'
 import { Participant } from 'livekit-client'
 import useRateLimiter from '@/hooks/useRateLimiter'

@@ -45,12 +39,7 @@ export const ReactionsToggle = () => {
  const instanceIdRef = useRef(0)
  const room = useRoomContext()

-  const [isOpen, setIsOpen] = useState(false)
-
-  useRegisterKeyboardShortcut({
-    id: 'reaction',
-    handler: () => setIsOpen((prev) => !prev),
-  })
+  const [isVisible, setIsVisible] = useState(false)

  const sendReaction = async (emoji: string) => {
    const encoder = new TextEncoder()
@@ -84,76 +73,100 @@ export const ReactionsToggle = () => {
    windowMs: 1000,
  })

+  // Custom animation implementation for the emoji toolbar
+  // Could not use a menu and its animation, because a menu would make the toolbar inaccessible by keyboard
+  // animation isn't perfect
+  const [isRendered, setIsRendered] = useState(isVisible)
+  const [opacity, setOpacity] = useState(isVisible ? 1 : 0)
+
+  useEffect(() => {
+    if (isVisible) {
+      // Show: first render, then animate in
+      setIsRendered(true)
+      // Need to delay setting opacity to ensure CSS transition works
+      // (using requestAnimationFrame to ensure DOM has updated)
+      requestAnimationFrame(() => {
+        requestAnimationFrame(() => {
+          setOpacity(1)
+        })
+      })
+    } else if (isRendered) {
+      // Hide: first animate out, then unrender
+      setOpacity(0)
+
+      // Wait for animation to complete before removing from DOM
+      const timer = setTimeout(() => {
+        setIsRendered(false)
+      }, 200) // Match this to your animation duration
+      return () => clearTimeout(timer)
+    }
+  }, [isVisible, isRendered])
+
  return (
    <>
-      <div className={css({ position: 'relative' })}>
-        <DialogTrigger isOpen={isOpen} onOpenChange={setIsOpen}>
-          <ToggleButton
-            square
-            variant="primaryDark"
-            aria-label={t('button')}
-            tooltip={t('button')}
-            isSelected={isOpen}
-            onChange={setIsOpen}
-          >
-            <RiEmotionLine />
-          </ToggleButton>
-          <RACPopover
-            placement="top"
-            offset={8}
-            isNonModal
-            shouldCloseOnInteractOutside={() => false}
+      <div
+        className={css({
+          position: 'relative',
+        })}
+      >
+        <ToggleButton
+          square
+          variant="primaryDark"
+          aria-label={t('button')}
+          tooltip={t('button')}
+          onPress={() => setIsVisible(!isVisible)}
+        >
+          <RiEmotionLine />
+        </ToggleButton>
+        {isRendered && (
+          <div
            className={css({
+              position: 'absolute',
+              top: -63,
+              left: -162,
              borderRadius: '8px',
              padding: '0.35rem',
              backgroundColor: 'primaryDark.50',
-              '&[data-entering]': {
-                animation: 'fade 200ms ease',
-              },
-              '&[data-exiting]': {
-                animation: 'fade 200ms ease-in reverse',
-              },
+              opacity: opacity,
+              transition: 'opacity 0.2s ease',
            })}
+            onTransitionEnd={() => {
+              if (!isVisible) {
+                setIsRendered(false)
+              }
+            }}
          >
-            <Dialog className={css({ outline: 'none' })}>
-              {/* eslint-disable-next-line jsx-a11y/no-autofocus -- FocusScope autoFocus is programmatic focus for overlays, not the HTML autofocus attribute */}
-              <FocusScope contain autoFocus restoreFocus>
-                <div
-                  role="toolbar"
-                  aria-orientation="horizontal"
-                  aria-label={t('button')}
-                  className={css({
-                    display: 'flex',
-                    gap: '0.5rem',
-                  })}
+            <RACToolbar
+              className={css({
+                display: 'flex',
+                gap: '0.5rem',
+              })}
+            >
+              {Object.values(Emoji).map((emoji, index) => (
+                <Button
+                  key={index}
+                  onPress={() => debouncedSendReaction(emoji)}
+                  aria-label={t('send', { emoji: getEmojiLabel(emoji, t) })}
+                  variant="primaryTextDark"
+                  size="sm"
+                  square
+                  data-attr={`send-reaction-${emoji}`}
                >
-                  {Object.values(Emoji).map((emoji, index) => (
-                    <Button
-                      key={index}
-                      onPress={() => debouncedSendReaction(emoji)}
-                      aria-label={t('send', { emoji: getEmojiLabel(emoji, t) })}
-                      variant="primaryTextDark"
-                      size="sm"
-                      square
-                      data-attr={`send-reaction-${emoji}`}
-                    >
-                      <img
-                        src={`/assets/reactions/${emoji}.png`}
-                        alt=""
-                        className={css({
-                          width: '28px',
-                          height: '28px',
-                          pointerEvents: 'none',
-                          userSelect: 'none',
-                        })}
-                      />
-                    </Button>
-                  ))}
-                </div>
-              </FocusScope>
-            </Dialog>
-          </RACPopover>
-        </DialogTrigger>
+                  <img
+                    src={`/assets/reactions/${emoji}.png`}
+                    alt=""
+                    className={css({
+                      minHeight: '28px',
+                      minWidth: '28px',
+                      pointerEvents: 'none',
+                      userSelect: 'none',
+                    })}
+                  />
+                </Button>
+              ))}
+            </RACToolbar>
+          </div>
+        )}
      </div>
      <ReactionPortals reactions={reactions} />
    </>
@@ -6,7 +6,8 @@ import {
 import React from 'react'

