🩹(frontend) fix overflow in participant metadata layout

Recent styling changes introduced an overflow, causing the network
indicator to be pushed outside of the participant tile.

Remove width: 100% and add a minimal gap to prevent metadata
elements from being too close to each other.

.github/workflows/crowdin-download.yml

@@ -13,7 +13,7 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Checkout
-        uses: actions/checkout@v4
+        uses: actions/checkout@v6
 
       - name: Download Crowdin files
         uses: crowdin/github-action@v2

.github/workflows/docker-hub.yml

@@ -23,7 +23,13 @@ jobs:
     steps:
       -
         name: Checkout repository
-        uses: actions/checkout@v4
+        uses: actions/checkout@v6
+      -
+        name: Set up QEMU
+        uses: docker/setup-qemu-action@v3
+      -
+        name: Set up Docker Buildx
+        uses: docker/setup-buildx-action@v3
       -
         name: Docker meta
         id: meta
@@ -37,18 +43,19 @@ jobs:
         with:
           username: ${{ secrets.DOCKER_HUB_USER }}
           password: ${{ secrets.DOCKER_HUB_PASSWORD }}
-      -
-        name: Run trivy scan
-        uses: numerique-gouv/action-trivy-cache@main
-        with:
-          docker-build-args: '--target backend-production -f Dockerfile'
-          docker-image-name: '${{ env.DOCKER_CONTAINER_REGISTRY_HOSTNAME }}/${{ env.DOCKER_CONTAINER_REGISTRY_NAMESPACE }}/meet-backend:${{ github.sha }}'
+#      -
+#        name: Run trivy scan
+#        uses: numerique-gouv/action-trivy-cache@main
+#        with:
+#          docker-build-args: '--target backend-production -f Dockerfile'
+#          docker-image-name: '${{ env.DOCKER_CONTAINER_REGISTRY_HOSTNAME }}/${{ env.DOCKER_CONTAINER_REGISTRY_NAMESPACE }}/meet-backend:${{ github.sha }}'
       -
         name: Build and push
         uses: docker/build-push-action@v6
         with:
           context: .
           target: backend-production
+          platforms: linux/amd64,linux/arm64
           build-args: DOCKER_USER=${{ env.DOCKER_USER }}:-1000
           push: ${{ github.event_name != 'pull_request' }}
           tags: ${{ steps.meta.outputs.tags }}
@@ -59,7 +66,13 @@ jobs:
     steps:
       -
         name: Checkout repository
-        uses: actions/checkout@v4
+        uses: actions/checkout@v6
+      -
+        name: Set up QEMU
+        uses: docker/setup-qemu-action@v3
+      -
+        name: Set up Docker Buildx
+        uses: docker/setup-buildx-action@v3
       -
         name: Docker meta
         id: meta
@@ -73,12 +86,12 @@ jobs:
         with:
           username: ${{ secrets.DOCKER_HUB_USER }}
           password: ${{ secrets.DOCKER_HUB_PASSWORD }}
-      -
-        name: Run trivy scan
-        uses: numerique-gouv/action-trivy-cache@main
-        with:
-          docker-build-args: '-f src/frontend/Dockerfile --target frontend-production'
-          docker-image-name: '${{ env.DOCKER_CONTAINER_REGISTRY_HOSTNAME }}/${{ env.DOCKER_CONTAINER_REGISTRY_NAMESPACE }}/meet-frontend:${{ github.sha }}'
+#      -
+#        name: Run trivy scan
+#        uses: numerique-gouv/action-trivy-cache@main
+#        with:
+#          docker-build-args: '-f src/frontend/Dockerfile --target frontend-production'
+#          docker-image-name: '${{ env.DOCKER_CONTAINER_REGISTRY_HOSTNAME }}/${{ env.DOCKER_CONTAINER_REGISTRY_NAMESPACE }}/meet-frontend:${{ github.sha }}'
       -
         name: Build and push
         uses: docker/build-push-action@v6
@@ -86,6 +99,7 @@ jobs:
           context: .
           file: ./src/frontend/Dockerfile
           target: frontend-production
+          platforms: linux/amd64,linux/arm64
           build-args: DOCKER_USER=${{ env.DOCKER_USER }}:-1000
           push: ${{ github.event_name != 'pull_request' }}
           tags: ${{ steps.meta.outputs.tags }}
@@ -96,7 +110,13 @@ jobs:
     steps:
       -
         name: Checkout repository
-        uses: actions/checkout@v4
+        uses: actions/checkout@v6
+      -
+        name: Set up QEMU
+        uses: docker/setup-qemu-action@v3
+      -
+        name: Set up Docker Buildx
+        uses: docker/setup-buildx-action@v3
       -
         name: Docker meta
         id: meta
@@ -110,12 +130,12 @@ jobs:
         with:
           username: ${{ secrets.DOCKER_HUB_USER }}
           password: ${{ secrets.DOCKER_HUB_PASSWORD }}
-      -
-        name: Run trivy scan
-        uses: numerique-gouv/action-trivy-cache@main
-        with:
-          docker-build-args: '-f docker/dinum-frontend/Dockerfile --target frontend-production'
-          docker-image-name: '${{ env.DOCKER_CONTAINER_REGISTRY_HOSTNAME }}/${{ env.DOCKER_CONTAINER_REGISTRY_NAMESPACE }}/meet-frontend-dinum:${{ github.sha }}'
+#      -
+#        name: Run trivy scan
+#        uses: numerique-gouv/action-trivy-cache@main
+#        with:
+#          docker-build-args: '-f docker/dinum-frontend/Dockerfile --target frontend-production'
+#          docker-image-name: '${{ env.DOCKER_CONTAINER_REGISTRY_HOSTNAME }}/${{ env.DOCKER_CONTAINER_REGISTRY_NAMESPACE }}/meet-frontend-dinum:${{ github.sha }}'
       -
         name: Build and push
         uses: docker/build-push-action@v6
@@ -123,6 +143,7 @@ jobs:
           context: .
           file: ./docker/dinum-frontend/Dockerfile
           target: frontend-production
+          platforms: linux/amd64,linux/arm64
           build-args: DOCKER_USER=${{ env.DOCKER_USER }}:-1000
           push: ${{ github.event_name != 'pull_request' }}
           tags: ${{ steps.meta.outputs.tags }}
@@ -133,7 +154,13 @@ jobs:
     steps:
       -
         name: Checkout repository
-        uses: actions/checkout@v4
+        uses: actions/checkout@v6
+      -
+        name: Set up QEMU
+        uses: docker/setup-qemu-action@v3
+      -
+        name: Set up Docker Buildx
+        uses: docker/setup-buildx-action@v3
       -
         name: Docker meta
         id: meta
@@ -147,13 +174,13 @@ jobs:
         with:
           username: ${{ secrets.DOCKER_HUB_USER }}
           password: ${{ secrets.DOCKER_HUB_PASSWORD }}
-      -
-        name: Run trivy scan
-        uses: numerique-gouv/action-trivy-cache@main
-        continue-on-error: true
-        with:
-          docker-build-args: '-f src/summary/Dockerfile --target production'
-          docker-image-name: '${{ env.DOCKER_CONTAINER_REGISTRY_HOSTNAME }}/${{ env.DOCKER_CONTAINER_REGISTRY_NAMESPACE }}/meet-summary:${{ github.sha }}'
+#      -
+#        name: Run trivy scan
+#        uses: numerique-gouv/action-trivy-cache@main
+#        continue-on-error: true
+#        with:
+#          docker-build-args: '-f src/summary/Dockerfile --target production'
+#          docker-image-name: '${{ env.DOCKER_CONTAINER_REGISTRY_HOSTNAME }}/${{ env.DOCKER_CONTAINER_REGISTRY_NAMESPACE }}/meet-summary:${{ github.sha }}'
           docker-context: './src/summary'
       -
         name: Build and push
@@ -162,6 +189,7 @@ jobs:
           context: ./src/summary
           file: ./src/summary/Dockerfile
           target: production
+          platforms: linux/amd64,linux/arm64
           build-args: DOCKER_USER=${{ env.DOCKER_USER }}:-1000
           push: ${{ github.event_name != 'pull_request' }}
           tags: ${{ steps.meta.outputs.tags }}
@@ -172,7 +200,13 @@ jobs:
     steps:
       -
         name: Checkout repository
-        uses: actions/checkout@v4
+        uses: actions/checkout@v6
+      -
+        name: Set up QEMU
+        uses: docker/setup-qemu-action@v3
+      -
+        name: Set up Docker Buildx
+        uses: docker/setup-buildx-action@v3
       -
         name: Docker meta
         id: meta
@@ -186,14 +220,14 @@ jobs:
         with:
           username: ${{ secrets.DOCKER_HUB_USER }}
           password: ${{ secrets.DOCKER_HUB_PASSWORD }}
-      -
-        name: Run trivy scan
-        uses: numerique-gouv/action-trivy-cache@main
-        continue-on-error: true
-        with:
-          docker-build-args: '-f src/agents/Dockerfile --target production'
-          docker-image-name: '${{ env.DOCKER_CONTAINER_REGISTRY_HOSTNAME }}/${{ env.DOCKER_CONTAINER_REGISTRY_NAMESPACE }}/meet-agents:${{ github.sha }}'
-          docker-context: './src/agents'
+#      -
+#        name: Run trivy scan
+#        uses: numerique-gouv/action-trivy-cache@main
+#        continue-on-error: true
+#        with:
+#          docker-build-args: '-f src/agents/Dockerfile --target production'
+#          docker-image-name: '${{ env.DOCKER_CONTAINER_REGISTRY_HOSTNAME }}/${{ env.DOCKER_CONTAINER_REGISTRY_NAMESPACE }}/meet-agents:${{ github.sha }}'
+#          docker-context: './src/agents'
       -
         name: Build and push
         uses: docker/build-push-action@v6
@@ -201,6 +235,7 @@ jobs:
           context: ./src/agents
           file: ./src/agents/Dockerfile
           target: production
+          platforms: linux/amd64,linux/arm64
           build-args: DOCKER_USER=${{ env.DOCKER_USER }}:-1000
           push: ${{ github.event_name != 'pull_request' }}
           tags: ${{ steps.meta.outputs.tags }}

.github/workflows/meet.yml

@@ -7,14 +7,18 @@ on:
   pull_request:
     branches:
       - "*"
+permissions:
+  contents: read
 
 jobs:
   lint-git:
     runs-on: ubuntu-latest
     if: github.event_name == 'pull_request' # Makes sense only for pull requests
+    permissions:
+      contents: read
     steps:
       - name: Checkout repository
-        uses: actions/checkout@v4
+        uses: actions/checkout@v6
         with:
           fetch-depth: 0
       - name: show
@@ -39,9 +43,11 @@ jobs:
     if: |
       contains(github.event.pull_request.labels.*.name, 'noChangeLog') == false &&
       github.event_name == 'pull_request'
+    permissions:
+        contents: read
     steps:
       - name: Checkout repository
-        uses: actions/checkout@v4
+        uses: actions/checkout@v6
         with:
           fetch-depth: 50
       - name: Check that the CHANGELOG has been modified in the current branch
@@ -49,9 +55,11 @@ jobs:
 
   lint-changelog:
     runs-on: ubuntu-latest
+    permissions:
+      contents: read
     steps:
       - name: Checkout repository
-        uses: actions/checkout@v4
+        uses: actions/checkout@v6
       - name: Check CHANGELOG max line length
         run: |
           max_line_length=$(cat CHANGELOG.md | grep -Ev "^\[.*\]: https://github.com" | wc -L)
@@ -62,20 +70,22 @@ jobs:
 
   build-mails:
     runs-on: ubuntu-latest
+    permissions:
+      contents: read
     defaults:
       run:
         working-directory: src/mail
     steps:
       - name: Checkout repository
-        uses: actions/checkout@v4
+        uses: actions/checkout@v6
 
       - name: Install Node.js
-        uses: actions/setup-node@v4
+        uses: actions/setup-node@v6
         with:
           node-version: "18"
 
       - name: Restore the mail templates
-        uses: actions/cache@v4
+        uses: actions/cache@v5
         id: mail-templates
         with:
           path: "src/backend/core/templates/mail"
@@ -95,21 +105,23 @@ jobs:
 
       - name: Cache mail templates
         if: steps.mail-templates.outputs.cache-hit != 'true'
-        uses: actions/cache@v4
+        uses: actions/cache@v5
         with:
           path: "src/backend/core/templates/mail"
           key: mail-templates-${{ hashFiles('src/mail/mjml') }}
 
   lint-back:
     runs-on: ubuntu-latest
+    permissions:
+      contents: read
     defaults:
       run:
         working-directory: src/backend
     steps:
       - name: Checkout repository
-        uses: actions/checkout@v4
+        uses: actions/checkout@v6
       - name: Install Python
-        uses: actions/setup-python@v5
+        uses: actions/setup-python@v6
         with:
           python-version: "3.13"
           cache: "pip"
@@ -124,14 +136,16 @@ jobs:
 
   lint-agents:
     runs-on: ubuntu-latest
+    permissions:
+      contents: read
     defaults:
       run:
         working-directory: src/agents
     steps:
       - name: Checkout repository
-        uses: actions/checkout@v4
+        uses: actions/checkout@v6
       - name: Install Python
-        uses: actions/setup-python@v5
+        uses: actions/setup-python@v6
         with:
           python-version: "3.13"
           cache: "pip"
@@ -144,14 +158,16 @@ jobs:
 
   lint-summary:
     runs-on: ubuntu-latest
+    permissions:
+      contents: read
     defaults:
       run:
         working-directory: src/summary
     steps:
       - name: Checkout repository
-        uses: actions/checkout@v4
+        uses: actions/checkout@v6
       - name: Install Python
-        uses: actions/setup-python@v5
+        uses: actions/setup-python@v6
         with:
           python-version: "3.13"
           cache: "pip"
@@ -165,7 +181,8 @@ jobs:
   test-back:
     runs-on: ubuntu-latest
     needs: build-mails
-
+    permissions:
+      contents: read
     defaults:
       run:
         working-directory: src/backend
@@ -216,7 +233,7 @@ jobs:
 
     steps:
       - name: Checkout repository
-        uses: actions/checkout@v4
+        uses: actions/checkout@v6
 
       - name: Create writable /data
         run: |
@@ -224,7 +241,7 @@ jobs:
           sudo mkdir -p /data/static
 
       - name: Restore the mail templates
-        uses: actions/cache@v4
+        uses: actions/cache@v5
         id: mail-templates
         with:
           path: "src/backend/core/templates/mail"
@@ -258,7 +275,7 @@ jobs:
             mc mb meet/meet-media-storage"
 
       - name: Install Python
-        uses: actions/setup-python@v5
+        uses: actions/setup-python@v6
         with:
           python-version: "3.13"
           cache: "pip"
@@ -279,9 +296,11 @@ jobs:
 
   lint-front:
     runs-on: ubuntu-latest
+    permissions:
+      contents: read
     steps:
       - name: Checkout repository
-        uses: actions/checkout@v4
+        uses: actions/checkout@v6
 
       - name: Install dependencies
         run: cd src/frontend/ && npm ci
@@ -294,12 +313,14 @@ jobs:
 
   lint-sdk:
     runs-on: ubuntu-latest
+    permissions:
+      contents: read
     defaults:
       run:
         working-directory: src/sdk/library
     steps:
       - name: Checkout repository
-        uses: actions/checkout@v4
+        uses: actions/checkout@v6
 
       - name: Install dependencies
         run: npm ci
@@ -312,13 +333,15 @@ jobs:
 
   build-sdk:
     runs-on: ubuntu-latest
+    permissions:
+      contents: read
     needs: lint-sdk
     defaults:
       run:
         working-directory: src/sdk/library
     steps:
       - name: Checkout repository
-        uses: actions/checkout@v4
+        uses: actions/checkout@v6
 
       - name: Install dependencies
         run: npm ci

.github/workflows/release-helm-chart.yaml

@@ -13,7 +13,7 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Checkout
-        uses: actions/checkout@v4
+        uses: actions/checkout@v6
         with:
           fetch-depth: 0
 

.github/workflows/security.yaml

@@ -0,0 +1,29 @@
+# /!\
+# Security Note: This action is not hardened against prompt injection attacks and should only be used
+# to review trusted PRs. Configure your repository with "Require approval for all external contributors"
+# to ensure workflows only run after a maintainer has reviewed the PR.
+name: Security Review
+
+permissions:
+  pull-requests: write  # Needed for leaving PR comments
+  contents: read
+
+on:
+  pull_request:
+    branches:
+      - 'main'
+
+jobs:
+  security:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v6
+        with:
+          ref: ${{ github.event.pull_request.head.sha || github.sha }}
+          fetch-depth: 2
+
+      - uses: anthropics/claude-code-security-review@0c6a49f1fa56a1d472575da86a94dbc1edb78eda
+        with:
+          comment-pr: true
+          exclude-directories: docs,gitlint,LICENSES,bin
+          claude-api-key: ${{ secrets.CLAUDE_API_KEY }}

CHANGELOG.md

@@ -10,7 +10,68 @@ and this project adheres to
 
 ### Changed
 
+- 🔒️(backend) enhance API input validation to strengthen security #1053
+- 🦺(backend) strengthen API validation for recording options #1063
+- ⚡️(frontend) optimize few performance caveats #1073
+
+### Fixed
+
+- 🐛(migrations) use settings in migrations #1058
+- 💄(frontend) truncate pinned participant name with ellipsis on overflow #1056
+- ♿(frontend) prevent focus ring clipping on invite dialog #1078
+
+## [1.9.0] - 2026-03-02
+
+### Added
+
+- 👷(docker) add arm64 platform support for image builds
+- ✨(summary) add localization support for transcription context text
+
+### Changed
+
+- ♻️(frontend) replace custom reactions toolbar with react aria popover #985
+- 🔒️(frontend) uninstall curl from the frontend production image #987
+- 💄(frontend) add focus ring to reaction emoji buttons
+- ✨(frontend) introduce a shortcut settings tab #975
+- 🚚(frontend) rename "wellknown" directory to "well-known" #1009
+- 🌐(frontend) localize SR modifier labels #1010
+- ⬆️(backend) update python dependencies #1011
+- ♿️(frontend) fix focus ring on tab container components #1012
+- ♿️(frontend) upgrade join meeting modal accessibility #1027
+- ⬆️(python) bump minimal required python version to 3.13 #1033
+- ♿️(frontend) improve accessibility of the IntroSlider carousel #1026
+- ♿️(frontend) add skip link component for keyboard navigation #1019
+- ♿️(frontend) announce mic/camera state to SR on shortcut toggle #1052
+- ✨(frontend) add Ctrl+Shift+/ to open shortcuts settings #1050
+
+### Fixed
+
+- 🩹(frontend) fix German language preference update #1021
+
+## [1.8.0] - 2026-02-20
+
+### Changed
+
+- 🔒️(agents) uninstall pip from the agents image
+- 🔒️(summary) switch to Alpine base image
+- 🔒️(backend) uninstall pip in the production image
+
+### Fixed
+
+- 🔒️(agents) upgrade OpenSSL to address CVE-2025-15467
+- 📌(agents) pin protobuf to 6.33.5 to fix CVE-2026-0994
+
+## [1.7.0] - 2026-02-19
+
+### Added
+
+- ✨(frontend) expose Windows app web link #976
+- ✨(frontend) support additional shortcuts to broaden accessibility
+
+### Changed
+
 - ✨(frontend) add clickable settings general link in idle modal #974
+- ♻️(backend) refactor external API token-related items #1006
 
 ## [1.6.0] - 2026-02-10
 

Dockerfile

@@ -127,6 +127,9 @@ ARG MEET_STATIC_ROOT=/data/static
 RUN mkdir -p /usr/local/etc/gunicorn
 COPY docker/files/usr/local/etc/gunicorn/meet.py /usr/local/etc/gunicorn/meet.py
 
+# Remove pip to reduce attack surface in production
+RUN pip uninstall -y pip
+
 # Un-privileged user running the application
 ARG DOCKER_USER
 USER ${DOCKER_USER}

Makefile

@@ -23,9 +23,10 @@
 # ==============================================================================
 # VARIABLES
 
-BOLD := \033[1m
-RESET := \033[0m
-GREEN := \033[1;32m
+ESC := $(shell printf '\033')
+BOLD := $(ESC)[1m
+RESET := $(ESC)[0m
+GREEN := $(ESC)[1;32m
 
 
 # -- Database
@@ -85,7 +86,8 @@ bootstrap: \
 	demo \
 	back-i18n-compile \
 	mails-install \
-	mails-build
+	mails-build \
+	run
 .PHONY: bootstrap
 
 # -- Docker/compose

bin/Tiltfile

@@ -18,6 +18,7 @@ docker_build(
     'localhost:5001/meet-backend:latest',
     context='..',
     dockerfile='../Dockerfile',
+    build_args={'DOCKER_USER': '1001:127'},
     only=['./src/backend', './src/mail', './docker'],
     target = 'backend-production',
     live_update=[
@@ -33,6 +34,7 @@ clean_old_images('localhost:5001/meet-backend')
 docker_build(
     'localhost:5001/meet-frontend-dinum:latest',
     context='..',
+    build_args={'DOCKER_USER': '1001:127'},
     dockerfile='../docker/dinum-frontend/Dockerfile',
     only=['./src/frontend', './docker', './.dockerignore'],
     target = 'frontend-production',
@@ -57,6 +59,7 @@ clean_old_images('localhost:5001/meet-frontend-generic')
 docker_build(
     'localhost:5001/meet-summary:latest',
     context='../src/summary',
+    build_args={'DOCKER_USER': '1001:127'},
     dockerfile='../src/summary/Dockerfile',
     only=['.'],
     target = 'production',
@@ -69,8 +72,9 @@ clean_old_images('localhost:5001/meet-summary')
 docker_build(
     'localhost:5001/meet-agents:latest',
     context='../src/agents',
+    build_args={'DOCKER_USER': '1001:127'},
     dockerfile='../src/agents/Dockerfile',
-   only=['.'],
+    only=['.'],
     target = 'production',
     live_update=[
         sync('../src/agents', '/app'),

docker/files/production/default.conf.template

@@ -1,9 +1,9 @@
 upstream meet_backend {
-    server ${BACKEND_HOST}:8000 fail_timeout=0;
+    server ${BACKEND_INTERNAL_HOST}:8000 fail_timeout=0;
 }
 
 upstream meet_frontend {
-    server ${FRONTEND_HOST}:8080 fail_timeout=0;
+    server ${FRONTEND_INTERNAL_HOST}:8080 fail_timeout=0;
 }
 
 server {

docker/livekit/Dockerfile

@@ -1,4 +1,4 @@
-FROM livekit/livekit-server:v1.9.0
+FROM livekit/livekit-server:v1.9.4
 
 # We inject the nip.io certificate manually because the livekit chart doesn't support volume mounting
 COPY rootCA.pem /etc/ssl/certs/

docs/examples/compose/compose.yaml

@@ -20,8 +20,8 @@ services:
     user: ${DOCKER_USER:-1000}
     restart: always
     env_file:
+    - .env
     - env.d/common
-    - env.d/backend
     - env.d/postgresql
     healthcheck:
       test: ["CMD", "python", "manage.py", "check"]
@@ -45,6 +45,7 @@ services:
     - /docker-entrypoint.sh
     command: ["nginx", "-g", "daemon off;"]
     env_file:
+    - .env
     - env.d/common
     # Uncomment and set your values if using our nginx proxy example
     # environment:

docs/installation/scalingo.md

@@ -32,7 +32,7 @@ Set the following environment variables in your Scalingo app:
 ### Buildpack Configuration
 
 ```bash
-scalingo env-set BUILDBACK_URL="https://github.com/suitenumerique/buildpack#main"
+scalingo env-set BUILDPACK_URL="https://github.com/suitenumerique/buildpack#main"
 scalingo env-set LASUITE_APP_NAME="meet"
 scalingo env-set LASUITE_BACKEND_DIR="."
 scalingo env-set LASUITE_FRONTEND_DIR="src/frontend/"

gitlint/gitlint_emoji.py

@@ -2,6 +2,7 @@
 Gitlint extra rule to validate that the message title is of the form
 "<gitmoji>(<scope>) <subject>"
 """
+
 from __future__ import unicode_literals
 
 import re

renovate.json

@@ -3,6 +3,21 @@
   "dependencyDashboard": true,
   "labels": ["dependencies", "noChangeLog"],
   "packageRules": [
+    {
+        "groupName": "js dependencies",
+        "matchManagers": ["npm"],
+        "schedule": ["on the first day of the month"],
+        "matchPackagePatterns": ["*"],
+        "minimumReleaseAge": "7 days",
+        "internalChecksFilter": "strict"
+      },
+      {
+        "groupName": "python dependencies",
+        "matchManagers": ["setup-cfg", "pep621"],
+        "schedule": ["on the first day of the month"],
+        "matchPackagePatterns": ["*"],
+        "minimumReleaseAge": "7 days"
+      },
     {
       "enabled": false,
       "groupName": "ignored python dependencies",
@@ -15,6 +30,12 @@
       "matchPackageNames": ["pylint"],
       "allowedVersions": "<4.0.0"
     },
+    {
+        "groupName": "allowed django versions",
+        "matchManagers": ["pep621"],
+        "matchPackageNames": ["django"],
+        "allowedVersions": "<6.0.0"
+    },
     {
       "enabled": false,
       "groupName": "ignored js dependencies",

src/agents/Dockerfile

@@ -4,6 +4,8 @@ FROM python:3.13-slim AS base
 RUN apt-get update && apt-get install -y \
     libglib2.0-0 \
     libgobject-2.0-0 \
+    "openssl=3.5.4-1~deb13u2" \
+    "libssl3t64=3.5.4-1~deb13u2" \
     && rm -rf /var/lib/apt/lists/*
 
 FROM base AS builder
@@ -19,6 +21,9 @@ FROM base AS production
 
 WORKDIR /app
 
+# Remove pip to reduce attack surface in production
+RUN pip uninstall -y pip
+
 ARG DOCKER_USER
 USER ${DOCKER_USER}
 

src/agents/pyproject.toml

@@ -1,14 +1,15 @@
 
 [project]
 name = "agents"
-version = "1.6.0"
+version = "1.9.0"
 requires-python = ">=3.12"
 dependencies = [
     "livekit-agents==1.3.10",
     "livekit-plugins-deepgram==1.3.10",
     "livekit-plugins-silero==1.3.10",
     "livekit-plugins-kyutai-lasuite==0.0.6",
-    "python-dotenv==1.2.1"
+    "python-dotenv==1.2.1",
+    "protobuf==6.33.5"
 ]
 
 [project.optional-dependencies]

src/backend/core/api/serializers.py

@@ -1,10 +1,14 @@
 """Client serializers for the Meet core app."""
 
 # pylint: disable=abstract-method,no-name-in-module
+from typing import Literal
 
+from django.conf import settings
+from django.core.exceptions import SuspiciousOperation
 from django.utils.translation import gettext_lazy as _
 
-from livekit.api import ParticipantPermission
+from django_pydantic_field.rest_framework import SchemaField
+from pydantic import BaseModel, Field
 from rest_framework import serializers
 from rest_framework.exceptions import PermissionDenied
 from timezone_field.rest_framework import TimeZoneSerializerField
@@ -201,6 +205,27 @@ class BaseValidationOnlySerializer(serializers.Serializer):
         raise NotImplementedError(f"{self.__class__.__name__} is validation-only")
 
 
+class RecordingOptions(BaseModel):
+    """Configuration options for recording.
+
+    Attributes:
+        language: ISO 639-1 language code compatible with whisperX.
+            When `None`, the transcription engine will attempt to
+            auto-detect the spoken language.
+        transcribe: Whether to transcribe the recorded audio.
+            When `None`, falls back to the application default.
+        original_mode: The original recording mode before any override.
+            Must be one of the valid RecordingModeChoices values when provided.
+
+    """
+
+    language: str | None = None
+    transcribe: bool | None = None
+    original_mode: Literal["screen_recording", "transcript"] | None = None
+
+    model_config = {"extra": "forbid"}
+
+
 class StartRecordingSerializer(BaseValidationOnlySerializer):
     """Validate start recording requests."""
 
@@ -213,10 +238,11 @@ class StartRecordingSerializer(BaseValidationOnlySerializer):
             "screen_recording or transcript.",
         },
     )
-    options = serializers.JSONField(
+    options = SchemaField(
+        schema=RecordingOptions | None,
         required=False,
         allow_null=True,
-        default=dict,
+        help_text="Recording options",
     )
 
 
@@ -261,6 +287,28 @@ class MuteParticipantSerializer(BaseParticipantsManagementSerializer):
     )
 
 
+class ParticipantPermission(BaseModel):
+    """Mirror the LiveKit ParticipantPermission protobuf.
+
+    Control what a participant is allowed to publish, subscribe, and do within a room.
+    Unknown fields are rejected.
+    """
+
+    can_subscribe: bool | None = None
+    can_publish: bool | None = None
+    can_publish_data: bool | None = None
+    can_publish_sources: list[int] = Field(
+        default_factory=list
+    )  # TrackSource enum values
+    hidden: bool | None = None
+    recorder: bool | None = None
+    can_update_metadata: bool | None = None
+    agent: bool | None = None
+    can_subscribe_metrics: bool | None = None
+
+    model_config = {"extra": "forbid"}
+
+
 class UpdateParticipantSerializer(BaseParticipantsManagementSerializer):
     """Validate participant update data."""
 
@@ -272,10 +320,11 @@ class UpdateParticipantSerializer(BaseParticipantsManagementSerializer):
         allow_null=True,
         help_text="Participant attributes as JSON object",
     )
-    permission = serializers.DictField(
+    permission = SchemaField(
+        schema=ParticipantPermission | None,
         required=False,
         allow_null=True,
-        help_text="Participant permission as JSON object",
+        help_text="Participant permissions",
     )
     name = serializers.CharField(
         max_length=255,
@@ -285,6 +334,33 @@ class UpdateParticipantSerializer(BaseParticipantsManagementSerializer):
         help_text="Display name for the participant",
     )
 
+    def validate_permission(self, permission):
+        """Validate that the given permission does not include forbidden or unimplemented fields."""
+
+        if permission is None:
+            return None
+
+        suspicious_fields = [
+            field
+            for field in settings.PARTICIPANT_FORBIDDEN_PERMISSION_FIELDS
+            if getattr(permission, field) is not None
+        ]
+        if suspicious_fields:
+            raise SuspiciousOperation(
+                f"Setting the following participant permissions is not allowed: "
+                f"{', '.join(suspicious_fields)}."
+            )
+        if permission.can_subscribe_metrics is not None:
+            raise serializers.ValidationError(
+                {
+                    "permission": {
+                        "can_subscribe_metrics": "This permission is not implemented."
+                    }
+                }
+            )
+
+        return permission
+
     def validate(self, attrs):
         """Ensure at least one update field is provided."""
         update_fields = ["metadata", "attributes", "permission", "name"]
@@ -300,12 +376,4 @@ class UpdateParticipantSerializer(BaseParticipantsManagementSerializer):
                 f"{', '.join(update_fields)}."
             )
 
-        if "permission" in attrs:
-            try:
-                ParticipantPermission(**attrs["permission"])
-            except ValueError as e:
-                raise serializers.ValidationError(
-                    {"permission": f"Invalid permission: {str(e)}"}
-                ) from e
-
         return attrs

src/backend/core/api/viewsets.py

@@ -296,12 +296,14 @@ class RoomViewSet(
             )
 
         mode = serializer.validated_data["mode"]
-        options = serializer.validated_data["options"]
+        options = serializer.validated_data.get("options")
         room = self.get_object()
 
         # May raise exception if an active or initiated recording already exist for the room
         recording = models.Recording.objects.create(
-            room=room, mode=mode, options=options
+            room=room,
+            mode=mode,
+            options=options.model_dump(exclude_none=True) if options else {},
         )
 
         models.RecordingAccess.objects.create(
@@ -607,13 +609,15 @@ class RoomViewSet(
         serializer = serializers.UpdateParticipantSerializer(data=request.data)
         serializer.is_valid(raise_exception=True)
 
+        permission = serializer.validated_data.get("permission")
+
         try:
             ParticipantsManagement().update(
                 room_name=str(room.pk),
                 identity=str(serializer.validated_data["participant_identity"]),
                 metadata=serializer.validated_data.get("metadata"),
                 attributes=serializer.validated_data.get("attributes"),
-                permission=serializer.validated_data.get("permission"),
+                permission=permission.model_dump() if permission else None,
                 name=serializer.validated_data.get("name"),
             )
         except ParticipantsManagementException:

src/backend/core/external_api/authentication.py

@@ -1,27 +1,51 @@
 """Authentication Backends for external application to the Meet core app."""
 
+# pylint: disable=R0913,R0917
+# ruff: noqa: PLR0913
+
 import logging
 
 from django.conf import settings
 from django.contrib.auth import get_user_model
 from django.core.exceptions import SuspiciousOperation
 
-import jwt as pyJwt
 from lasuite.oidc_resource_server.backend import ResourceServerBackend as LaSuiteBackend
 from rest_framework import authentication, exceptions
 
 from core.models import Application
+from core.services import jwt_token
 
 User = get_user_model()
 logger = logging.getLogger(__name__)
 
 
-class ApplicationJWTAuthentication(authentication.BaseAuthentication):
-    """JWT authentication for application-delegated API access.
+class BaseJWTAuthentication(authentication.BaseAuthentication):
+    """Base JWT authentication class."""
 
-    Validates JWT tokens issued to applications that are acting on behalf
-    of users. Tokens must include user_id, client_id, and delegation flag.
-    """
+    def __init__(
+        self, secret_key, algorithm, issuer, audience, expiration_seconds, token_type
+    ):
+        """Initialize the JWT authentication backend with the given token service configuration.
+
+        Args:
+            secret_key: Secret key for JWT encoding/decoding
+            algorithm: JWT algorithm (e.g. HS256)
+            issuer: Expected token issuer identifier
+            audience: Expected token audience identifier
+            expiration_seconds: Token expiration time in seconds
+            token_type: Token type (e.g. Bearer)
+        """
+
+        super().__init__()
+
+        self._token_service = jwt_token.JwtTokenService(
+            secret_key=secret_key,
+            algorithm=algorithm,
+            issuer=issuer,
+            audience=audience,
+            expiration_seconds=expiration_seconds,
+            token_type=token_type,
+        )
 
     def authenticate(self, request):
         """Extract and validate JWT from Authorization header.
@@ -48,6 +72,78 @@ class ApplicationJWTAuthentication(authentication.BaseAuthentication):
 
         return self.authenticate_credentials(token)
 
+    def decode_jwt(self, token):
+        """Decode and validate JWT token.
+
+        Args:
+            token: JWT token string
+
+        Returns:
+            Decoded payload dict, or None if token is invalid
+
+        Raises:
+            AuthenticationFailed: If token is expired or has invalid issuer/audience
+        """
+
+        try:
+            payload = self._token_service.decode_jwt(token)
+            return payload
+        except jwt_token.TokenExpiredError as e:
+            logger.warning("Token expired")
+            raise exceptions.AuthenticationFailed("Token expired.") from e
+        except jwt_token.TokenInvalidError as e:
+            logger.warning("Invalid JWT issuer or audience: %s", e)
+            raise exceptions.AuthenticationFailed("Invalid token.") from e
+        except jwt_token.TokenDecodeError:
+            # Invalid JWT token - defer to next authentication backend
+            return None
+
+    def validate_payload(self, payload):
+        """Validate JWT payload claims.
+
+        Override in subclasses to add custom validation.
+
+        Args:
+            payload: Decoded JWT payload
+
+        Raises:
+            AuthenticationFailed: If required claims are missing or invalid
+        """
+
+    def get_user(self, payload):
+        """Retrieve and validate user from payload.
+
+        Args:
+            payload: Decoded JWT payload
+
+        Returns:
+            User instance
+
+        Raises:
+            AuthenticationFailed: If user not found or inactive
+        """
+        user_id = payload.get("user_id")
+
+        if not user_id:
+            logger.warning("Missing 'user_id' in JWT payload")
+            raise exceptions.AuthenticationFailed("Invalid token claims.")
+
+        try:
+            user = User.objects.get(id=user_id)
+        except User.DoesNotExist as e:
+            logger.warning("User not found: %s", user_id)
+            raise exceptions.AuthenticationFailed("User not found.") from e
+
+        if not user.is_active:
+            logger.warning("Inactive user attempted authentication: %s", user_id)
+            raise exceptions.AuthenticationFailed("User account is disabled.")
+
+        return user
+
+    def authenticate_header(self, request):
+        """Return authentication scheme for WWW-Authenticate header."""
+        return "Bearer"
+
     def authenticate_credentials(self, token):
         """Validate JWT token and return authenticated user.
 
@@ -62,36 +158,41 @@ class ApplicationJWTAuthentication(authentication.BaseAuthentication):
         Raises:
             AuthenticationFailed: If token is expired, or user not found
         """
-        # Decode and validate JWT
-        try:
-            payload = pyJwt.decode(
-                token,
-                settings.APPLICATION_JWT_SECRET_KEY,
-                algorithms=[settings.APPLICATION_JWT_ALG],
-                issuer=settings.APPLICATION_JWT_ISSUER,
-                audience=settings.APPLICATION_JWT_AUDIENCE,
-            )
-        except pyJwt.ExpiredSignatureError as e:
-            logger.warning("Token expired")
-            raise exceptions.AuthenticationFailed("Token expired.") from e
-        except pyJwt.InvalidIssuerError as e:
-            logger.warning("Invalid JWT issuer: %s", e)
-            raise exceptions.AuthenticationFailed("Invalid token.") from e
-        except pyJwt.InvalidAudienceError as e:
-            logger.warning("Invalid JWT audience: %s", e)
-            raise exceptions.AuthenticationFailed("Invalid token.") from e
-        except pyJwt.InvalidTokenError:
-            # Invalid JWT token - defer to next authentication backend
+
+        payload = self.decode_jwt(token)
+
+        if payload is None:
             return None
 
-        user_id = payload.get("user_id")
+        self.validate_payload(payload)
+        user = self.get_user(payload)
+
+        return (user, payload)
+
+
+class ApplicationJWTAuthentication(BaseJWTAuthentication):
+    """JWT authentication for application-delegated API access.
+
+    Validates JWT tokens issued to applications that are acting on behalf
+    of users. Tokens must include user_id, client_id, and delegation flag.
+    """
+
+    def __init__(self):
+        """Initialize authentication backend with application JWT settings from Django settings."""
+        super().__init__(
+            secret_key=settings.APPLICATION_JWT_SECRET_KEY,
+            algorithm=settings.APPLICATION_JWT_ALG,
+            issuer=settings.APPLICATION_JWT_ISSUER,
+            audience=settings.APPLICATION_JWT_AUDIENCE,
+            expiration_seconds=settings.APPLICATION_JWT_EXPIRATION_SECONDS,
+            token_type=settings.APPLICATION_JWT_TOKEN_TYPE,
+        )
+
+    def validate_payload(self, payload):
+        """Validate application-specific claims."""
         client_id = payload.get("client_id")
         is_delegated = payload.get("delegated", False)
 
-        if not user_id:
-            logger.warning("Missing 'user_id' in JWT payload")
-            raise exceptions.AuthenticationFailed("Invalid token claims.")
-
         if not client_id:
             logger.warning("Missing 'client_id' in JWT payload")
             raise exceptions.AuthenticationFailed("Invalid token claims.")
@@ -112,22 +213,6 @@ class ApplicationJWTAuthentication(authentication.BaseAuthentication):
             logger.warning("Token is not marked as delegated")
             raise exceptions.AuthenticationFailed("Invalid token type.")
 
-        try:
-            user = User.objects.get(id=user_id)
-        except User.DoesNotExist as e:
-            logger.warning("User not found: %s", user_id)
-            raise exceptions.AuthenticationFailed("User not found.") from e
-
-        if not user.is_active:
-            logger.warning("Inactive user attempted authentication: %s", user_id)
-            raise exceptions.AuthenticationFailed("User account is disabled.")
-
-        return (user, payload)
-
-    def authenticate_header(self, request):
-        """Return authentication scheme for WWW-Authenticate header."""
-        return "Bearer"
-
 
 class ResourceServerBackend(LaSuiteBackend):
     """OIDC Resource Server backend for user creation and retrieval."""

src/backend/core/external_api/viewsets.py

@@ -1,6 +1,5 @@
 """External API endpoints"""
 
-from datetime import datetime, timedelta, timezone
 from logging import getLogger
 
 from django.conf import settings
@@ -8,7 +7,6 @@ from django.contrib.auth.hashers import check_password
 from django.core.exceptions import SuspiciousOperation, ValidationError
 from django.core.validators import validate_email
 
-import jwt
 from lasuite.oidc_resource_server.authentication import ResourceServerAuthentication
 from rest_framework import decorators, mixins, viewsets
 from rest_framework import (
@@ -22,6 +20,7 @@ from rest_framework import (
 )
 
 from core import api, models
+from core.services.jwt_token import JwtTokenService
 
 from . import authentication, permissions, serializers
 
@@ -128,33 +127,28 @@ class ApplicationViewSet(viewsets.ViewSet):
                 "Multiple user accounts share a common email."
             ) from e
 
-        now = datetime.now(timezone.utc)
         scope = " ".join(application.scopes or [])
 
-        payload = {
-            "iss": settings.APPLICATION_JWT_ISSUER,
-            "aud": settings.APPLICATION_JWT_AUDIENCE,
-            "iat": now,
-            "exp": now + timedelta(seconds=settings.APPLICATION_JWT_EXPIRATION_SECONDS),
-            "client_id": client_id,
-            "scope": scope,
-            "user_id": str(user.id),
-            "delegated": True,
-        }
-
-        token = jwt.encode(
-            payload,
-            settings.APPLICATION_JWT_SECRET_KEY,
+        token_service = JwtTokenService(
+            secret_key=settings.APPLICATION_JWT_SECRET_KEY,
             algorithm=settings.APPLICATION_JWT_ALG,
+            issuer=settings.APPLICATION_JWT_ISSUER,
+            audience=settings.APPLICATION_JWT_AUDIENCE,
+            expiration_seconds=settings.APPLICATION_JWT_EXPIRATION_SECONDS,
+            token_type=settings.APPLICATION_JWT_TOKEN_TYPE,
+        )
+
+        data = token_service.generate_jwt(
+            user,
+            scope,
+            {
+                "client_id": client_id,
+                "delegated": True,
+            },
         )
 
         return drf_response.Response(
-            {
-                "access_token": token,
-                "token_type": settings.APPLICATION_JWT_TOKEN_TYPE,
-                "expires_in": settings.APPLICATION_JWT_EXPIRATION_SECONDS,
-                "scope": scope,
-            },
+            data,
             status=drf_status.HTTP_200_OK,
         )
 

src/backend/core/migrations/0001_initial.py

@@ -44,7 +44,7 @@ class Migration(migrations.Migration):
                 ('sub', models.CharField(blank=True, help_text='Optional for pending users; required upon account activation. 255 characters or fewer. Letters, numbers, and @/./+/-/_ characters only.', max_length=255, null=True, unique=True, validators=[django.core.validators.RegexValidator(message='Enter a valid sub. This value may contain only letters, numbers, and @/./+/-/_ characters.', regex='^[\\w.@+-]+\\Z')], verbose_name='sub')),
                 ('email', models.EmailField(blank=True, max_length=254, null=True, verbose_name='identity email address')),
                 ('admin_email', models.EmailField(blank=True, max_length=254, null=True, unique=True, verbose_name='admin email address')),