 /** @public */
-export interface AllowMediaPlaybackProps extends React.ButtonHTMLAttributes<HTMLButtonElement> {
+export interface AllowMediaPlaybackProps
+  extends React.ButtonHTMLAttributes<HTMLButtonElement> {
  label?: string
 }

@@ -11,7 +11,8 @@ const ASPECT_RATIO = 16 / 10
 const ASPECT_RATIO_INVERT = (1 - ASPECT_RATIO) * -1

 /** @public */
-export interface CarouselLayoutProps extends React.HTMLAttributes<HTMLMediaElement> {
+export interface CarouselLayoutProps
+  extends React.HTMLAttributes<HTMLMediaElement> {
  tracks: TrackReferenceOrPlaceholder[]
  children: React.ReactNode
  /** Place the tiles vertically or horizontally next to each other.
@@ -13,8 +13,7 @@ import { PaginationControl } from '../controls/PaginationControl'

 /** @public */
 export interface GridLayoutProps
-  extends
-    React.HTMLAttributes<HTMLDivElement>,
+  extends React.HTMLAttributes<HTMLDivElement>,
    Pick<UseParticipantsOptions, 'updateOnlyOn'> {
  children: React.ReactNode
  tracks: TrackReferenceOrPlaceholder[]
@@ -12,6 +12,6 @@ export function useCanPublishTrack(trackSource: TrackSource): boolean {

  return Boolean(
    permissions?.canPublish &&
-    permissions?.canPublishSources?.includes(trackSource)
+      permissions?.canPublishSources?.includes(trackSource)
  )
 }
@@ -1,16 +1,19 @@
 import { useMemo } from 'react'
-import {
-  getShortcutDescriptorById,
-  ShortcutDescriptor,
-} from '@/features/shortcuts/catalog'
+import { Shortcut } from '@/features/shortcuts/types'

 export const useDeviceShortcut = (kind: MediaDeviceKind) => {
-  return useMemo<ShortcutDescriptor | undefined>(() => {
+  return useMemo<Shortcut | undefined>(() => {
    switch (kind) {
      case 'audioinput':
-        return getShortcutDescriptorById('toggle-microphone')
+        return {
+          key: 'd',
+          ctrlKey: true,
+        }
      case 'videoinput':
-        return getShortcutDescriptorById('toggle-camera')
+        return {
+          key: 'e',
+          ctrlKey: true,
+        }
      default:
        return undefined
    }
@@ -18,7 +18,8 @@ import { css } from '@/styled-system/css'
 import { useRestoreFocus } from '@/hooks/useRestoreFocus'

 export interface ChatProps
-  extends React.HTMLAttributes<HTMLDivElement>, ChatOptions {}
+  extends React.HTMLAttributes<HTMLDivElement>,
+    ChatOptions {}

 /**
 * The Chat component adds a basis chat functionality to the LiveKit room. The messages are distributed to all participants
@@ -22,7 +22,7 @@ export function DesktopControlBar({
  const desktopControlBarEl = useRef<HTMLDivElement>(null)

  useRegisterKeyboardShortcut({
-    id: 'focus-toolbar',
+    shortcut: { key: 'F2' },
    handler: () => {
      const root = desktopControlBarEl.current
      if (!root) return
@@ -66,7 +66,8 @@ const LayoutWrapper = styled(
 /**
 * @public
 */
-export interface VideoConferenceProps extends React.HTMLAttributes<HTMLDivElement> {
+export interface VideoConferenceProps
+  extends React.HTMLAttributes<HTMLDivElement> {
  /** @alpha */
  SettingsComponent?: React.ComponentType
 }
@@ -9,7 +9,8 @@ import NoiseSuppressorWorklet from '@timephy/rnnoise-wasm/NoiseSuppressorWorklet
 // and suspend/resume it as needed to manage audio state
 let audioContext: AudioContext

-export interface AudioProcessorInterface extends TrackProcessor<Track.Kind.Audio> {
+export interface AudioProcessorInterface
+  extends TrackProcessor<Track.Kind.Audio> {
  name: string
 }

@@ -12,7 +12,6 @@ import {
  RiSpeakerLine,
  RiVideoOnLine,
  RiEyeLine,
-  RiKeyboardBoxLine,
 } from '@remixicon/react'
 import { AccountTab } from './tabs/AccountTab'
 import { NotificationsTab } from './tabs/NotificationsTab'
@@ -20,12 +19,11 @@ import { GeneralTab } from './tabs/GeneralTab'
 import { AudioTab } from './tabs/AudioTab'
 import { VideoTab } from './tabs/VideoTab'
 import { TranscriptionTab } from './tabs/TranscriptionTab'
-import { ShortcutTab } from './tabs/ShortcutTab'
 import { useRef } from 'react'
 import { useMediaQuery } from '@/features/rooms/livekit/hooks/useMediaQuery'
 import { SettingsDialogExtendedKey } from '@/features/settings/type'
 import { useIsAdminOrOwner } from '@/features/rooms/livekit/hooks/useIsAdminOrOwner'
-import { AccessibilityTab } from './tabs/AccessibilityTab'
+import AccessibilityTab from './tabs/AccessibilityTab'

 const tabsStyle = css({
  maxHeight: '40.625rem', // fixme size copied from meet settings modal
@@ -41,7 +39,6 @@ const tabListContainerStyle = css({
  flexDirection: 'column',
  borderRight: '1px solid lightGray', // fixme poor color management
  paddingY: '1rem',
-  paddingLeft: '0.2rem',
  paddingRight: '1.5rem',
 })