-                ('language', models.CharField(choices="(('en-us', 'English'), ('fr-fr', 'French'))", default='en-us', help_text='The language in which the user wants to see the interface.', max_length=10, verbose_name='language')),
+                ('language', models.CharField(choices=settings.LANGUAGES, default=settings.LANGUAGE_CODE, help_text='The language in which the user wants to see the interface.', max_length=10, verbose_name='language')),
                 ('timezone', timezone_field.fields.TimeZoneField(choices_display='WITH_GMT_OFFSET', default='UTC', help_text='The timezone in which the user wants to see times.', use_pytz=False)),
                 ('is_device', models.BooleanField(default=False, help_text='Whether the user is a device or a real user.', verbose_name='device')),
                 ('is_staff', models.BooleanField(default=False, help_text='Whether the user can log into this admin site.', verbose_name='staff status')),
@@ -96,7 +96,7 @@ class Migration(migrations.Migration):
         migrations.AddField(
             model_name='resource',
             name='users',
-            field=models.ManyToManyField(related_name='resources', through='core.ResourceAccess', to=settings.AUTH_USER_MODEL),
+            field=models.ManyToManyField(related_name='resources', through='core.ResourceAccess', through_fields=('resource', 'user'), to=settings.AUTH_USER_MODEL),
         ),
         migrations.AddConstraint(
             model_name='resourceaccess',

src/backend/core/migrations/0004_alter_user_language.py

@@ -1,5 +1,5 @@
 # Generated by Django 5.0.7 on 2024-08-07 14:39
-
+from django.conf import settings
 from django.db import migrations, models
 
 
@@ -13,6 +13,6 @@ class Migration(migrations.Migration):
         migrations.AlterField(
             model_name='user',
             name='language',
-            field=models.CharField(choices="(('en-us', 'English'), ('fr-fr', 'French'))", default='en-us', help_text='The language in which the user wants to see the interface.', max_length=10, verbose_name='language'),
+            field=models.CharField(choices=settings.LANGUAGES, default=settings.LANGUAGE_CODE, help_text='The language in which the user wants to see the interface.', max_length=10, verbose_name='language'),
         ),
     ]

src/backend/core/migrations/0013_alter_user_language.py

@@ -1,5 +1,5 @@
 # Generated by Django 5.1.8 on 2025-04-22 14:52
-
+from django.conf import settings
 from django.db import migrations, models
 
 
@@ -13,6 +13,6 @@ class Migration(migrations.Migration):
         migrations.AlterField(
             model_name='user',
             name='language',
-            field=models.CharField(choices="(('en-us', 'English'), ('fr-fr', 'French'), ('nl-nl', 'Dutch'))", default='en-us', help_text='The language in which the user wants to see the interface.', max_length=10, verbose_name='language'),
+            field=models.CharField(choices=settings.LANGUAGES, default=settings.LANGUAGE_CODE, help_text='The language in which the user wants to see the interface.', max_length=10, verbose_name='language'),
         ),
     ]

src/backend/core/recording/event/notification.py

@@ -167,6 +167,7 @@ class NotificationService:
                 owner_access.user.timezone
             ).strftime("%H:%M"),
             "download_link": f"{get_recording_download_base_url()}/{recording.id}",
+            "context_language": owner_access.user.language,
         }
 
         headers = {

src/backend/core/services/jwt_token.py

@@ -0,0 +1,153 @@
+"""JWT token service."""
+
+# pylint: disable=R0913,R0917
+# ruff: noqa: PLR0913
+
+from datetime import datetime, timedelta, timezone
+from typing import Optional
+
+from django.core.exceptions import ImproperlyConfigured
+
+import jwt
+
+
+class JWTError(Exception):
+    """Base exception for all JWT token errors."""
+
+
+class TokenExpiredError(JWTError):
+    """Raised when the JWT token has expired."""
+
+
+class TokenInvalidError(JWTError):
+    """Raised when the JWT token has an invalid issuer or audience."""
+
+
+class TokenDecodeError(JWTError):
+    """Raised for any other unrecoverable JWT decode failure."""
+
+
+class JwtTokenService:
+    """Generic JWT token service with configurable settings."""
+
+    def __init__(
+        self,
+        secret_key: str,
+        algorithm: str,
+        issuer: str,
+        audience: str,
+        expiration_seconds: int,
+        token_type: str,
+    ):
+        """
+        Initialize the token service with custom settings.
+
+        Args:
+            secret_key: Secret key for JWT encoding/decoding
+            algorithm: JWT algorithm
+            issuer: Token issuer identifier
+            audience: Token audience identifier
+            expiration_seconds: Token expiration time in seconds
+            token_type: Token type
+
+        Raises:
+            ImproperlyConfigured: If secret_key is None or empty
+        """
+        if not secret_key:
+            raise ImproperlyConfigured("Secret key is required.")
+        if not algorithm:
+            raise ImproperlyConfigured("Algorithm is required.")
+        if not token_type:
+            raise ImproperlyConfigured("Token's type is required.")
+        if expiration_seconds is None:
+            raise ImproperlyConfigured("Expiration's seconds is required.")
+
+        self._key = secret_key
+        self._algorithm = algorithm
+        self._issuer = issuer
+        self._audience = audience
+        self._expiration_seconds = expiration_seconds
+        self._token_type = token_type
+
+    def generate_jwt(
+        self, user, scope: str, extra_payload: Optional[dict] = None
+    ) -> dict:
+        """
+        Generate an access token for the given user.
+
+        Note: any extra_payload variables named iat, exp, or user_id will
+        be overwritten by this service
+
+        Args:
+            user: User instance for whom to generate the token
+            scope: Space-separated scope string
+
+        Returns:
+            Dictionary containing access_token, token_type, expires_in, and scope optionally
+        """
+        now = datetime.now(timezone.utc)
+
+        payload = extra_payload.copy() if extra_payload else {}
+
+        payload.update(
+            {
+                "iat": now,
+                "exp": now + timedelta(seconds=self._expiration_seconds),
+                "user_id": str(user.id),
+            }
+        )
+
+        if self._issuer:
+            payload["iss"] = self._issuer
+        if self._audience:
+            payload["aud"] = self._audience
+        if scope:
+            payload["scope"] = scope
+
+        token = jwt.encode(
+            payload,
+            self._key,
+            algorithm=self._algorithm,
+        )
+
+        response = {
+            "access_token": token,
+            "token_type": self._token_type,
+            "expires_in": self._expiration_seconds,
+        }
+
+        if scope:
+            response["scope"] = scope
+
+        return response
+
+    def decode_jwt(self, token):
+        """Decode and validate JWT token.
+
+        Args:
+            token: JWT token string
+
+        Returns:
+            Decoded payload dict.
+
+        Raises:
+            TokenExpiredError: If the token has expired.
+            TokenInvalidError: If the token has an invalid issuer or audience.
+            TokenDecodeError: If the token is malformed or cannot be decoded.
+        """
+
+        try:
+            payload = jwt.decode(
+                token,
+                self._key,
+                algorithms=[self._algorithm],
+                issuer=self._issuer,
+                audience=self._audience,
+            )
+            return payload
+        except jwt.ExpiredSignatureError as e:
+            raise TokenExpiredError("Token expired.") from e
+        except (jwt.InvalidIssuerError, jwt.InvalidAudienceError) as e:
+            raise TokenInvalidError("Invalid token.") from e
+        except jwt.InvalidTokenError as e:
+            raise TokenDecodeError("Token decode error.") from e

src/backend/core/tests/rooms/test_api_rooms_participants_management.py

@@ -8,6 +8,7 @@ import random
 from unittest import mock
 from uuid import uuid4
 
+from django.core.exceptions import SuspiciousOperation
 from django.urls import reverse
 
 import pytest
@@ -132,11 +133,7 @@ def test_update_participant_success(mock_livekit_client):
                 1,
                 2,
             ],  # [TrackSource.CAMERA, TrackSource.MICROPHONE]
-            "hidden": False,
-            "recorder": False,
             "can_update_metadata": True,
-            "agent": False,
-            "can_subscribe_metrics": False,
         },
         "name": "John Doe",
     }
@@ -151,6 +148,151 @@ def test_update_participant_success(mock_livekit_client):
     mock_livekit_client.aclose.assert_called_once()
 
 
+@pytest.mark.parametrize(
+    "permission_payload",
+    [
+        {},  # empty dict is valid
+        {"can_subscribe": True},
+        {"can_publish": True},
+        {"can_publish_data": True},
+        {"can_publish_sources": [1, 2]},
+        {"can_update_metadata": True},
+    ],
+)
+def test_update_participant_permission_fields_are_optional(
+    mock_livekit_client, permission_payload
+):
+    """Test that each required permission field can be passed individually."""
+    client = APIClient()
+    room = RoomFactory()
+    user = UserFactory()
+    UserResourceAccessFactory(
+        resource=room, user=user, role=random.choice(["administrator", "owner"])
+    )
+    client.force_authenticate(user=user)
+
+    payload = {
+        "participant_identity": str(uuid4()),
+        "permission": permission_payload,
+    }
+
+    url = reverse("rooms-update-participant", kwargs={"pk": room.id})
+    response = client.post(url, payload, format="json")
+
+    assert response.status_code == status.HTTP_200_OK
+    assert response.data == {"status": "success"}
+
+    mock_livekit_client.room.update_participant.assert_called_once()
+    mock_livekit_client.aclose.assert_called_once()
+
+
+@pytest.mark.parametrize(
+    "value,permission_key",
+    [
+        (False, "hidden"),
+        (True, "hidden"),
+        (False, "recorder"),
+        (True, "recorder"),
+        (False, "agent"),
+        (True, "agent"),
+    ],
+)
+@mock.patch("core.api.serializers.SuspiciousOperation", side_effect=SuspiciousOperation)
+def test_update_participant_suspicious_permission(
+    mock_suspicious, value, permission_key
+):
+    """Test update participant raises 400 when a restricted permission is set."""
+    client = APIClient()
+    room = RoomFactory()
+    user = UserFactory()
+    UserResourceAccessFactory(
+        resource=room, user=user, role=random.choice(["administrator", "owner"])
+    )
+    client.force_authenticate(user=user)
+
+    payload = {
+        "participant_identity": str(uuid4()),
+        "permission": {
+            "can_subscribe": True,
+            "can_publish": True,
+            "can_publish_data": True,
+            "can_update_metadata": False,
+            permission_key: value,
+        },
+    }
+
+    url = reverse("rooms-update-participant", kwargs={"pk": room.id})
+    response = client.post(url, payload, format="json")
+
+    assert response.status_code == status.HTTP_400_BAD_REQUEST
+    mock_suspicious.assert_called_once_with(
+        f"Setting the following participant permissions is not allowed: {permission_key}."
+    )
+
+
+@mock.patch("core.api.serializers.SuspiciousOperation", side_effect=SuspiciousOperation)
+def test_update_participant_suspicious_permission_multiple(mock_suspicious):
+    """Test update participant raises 400 when multiple suspicious permissions are set."""
+    client = APIClient()
+    room = RoomFactory()
+    user = UserFactory()
+    UserResourceAccessFactory(
+        resource=room, user=user, role=random.choice(["administrator", "owner"])
+    )
+    client.force_authenticate(user=user)
+
+    payload = {
+        "participant_identity": str(uuid4()),
+        "permission": {
+            "can_subscribe": True,
+            "can_publish": True,
+            "can_publish_data": True,
+            "hidden": True,
+            "recorder": False,
+            "can_update_metadata": False,
+            "agent": True,
+            "can_subscribe_metrics": False,
+        },
+    }
+
+    url = reverse("rooms-update-participant", kwargs={"pk": room.id})
+    response = client.post(url, payload, format="json")
+
+    assert response.status_code == status.HTTP_400_BAD_REQUEST
+    mock_suspicious.assert_called_once_with(
+        "Setting the following participant permissions is not allowed: hidden, recorder, agent."
+    )
+
+
+@pytest.mark.parametrize("value", (False, True))
+def test_update_participant_unimplemented_can_subscribe_metrics(value):
+    """Test update participant raises 400 when can_subscribe_metrics is set."""
+    client = APIClient()
+    room = RoomFactory()
+    user = UserFactory()
+    UserResourceAccessFactory(
+        resource=room, user=user, role=random.choice(["administrator", "owner"])
+    )
+    client.force_authenticate(user=user)
+
+    payload = {
+        "participant_identity": str(uuid4()),
+        "permission": {
+            "can_subscribe": True,
+            "can_publish": True,
+            "can_publish_data": True,
+            "can_update_metadata": False,
+            "can_subscribe_metrics": value,
+        },
+    }
+
+    url = reverse("rooms-update-participant", kwargs={"pk": room.id})
+    response = client.post(url, payload, format="json")
+
+    assert response.status_code == status.HTTP_400_BAD_REQUEST
+    assert "can_subscribe_metrics" in str(response.data)
+
+
 def test_update_participant_forbidden_without_access():
     """Test update participant returns 403 when user lacks room privileges."""
     client = APIClient()
@@ -226,7 +368,17 @@ def test_update_participant_invalid_permission():
     response = client.post(url, payload, format="json")
 
     assert response.status_code == status.HTTP_400_BAD_REQUEST
-    assert "Invalid permission" in str(response.data)
+    assert response.json() == {
+        "permission": [
+            {
+                "type": "extra_forbidden",
+                "loc": ["invalid-attributes"],
+                "msg": "Extra inputs are not permitted",
+                "input": "True",
+                "url": "https://errors.pydantic.dev/2.12/v/extra_forbidden",
+            },
+        ]
+    }
 
 
 def test_update_participant_wrong_metadata_attributes():

src/backend/core/tests/rooms/test_api_rooms_start_recording.py

@@ -199,3 +199,308 @@ def test_start_recording_success(
     access = recording.accesses.first()
     assert access.user == user
     assert access.role == "owner"
+
+
+@pytest.mark.parametrize("value", ["fr", "en", "nl", "de"])
+def test_start_recording_options_language_valid(
+    settings, mock_worker_service_factory, mock_worker_manager, value
+):
+    """Should accept a valid ISO 639-1 language code."""
+    settings.RECORDING_ENABLE = True
+    room = RoomFactory()
+    user = UserFactory()
+    room.accesses.create(user=user, role="owner")
+    client = APIClient()
+    client.force_login(user)
+
+    response = client.post(
+        f"/api/v1.0/rooms/{room.id}/start-recording/",
+        {"mode": "screen_recording", "options": {"language": value}},
+        format="json",
+    )
+
+    assert response.status_code == 201
+
+    recording = Recording.objects.get(room=room)
+    assert recording.options == {"language": value}
+
+
+@pytest.mark.parametrize("value", ["invalid-value", "francais", "123"])
+def test_start_recording_options_language_not_validated(
+    settings, mock_worker_service_factory, mock_worker_manager, value
+):
+    """Invalid language codes are currently accepted — no format validation yet.
+
+    TODO: tighten this once language validation is introduced.
+    """
+    settings.RECORDING_ENABLE = True
+    room = RoomFactory()
+    user = UserFactory()
+    room.accesses.create(user=user, role="owner")
+    client = APIClient()
+    client.force_login(user)
+
+    response = client.post(
+        f"/api/v1.0/rooms/{room.id}/start-recording/",
+        {"mode": "screen_recording", "options": {"language": value}},
+        format="json",
+    )
+
+    assert response.status_code == 201
+
+
+def test_start_recording_options_language_null(
+    settings, mock_worker_service_factory, mock_worker_manager
+):
+    """Should accept null language (triggers auto-detection)."""
+    settings.RECORDING_ENABLE = True
+    room = RoomFactory()
+    user = UserFactory()
+    room.accesses.create(user=user, role="owner")
+    client = APIClient()
+    client.force_login(user)
+
+    response = client.post(
+        f"/api/v1.0/rooms/{room.id}/start-recording/",
+        {"mode": "screen_recording", "options": {"language": None}},
+        format="json",
+    )
+
+    assert response.status_code == 201
+    recording = Recording.objects.get(room=room)
+    assert recording.options == {}
+
+
+@pytest.mark.parametrize("value", [True, 1, "y", "on", "true", "yes", "t"])
+def test_start_recording_options_transcribe_valid_true(
+    settings, mock_worker_service_factory, mock_worker_manager, value
+):
+    """Should accept transcribe with any valid pydantic true values."""
+    settings.RECORDING_ENABLE = True
+    room = RoomFactory()
+    user = UserFactory()
+    room.accesses.create(user=user, role="owner")
+    client = APIClient()
+    client.force_login(user)
+
+    response = client.post(
+        f"/api/v1.0/rooms/{room.id}/start-recording/",
+        {"mode": "screen_recording", "options": {"transcribe": value}},
+        format="json",
+    )
+
+    assert response.status_code == 201
+    recording = Recording.objects.get(room=room)
+    assert recording.options == {"transcribe": True}
+
+
+@pytest.mark.parametrize("value", [False, 0, "n", "off", "false", "no", "f"])
+def test_start_recording_options_transcribe_valid_false(
+    settings, mock_worker_service_factory, mock_worker_manager, value
+):
+    """Should accept transcribe with any valid pydantic false values."""
+    settings.RECORDING_ENABLE = True
+    room = RoomFactory()
+    user = UserFactory()
+    room.accesses.create(user=user, role="owner")
+    client = APIClient()
+    client.force_login(user)
+
+    response = client.post(
+        f"/api/v1.0/rooms/{room.id}/start-recording/",
+        {"mode": "screen_recording", "options": {"transcribe": value}},
+        format="json",
+    )
+
+    assert response.status_code == 201
+    recording = Recording.objects.get(room=room)
+    assert recording.options == {"transcribe": False}
+
+
+def test_start_recording_options_transcribe_null(
+    settings, mock_worker_service_factory, mock_worker_manager
+):
+    """Should accept transcribe=null (falls back to application default)."""
+    settings.RECORDING_ENABLE = True
+    room = RoomFactory()
+    user = UserFactory()
+    room.accesses.create(user=user, role="owner")
+    client = APIClient()
+    client.force_login(user)
+
+    response = client.post(
+        f"/api/v1.0/rooms/{room.id}/start-recording/",
+        {"mode": "screen_recording", "options": {"transcribe": None}},
+        format="json",
+    )
+
+    assert response.status_code == 201
+    recording = Recording.objects.get(room=room)
+    assert recording.options == {}
+
+
+def test_start_recording_options_null(
+    settings, mock_worker_service_factory, mock_worker_manager
+):
+    """Should accept options=null."""
+    settings.RECORDING_ENABLE = True
+    room = RoomFactory()
+    user = UserFactory()
+    room.accesses.create(user=user, role="owner")
+    client = APIClient()
+    client.force_login(user)
+
+    response = client.post(
+        f"/api/v1.0/rooms/{room.id}/start-recording/",
+        {"mode": "screen_recording", "options": None},
+        format="json",
+    )
+
+    assert response.status_code == 201
+    recording = Recording.objects.get(room=room)
+    assert recording.options == {}
+
+
+def test_start_recording_options_omitted(
+    settings, mock_worker_service_factory, mock_worker_manager
+):
+    """Should accept a request with no options field at all."""
+    settings.RECORDING_ENABLE = True
+    room = RoomFactory()
+    user = UserFactory()
+    room.accesses.create(user=user, role="owner")
+    client = APIClient()
+    client.force_login(user)
+
+    response = client.post(
+        f"/api/v1.0/rooms/{room.id}/start-recording/",
+        {"mode": "screen_recording"},
+        format="json",
+    )
+
+    assert response.status_code == 201
+    recording = Recording.objects.get(room=room)
+    assert recording.options == {}
+
+
+def test_start_recording_options_unknown_field_rejected(settings):
+    """Should reject unknown fields in options (extra='forbid')."""
+    settings.RECORDING_ENABLE = True
+    room = RoomFactory()
+    user = UserFactory()
+    room.accesses.create(user=user, role="owner")
+    client = APIClient()
+    client.force_login(user)
+
+    response = client.post(
+        f"/api/v1.0/rooms/{room.id}/start-recording/",