@@ -110,10 +107,6 @@ export const SettingsDialogExtended = (props: SettingsDialogExtended) => {
              {isWideScreen &&
                t(`tabs.${SettingsDialogExtendedKey.NOTIFICATIONS}`)}
            </Tab>
-            <Tab icon highlight id={SettingsDialogExtendedKey.SHORTCUTS}>
-              <RiKeyboardBoxLine />
-              {isWideScreen && t(`tabs.${SettingsDialogExtendedKey.SHORTCUTS}`)}
-            </Tab>
            {isAdminOrOwner && (
              <Tab icon highlight id={SettingsDialogExtendedKey.TRANSCRIPTION}>
                <Icon type="symbols" name="speech_to_text" />
@@ -137,7 +130,6 @@ export const SettingsDialogExtended = (props: SettingsDialogExtended) => {
          <VideoTab id={SettingsDialogExtendedKey.VIDEO} />
          <GeneralTab id={SettingsDialogExtendedKey.GENERAL} />
          <NotificationsTab id={SettingsDialogExtendedKey.NOTIFICATIONS} />
-          <ShortcutTab id={SettingsDialogExtendedKey.SHORTCUTS} />
          {/* Transcription tab won't be accessible if the tab is not active in the tab list */}
          <TranscriptionTab id={SettingsDialogExtendedKey.TRANSCRIPTION} />
          <AccessibilityTab id={SettingsDialogExtendedKey.ACCESSIBILITY} />
@@ -36,3 +36,5 @@ export const AccessibilityTab = ({ id }: AccessibilityTabProps) => {
    </TabPanel>
  )
 }
+
+export default AccessibilityTab
@@ -1,51 +0,0 @@
-import { shortcutCatalog } from '@/features/shortcuts/catalog'
-import { ShortcutRow } from '@/features/shortcuts/components/ShortcutRow'
-import { css } from '@/styled-system/css'
-import { useTranslation } from 'react-i18next'
-import { TabPanel, type TabPanelProps } from '@/primitives/Tabs'
-import { H } from '@/primitives'
-
-const tableStyle = css({
-  width: '100%',
-  borderCollapse: 'collapse',
-  overflowY: 'auto',
-  '& th, & td': {
-    padding: '0.65rem 0',
-    textAlign: 'left',
-  },
-  '& tbody tr': {
-    borderBottom: '1px solid rgba(255,255,255,0.08)',
-  },
-})
-
-export const ShortcutTab = ({ id }: Pick<TabPanelProps, 'id'>) => {
-  const { t } = useTranslation(['settings', 'rooms'])
-
-  return (
-    <TabPanel
-      id={id}
-      padding="md"
-      flex
-      className={css({
-        display: 'flex',
-        flexDirection: 'column',
-        gap: '0.75rem',
-      })}
-    >
-      <H lvl={2}>{t('shortcuts.listLabel')}</H>
-      <table className={tableStyle}>
-        <thead className="sr-only">
-          <tr>
-            <th scope="col">{t('shortcuts.columnAction')}</th>
-            <th scope="col">{t('shortcuts.columnShortcut')}</th>
-          </tr>
-        </thead>
-        <tbody>
-          {shortcutCatalog.map((item) => (
-            <ShortcutRow key={item?.id} descriptor={item} />
-          ))}
-        </tbody>
-      </table>
-    </TabPanel>
-  )
-}
@@ -5,6 +5,5 @@ export enum SettingsDialogExtendedKey {
  GENERAL = 'general',
  NOTIFICATIONS = 'notifications',
  TRANSCRIPTION = 'transcription',
-  SHORTCUTS = 'shortcuts',
  ACCESSIBILITY = 'accessibility',
 }
@@ -1,83 +0,0 @@
-import { Shortcut } from './types'
-
-// Central list of current keyboard shortcuts.
-// Keep a single source of truth for display and, later, customization
-export type ShortcutCategory = 'navigation' | 'media' | 'interaction'
-
-export type ShortcutId =
-  | 'focus-toolbar'
-  | 'toggle-microphone'
-  | 'toggle-camera'
-  | 'push-to-talk'
-  | 'toggle-chat'
-  | 'toggle-participants'
-  | 'raise-hand'
-  | 'recording'
-  | 'reaction'
-  | 'fullscreen'
-
-export const getShortcutDescriptorById = (id: ShortcutId) =>
-  shortcutCatalog.find((item) => item.id === id)
-
-export type ShortcutDescriptor = {
-  id: ShortcutId
-  category: ShortcutCategory
-  shortcut?: Shortcut
-  kind?: 'press' | 'longPress'
-  code?: string // used when kind === 'longPress' (KeyboardEvent.code)
-  description?: string
-}
-
-export const shortcutCatalog: ShortcutDescriptor[] = [
-  {
-    id: 'focus-toolbar',
-    category: 'navigation',
-    shortcut: { key: 'F2' },
-  },
-  {
-    id: 'toggle-microphone',
-    category: 'media',
-    shortcut: { key: 'd', ctrlKey: true },
-  },
-  {
-    id: 'toggle-camera',
-    category: 'media',
-    shortcut: { key: 'e', ctrlKey: true },
-  },
-  {
-    id: 'push-to-talk',
-    category: 'media',
-    kind: 'longPress',
-    code: 'KeyV',
-  },
-  {
-    id: 'reaction',
-    category: 'interaction',
-    shortcut: { key: 'E', ctrlKey: true, shiftKey: true },
-  },
-  {
-    id: 'fullscreen',
-    category: 'interaction',
-    shortcut: { key: 'F', ctrlKey: true, shiftKey: true },
-  },
-  {
-    id: 'recording',
-    category: 'interaction',
-    shortcut: { key: 'L', ctrlKey: true, shiftKey: true },
-  },
-  {
-    id: 'raise-hand',
-    category: 'interaction',
-    shortcut: { key: 'H', ctrlKey: true, shiftKey: true },
-  },
-  {
-    id: 'toggle-chat',
-    category: 'interaction',
-    shortcut: { key: 'M', ctrlKey: true, shiftKey: true },
-  },
-  {
-    id: 'toggle-participants',
-    category: 'interaction',
-    shortcut: { key: 'P', ctrlKey: true, shiftKey: true },
-  },
-]
@@ -1,34 +0,0 @@
-import React from 'react'
-import { css, cx } from '@/styled-system/css'
-
-type ShortcutBadgeProps = {
-  visualLabel: string
-  srLabel?: string
-  className?: string
-}
-
-const badgeStyle = css({
-  fontFamily: 'monospace',
-  backgroundColor: 'rgba(255,255,255,0.12)',
-  paddingInline: '0.4rem',
-  paddingBlock: '0.2rem',
-  borderRadius: '6px',
-  whiteSpace: 'nowrap',
-  minWidth: '5.5rem',
-  textAlign: 'center',
-})
-
-export const ShortcutBadge: React.FC<ShortcutBadgeProps> = ({
-  visualLabel,
-  srLabel,
-  className,
-}) => {
-  return (
-    <>
-      <div className={cx(badgeStyle, className)} aria-hidden="true">
-        <span>{visualLabel}</span>
-      </div>
-      {srLabel && <span className="sr-only">{srLabel}</span>}
-    </>
-  )
-}
@@ -1,42 +0,0 @@
-import React from 'react'
-import { css } from '@/styled-system/css'
-import { text } from '@/primitives/Text'
-import { ShortcutDescriptor } from '../catalog'
-import { ShortcutBadge } from './ShortcutBadge'
-import { useShortcutFormatting } from '../hooks/useShortcutFormatting'
-import { useTranslation } from 'react-i18next'
-
-type ShortcutRowProps = {
-  descriptor: ShortcutDescriptor
-}
-
-const shortcutCellStyle = css({
-  textAlign: 'right',
-})
-
-export const ShortcutRow: React.FC<ShortcutRowProps> = ({ descriptor }) => {
-  const { t } = useTranslation('rooms', { keyPrefix: 'shortcutsPanel' })
-  const { formatVisual, formatForSR } = useShortcutFormatting()
-
-  const visualShortcut = formatVisual(
-    descriptor.shortcut,
-    descriptor.code,
-    descriptor.kind
-  )
-  const srShortcut = formatForSR(
-    descriptor.shortcut,
-    descriptor.code,
-    descriptor.kind
-  )
-
-  return (
-    <tr>
-      <td className={text({ variant: 'body' })}>
-        {t(`actions.${descriptor.id}`)}
-      </td>
-      <td className={shortcutCellStyle}>
-        <ShortcutBadge visualLabel={visualShortcut} srLabel={srShortcut} />
-      </td>
-    </tr>
-  )
-}
@@ -1,59 +0,0 @@
-import { Shortcut } from './types'
-import { isMacintosh } from '@/utils/livekit'
-
-// Visible label for a shortcut (uses ⌘/Ctrl prefix when needed).
-export const formatShortcutLabel = (shortcut?: Shortcut) => {
-  if (!shortcut) return '—'
-  const key = shortcut.key?.toUpperCase()
-  if (!key) return '—'
-  const parts: string[] = []
-  if (shortcut.ctrlKey) parts.push(isMacintosh() ? '⌘' : 'Ctrl')
-  if (shortcut.altKey) parts.push(isMacintosh() ? '⌥' : 'Alt')
-  if (shortcut.shiftKey) parts.push('Shift')
-  parts.push(key)
-  return parts.join('+')
-}
-
-// SR-friendly label for a shortcut (reads "Control plus D").