+        {"mode": "screen_recording", "options": {"unknown_field": "value"}},
+        format="json",
+    )
+
+    assert response.status_code == 400
+
+
+@pytest.mark.parametrize("value", ["foo", 12])
+def test_start_recording_options_invalid_transcribe_type(settings, value):
+    """Should reject non-boolean transcribe values."""
+    settings.RECORDING_ENABLE = True
+    room = RoomFactory()
+    user = UserFactory()
+    room.accesses.create(user=user, role="owner")
+    client = APIClient()
+    client.force_login(user)
+
+    response = client.post(
+        f"/api/v1.0/rooms/{room.id}/start-recording/",
+        {"mode": "screen_recording", "options": {"transcribe": value}},
+        format="json",
+    )
+
+    assert response.status_code == 400
+
+
+@pytest.mark.parametrize("value", ["screen_recording", "transcript"])
+def test_start_recording_options_original_mode_valid(
+    settings, mock_worker_service_factory, mock_worker_manager, value
+):
+    """Should accept valid recording mode choices for original_mode."""
+    settings.RECORDING_ENABLE = True
+    room = RoomFactory()
+    user = UserFactory()
+    room.accesses.create(user=user, role="owner")
+    client = APIClient()
+    client.force_login(user)
+
+    response = client.post(
+        f"/api/v1.0/rooms/{room.id}/start-recording/",
+        {"mode": "screen_recording", "options": {"original_mode": value}},
+        format="json",
+    )
+
+    assert response.status_code == 201
+    recording = Recording.objects.get(room=room)
+    assert recording.options == {"original_mode": value}
+
+
+def test_start_recording_options_original_mode_null(
+    settings, mock_worker_service_factory, mock_worker_manager
+):
+    """Should accept original_mode=null."""
+    settings.RECORDING_ENABLE = True
+    room = RoomFactory()
+    user = UserFactory()
+    room.accesses.create(user=user, role="owner")
+    client = APIClient()
+    client.force_login(user)
+
+    response = client.post(
+        f"/api/v1.0/rooms/{room.id}/start-recording/",
+        {"mode": "screen_recording", "options": {"original_mode": None}},
+        format="json",
+    )
+
+    assert response.status_code == 201
+    recording = Recording.objects.get(room=room)
+    assert recording.options == {}
+
+
+def test_start_recording_options_original_mode_omitted(
+    settings, mock_worker_service_factory, mock_worker_manager
+):
+    """Should accept a request with original_mode omitted."""
+    settings.RECORDING_ENABLE = True
+    room = RoomFactory()
+    user = UserFactory()
+    room.accesses.create(user=user, role="owner")
+    client = APIClient()
+    client.force_login(user)
+
+    response = client.post(
+        f"/api/v1.0/rooms/{room.id}/start-recording/",
+        {"mode": "screen_recording", "options": {}},
+        format="json",
+    )
+
+    assert response.status_code == 201
+    recording = Recording.objects.get(room=room)
+    assert recording.options == {}
+
+
+@pytest.mark.parametrize("value", ["invalid_mode", "foo", 123, "SCREEN_RECORDING"])
+def test_start_recording_options_original_mode_invalid(settings, value):
+    """Should reject invalid recording mode values for original_mode."""
+    settings.RECORDING_ENABLE = True
+    room = RoomFactory()
+    user = UserFactory()
+    room.accesses.create(user=user, role="owner")
+    client = APIClient()
+    client.force_login(user)
+
+    response = client.post(
+        f"/api/v1.0/rooms/{room.id}/start-recording/",
+        {"mode": "screen_recording", "options": {"original_mode": value}},
+        format="json",
+    )
+
+    assert response.status_code == 400

src/backend/core/tests/test_external_api_rooms.py

@@ -55,9 +55,8 @@ def test_api_rooms_list_requires_authentication():
     assert response.status_code == 401
 
 
-def test_api_rooms_list_inactive_user(settings):
+def test_api_rooms_list_inactive_user():
     """List should return 401 if user is inactive."""
-    settings.APPLICATION_JWT_SECRET_KEY = "devKey"
 
     user1 = UserFactory(is_active=False)
     RoomFactory(users=[(user1, RoleChoices.OWNER)])
@@ -72,11 +71,9 @@ def test_api_rooms_list_inactive_user(settings):
     assert "user account is disabled" in str(response.data).lower()
 
 
-def test_api_rooms_list_with_valid_token(settings):
+def test_api_rooms_list_with_valid_token():
     """Listing rooms with valid token should succeed."""
 
-    settings.APPLICATION_JWT_SECRET_KEY = "devKey"
-
     user = UserFactory()
     room = RoomFactory(users=[(user, RoleChoices.OWNER)])
 
@@ -92,9 +89,8 @@ def test_api_rooms_list_with_valid_token(settings):
     assert response.data["results"][0]["id"] == str(room.id)
 
 
-def test_api_rooms_list_with_no_rooms(settings):
+def test_api_rooms_list_with_no_rooms():
     """Listing rooms with a valid token returns an empty list when there are no rooms."""
-    settings.APPLICATION_JWT_SECRET_KEY = "devKey"
 
     user = UserFactory()
 
@@ -112,7 +108,6 @@ def test_api_rooms_list_with_no_rooms(settings):
 
 def test_api_rooms_list_with_expired_token(settings):
     """Listing rooms with expired token should return 401."""
-    settings.APPLICATION_JWT_SECRET_KEY = "devKey"
     settings.APPLICATION_JWT_EXPIRATION_SECONDS = 0
 
     user = UserFactory()
@@ -153,9 +148,8 @@ def test_api_rooms_list_with_invalid_rs_token(settings):
     assert response.status_code == 400
 
 
-def test_api_rooms_list_missing_scope(settings):
+def test_api_rooms_list_missing_scope():
     """Listing rooms without required scope should return 403."""
-    settings.APPLICATION_JWT_SECRET_KEY = "devKey"
 
     user = UserFactory()
 
@@ -173,9 +167,8 @@ def test_api_rooms_list_missing_scope(settings):
     )
 
 
-def test_api_rooms_list_no_scope(settings):
+def test_api_rooms_list_no_scope():
     """Listing rooms without any scope should return 403."""
-    settings.APPLICATION_JWT_SECRET_KEY = "devKey"
 
     user = UserFactory()
 
@@ -190,9 +183,8 @@ def test_api_rooms_list_no_scope(settings):
     assert "insufficient permissions." in str(response.data).lower()
 
 
-def test_api_rooms_list_filters_by_user(settings):
+def test_api_rooms_list_filters_by_user():
     """List should only return rooms accessible to the authenticated user."""
-    settings.APPLICATION_JWT_SECRET_KEY = "devKey"
 
     user1 = UserFactory()
     user2 = UserFactory()
@@ -217,11 +209,9 @@ def test_api_rooms_list_filters_by_user(settings):
     assert str(room2.id) not in returned_ids
 
 
-def test_api_rooms_retrieve_requires_authentication(settings):
+def test_api_rooms_retrieve_requires_authentication():
     """Retrieving rooms without authentication should return 401."""
 
-    settings.APPLICATION_JWT_SECRET_KEY = "devKey"
-
     user1 = UserFactory()
     room1 = RoomFactory(users=[(user1, RoleChoices.OWNER)])
 
@@ -231,9 +221,8 @@ def test_api_rooms_retrieve_requires_authentication(settings):
     assert response.status_code == 401
 
 
-def test_api_rooms_retrieve_inactive_user(settings):
+def test_api_rooms_retrieve_inactive_user():
     """Retrieve should return 401 if user is inactive."""
-    settings.APPLICATION_JWT_SECRET_KEY = "devKey"
 
     user1 = UserFactory(is_active=False)
     room1 = RoomFactory(users=[(user1, RoleChoices.OWNER)])
@@ -250,7 +239,6 @@ def test_api_rooms_retrieve_inactive_user(settings):
 
 def test_api_rooms_retrieve_with_expired_token(settings):
     """Retrieving rooms with expired token should return 401."""
-    settings.APPLICATION_JWT_SECRET_KEY = "devKey"
     settings.APPLICATION_JWT_EXPIRATION_SECONDS = 0
 
     user = UserFactory()
@@ -295,9 +283,8 @@ def test_api_rooms_retrieve_with_invalid_rs_token(settings):
     assert response.status_code == 400
 
 
-def test_api_rooms_retrieve_requires_scope(settings):
+def test_api_rooms_retrieve_requires_scope():
     """Retrieving a room requires ROOMS_RETRIEVE scope."""
-    settings.APPLICATION_JWT_SECRET_KEY = "devKey"
 
     user = UserFactory()
     room = RoomFactory(users=[(user, RoleChoices.OWNER)])
@@ -315,9 +302,8 @@ def test_api_rooms_retrieve_requires_scope(settings):
     )
 
 
-def test_api_rooms_retrieve_no_scope(settings):
+def test_api_rooms_retrieve_no_scope():
     """Retrieving rooms without any scope should return 403."""
-    settings.APPLICATION_JWT_SECRET_KEY = "devKey"
 
     user = UserFactory()
 
@@ -335,7 +321,6 @@ def test_api_rooms_retrieve_no_scope(settings):
 
 def test_api_rooms_retrieve_success(settings):
     """Retrieving a room with correct scope should succeed."""
-    settings.APPLICATION_JWT_SECRET_KEY = "devKey"
     settings.APPLICATION_BASE_URL = "http://your-application.com"
     settings.ROOM_TELEPHONY_ENABLED = True
     settings.ROOM_TELEPHONY_PHONE_NUMBER = "+1-555-0100"
@@ -367,9 +352,8 @@ def test_api_rooms_retrieve_success(settings):
     }
 
 
-def test_api_rooms_retrieve_success_by_user(settings):
+def test_api_rooms_retrieve_success_by_user():
     """Retrieve should only return rooms accessible to the authenticated user."""
-    settings.APPLICATION_JWT_SECRET_KEY = "devKey"
 
     user1 = UserFactory()
     user2 = UserFactory()
@@ -408,9 +392,8 @@ def test_api_rooms_retrieve_success_by_user(settings):
     assert response.status_code == 200
 
 
-def test_api_rooms_retrieve_not_found(settings):
+def test_api_rooms_retrieve_not_found():
     """Retrieving a non-existing room with correct scope should return a 404."""
-    settings.APPLICATION_JWT_SECRET_KEY = "devKey"
 
     user = UserFactory()
     token = generate_test_token(user, [ApplicationScope.ROOMS_RETRIEVE])
@@ -423,11 +406,9 @@ def test_api_rooms_retrieve_not_found(settings):
     assert "no room matches the given query." in str(response.data).lower()
 
 
-def test_api_rooms_create_requires_authentication(settings):
+def test_api_rooms_create_requires_authentication():
     """Creating rooms without authentication should return 401."""
 
-    settings.APPLICATION_JWT_SECRET_KEY = "devKey"
-
     client = APIClient()
     response = client.post("/external-api/v1.0/rooms/")
 
@@ -436,7 +417,6 @@ def test_api_rooms_create_requires_authentication(settings):
 
 def test_api_rooms_create_with_expired_token(settings):
     """Creating rooms with expired token should return 401."""
-    settings.APPLICATION_JWT_SECRET_KEY = "devKey"
     settings.APPLICATION_JWT_EXPIRATION_SECONDS = 0
 
     user = UserFactory()
@@ -477,9 +457,8 @@ def test_api_rooms_create_with_invalid_rs_token(settings):
     assert response.status_code == 400
 
 
-def test_api_rooms_create_inactive_user(settings):
+def test_api_rooms_create_inactive_user():
     """Create should return 401 if user is inactive."""
-    settings.APPLICATION_JWT_SECRET_KEY = "devKey"
 
     user1 = UserFactory(is_active=False)
 
@@ -493,9 +472,8 @@ def test_api_rooms_create_inactive_user(settings):
     assert "user account is disabled" in str(response.data).lower()
 
 
-def test_api_rooms_create_requires_scope(settings):
+def test_api_rooms_create_requires_scope():
     """Creating a room requires ROOMS_CREATE scope."""
-    settings.APPLICATION_JWT_SECRET_KEY = "devKey"
     user = UserFactory()
 
     # Token without ROOMS_CREATE scope
@@ -512,9 +490,8 @@ def test_api_rooms_create_requires_scope(settings):
     )
 
 
-def test_api_rooms_create_no_scope(settings):
+def test_api_rooms_create_no_scope():
     """Creating rooms without any scope should return 403."""
-    settings.APPLICATION_JWT_SECRET_KEY = "devKey"
 
     user = UserFactory()
 
@@ -529,9 +506,8 @@ def test_api_rooms_create_no_scope(settings):
     assert "insufficient permissions." in str(response.data).lower()
 
 
-def test_api_rooms_create_success(settings):
+def test_api_rooms_create_success():
     """Creating a room with correct scope should succeed."""
-    settings.APPLICATION_JWT_SECRET_KEY = "devKey"
 
     user = UserFactory()
 
@@ -555,9 +531,8 @@ def test_api_rooms_create_success(settings):
     assert room.access_level == "trusted"
 
 
-def test_api_rooms_create_readonly_enforcement(settings):
+def test_api_rooms_create_readonly_enforcement():
     """Creating a room succeeds and any provided read-only fields are ignored."""
-    settings.APPLICATION_JWT_SECRET_KEY = "devKey"
 
     user = UserFactory()
 
@@ -590,9 +565,8 @@ def test_api_rooms_create_readonly_enforcement(settings):
     assert room.access_level == "trusted"
 
 
-def test_api_rooms_unknown_actions(settings):
+def test_api_rooms_unknown_actions():
     """Updating or deleting a room are not supported yet."""
-    settings.APPLICATION_JWT_SECRET_KEY = "devKey"
 
     user = UserFactory()
     room = RoomFactory(users=[(user, RoleChoices.OWNER)])
@@ -623,7 +597,6 @@ def test_api_rooms_unknown_actions(settings):
 
 def test_api_rooms_response_no_url(settings):
     """Response should not include url field when APPLICATION_BASE_URL is None."""
-    settings.APPLICATION_JWT_SECRET_KEY = "devKey"
     settings.APPLICATION_BASE_URL = None
 
     user = UserFactory()
@@ -642,7 +615,6 @@ def test_api_rooms_response_no_url(settings):
 
 def test_api_rooms_response_no_telephony(settings):
     """Response should not include telephony field when ROOM_TELEPHONY_ENABLED is False."""
-    settings.APPLICATION_JWT_SECRET_KEY = "devKey"
     settings.ROOM_TELEPHONY_ENABLED = False
 
     user = UserFactory()
@@ -661,7 +633,6 @@ def test_api_rooms_response_no_telephony(settings):
 
 def test_api_rooms_token_scope_case_insensitive(settings):
     """Token's scope should be case-insensitive."""
-    settings.APPLICATION_JWT_SECRET_KEY = "devKey"
     user = UserFactory()
     application = ApplicationFactory()
 
@@ -693,7 +664,6 @@ def test_api_rooms_token_scope_case_insensitive(settings):
 
 def test_api_rooms_token_without_delegated_flag(settings):
     """Token without delegated flag should be rejected."""
-    settings.APPLICATION_JWT_SECRET_KEY = "devKey"
     user = UserFactory()
     application = ApplicationFactory()
 
@@ -726,7 +696,6 @@ def test_api_rooms_token_without_delegated_flag(settings):
 @mock.patch.object(ResourceServerAuthentication, "authenticate", return_value=None)
 def test_api_rooms_token_invalid_signature(mock_rs_authenticate, settings):
     """Token signed with an invalid key should defer to the next authentication."""
-    settings.APPLICATION_JWT_SECRET_KEY = "devKey"
     user = UserFactory()
     application = ApplicationFactory()
 
@@ -759,7 +728,6 @@ def test_api_rooms_token_invalid_signature(mock_rs_authenticate, settings):
 @mock.patch.object(ResourceServerAuthentication, "authenticate", return_value=None)
 def test_api_rooms_token_invalid_alg(mock_rs_authenticate, settings):
     """Token signed with an invalid alg should defer to the next authentication."""
-    settings.APPLICATION_JWT_SECRET_KEY = "devKey"
     settings.APPLICATION_JWT_ALG = "RS256"
     user = UserFactory()
 
@@ -791,7 +759,6 @@ def test_api_rooms_token_invalid_alg(mock_rs_authenticate, settings):
 
 def test_api_rooms_token_missing_client_id(settings):
     """Token without client_id should be rejected."""
-    settings.APPLICATION_JWT_SECRET_KEY = "devKey"
     user = UserFactory()
 
     now = datetime.now(timezone.utc)
@@ -821,7 +788,6 @@ def test_api_rooms_token_missing_client_id(settings):
 
 def test_api_rooms_token_missing_user_id(settings):
     """Token without user_id should be rejected."""
-    settings.APPLICATION_JWT_SECRET_KEY = "devKey"
     application = ApplicationFactory()
 
     now = datetime.now(timezone.utc)
@@ -851,7 +817,6 @@ def test_api_rooms_token_missing_user_id(settings):
 
 def test_api_rooms_token_invalid_audience(settings):
     """Token with an invalid audience should be rejected."""
-    settings.APPLICATION_JWT_SECRET_KEY = "devKey"
     user = UserFactory()
     application = ApplicationFactory()
 
@@ -882,7 +847,6 @@ def test_api_rooms_token_invalid_audience(settings):
 
 def test_api_rooms_token_unknown_user(settings):
     """Token for unknown user should be rejected."""
-    settings.APPLICATION_JWT_SECRET_KEY = "devKey"
     application = ApplicationFactory()
 
     now = datetime.now(timezone.utc)
@@ -912,7 +876,6 @@ def test_api_rooms_token_unknown_user(settings):
 
 def test_api_rooms_token_unknown_application(settings):
     """Token for unknown application should be rejected."""
-    settings.APPLICATION_JWT_SECRET_KEY = "devKey"
 
     now = datetime.now(timezone.utc)
     payload = {
@@ -941,7 +904,6 @@ def test_api_rooms_token_unknown_application(settings):
 
 def test_api_rooms_token_inactive_application(settings):
     """Token for inactive application should be rejected."""
-    settings.APPLICATION_JWT_SECRET_KEY = "devKey"
     application = ApplicationFactory(active=False)
 
     now = datetime.now(timezone.utc)

src/backend/core/tests/test_external_api_token.py

@@ -21,7 +21,6 @@ pytestmark = pytest.mark.django_db
 
 def test_api_applications_generate_token_success(settings):
     """Valid credentials should return a JWT token."""
-    settings.APPLICATION_JWT_SECRET_KEY = "devKey"
     UserFactory(email="User.Family@example.com")
     application = ApplicationFactory(
         active=True,
@@ -173,9 +172,8 @@ def test_api_applications_generate_token_domain_not_authorized():
     assert "not authorized for this email domain" in str(response.data)
 
 
-def test_api_applications_generate_token_domain_authorized(settings):
+def test_api_applications_generate_token_domain_authorized():
     """Application with domain authorization should succeed."""
-    settings.APPLICATION_JWT_SECRET_KEY = "devKey"
     user = UserFactory(email="user@allowed.com")
     application = ApplicationFactory(
         active=True,
@@ -230,7 +228,6 @@ def test_api_applications_generate_token_user_not_found():
 @freeze_time("2023-01-15 12:00:00")
 def test_api_applications_token_payload_structure(settings):
     """Generated token should have correct payload structure."""
-    settings.APPLICATION_JWT_SECRET_KEY = "devKey"
     user = UserFactory(email="user@example.com")
 
     application = ApplicationFactory(
@@ -280,7 +277,6 @@ def test_api_applications_token_payload_structure(settings):
 def test_api_applications_token_new_user(settings):
     """Should create a new pending user when creation is allowed and user doesn't exist."""
 
-    settings.APPLICATION_JWT_SECRET_KEY = "devKey"
     settings.APPLICATION_ALLOW_USER_CREATION = True
     settings.OIDC_FALLBACK_TO_EMAIL_FOR_IDENTIFICATION = True
     settings.OIDC_USER_SUB_FIELD_IMMUTABLE = False
@@ -337,7 +333,6 @@ def test_api_applications_token_new_user(settings):
 def test_api_applications_token_existing_user(settings):
     """Application should not create a new user when user exist."""
 
-    settings.APPLICATION_JWT_SECRET_KEY = "devKey"
     user = UserFactory(email="user@example.com")
 
     settings.APPLICATION_ALLOW_USER_CREATION = True

src/backend/meet/settings.py

@@ -596,6 +596,12 @@ class Base(Configuration):
     ALLOW_UNREGISTERED_ROOMS = values.BooleanValue(
         True, environ_name="ALLOW_UNREGISTERED_ROOMS", environ_prefix=None
     )
+    # if provided, treat as suspicious (possible privilege escalation attempt).
+    PARTICIPANT_FORBIDDEN_PERMISSION_FIELDS = values.ListValue(
+        ["hidden", "recorder", "agent"],
+        environ_name="PARTICIPANT_FORBIDDEN_PERMISSION_FIELDS",
+        environ_prefix=None,
+    )
 
     # Recording settings
     RECORDING_ENABLE = values.BooleanValue(
@@ -667,7 +673,7 @@ class Base(Configuration):
         [],
         environ_name="BREVO_API_CONTACT_LIST_IDS",
         environ_prefix=None,
-        converter=lambda x: int(x),  # pylint: disable=unnecessary-lambda
+        converter=int,
     )
     BREVO_API_CONTACT_ATTRIBUTES = values.DictValue({"VISIO_USER": True})
     BREVO_API_TIMEOUT = values.PositiveIntegerValue(
@@ -917,6 +923,9 @@ class Test(Base):
     USE_SWAGGER = True
     EXTERNAL_API_ENABLED = True
 
+    APPLICATION_JWT_SECRET_KEY = "devKey"  # noqa:S105
+    APPLICATION_JWT_AUDIENCE = "Test inc."
+
     CELERY_TASK_ALWAYS_EAGER = values.BooleanValue(True)
 
     def __init__(self):

src/backend/pyproject.toml

@@ -7,7 +7,7 @@ build-backend = "setuptools.build_meta"
 
 [project]
 name = "meet"
-version = "1.6.0"
+version = "1.9.0"
 authors = [{ "name" = "DINUM", "email" = "dev@mail.numerique.gouv.fr" }]
 classifiers = [
     "Development Status :: 5 - Production/Stable",
@@ -17,46 +17,48 @@ classifiers = [
     "License :: OSI Approved :: MIT License",
     "Natural Language :: English",
     "Programming Language :: Python :: 3",
-    "Programming Language :: Python :: 3.10",
+    "Programming Language :: Python :: 3.13",
 ]
 description = "A simple video and phone conferencing tool, powered by LiveKit"
 keywords = ["Django", "Contacts", "Templates", "RBAC"]
 license = { file = "LICENSE" }
 readme = "README.md"
-requires-python = ">=3.10"
+requires-python = ">=3.13"
 dependencies = [
-    "boto3==1.40.69",
+    "boto3==1.42.49",
     "Brotli==1.2.0",
     "brevo-python==1.2.0",
-    "celery[redis]==5.5.3",
+    "celery[redis]==5.6.2",
     "dj-database-url==3.1.0",
     "django-configurations==2.5.1",
     "django-cors-headers==4.9.0",
-    "django-countries==8.0.0",
-    "django-lasuite[all]==0.0.19",
+    "django-countries==8.2.0",