-export const formatShortcutLabelForSR = (
-  shortcut: Shortcut | undefined,
-  {
-    controlLabel,
-    commandLabel,
-    altLabel,
-    optionLabel,
-    shiftLabel,
-    plusLabel,
-    noShortcutLabel,
-  }: {
-    controlLabel: string
-    commandLabel: string
-    altLabel: string
-    optionLabel: string
-    shiftLabel: string
-    plusLabel: string
-    noShortcutLabel: string
-  }
-) => {
-  if (!shortcut) return noShortcutLabel
-  const key = shortcut.key?.toUpperCase()
-  if (!key) return noShortcutLabel
-  const ctrlWord = isMacintosh() ? commandLabel : controlLabel
-  const altWord = isMacintosh() ? optionLabel : altLabel
-  const parts: string[] = []
-  if (shortcut.ctrlKey) parts.push(ctrlWord)
-  if (shortcut.altKey) parts.push(altWord)
-  if (shortcut.shiftKey) parts.push(shiftLabel)
-  parts.push(key)
-  return parts.join(` ${plusLabel} `)
-}
-
-// Extract displayable key name from KeyboardEvent.code (ex: KeyV -> V).
-export const getKeyLabelFromCode = (code?: string) => {
-  if (!code) return ''
-  if (code.startsWith('Key') && code.length === 4) return code.slice(3)
-  if (code.startsWith('Digit') && code.length === 6) return code.slice(5)
-  if (code === 'Space') return '␣'
-  if (code.startsWith('Arrow')) return code.slice(5) // Up, Down, Left, Right
-  return code
-}
@@ -1,47 +0,0 @@
-import { useCallback } from 'react'
-import { useTranslation } from 'react-i18next'
-import { Shortcut } from '../types'
-import {
-  formatShortcutLabel,
-  formatShortcutLabelForSR,
-  getKeyLabelFromCode,
-} from '../formatLabels'
-
-export const useShortcutFormatting = () => {
-  const { t } = useTranslation('rooms')
-
-  const formatVisual = useCallback(
-    (shortcut?: Shortcut, code?: string, kind?: string) => {
-      if (code && kind === 'longPress') {
-        const label = getKeyLabelFromCode(code)
-        return t('shortcutsPanel.visual.hold', { key: label || '?' })
-      }
-      return formatShortcutLabel(shortcut)
-    },
-    [t]
-  )
-
-  const formatForSR = useCallback(
-    (shortcut?: Shortcut, code?: string, kind?: string) => {
-      if (code && kind === 'longPress') {
-        const label = getKeyLabelFromCode(code)
-        return t('shortcutsPanel.sr.hold', { key: label || '?' })
-      }
-      return formatShortcutLabelForSR(shortcut, {
-        controlLabel: t('shortcutsPanel.sr.control'),
-        commandLabel: t('shortcutsPanel.sr.command'),
-        altLabel: t('shortcutsPanel.sr.alt'),
-        optionLabel: t('shortcutsPanel.sr.option'),
-        shiftLabel: t('shortcutsPanel.sr.shift'),
-        plusLabel: t('shortcutsPanel.sr.plus'),
-        noShortcutLabel: t('shortcutsPanel.sr.noShortcut'),
-      })
-    },
-    [t]
-  )
-
-  return {
-    formatVisual,
-    formatForSR,
-  }
-}
@@ -1,6 +1,4 @@
 export type Shortcut = {
  key: string
  ctrlKey?: boolean
-  shiftKey?: boolean
-  altKey?: boolean
 }
@@ -11,13 +11,11 @@ export const useKeyboardShortcuts = () => {
    // This approach handles basic shortcuts but isn't comprehensive.
    // Issues might occur. First draft.
    const onKeyDown = async (e: KeyboardEvent) => {
-      const { key, metaKey, ctrlKey, shiftKey, altKey } = e
+      const { key, metaKey, ctrlKey } = e
      if (!key) return
      const shortcutKey = formatShortcutKey({
        key,
        ctrlKey: ctrlKey || (isMacintosh() && metaKey),
-        shiftKey,
-        altKey,
      })
      const shortcut = shortcutsSnap.shortcuts.get(shortcutKey)
      if (!shortcut) return
@@ -1,28 +1,26 @@
 import { useEffect } from 'react'
 import { keyboardShortcutsStore } from '@/stores/keyboardShortcuts'
 import { formatShortcutKey } from '@/features/shortcuts/utils'
-import { ShortcutId, getShortcutDescriptorById } from './catalog'
+import { Shortcut } from '@/features/shortcuts/types'