+    "django-lasuite[all]==0.0.24",
     "django-parler==2.3",
     "redis==5.2.1",
     "django-redis==6.0.0",
     "django-storages[s3]==1.14.6",
     "django-timezone-field>=5.1",
+    "django-pydantic-field==0.5.4",
     "django==5.2.11",
     "djangorestframework==3.16.1",
     "drf_spectacular==0.29.0",
-    "dockerflow==2024.4.2",
+    "dockerflow==2026.1.26",
     "easy_thumbnails==2.10.1",
     "factory_boy==3.3.3",
-    "gunicorn==23.0.0",
-    "jsonschema==4.25.1",
-    "markdown==3.10",
+    "gunicorn==25.1.0",
+    "jsonschema==4.26.0",
+    "markdown==3.10.2",
     "nested-multipart-parser==1.6.0",
-    "psycopg[binary]==3.2.12",
-    "PyJWT==2.10.1",
+    "psycopg[binary]==3.3.2",
+    "pydantic==2.12.4",
+    "PyJWT==2.11.0",
     "python-frontmatter==1.1.0",
     "requests==2.32.5",
-    "sentry-sdk==2.43.0",
+    "sentry-sdk==2.53.0",
     "whitenoise==6.11.0",
-    "mozilla-django-oidc==4.0.1",
-    "livekit-api==1.0.7",
+    "mozilla-django-oidc==5.0.2",
+    "livekit-api==1.1.0",
     "aiohttp==3.13.3",
 ]
 
@@ -69,21 +71,21 @@ dependencies = [
 [project.optional-dependencies]
 dev = [
     "django-extensions==4.1",
-    "drf-spectacular-sidecar==2025.10.1",
+    "drf-spectacular-sidecar==2026.1.1",
     "freezegun==1.5.5",
     "ipdb==0.13.13",
-    "ipython==9.7.0",
-    "pyfakefs==5.10.2",
-    "pylint-django==2.6.1",
+    "ipython==9.10.0",
+    "pyfakefs==6.1.1",
+    "pylint-django==2.7.0",
     "pylint<4.0.0",
     "pytest-cov==7.0.0",
-    "pytest-django==4.11.1",
-    "pytest==9.0.0",
+    "pytest-django==4.12.0",
+    "pytest==9.0.2",
     "pytest-icdiff==0.9",
     "pytest-xdist==3.8.0",
     "responses==0.25.8",
-    "ruff==0.14.4",
-    "types-requests==2.32.4.20250913",
+    "ruff==0.15.1",
+    "types-requests==2.32.4.20260107",
 ]
 
 [tool.setuptools]

src/frontend/Dockerfile

@@ -43,7 +43,8 @@ RUN apk update && apk upgrade libssl3 \
     libxml2>=2.12.7-r2 \
     libxslt>=1.1.39-r2 \
     libexpat>=2.7.2-r0 \
-    libpng>=1.6.53-r0
+    libpng>=1.6.53-r0 \
+    && apk del curl
 
 USER nginx
 

src/frontend/default.conf

@@ -5,6 +5,12 @@ server {
 
   root /usr/share/nginx/html;
 
+  location = /.well-known/windows-app-web-link {
+      default_type application/json;
+      alias /usr/share/nginx/html/.well-known/windows-app-web-link;
+      add_header Content-Disposition "attachment; filename=windows-app-web-link";
+  }
+
   # Serve static files with caching
   location ~* ^/assets/.*\.(css|js|json|png|jpg|jpeg|gif|ico|svg|woff|woff2|ttf|eot)$ {
       expires 30d;

src/frontend/package.json

@@ -1,7 +1,7 @@
 {
   "name": "meet",
   "private": true,
-  "version": "1.6.0",
+  "version": "1.9.0",
   "type": "module",
   "scripts": {
     "dev": "panda codegen && vite",
@@ -13,56 +13,56 @@
     "check": "prettier --check ./src"
   },
   "dependencies": {
-    "@fontsource-variable/material-symbols-outlined": "5.2.30",
+    "@fontsource-variable/material-symbols-outlined": "5.2.34",
     "@fontsource/material-icons-outlined": "5.2.6",
-    "@livekit/components-react": "2.9.13",
-    "@livekit/components-styles": "1.1.6",
-    "@livekit/track-processors": "0.6.1",
-    "@pandacss/preset-panda": "0.54.0",
-    "@react-aria/toast": "3.0.5",
-    "@react-types/overlays": "3.9.0",
+    "@livekit/components-react": "2.9.19",
+    "@livekit/components-styles": "1.2.0",
+    "@livekit/track-processors": "0.7.0",
+    "@pandacss/preset-panda": "1.8.2",
+    "@react-aria/toast": "3.0.10",
+    "@react-types/overlays": "3.9.3",
     "@remixicon/react": "4.6.0",
-    "@tanstack/react-query": "5.81.5",
+    "@tanstack/react-query": "5.90.21",
     "@timephy/rnnoise-wasm": "1.0.0",
-    "crisp-sdk-web": "1.0.25",
+    "crisp-sdk-web": "1.0.27",
     "derive-valtio": "0.2.0",
     "hoofd": "1.7.3",
-    "humanize-duration": "3.33.0",
-    "i18next": "25.3.1",
-    "i18next-browser-languagedetector": "8.2.0",
+    "humanize-duration": "3.33.2",
+    "i18next": "25.8.8",
+    "i18next-browser-languagedetector": "8.2.1",
     "i18next-parser": "9.3.0",
     "i18next-resources-to-backend": "1.2.1",
     "libphonenumber-js": "1.12.10",
-    "livekit-client": "2.15.7",
-    "posthog-js": "1.256.2",
+    "livekit-client": "2.17.1",
+    "posthog-js": "1.342.1",
     "react": "18.3.1",
-    "react-aria-components": "1.10.1",
+    "react-aria-components": "1.14.0",
     "react-dom": "18.3.1",
     "react-i18next": "15.1.1",
     "use-sound": "5.0.0",
-    "valtio": "2.1.5",
-    "wouter": "3.7.1"
+    "valtio": "2.3.0",
+    "wouter": "3.9.0"
   },
   "devDependencies": {
-    "@pandacss/dev": "0.54.0",
-    "@tanstack/eslint-plugin-query": "5.81.2",
-    "@tanstack/react-query-devtools": "5.81.5",
+    "@pandacss/dev": "1.8.2",
+    "@tanstack/eslint-plugin-query": "5.91.4",
+    "@tanstack/react-query-devtools": "5.91.3",
     "@types/humanize-duration": "3.27.4",
     "@types/node": "22.16.0",
     "@types/react": "18.3.12",
     "@types/react-dom": "18.3.1",
     "@typescript-eslint/eslint-plugin": "8.35.1",
     "@typescript-eslint/parser": "8.35.1",
-    "@vitejs/plugin-react": "4.6.0",
+    "@vitejs/plugin-react": "5.1.4",
     "eslint": "8.57.0",
     "eslint-config-prettier": "10.1.5",
     "eslint-plugin-jsx-a11y": "6.10.2",
     "eslint-plugin-react-hooks": "5.2.0",
     "eslint-plugin-react-refresh": "0.4.20",
     "postcss": "8.5.6",
-    "prettier": "3.6.2",
+    "prettier": "3.8.1",
     "typescript": "5.8.3",
-    "vite": "7.0.8",
-    "vite-tsconfig-paths": "5.1.4"
+    "vite": "7.3.1",
+    "vite-tsconfig-paths": "6.1.1"
   }
 }

src/frontend/public/.well-known/windows-app-web-link

@@ -0,0 +1,6 @@
+[
+{
+  "packageFamilyName" : "Visio_g3z6ba6vek6vg",
+  "paths" : [ "*" ]
+}
+]

src/frontend/src/features/home/components/IntroSlider.tsx

@@ -4,6 +4,7 @@ import { Button } from '@/primitives'
 import { RiArrowLeftSLine, RiArrowRightSLine } from '@remixicon/react'
 import { useState } from 'react'
 import { useTranslation } from 'react-i18next'
+import { useScreenReaderAnnounce } from '@/hooks/useScreenReaderAnnounce'
 
 const Heading = styled('h2', {
   base: {
@@ -144,6 +145,21 @@ type Slide = {
   isAvailableInBeta?: boolean
 }
 
+const carouselNavButton = css({
+  _focusVisible: {
+    outline: '2px solid var(--colors-focus-ring) !important',
+    outlineOffset: '1px',
+  },
+  _disabled: {
+    color: 'greyscale.400',
+    cursor: 'default',
+    pointerEvents: 'none',
+    _pressed: {
+      backgroundColor: 'transparent',
+    },
+  },
+})
+
 // todo - optimize how images are imported
 const SLIDES: Slide[] = [
   {
@@ -163,11 +179,45 @@ const SLIDES: Slide[] = [
 export const IntroSlider = () => {
   const [slideIndex, setSlideIndex] = useState(0)
   const { t } = useTranslation('home', { keyPrefix: 'introSlider' })
+  const announce = useScreenReaderAnnounce()
 
   const NUMBER_SLIDES = SLIDES.length
 
+  const goPrev = () => {
+    if (slideIndex === 0) return
+    const newIndex = slideIndex - 1
+    setSlideIndex(newIndex)
+    announce(
+      t('slidePosition', { current: newIndex + 1, total: NUMBER_SLIDES }),
+      'polite',
+      'global'
+    )
+  }
+
+  const goNext = () => {
+    if (slideIndex === NUMBER_SLIDES - 1) return
+    const newIndex = slideIndex + 1
+    setSlideIndex(newIndex)
+    announce(
+      t('slidePosition', { current: newIndex + 1, total: NUMBER_SLIDES }),
+      'polite',
+      'global'
+    )
+  }
+
+  const ariaLabelParams = {
+    current: slideIndex + 1,
+    total: NUMBER_SLIDES,
+  }
+  const previousAriaLabel = t('previous.labelWithPosition', ariaLabelParams)
+  const nextAriaLabel = t('next.labelWithPosition', ariaLabelParams)
+
   return (
-    <Container>
+    <Container
+      role="region"
+      aria-roledescription="carousel"
+      aria-label={t('carouselLabel')}
+    >
       <div
         className={css({
           display: 'flex',
@@ -180,10 +230,10 @@ export const IntroSlider = () => {
             <Button
               variant="secondaryText"
               square
-              aria-label={t('previous.label')}
-              tooltip={t('previous.tooltip')}
-              onPress={() => setSlideIndex(slideIndex - 1)}
-              isDisabled={slideIndex == 0}
+              className={carouselNavButton}
+              aria-label={previousAriaLabel}
+              aria-disabled={slideIndex === 0}
+              onPress={goPrev}
             >
               <RiArrowLeftSLine />
             </Button>
@@ -191,7 +241,11 @@ export const IntroSlider = () => {
         </ButtonContainer>
         <SlideContainer>
           {SLIDES.map((slide, index) => (
-            <Slide visible={index == slideIndex} key={index}>
+            <Slide
+              aria-hidden={index !== slideIndex}
+              visible={index === slideIndex}
+              key={index}
+            >
               <Image src={slide.src} alt="" role="presentation" />
               <TextAnimation visible={index == slideIndex}>
                 <Heading>{t(`${slide.key}.title`)}</Heading>
@@ -205,10 +259,10 @@ export const IntroSlider = () => {
             <Button
               variant="secondaryText"
               square
-              aria-label={t('next.label')}
-              tooltip={t('next.tooltip')}
-              onPress={() => setSlideIndex(slideIndex + 1)}
-              isDisabled={slideIndex == NUMBER_SLIDES - 1}
+              className={carouselNavButton}
+              aria-label={nextAriaLabel}
+              aria-disabled={slideIndex === NUMBER_SLIDES - 1}
+              onPress={goNext}
             >
               <RiArrowRightSLine />
             </Button>

src/frontend/src/features/home/components/JoinMeetingDialog.tsx

@@ -5,37 +5,42 @@ import { isRoomValid } from '@/features/rooms'
 
 export const JoinMeetingDialog = () => {
   const { t } = useTranslation('home')
+
+  const handleSubmit = (data: { roomId?: FormDataEntryValue }) => {
+    const roomId = (data.roomId as string)
+      .trim()
+      .replace(`${window.location.origin}/`, '')
+    navigateTo('room', roomId)
+  }
+
+  const validateRoomId = (value: string) => {
+    const trimmed = value.trim()
+    if (!trimmed) return null
+    return !isRoomValid(trimmed) ? (
+      <>
+        <p>{t('joinInputError')}</p>
+        <Ul>
+          <li>{window.location.origin}/uio-azer-jkl</li>
+          <li>uio-azer-jkl</li>
+        </Ul>
+      </>
+    ) : null
+  }
+
   return (
     <Dialog title={t('joinMeeting')}>
-      <Form
-        onSubmit={(data) => {
-          navigateTo(
-            'room',
-            (data.roomId as string)
-              .trim()
-              .replace(`${window.location.origin}/`, '')
-          )
-        }}
-        submitLabel={t('joinInputSubmit')}
-      >
+      <Form onSubmit={handleSubmit} submitLabel={t('joinInputSubmit')}>
+        {/* eslint-disable jsx-a11y/no-autofocus -- Focus on input when modal opens, required for accessibility */}
         <Field
           type="text"
+          autoFocus
+          isRequired
           name="roomId"
           label={t('joinInputLabel')}
           description={t('joinInputExample', {
             example: window.origin + '/azer-tyu-qsdf',
           })}
-          validate={(value) => {
-            return !isRoomValid(value.trim()) ? (
-              <>
-                <p>{t('joinInputError')}</p>
-                <Ul>
-                  <li>{window.location.origin}/uio-azer-jkl</li>
-                  <li>uio-azer-jkl</li>
-                </Ul>
-              </>
-            ) : null
-          }}
+          validate={validateRoomId}
         />
       </Form>
       <H lvl={2}>{t('joinMeetingTipHeading')}</H>

src/frontend/src/features/rooms/components/InviteDialog.tsx

@@ -65,7 +65,7 @@ export const InviteDialog = (props: Omit<DialogProps, 'title'>) => {
           alignItems="left"
           justify="start"
           gap={0}
-          style={{ maxWidth: '100%', overflow: 'hidden' }}
+          style={{ maxWidth: '100%', overflow: 'visible' }}
         >
           <Heading slot="title" level={2} className={text({ variant: 'h2' })}>
             {t('heading')}
@@ -93,7 +93,7 @@ export const InviteDialog = (props: Omit<DialogProps, 'title'>) => {
                 flexDirection: 'column',
                 marginTop: '0.5rem',
                 gap: '1rem',
-                overflow: 'hidden',
+                overflow: 'visible',
               })}
             >
               <div

src/frontend/src/features/rooms/components/Join.tsx

@@ -753,7 +753,7 @@ export const Join = ({
                     try {
                       saveVideoInputDeviceId(id)
                       if (videoTrack) {
-                        await await videoTrack.setDeviceId({ exact: id })
+                        await videoTrack.setDeviceId({ exact: id })
                       }
                     } catch (err) {
                       console.error('Failed to switch camera device', err)

src/frontend/src/features/rooms/components/Rating.tsx

@@ -4,7 +4,7 @@ import { cva } from '@/styled-system/css'
 import { useTranslation } from 'react-i18next'
 import { styled, VStack } from '@/styled-system/jsx'
 import { usePostHog } from 'posthog-js/react'
-import { PostHog } from 'posthog-js'
+import type { PostHog } from 'posthog-js'
 import { Button as RACButton } from 'react-aria-components'
 import { useIsAnalyticsEnabled } from '@/features/analytics/hooks/useIsAnalyticsEnabled'
 

src/frontend/src/features/rooms/hooks/useWaitingParticipants.ts

@@ -74,13 +74,17 @@ export const useWaitingParticipants = () => {
   ): Promise<void> => {
     try {
       setListEnabled(false)
-      for (const participant of waitingParticipants) {
-        await enterRoom({
-          roomId: roomId,
-          allowEntry,
-          participantId: participant.id,
-        })
-      }
+
+      await Promise.all(
+        waitingParticipants.map((participant) =>
+          enterRoom({
+            roomId: roomId,
+            allowEntry,
+            participantId: participant.id,
+          })
+        )
+      )
+
       await refetchWaiting()
     } catch (e) {
       console.error(e)

src/frontend/src/features/rooms/livekit/components/IsIdleDisconnectModal.tsx

@@ -13,7 +13,7 @@ import { useSettingsDialog } from '@/features/settings/hook/useSettingsDialog'
 import { SettingsDialogExtendedKey } from '@/features/settings/type'
 
 const IDLE_DISCONNECT_TIMEOUT_MS = 120000 // 2 minutes
-const COUNTDOWN_ANNOUNCEMENT_SECONDS = [90, 60, 30]
+const COUNTDOWN_ANNOUNCEMENT_SECONDS = new Set([90, 60, 30])
 const FINAL_COUNTDOWN_SECONDS = 10
 
 export const IsIdleDisconnectModal = () => {
@@ -58,7 +58,7 @@ export const IsIdleDisconnectModal = () => {
     if (!connectionObserverSnap.isIdleDisconnectModalOpen) return
 
     const shouldAnnounce =
-      COUNTDOWN_ANNOUNCEMENT_SECONDS.includes(remainingSeconds) ||
+      COUNTDOWN_ANNOUNCEMENT_SECONDS.has(remainingSeconds) ||
       remainingSeconds <= FINAL_COUNTDOWN_SECONDS
 
     if (shouldAnnounce && remainingSeconds !== lastAnnouncementRef.current) {

src/frontend/src/features/rooms/livekit/components/KeyboardShortcutHint.tsx

@@ -1,5 +1,28 @@
 import React, { ReactNode } from 'react'
-import { css } from '@/styled-system/css'
+import { styled } from '@/styled-system/jsx'
+
+const Hint = styled('div', {
+  base: {
+    position: 'absolute',
+    top: '0.75rem',
+    right: '0.75rem',
+    backgroundColor: 'rgba(0,0,0,0.5)',
+    color: 'white',
+    borderRadius: 'calc(var(--lk-border-radius) / 2)',
+    paddingInline: '0.5rem',
+    paddingBlock: '0.1rem',
+    fontSize: '0.875rem',
+    opacity: 0,
+    visibility: 'hidden',
+    pointerEvents: 'none',
+    transition: 'opacity 150ms ease',
+    '.lk-grid-layout > *:first-child:focus-within &': {
+      opacity: 1,
+      visibility: 'visible',
+      pointerEvents: 'auto',
+    },
+  },
+})
 
 export interface KeyboardShortcutHintProps {
   children: ReactNode
@@ -12,21 +35,5 @@ export interface KeyboardShortcutHintProps {
 export const KeyboardShortcutHint: React.FC<KeyboardShortcutHintProps> = ({
   children,
 }) => {
-  return (
-    <div
-      className={css({
-        position: 'absolute',
-        top: '0.75rem',
-        right: '0.75rem',
-        backgroundColor: 'rgba(0,0,0,0.5)',
-        color: 'white',
-        borderRadius: 'calc(var(--lk-border-radius) / 2)',
-        paddingInline: '0.5rem',
-        paddingBlock: '0.1rem',
-        fontSize: '0.875rem',
-      })}
-    >
-      {children}
-    </div>
-  )
+  return <Hint>{children}</Hint>
 }

src/frontend/src/features/rooms/livekit/components/ParticipantName.tsx

@@ -1,8 +1,21 @@
+import type { CSSProperties } from 'react'
 import { Text } from '@/primitives'
 import { useTranslation } from 'react-i18next'
 import { useParticipantInfo } from '@livekit/components-react'
 import { Participant } from 'livekit-client'
 
+const participantNameStyles: CSSProperties = {
+  paddingBottom: '0.1rem',
+  overflow: 'hidden',
+  textOverflow: 'ellipsis',
+  whiteSpace: 'nowrap',
+}
+
+const participantNameScreenShareStyles: CSSProperties = {
+  ...participantNameStyles,
+  marginLeft: '0.4rem',
+}
+
 export const ParticipantName = ({
   participant,
   isScreenShare = false,
@@ -17,26 +30,14 @@ export const ParticipantName = ({
 
   if (isScreenShare) {
     return (
-      <Text
-        variant="sm"
-        style={{
-          paddingBottom: '0.1rem',
-          marginLeft: '0.4rem',
-        }}
-      >
+      <Text variant="sm" style={participantNameScreenShareStyles}>
         {t('screenShare', { name: displayedName })}
       </Text>
     )
   }
 
   return (
-    <Text
-      variant="sm"
-      style={{
-        paddingBottom: '0.1rem',
-      }}
-      aria-hidden="true"
-    >
+    <Text variant="sm" style={participantNameStyles} aria-hidden="true">
       {displayedName}
     </Text>
   )

src/frontend/src/features/rooms/livekit/components/ParticipantTile.tsx

@@ -183,7 +183,7 @@ export const ParticipantTile: (
                       }}
                     >
                       {isHandRaised && !isScreenShare && (
-                        <>
+                        <span>
                           <span>{positionInQueue}</span>
                           <RiHand
                             color="black"
@@ -197,7 +197,7 @@ export const ParticipantTile: (
                               animationIterationCount: '2',
                             }}
                           />
-                        </>
+                        </span>
                       )}
                       {isScreenShare && (
                         <ScreenShareIcon
@@ -210,10 +210,12 @@ export const ParticipantTile: (
                       {isEncrypted && !isScreenShare && (
                         <LockLockedIcon style={{ marginRight: '0.25rem' }} />
                       )}
-                      <ParticipantName
-                        isScreenShare={isScreenShare}
-                        participant={trackReference.participant}
-                      />
+                      <div className="lk-participant-name-wrapper">
+                        <ParticipantName
+                          isScreenShare={isScreenShare}
+                          participant={trackReference.participant}
+                        />
+                      </div>
                     </div>
                   </HStack>
                   <ConnectionQualityIndicator className="lk-participant-metadata-item" />
@@ -229,9 +231,7 @@ export const ParticipantTile: (
           )}
         </ParticipantContextIfNeeded>
       </TrackRefContextIfNeeded>
-      {hasKeyboardFocus && (
-        <KeyboardShortcutHint>{t('toolbarHint')}</KeyboardShortcutHint>
-      )}
+      <KeyboardShortcutHint>{t('toolbarHint')}</KeyboardShortcutHint>
     </div>
   )
 })

src/frontend/src/features/rooms/livekit/components/blur/UnifiedBackgroundTrackProcessor.ts

@@ -11,9 +11,7 @@ import {
   ProcessorType,
 } from '.'
 
-export class UnifiedBackgroundTrackProcessor
-  implements BackgroundProcessorInterface
-{
+export class UnifiedBackgroundTrackProcessor implements BackgroundProcessorInterface {
   processor: ProcessorWrapper<BackgroundOptions>
   opts: BackgroundOptions
   processorType: ProcessorType

src/frontend/src/features/rooms/livekit/components/blur/index.ts

@@ -13,8 +13,7 @@ export interface ProcessorSerialized {
   options: BackgroundOptions
 }
 
-export interface BackgroundProcessorInterface
-  extends TrackProcessor<Track.Kind> {
+export interface BackgroundProcessorInterface extends TrackProcessor<Track.Kind> {
   update(opts: BackgroundOptions): Promise<void>
   options: BackgroundOptions
   clone(): BackgroundProcessorInterface

src/frontend/src/features/rooms/livekit/components/controls/Device/ToggleDevice.tsx

@@ -1,5 +1,6 @@
 import { ToggleButton } from '@/primitives'
 import { useRegisterKeyboardShortcut } from '@/features/shortcuts/useRegisterKeyboardShortcut'
+import { useScreenReaderAnnounce } from '@/hooks/useScreenReaderAnnounce'
 import { useMemo, useState } from 'react'
 import { appendShortcutLabel } from '@/features/shortcuts/utils'
 import { useTranslation } from 'react-i18next'
@@ -87,10 +88,24 @@ export const ToggleDevice = <T extends ToggleSource>({
   const deviceIcons = useDeviceIcons(kind)
   const cannotUseDevice = useCannotUseDevice(kind)
   const deviceShortcut = useDeviceShortcut(kind)
+  const announce = useScreenReaderAnnounce()
 
   useRegisterKeyboardShortcut({
     id: deviceShortcut?.id,
-    handler: async () => await toggle(),
+    handler: async () => {
+      const nextState = !enabled
+      try {
+        const didChange = await toggle(nextState)
+        if (didChange === false) return
+
+        const message = t(nextState ? 'turnedOn' : 'turnedOff', {
+          keyPrefix: `selectDevice.${kind}`,
+        })
+        announce(message, 'assertive')
+      } catch {
+        // no announce
+      }
+    },
     isDisabled: cannotUseDevice,
   })
 

src/frontend/src/features/rooms/livekit/components/controls/Participants/ParticipantsToggle.tsx

@@ -6,6 +6,7 @@ import { css } from '@/styled-system/css'
 import { useParticipants } from '@livekit/components-react'
 import { useSidePanel } from '../../../hooks/useSidePanel'
 import { ToggleButtonProps } from '@/primitives/ToggleButton'
+import { useRegisterKeyboardShortcut } from '@/features/shortcuts/useRegisterKeyboardShortcut'
 
 export const ParticipantsToggle = ({
   onPress,
@@ -27,6 +28,11 @@ export const ParticipantsToggle = ({
 
   const tooltipLabel = isParticipantsOpen ? 'open' : 'closed'
 
+  useRegisterKeyboardShortcut({
+    id: 'toggle-participants',
+    handler: toggleParticipants,
+  })
+
   return (
     <div
       className={css({

src/frontend/src/features/rooms/livekit/components/controls/ReactionsToggle.tsx

@@ -1,6 +1,6 @@
 import { useTranslation } from 'react-i18next'
 import { RiEmotionLine } from '@remixicon/react'
-import { useState, useRef, useEffect } from 'react'
+import { useState, useRef } from 'react'
 import { css } from '@/styled-system/css'
 import { useRoomContext } from '@livekit/components-react'
 import { ToggleButton, Button } from '@/primitives'
@@ -12,7 +12,12 @@ import {
 } from '@/features/rooms/livekit/components/ReactionPortal'
 import { getEmojiLabel } from '@/features/rooms/livekit/utils/reactionUtils'
 import { useRegisterKeyboardShortcut } from '@/features/shortcuts/useRegisterKeyboardShortcut'
-import { Toolbar as RACToolbar } from 'react-aria-components'
+import {
+  Popover as RACPopover,
+  Dialog,
+  DialogTrigger,
+} from 'react-aria-components'
+import { FocusScope } from '@react-aria/focus'
 import { Participant } from 'livekit-client'
 import useRateLimiter from '@/hooks/useRateLimiter'
 
@@ -40,11 +45,11 @@ export const ReactionsToggle = () => {
   const instanceIdRef = useRef(0)
   const room = useRoomContext()
 
-  const [isVisible, setIsVisible] = useState(false)
+  const [isOpen, setIsOpen] = useState(false)
 
   useRegisterKeyboardShortcut({
     id: 'reaction',
-    handler: () => setIsVisible((prev) => !prev),
+    handler: () => setIsOpen((prev) => !prev),
   })
 
   const sendReaction = async (emoji: string) => {
@@ -79,100 +84,76 @@ export const ReactionsToggle = () => {
     windowMs: 1000,
   })
 
-  // Custom animation implementation for the emoji toolbar
-  // Could not use a menu and its animation, because a menu would make the toolbar inaccessible by keyboard
-  // animation isn't perfect
-  const [isRendered, setIsRendered] = useState(isVisible)
-  const [opacity, setOpacity] = useState(isVisible ? 1 : 0)
-
-  useEffect(() => {
-    if (isVisible) {
-      // Show: first render, then animate in
-      setIsRendered(true)
-      // Need to delay setting opacity to ensure CSS transition works
-      // (using requestAnimationFrame to ensure DOM has updated)
-      requestAnimationFrame(() => {
-        requestAnimationFrame(() => {
-          setOpacity(1)
-        })
-      })
-    } else if (isRendered) {
-      // Hide: first animate out, then unrender
-      setOpacity(0)
-
-      // Wait for animation to complete before removing from DOM
-      const timer = setTimeout(() => {
-        setIsRendered(false)
-      }, 200) // Match this to your animation duration
-      return () => clearTimeout(timer)
-    }
-  }, [isVisible, isRendered])
-
   return (
     <>
-      <div
-        className={css({
-          position: 'relative',
-        })}
-      >
-        <ToggleButton
-          square
-          variant="primaryDark"
-          aria-label={t('button')}
-          tooltip={t('button')}
-          onPress={() => setIsVisible(!isVisible)}
-        >
-          <RiEmotionLine />
-        </ToggleButton>
-        {isRendered && (
-          <div
+      <div className={css({ position: 'relative' })}>
+        <DialogTrigger isOpen={isOpen} onOpenChange={setIsOpen}>
+          <ToggleButton
+            square
+            variant="primaryDark"
+            aria-label={t('button')}
+            tooltip={t('button')}
+            isSelected={isOpen}
+            onChange={setIsOpen}
+          >
+            <RiEmotionLine />
+          </ToggleButton>
+          <RACPopover
+            placement="top"
+            offset={8}
+            isNonModal
+            shouldCloseOnInteractOutside={() => false}
             className={css({
-              position: 'absolute',
-              top: -63,
-              left: -162,
               borderRadius: '8px',
               padding: '0.35rem',
               backgroundColor: 'primaryDark.50',
-              opacity: opacity,
-              transition: 'opacity 0.2s ease',
+              '&[data-entering]': {
+                animation: 'fade 200ms ease',
+              },
+              '&[data-exiting]': {
+                animation: 'fade 200ms ease-in reverse',
+              },
             })}
-            onTransitionEnd={() => {
-              if (!isVisible) {
-                setIsRendered(false)
-              }
-            }}
           >
-            <RACToolbar
-              className={css({
-                display: 'flex',
-                gap: '0.5rem',
-              })}
-            >
-              {Object.values(Emoji).map((emoji, index) => (
-                <Button
-                  key={index}
-                  onPress={() => debouncedSendReaction(emoji)}
-                  aria-label={t('send', { emoji: getEmojiLabel(emoji, t) })}
-                  variant="primaryTextDark"
-                  size="sm"
-                  square
-                  data-attr={`send-reaction-${emoji}`}
+            <Dialog className={css({ outline: 'none' })}>
+              {/* eslint-disable-next-line jsx-a11y/no-autofocus -- FocusScope autoFocus is programmatic focus for overlays, not the HTML autofocus attribute */}
+              <FocusScope contain autoFocus restoreFocus>
+                <div
+                  role="toolbar"
+                  aria-orientation="horizontal"
+                  aria-label={t('button')}
+                  className={css({
+                    display: 'flex',
+                    gap: '0.5rem',
+                  })}
                 >
-                  <img
-                    src={`/assets/reactions/${emoji}.png`}
-                    alt=""
-                    className={css({
-                      minHeight: '28px',
-                      minWidth: '28px',
-                      pointerEvents: 'none',
-                      userSelect: 'none',
-                    })}
-                  />
-                </Button>
-              ))}
-            </RACToolbar>
-          </div>
-        )}
+                  {Object.values(Emoji).map((emoji, index) => (
+                    <Button
+                      key={index}
+                      onPress={() => debouncedSendReaction(emoji)}
+                      aria-label={t('send', { emoji: getEmojiLabel(emoji, t) })}
+                      variant="primaryTextDark"
+                      size="sm"
+                      square
+                      data-attr={`send-reaction-${emoji}`}
+                    >
+                      <img
+                        src={`/assets/reactions/${emoji}.png`}
+                        alt=""
+                        className={css({
+                          width: '28px',
+                          height: '28px',
+                          pointerEvents: 'none',
+                          userSelect: 'none',
+                        })}
+                      />
+                    </Button>
+                  ))}
+                </div>
+              </FocusScope>
+            </Dialog>
+          </RACPopover>
+        </DialogTrigger>
       </div>
       <ReactionPortals reactions={reactions} />
     </>

src/frontend/src/features/rooms/livekit/components/controls/StartMediaButton.tsx

@@ -6,8 +6,7 @@ import {
 import React from 'react'
 
 /** @public */
-export interface AllowMediaPlaybackProps
-  extends React.ButtonHTMLAttributes<HTMLButtonElement> {
+export interface AllowMediaPlaybackProps extends React.ButtonHTMLAttributes<HTMLButtonElement> {
   label?: string
 }
 

src/frontend/src/features/rooms/livekit/components/controls/ToolsToggle.tsx

@@ -4,6 +4,7 @@ import { useTranslation } from 'react-i18next'
 import { useSidePanel } from '../../hooks/useSidePanel'
 import { css } from '@/styled-system/css'
 import { ToggleButtonProps } from '@/primitives/ToggleButton'
+import { useRegisterKeyboardShortcut } from '@/features/shortcuts/useRegisterKeyboardShortcut'
 
 export const ToolsToggle = ({
   variant = 'primaryTextDark',
@@ -15,6 +16,11 @@ export const ToolsToggle = ({
   const { isToolsOpen, toggleTools } = useSidePanel()
   const tooltipLabel = isToolsOpen ? 'open' : 'closed'
 
+  useRegisterKeyboardShortcut({
+    id: 'recording',
+    handler: toggleTools,
+  })
+
   return (
     <div
       className={css({

src/frontend/src/features/rooms/livekit/components/layout/CarouselLayout.tsx

@@ -11,8 +11,7 @@ const ASPECT_RATIO = 16 / 10
 const ASPECT_RATIO_INVERT = (1 - ASPECT_RATIO) * -1
 
 /** @public */
-export interface CarouselLayoutProps
-  extends React.HTMLAttributes<HTMLMediaElement> {
+export interface CarouselLayoutProps extends React.HTMLAttributes<HTMLMediaElement> {
   tracks: TrackReferenceOrPlaceholder[]
   children: React.ReactNode
   /** Place the tiles vertically or horizontally next to each other.

src/frontend/src/features/rooms/livekit/components/layout/GridLayout.tsx

@@ -13,7 +13,8 @@ import { PaginationControl } from '../controls/PaginationControl'
 
 /** @public */
 export interface GridLayoutProps
-  extends React.HTMLAttributes<HTMLDivElement>,
+  extends
+    React.HTMLAttributes<HTMLDivElement>,
     Pick<UseParticipantsOptions, 'updateOnlyOn'> {
   children: React.ReactNode
   tracks: TrackReferenceOrPlaceholder[]

src/frontend/src/features/rooms/livekit/hooks/useCanPublishTrack.ts

@@ -12,6 +12,6 @@ export function useCanPublishTrack(trackSource: TrackSource): boolean {
 
   return Boolean(
     permissions?.canPublish &&
-      permissions?.canPublishSources?.includes(trackSource)
+    permissions?.canPublishSources?.includes(trackSource)
   )
 }

src/frontend/src/features/rooms/livekit/prefabs/Chat.tsx

@@ -18,8 +18,7 @@ import { css } from '@/styled-system/css'
 import { useRestoreFocus } from '@/hooks/useRestoreFocus'
 
 export interface ChatProps
-  extends React.HTMLAttributes<HTMLDivElement>,
-    ChatOptions {}
+  extends React.HTMLAttributes<HTMLDivElement>, ChatOptions {}
 
 /**
  * The Chat component adds a basis chat functionality to the LiveKit room. The messages are distributed to all participants

src/frontend/src/features/rooms/livekit/prefabs/ControlBar/DesktopControlBar.tsx

@@ -12,6 +12,7 @@ import { StartMediaButton } from '../../components/controls/StartMediaButton'
 import { MoreOptions } from './MoreOptions'
 import { useRef } from 'react'
 import { useRegisterKeyboardShortcut } from '@/features/shortcuts/useRegisterKeyboardShortcut'
+import { useFullScreen } from '../../hooks/useFullScreen'
 import { VideoDeviceControl } from '../../components/controls/Device/VideoDeviceControl'
 import { AudioDevicesControl } from '../../components/controls/Device/AudioDevicesControl'
 
@@ -21,6 +22,8 @@ export function DesktopControlBar({
   const browserSupportsScreenSharing = supportsScreenSharing()
   const desktopControlBarEl = useRef<HTMLDivElement>(null)
 
+  const { toggleFullScreen, isFullscreenAvailable } = useFullScreen({})
+
   useRegisterKeyboardShortcut({
     id: 'focus-toolbar',
     handler: () => {
@@ -32,6 +35,13 @@ export function DesktopControlBar({
       firstButton?.focus()
     },
   })
+
+  useRegisterKeyboardShortcut({
+    id: 'fullscreen',
+    handler: toggleFullScreen,
+    isDisabled: !isFullscreenAvailable,
+  })
+
   return (
     <div
       ref={desktopControlBarEl}

src/frontend/src/features/rooms/livekit/prefabs/VideoConference.tsx

@@ -31,6 +31,9 @@ import { RecordingProvider } from '@/features/recording'
 import { ScreenShareErrorModal } from '../components/ScreenShareErrorModal'
 import { useConnectionObserver } from '../hooks/useConnectionObserver'
 import { useNoiseReduction } from '../hooks/useNoiseReduction'
+import { useRegisterKeyboardShortcut } from '@/features/shortcuts/useRegisterKeyboardShortcut'
+import { useSettingsDialog } from '@/features/settings'
+import { SettingsDialogExtendedKey } from '@/features/settings/type'
 import { useVideoResolutionSubscription } from '../hooks/useVideoResolutionSubscription'
 import { SettingsDialogProvider } from '@/features/settings/components/SettingsDialogProvider'
 import { useSubtitles } from '@/features/subtitle/hooks/useSubtitles'
@@ -66,8 +69,7 @@ const LayoutWrapper = styled(
 /**
  * @public
  */
-export interface VideoConferenceProps
-  extends React.HTMLAttributes<HTMLDivElement> {
+export interface VideoConferenceProps extends React.HTMLAttributes<HTMLDivElement> {
   /** @alpha */
   SettingsComponent?: React.ComponentType
 }
@@ -98,6 +100,7 @@ export function VideoConference({ ...props }: VideoConferenceProps) {
   const { t: tRooms } = useTranslation('rooms')
   const room = useRoomContext()
   const announce = useScreenReaderAnnounce()
+  const { toggleSettingsDialog } = useSettingsDialog()
 
   const getAnnouncementName = useCallback(
     (participant?: Participant | null) => {
@@ -112,6 +115,13 @@ export function VideoConference({ ...props }: VideoConferenceProps) {
   useConnectionObserver()
   useVideoResolutionSubscription()
 
+  useRegisterKeyboardShortcut({
+    id: 'open-shortcuts',
+    handler: useCallback(() => {
+      toggleSettingsDialog(SettingsDialogExtendedKey.SHORTCUTS)
+    }, [toggleSettingsDialog]),
+  })
+
   const tracks = useTracks(
     [
       { source: Track.Source.Camera, withPlaceholder: true },

src/frontend/src/features/rooms/livekit/processors/RnnNoiseProcessor.ts

@@ -9,8 +9,7 @@ import NoiseSuppressorWorklet from '@timephy/rnnoise-wasm/NoiseSuppressorWorklet
 // and suspend/resume it as needed to manage audio state
 let audioContext: AudioContext
 
-export interface AudioProcessorInterface
-  extends TrackProcessor<Track.Kind.Audio> {
+export interface AudioProcessorInterface extends TrackProcessor<Track.Kind.Audio> {
   name: string
 }
 

src/frontend/src/features/rooms/utils/isRoomValid.ts

@@ -4,8 +4,10 @@ export const roomIdPattern = '[a-z]{3}-[a-z]{4}-[a-z]{3}'
 export const flexibleRoomIdPattern =
   '(?:[a-zA-Z0-9]{3}-?[a-zA-Z0-9]{4}-?[a-zA-Z0-9]{3})'
 
+const roomRegex = new RegExp(`^${roomIdPattern}$`)
+
 export const isRoomValid = (roomIdOrUrl: string) =>
-  new RegExp(`^${roomIdPattern}$`).test(roomIdOrUrl) ||
+  roomRegex.test(roomIdOrUrl) ||
   new RegExp(`^${window.location.origin}/${roomIdPattern}$`).test(roomIdOrUrl)
 
 export const normalizeRoomId = (roomId: string) => {

src/frontend/src/features/settings/components/SettingsDialogExtended.tsx

@@ -12,6 +12,7 @@ import {
   RiSpeakerLine,
   RiVideoOnLine,
   RiEyeLine,
+  RiKeyboardBoxLine,
 } from '@remixicon/react'
 import { AccountTab } from './tabs/AccountTab'
 import { NotificationsTab } from './tabs/NotificationsTab'
@@ -19,11 +20,12 @@ import { GeneralTab } from './tabs/GeneralTab'
 import { AudioTab } from './tabs/AudioTab'
 import { VideoTab } from './tabs/VideoTab'
 import { TranscriptionTab } from './tabs/TranscriptionTab'
+import { ShortcutTab } from './tabs/ShortcutTab'
 import { useRef } from 'react'
 import { useMediaQuery } from '@/features/rooms/livekit/hooks/useMediaQuery'
 import { SettingsDialogExtendedKey } from '@/features/settings/type'
 import { useIsAdminOrOwner } from '@/features/rooms/livekit/hooks/useIsAdminOrOwner'
-import AccessibilityTab from './tabs/AccessibilityTab'
+import { AccessibilityTab } from './tabs/AccessibilityTab'
 
 const tabsStyle = css({
   maxHeight: '40.625rem', // fixme size copied from meet settings modal
@@ -39,6 +41,7 @@ const tabListContainerStyle = css({
   flexDirection: 'column',
   borderRight: '1px solid lightGray', // fixme poor color management
   paddingY: '1rem',
+  paddingLeft: '0.2rem',
   paddingRight: '1.5rem',
 })
 
@@ -107,6 +110,10 @@ export const SettingsDialogExtended = (props: SettingsDialogExtended) => {
               {isWideScreen &&
                 t(`tabs.${SettingsDialogExtendedKey.NOTIFICATIONS}`)}
             </Tab>
+            <Tab icon highlight id={SettingsDialogExtendedKey.SHORTCUTS}>
+              <RiKeyboardBoxLine />
+              {isWideScreen && t(`tabs.${SettingsDialogExtendedKey.SHORTCUTS}`)}
+            </Tab>
             {isAdminOrOwner && (
               <Tab icon highlight id={SettingsDialogExtendedKey.TRANSCRIPTION}>
                 <Icon type="symbols" name="speech_to_text" />
@@ -130,6 +137,7 @@ export const SettingsDialogExtended = (props: SettingsDialogExtended) => {
           <VideoTab id={SettingsDialogExtendedKey.VIDEO} />
           <GeneralTab id={SettingsDialogExtendedKey.GENERAL} />
           <NotificationsTab id={SettingsDialogExtendedKey.NOTIFICATIONS} />
+          <ShortcutTab id={SettingsDialogExtendedKey.SHORTCUTS} />
           {/* Transcription tab won't be accessible if the tab is not active in the tab list */}
           <TranscriptionTab id={SettingsDialogExtendedKey.TRANSCRIPTION} />
           <AccessibilityTab id={SettingsDialogExtendedKey.ACCESSIBILITY} />

src/frontend/src/features/settings/components/tabs/AccessibilityTab.tsx

@@ -36,5 +36,3 @@ export const AccessibilityTab = ({ id }: AccessibilityTabProps) => {
     </TabPanel>
   )
 }
-
-export default AccessibilityTab

src/frontend/src/features/settings/components/tabs/ShortcutTab.tsx

@@ -0,0 +1,55 @@
+import { shortcutCatalog } from '@/features/shortcuts/catalog'
+import { ShortcutRow } from '@/features/shortcuts/components/ShortcutRow'
+import { css } from '@/styled-system/css'
+import { useTranslation } from 'react-i18next'
+import { TabPanel, type TabPanelProps } from '@/primitives/Tabs'
+
+const tableStyle = css({
+  width: '100%',
+  borderCollapse: 'collapse',
+  overflowY: 'auto',
+  '& caption': {
+    fontWeight: 'bold',
+    marginBottom: '0.75rem',
+    textAlign: 'left',
+  },
+  '& th, & td': {
+    padding: '0.65rem 0',
+    textAlign: 'left',
+    fontWeight: 'normal',
+  },
+  '& tbody tr': {
+    borderBottom: '1px solid rgba(255,255,255,0.08)',
+  },
+})
+
+export const ShortcutTab = ({ id }: Pick<TabPanelProps, 'id'>) => {
+  const { t } = useTranslation(['settings', 'rooms'])
+
+  return (
+    <TabPanel
+      id={id}
+      padding="md"
+      flex
+      className={css({
+        display: 'flex',
+        flexDirection: 'column',
+      })}
+    >
+      <table className={tableStyle}>
+        <caption>{t('shortcuts.listLabel')}</caption>
+        <thead>
+          <tr>
+            <th scope="col">{t('shortcuts.columnAction')}</th>
+            <th scope="col">{t('shortcuts.columnShortcut')}</th>
+          </tr>
+        </thead>
+        <tbody>
+          {shortcutCatalog.map((item) => (
+            <ShortcutRow key={item?.id} descriptor={item} />
+          ))}
+        </tbody>
+      </table>
+    </TabPanel>
+  )
+}

src/frontend/src/features/settings/components/tabs/VideoTab.tsx

@@ -4,7 +4,7 @@ import { TabPanel, TabPanelProps } from '@/primitives/Tabs'
 import { useMediaDeviceSelect, useRoomContext } from '@livekit/components-react'
 import { useTranslation } from 'react-i18next'
 import { usePersistentUserChoices } from '@/features/rooms/livekit/hooks/usePersistentUserChoices'
-import { useCallback, useEffect, useState } from 'react'
+import { useCallback, useEffect, useMemo, useState } from 'react'
 import { css } from '@/styled-system/css'
 import {
   createLocalVideoTrack,
@@ -22,6 +22,8 @@ export type VideoTabProps = Pick<DialogProps, 'onOpenChange'> &
 
 type DeviceItems = Array<{ value: string; label: string }>
 
+const EMPTY_PROPS = {}
+
 export const VideoTab = ({ id }: VideoTabProps) => {
   const { t } = useTranslation('settings', { keyPrefix: 'video' })
   const { localParticipant, remoteParticipants } = useRoomContext()
@@ -59,7 +61,7 @@ export const VideoTab = ({ id }: VideoTabProps) => {
   const isCamEnabled = devicesIn?.length > 0
 
   const disabledProps = isCamEnabled
-    ? {}
+    ? EMPTY_PROPS
     : {
         placeholder: t('permissionsRequired'),
         isDisabled: true,