 export type useRegisterKeyboardShortcutProps = {
-  id?: ShortcutId
+  shortcut?: Shortcut
  handler: () => Promise<void | boolean | undefined> | void
  isDisabled?: boolean
 }

 export const useRegisterKeyboardShortcut = ({
-  id,
+  shortcut,
  handler,
  isDisabled = false,
 }: useRegisterKeyboardShortcutProps) => {
  useEffect(() => {
-    if (!id) return
-    const descriptor = getShortcutDescriptorById(id)
-    if (!descriptor?.shortcut) return
-    const formattedKey = formatShortcutKey(descriptor.shortcut)
+    if (!shortcut) return
+    const formattedKey = formatShortcutKey(shortcut)
    if (isDisabled) {
      keyboardShortcutsStore.shortcuts.delete(formattedKey)
    } else {
      keyboardShortcutsStore.shortcuts.set(formattedKey, handler)
    }
-  }, [handler, id, isDisabled])
+  }, [handler, shortcut, isDisabled])
 }
@@ -4,27 +4,15 @@ import { Shortcut } from '@/features/shortcuts/types'
 export const CTRL = 'ctrl'

 export const formatShortcutKey = (shortcut: Shortcut) => {
-  const parts = []
-  if (shortcut.ctrlKey) parts.push(CTRL)
-  if (shortcut.altKey) parts.push('alt')
-  if (shortcut.shiftKey) parts.push('shift')
-  parts.push(shortcut.key.toUpperCase())
-  return parts.join('+')
+  if (shortcut.ctrlKey) return `${CTRL}+${shortcut.key.toUpperCase()}`
+  return shortcut.key.toUpperCase()
 }

 export const appendShortcutLabel = (label: string, shortcut: Shortcut) => {
  if (!shortcut.key) return
-  const parts: string[] = []
+  let formattedKeyLabel = shortcut.key.toLowerCase()
  if (shortcut.ctrlKey) {
-    parts.push(isMacintosh() ? '⌘' : 'Ctrl')
+    formattedKeyLabel = `${isMacintosh() ? '⌘' : 'Ctrl'}+${formattedKeyLabel}`
  }
-  if (shortcut.altKey) {
-    parts.push(isMacintosh() ? '⌥' : 'Alt')
-  }
-  if (shortcut.shiftKey) {
-    parts.push('Shift')
-  }
-  parts.push(shortcut.key.toLowerCase())
-  const formattedKeyLabel = parts.join('+')
  return `${label} (${formattedKeyLabel})`
 }
@@ -20,7 +20,8 @@ export interface TranscriptionSegment {
  lastReceivedTime: number
 }

-export interface TranscriptionSegmentWithParticipant extends TranscriptionSegment {
+export interface TranscriptionSegmentWithParticipant
+  extends TranscriptionSegment {
  participant: Participant
 }

@@ -154,9 +154,7 @@
  "isIdleDisconnectModal": {
    "title": "Bist du noch da?",
    "body": "Du bist der einzige Teilnehmer. Dieses Gespräch endet in {{duration}}. Möchtest du das Gespräch fortsetzen?",
-    "settingsPrefix": "Um diese Nachricht nicht mehr zu sehen, gehe zu",
-    "settingsLink": "Einstellungen > Allgemein",
-    "settingsSuffix": ".",
+    "settings": "Um diese Nachricht nicht mehr zu sehen, gehe zu Einstellungen > Allgemein.",
    "stayButton": "Gespräch fortsetzen",
    "leaveButton": "Jetzt verlassen",
    "countdownAnnouncement": "Das Gespräch endet in {{duration}}."
@@ -595,41 +593,6 @@
    "muteParticipant": "{{name}} stummschalten",
    "fullScreen": "Vollbild"
  },
-  "shortcutsPanel": {
-    "title": "Tastenkombinationen",
-    "categories": {
-      "navigation": "Navigation",
-      "media": "Medien",
-      "interaction": "Interaktion"
-    },
-    "actions": {
-      "open-shortcuts": "Tastenkürzel-Hilfe öffnen",
-      "focus-toolbar": "Fokus auf die untere Symbolleiste",
-      "toggle-microphone": "Mikrofon umschalten",
-      "toggle-camera": "Kamera umschalten",
-      "push-to-talk": "Push-to-talk (gedrückt halten zum Einschalten)",
-      "reaction": "Reaktionspanel",
-      "fullscreen": "Vollbild umschalten",
-      "recording": "Aufnahmepanel umschalten",
-      "raise-hand": "Hand heben oder senken",
-      "toggle-chat": "Chat anzeigen/ausblenden",
-      "toggle-participants": "Teilnehmer anzeigen/ausblenden",
-      "open-shortcuts-settings": "Tastenkürzel-Einstellungen öffnen"
-    },
-    "sr": {
-      "control": "Steuerung",
-      "command": "Befehl",
-      "alt": "Alt",
-      "option": "Option",
-      "shift": "Umschalt",
-      "plus": "plus",
-      "hold": "Halte {{key}} gedrückt",
-      "noShortcut": "Kein Tastenkürzel"
-    },
-    "visual": {
-      "hold": "Halte {{key}} gedrückt"
-    }
-  },
  "fullScreenWarning": {
    "message": "Um eine Endlosschleife zu vermeiden, teile nicht deinen gesamten Bildschirm. Teile stattdessen einen Tab oder ein anderes Fenster.",
    "stop": "Präsentation beenden",
@@ -100,11 +100,6 @@
      }
    }
  },
-  "shortcuts": {
-    "listLabel": "Tastenkürzel",
-    "columnAction": "Aktion",
-    "columnShortcut": "Tastenkürzel"
-  },
  "dialog": {
    "heading": "Einstellungen"
  },
@@ -125,7 +120,6 @@
    "general": "Allgemein",
    "notifications": "Benachrichtigungen",
    "accessibility": "Barrierefreiheit",
-    "transcription": "Transkription",
-    "shortcuts": "Tastenkürzel"
+    "transcription": "Transkription"
  }
 }
--- a/Show More
+++ b/Show More