@@ -117,6 +119,40 @@ export const VideoTab = ({ id }: VideoTabProps) => {
     }
   }, [videoDeviceId, videoElement])
 
+  const resolutionItems = useMemo(() => {
+    return [
+      {
+        value: 'h720',
+        label: `${t('resolution.publish.items.high')} (720p)`,
+      },
+      {
+        value: 'h360',
+        label: `${t('resolution.publish.items.medium')} (360p)`,
+      },
+      {
+        value: 'h180',
+        label: `${t('resolution.publish.items.low')} (180p)`,
+      },
+    ]
+  }, [t])
+
+  const videoQualityItems = useMemo(() => {
+    return [
+      {
+        value: VideoQuality.HIGH.toString(),
+        label: t('resolution.subscribe.items.high'),
+      },
+      {
+        value: VideoQuality.MEDIUM.toString(),
+        label: t('resolution.subscribe.items.medium'),
+      },
+      {
+        value: VideoQuality.LOW.toString(),
+        label: t('resolution.subscribe.items.low'),
+      },
+    ]
+  }, [t])
+
   return (
     <TabPanel padding={'md'} flex id={id}>
       <RowWrapper heading={t('camera.heading')}>
@@ -178,20 +214,7 @@ export const VideoTab = ({ id }: VideoTabProps) => {
         <Field
           type="select"
           label={t('resolution.publish.label')}
-          items={[
-            {
-              value: 'h720',
-              label: `${t('resolution.publish.items.high')} (720p)`,
-            },
-            {
-              value: 'h360',
-              label: `${t('resolution.publish.items.medium')} (360p)`,
-            },
-            {
-              value: 'h180',
-              label: `${t('resolution.publish.items.low')} (180p)`,
-            },
-          ]}
+          items={resolutionItems}
           selectedKey={videoPublishResolution}
           onSelectionChange={async (key) => {
             await handleVideoResolutionChange(key as VideoResolution)
@@ -206,20 +229,7 @@ export const VideoTab = ({ id }: VideoTabProps) => {
         <Field
           type="select"
           label={t('resolution.subscribe.label')}
-          items={[
-            {
-              value: VideoQuality.HIGH.toString(),
-              label: t('resolution.subscribe.items.high'),
-            },
-            {
-              value: VideoQuality.MEDIUM.toString(),
-              label: t('resolution.subscribe.items.medium'),
-            },
-            {
-              value: VideoQuality.LOW.toString(),
-              label: t('resolution.subscribe.items.low'),
-            },
-          ]}
+          items={videoQualityItems}
           selectedKey={videoSubscribeQuality?.toString()}
           onSelectionChange={(key) => {
             if (key == undefined) return

src/frontend/src/features/settings/hook/useSettingsDialog.ts

@@ -14,7 +14,25 @@ export const useSettingsDialog = () => {
     settingsStore.areSettingsOpen = true
   }
 
+  const closeSettingsDialog = () => {
+    settingsStore.areSettingsOpen = false
+  }
+
+  const toggleSettingsDialog = (
+    defaultSelectedTab?: SettingsDialogExtendedKey
+  ) => {
+    if (areSettingsOpen) {
+      closeSettingsDialog()
+    } else {
+      if (defaultSelectedTab)
+        settingsStore.defaultSelectedTab = defaultSelectedTab
+      settingsStore.areSettingsOpen = true
+    }
+  }
+
   return {
     openSettingsDialog,
+    closeSettingsDialog,
+    toggleSettingsDialog,
   }
 }

src/frontend/src/features/settings/type.ts

@@ -5,5 +5,6 @@ export enum SettingsDialogExtendedKey {
   GENERAL = 'general',
   NOTIFICATIONS = 'notifications',
   TRANSCRIPTION = 'transcription',
+  SHORTCUTS = 'shortcuts',
   ACCESSIBILITY = 'accessibility',
 }

src/frontend/src/features/shortcuts/catalog.ts

@@ -5,6 +5,7 @@ import { Shortcut } from './types'
 export type ShortcutCategory = 'navigation' | 'media' | 'interaction'
 
 export type ShortcutId =
+  | 'open-shortcuts'
   | 'focus-toolbar'
   | 'toggle-microphone'
   | 'toggle-camera'
@@ -29,6 +30,11 @@ export type ShortcutDescriptor = {
 }
 
 export const shortcutCatalog: ShortcutDescriptor[] = [
+  {
+    id: 'open-shortcuts',
+    category: 'navigation',
+    shortcut: { key: '/', ctrlKey: true, shiftKey: true },
+  },
   {
     id: 'focus-toolbar',
     category: 'navigation',

src/frontend/src/features/shortcuts/components/ShortcutBadge.tsx

@@ -0,0 +1,34 @@
+import React from 'react'
+import { css, cx } from '@/styled-system/css'
+
+type ShortcutBadgeProps = {
+  visualLabel: string
+  srLabel?: string
+  className?: string
+}
+
+const badgeStyle = css({
+  fontFamily: 'monospace',
+  backgroundColor: 'rgba(255,255,255,0.12)',
+  paddingInline: '0.4rem',
+  paddingBlock: '0.2rem',
+  borderRadius: '6px',
+  whiteSpace: 'nowrap',
+  minWidth: '5.5rem',
+  textAlign: 'center',
+})
+
+export const ShortcutBadge: React.FC<ShortcutBadgeProps> = ({
+  visualLabel,
+  srLabel,
+  className,
+}) => {
+  return (
+    <>
+      <kbd className={cx(badgeStyle, className)} aria-hidden="true">
+        {visualLabel}
+      </kbd>
+      {srLabel && <span className="sr-only">{srLabel}</span>}
+    </>
+  )
+}

src/frontend/src/features/shortcuts/components/ShortcutRow.tsx

@@ -0,0 +1,42 @@
+import React from 'react'
+import { css } from '@/styled-system/css'
+import { text } from '@/primitives/Text'
+import { ShortcutDescriptor } from '../catalog'
+import { ShortcutBadge } from './ShortcutBadge'
+import { useShortcutFormatting } from '../hooks/useShortcutFormatting'
+import { useTranslation } from 'react-i18next'
+
+type ShortcutRowProps = {
+  descriptor: ShortcutDescriptor
+}
+
+const shortcutCellStyle = css({
+  textAlign: 'right',
+})
+
+export const ShortcutRow: React.FC<ShortcutRowProps> = ({ descriptor }) => {
+  const { t } = useTranslation('rooms', { keyPrefix: 'shortcutsPanel' })
+  const { formatVisual, formatForSR } = useShortcutFormatting()
+
+  const visualShortcut = formatVisual(
+    descriptor.shortcut,
+    descriptor.code,
+    descriptor.kind
+  )
+  const srShortcut = formatForSR(
+    descriptor.shortcut,
+    descriptor.code,
+    descriptor.kind
+  )
+
+  return (
+    <tr>
+      <th scope="row" className={text({ variant: 'body' })}>
+        {t(`actions.${descriptor.id}`)}
+      </th>
+      <td className={shortcutCellStyle}>
+        <ShortcutBadge visualLabel={visualShortcut} srLabel={srShortcut} />
+      </td>
+    </tr>
+  )
+}

src/frontend/src/features/shortcuts/formatLabels.ts

@@ -0,0 +1,59 @@
+import { Shortcut } from './types'
+import { isMacintosh } from '@/utils/livekit'
+
+// Visible label for a shortcut (uses ⌘/Ctrl prefix when needed).
+export const formatShortcutLabel = (shortcut?: Shortcut) => {
+  if (!shortcut) return '—'
+  const key = shortcut.key?.toUpperCase()
+  if (!key) return '—'
+  const parts: string[] = []
+  if (shortcut.ctrlKey) parts.push(isMacintosh() ? '⌘' : 'Ctrl')
+  if (shortcut.altKey) parts.push(isMacintosh() ? '⌥' : 'Alt')
+  if (shortcut.shiftKey) parts.push('Shift')
+  parts.push(key)
+  return parts.join('+')
+}
+
+// SR-friendly label for a shortcut (reads "Control plus D").
+export const formatShortcutLabelForSR = (
+  shortcut: Shortcut | undefined,
+  {
+    controlLabel,
+    commandLabel,
+    altLabel,
+    optionLabel,
+    shiftLabel,
+    plusLabel,
+    noShortcutLabel,
+  }: {
+    controlLabel: string
+    commandLabel: string
+    altLabel: string
+    optionLabel: string
+    shiftLabel: string
+    plusLabel: string
+    noShortcutLabel: string
+  }
+) => {
+  if (!shortcut) return noShortcutLabel
+  const key = shortcut.key?.toUpperCase()
+  if (!key) return noShortcutLabel
+  const ctrlWord = isMacintosh() ? commandLabel : controlLabel
+  const altWord = isMacintosh() ? optionLabel : altLabel
+  const parts: string[] = []
+  if (shortcut.ctrlKey) parts.push(ctrlWord)
+  if (shortcut.altKey) parts.push(altWord)
+  if (shortcut.shiftKey) parts.push(shiftLabel)
+  parts.push(key)
+  return parts.join(` ${plusLabel} `)
+}
+
+// Extract displayable key name from KeyboardEvent.code (ex: KeyV -> V).
+export const getKeyLabelFromCode = (code?: string) => {
+  if (!code) return ''
+  if (code.startsWith('Key') && code.length === 4) return code.slice(3)
+  if (code.startsWith('Digit') && code.length === 6) return code.slice(5)
+  if (code === 'Space') return '␣'
+  if (code.startsWith('Arrow')) return code.slice(5) // Up, Down, Left, Right
+  return code
+}

src/frontend/src/features/shortcuts/hooks/useShortcutFormatting.ts

@@ -0,0 +1,47 @@
+import { useCallback } from 'react'
+import { useTranslation } from 'react-i18next'
+import { Shortcut } from '../types'
+import {
+  formatShortcutLabel,
+  formatShortcutLabelForSR,
+  getKeyLabelFromCode,
+} from '../formatLabels'
+
+export const useShortcutFormatting = () => {
+  const { t } = useTranslation('rooms')
+
+  const formatVisual = useCallback(
+    (shortcut?: Shortcut, code?: string, kind?: string) => {
+      if (code && kind === 'longPress') {
+        const label = getKeyLabelFromCode(code)
+        return t('shortcutsPanel.visual.hold', { key: label || '?' })
+      }
+      return formatShortcutLabel(shortcut)
+    },
+    [t]
+  )
+
+  const formatForSR = useCallback(
+    (shortcut?: Shortcut, code?: string, kind?: string) => {
+      if (code && kind === 'longPress') {
+        const label = getKeyLabelFromCode(code)
+        return t('shortcutsPanel.sr.hold', { key: label || '?' })
+      }
+      return formatShortcutLabelForSR(shortcut, {
+        controlLabel: t('shortcutsPanel.sr.control'),
+        commandLabel: t('shortcutsPanel.sr.command'),
+        altLabel: t('shortcutsPanel.sr.alt'),
+        optionLabel: t('shortcutsPanel.sr.option'),
+        shiftLabel: t('shortcutsPanel.sr.shift'),
+        plusLabel: t('shortcutsPanel.sr.plus'),
+        noShortcutLabel: t('shortcutsPanel.sr.noShortcut'),
+      })
+    },
+    [t]
+  )
+
+  return {
+    formatVisual,
+    formatForSR,
+  }
+}

src/frontend/src/features/shortcuts/useKeyboardShortcuts.ts

@@ -19,7 +19,10 @@ export const useKeyboardShortcuts = () => {
         shiftKey,
         altKey,
       })
-      const shortcut = shortcutsSnap.shortcuts.get(shortcutKey)
+      let shortcut = shortcutsSnap.shortcuts.get(shortcutKey)
+      if (!shortcut && shortcutKey === 'ctrl+shift+?') {
+        shortcut = shortcutsSnap.shortcuts.get('ctrl+shift+/')
+      }
       if (!shortcut) return
       e.preventDefault()
       await shortcut()

src/frontend/src/features/subtitle/component/Subtitles.tsx

@@ -20,8 +20,7 @@ export interface TranscriptionSegment {
   lastReceivedTime: number
 }
 
-export interface TranscriptionSegmentWithParticipant
-  extends TranscriptionSegment {
+export interface TranscriptionSegmentWithParticipant extends TranscriptionSegment {
   participant: Participant
 }
 

src/frontend/src/layout/Layout.tsx

@@ -5,6 +5,7 @@ import { layoutStore } from '@/stores/layout'
 import { useSnapshot } from 'valtio'
 import { Footer } from '@/layout/Footer'
 import { ScreenReaderAnnouncer } from '@/primitives'
+import { SkipLink, MAIN_CONTENT_ID } from './SkipLink'
 
 export type Layout = 'fullpage' | 'centered'
 
@@ -21,6 +22,7 @@ export const Layout = ({ children }: { children: ReactNode }) => {
 
   return (
     <>
+      {showHeader && <SkipLink />}
       <div
         className={css({
           display: 'flex',
@@ -35,6 +37,7 @@ export const Layout = ({ children }: { children: ReactNode }) => {
       >
         {showHeader && <Header />}
         <main
+          id={MAIN_CONTENT_ID}
           className={css({
             flexGrow: 1,
             overflow: 'auto',

src/frontend/src/layout/SkipLink.tsx

@@ -0,0 +1,69 @@
+import { type MouseEvent } from 'react'
+import { useTranslation } from 'react-i18next'
+import { styled } from '@/styled-system/jsx'
+
+export const MAIN_CONTENT_ID = 'main-content'
+
+// Visually hidden until focus (not sr-only). Must become visible on focus for keyboard users.
+const StyledSkipLink = styled('a', {
+  base: {
+    position: 'absolute',
+    width: '1px',
+    height: '1px',
+    margin: '-1px',
+    padding: 0,
+    overflow: 'hidden',
+    clip: 'rect(0, 0, 0, 0)',
+    whiteSpace: 'nowrap',
+    border: 0,
+    textDecoration: 'none',
+    _focusVisible: {
+      position: 'fixed',
+      top: '0.5rem',
+      left: '50%',
+      transform: 'translateX(-50%)',
+      width: 'auto',
+      height: 'auto',
+      margin: 0,
+      padding: '0.625rem 1rem',
+      overflow: 'visible',
+      clip: 'auto',
+      whiteSpace: 'normal',
+      zIndex: 9999,
+      backgroundColor: 'white',
+      color: 'primary.800',
+      fontWeight: 500,
+      fontSize: '0.875rem',
+      border: '1px solid',
+      borderColor: 'primary.800',
+      borderRadius: 4,
+      outline: '2px solid',
+      outlineColor: 'focusRing',
+      outlineOffset: 2,
+    },
+  },
+})
+
+export const SkipLink = () => {
+  const { t } = useTranslation()
+
+  const handleClick = (e: MouseEvent<HTMLAnchorElement>) => {
+    e.preventDefault()
+    const main = document.getElementById(MAIN_CONTENT_ID)
+    if (!main) return
+
+    const heading = main.querySelector('h1, h2, h3') as HTMLElement | null
+    const target = heading ?? main
+
+    if (!target.hasAttribute('tabindex')) {
+      target.setAttribute('tabindex', '-1')
+    }
+    target.focus()
+  }
+
+  return (
+    <StyledSkipLink href={`#${MAIN_CONTENT_ID}`} onClick={handleClick}>
+      {t('skipLink')}
+    </StyledSkipLink>
+  )
+}

src/frontend/src/locales/de/global.json

@@ -52,6 +52,7 @@
       "label": "OK"
     }
   },
+  "skipLink": "Zum Hauptinhalt springen",
   "clipboardContent": {
     "url": "Um an der Videokonferenz teilzunehmen, klicken Sie auf diesen Link: {{roomUrl}}",
     "numberAndPin": "Um telefonisch teilzunehmen, wählen Sie {{phoneNumber}} und geben Sie diesen Code ein: {{pinCode}}"

src/frontend/src/locales/de/home.json

@@ -31,12 +31,14 @@
   },
   "introSlider": {
     "previous": {
-      "label": "Zurück",
-      "tooltip": "Zurück"
+      "label": "Vorherige Folie",
+      "labelWithPosition": "Vorherige Folie ({{current}} von {{total}})",
+      "tooltip": "Vorherige Folie"
     },
     "next": {
-      "label": "Weiter",
-      "tooltip": "Weiter"
+      "label": "Nächste Folie",
+      "labelWithPosition": "Nächste Folie ({{current}} von {{total}})",
+      "tooltip": "Nächste Folie"
     },
     "beta": {
       "text": "An der Beta teilnehmen",
@@ -53,6 +55,8 @@
     "slide3": {
       "title": "Verwandeln Sie Ihre Meetings mit KI",
       "body": "Erhalten Sie präzise und verwertbare Transkripte zur Steigerung Ihrer Produktivität. Funktion in der Beta – jetzt testen!"
-    }
+    },
+    "carouselLabel": "Einführungs-Diashow",
+    "slidePosition": "Folie {{current}} von {{total}}"
   }
 }

src/frontend/src/locales/de/rooms.json

@@ -22,6 +22,8 @@
       "permissionsNeeded": "Kamera auswählen - genehmigung erforderlich",
       "disable": "Kamera deaktivieren",
       "enable": "Kamera aktivieren",
+      "turnedOff": "Kamera deaktiviert",
+      "turnedOn": "Kamera aktiviert",
       "label": "Kamera",
       "placeholder": "Kamera aktivieren, um die Vorschau zu sehen"
     },
@@ -30,6 +32,8 @@
       "permissionsNeeded": "Mikrofon auswählen - genehmigung erforderlich",
       "disable": "Mikrofon deaktivieren",
       "enable": "Mikrofon aktivieren",
+      "turnedOff": "Mikrofon deaktiviert",
+      "turnedOn": "Mikrofon aktiviert",
       "label": "Mikrofon"
     },
     "audiooutput": {
@@ -586,7 +590,7 @@
   },
   "participantTileFocus": {
     "containerLabel": "Optionen für {{name}}",
-    "toolbarHint": "F2: zur Symbolleiste unten.",
+    "toolbarHint": "Ctrl+Shift+/: Direkt auf die Tastenkürzel zugreifen.",
     "pin": {
       "enable": "Anheften",
       "disable": "Lösen"
@@ -595,6 +599,41 @@
     "muteParticipant": "{{name}} stummschalten",
     "fullScreen": "Vollbild"
   },
+  "shortcutsPanel": {
+    "title": "Tastenkombinationen",
+    "categories": {
+      "navigation": "Navigation",
+      "media": "Medien",
+      "interaction": "Interaktion"
+    },
+    "actions": {
+      "open-shortcuts": "Tastenkürzel-Hilfe öffnen",
+      "focus-toolbar": "Fokus auf die untere Symbolleiste",
+      "toggle-microphone": "Mikrofon umschalten",
+      "toggle-camera": "Kamera umschalten",
+      "push-to-talk": "Push-to-talk (gedrückt halten zum Einschalten)",
+      "reaction": "Reaktionspanel",
+      "fullscreen": "Vollbild umschalten",
+      "recording": "Aufnahmepanel umschalten",
+      "raise-hand": "Hand heben oder senken",
+      "toggle-chat": "Chat anzeigen/ausblenden",
+      "toggle-participants": "Teilnehmer anzeigen/ausblenden",
+      "open-shortcuts-settings": "Tastenkürzel-Einstellungen öffnen"
+    },
+    "sr": {
+      "control": "Steuerung",
+      "command": "Befehl",
+      "alt": "Alt",
+      "option": "Option",
+      "shift": "Umschalt",
+      "plus": "plus",
+      "hold": "Halte {{key}} gedrückt",
+      "noShortcut": "Kein Tastenkürzel"
+    },
+    "visual": {
+      "hold": "Halte {{key}} gedrückt"
+    }
+  },
   "fullScreenWarning": {
     "message": "Um eine Endlosschleife zu vermeiden, teile nicht deinen gesamten Bildschirm. Teile stattdessen einen Tab oder ein anderes Fenster.",
     "stop": "Präsentation beenden",

src/frontend/src/locales/de/settings.json

@@ -100,6 +100,11 @@
       }
     }
   },
+  "shortcuts": {
+    "listLabel": "Tastenkürzel",
+    "columnAction": "Aktion",
+    "columnShortcut": "Tastenkürzel"
+  },
   "dialog": {
     "heading": "Einstellungen"
   },
@@ -120,6 +125,7 @@
     "general": "Allgemein",
     "notifications": "Benachrichtigungen",
     "accessibility": "Barrierefreiheit",
-    "transcription": "Transkription"
+    "transcription": "Transkription",
+    "shortcuts": "Tastenkürzel"
   }
 }

src/frontend/src/locales/en/global.json

@@ -52,6 +52,7 @@
       "label": "OK"
     }
   },
+  "skipLink": "Skip to main content",
   "clipboardContent": {
     "url": "To join the video conference, click on this link: {{roomUrl}}",
     "numberAndPin": "To join by phone, dial {{phoneNumber}} and enter this code: {{pinCode}}"

src/frontend/src/locales/en/home.json

@@ -31,12 +31,14 @@
   },
   "introSlider": {
     "previous": {
-      "label": "previous",
-      "tooltip": "previous"
+      "label": "Previous slide",
+      "labelWithPosition": "Previous slide ({{current}} of {{total}})",
+      "tooltip": "Previous slide"
     },
     "next": {
-      "label": "next",
-      "tooltip": "next"
+      "label": "Next slide",
+      "labelWithPosition": "Next slide ({{current}} of {{total}})",
+      "tooltip": "Next slide"
     },
     "beta": {
       "text": "Join the beta",
@@ -53,6 +55,8 @@
     "slide3": {
       "title": "Transform your meetings with AI",
       "body": "Get accurate and actionable transcripts to boost your productivity. Feature in beta—try it now!"
-    }
+    },
+    "carouselLabel": "Introduction slideshow",
+    "slidePosition": "Slide {{current}} of {{total}}"
   }
 }

src/frontend/src/locales/en/rooms.json

@@ -22,6 +22,8 @@
       "permissionsNeeded": "Select camera - permission needed",
       "disable": "Disable camera",
       "enable": "Enable camera",
+      "turnedOff": "Camera turned off",
+      "turnedOn": "Camera turned on",
       "label": "Camera",
       "placeholder": "Enable camera to see the preview"
     },
@@ -30,6 +32,8 @@
       "permissionsNeeded": "Select microphone - permission needed",
       "disable": "Disable microphone",
       "enable": "Enable microphone",
+      "turnedOff": "Microphone turned off",
+      "turnedOn": "Microphone turned on",
       "label": "Microphone"
     },
     "audiooutput": {
@@ -586,7 +590,7 @@
   },
   "participantTileFocus": {
     "containerLabel": "Options for {{name}}",
-    "toolbarHint": "F2: go to the bottom toolbar.",
+    "toolbarHint": "Ctrl+Shift+/: access shortcuts directly.",
     "pin": {
       "enable": "Pin",
       "disable": "Unpin"
@@ -595,6 +599,41 @@
     "muteParticipant": "Mute {{name}}",
     "fullScreen": "Full screen"
   },
+  "shortcutsPanel": {
+    "title": "Keyboard shortcuts",
+    "categories": {
+      "navigation": "Navigation",
+      "media": "Media",
+      "interaction": "Interaction"
+    },
+    "actions": {
+      "open-shortcuts": "Open shortcuts help",
+      "focus-toolbar": "Focus bottom toolbar",
+      "toggle-microphone": "Toggle microphone",
+      "toggle-camera": "Toggle camera",
+      "push-to-talk": "Push-to-talk (hold to unmute)",
+      "reaction": "Emoji reaction panel",
+      "fullscreen": "Toggle fullscreen",
+      "recording": "Toggle recording panel",
+      "raise-hand": "Raise or lower hand",
+      "toggle-chat": "Toggle chat",
+      "toggle-participants": "Toggle participants",
+      "open-shortcuts-settings": "Open shortcuts settings"
+    },
+    "sr": {
+      "control": "Control",
+      "command": "Command",
+      "alt": "Alt",
+      "option": "Option",
+      "shift": "Shift",
+      "plus": "plus",
+      "hold": "Hold {{key}}",
+      "noShortcut": "No shortcut"
+    },
+    "visual": {
+      "hold": "Hold {{key}}"
+    }
+  },
   "fullScreenWarning": {
     "message": "To avoid infinite loop display, do not share your entire screen. Instead, share a tab or another window.",
     "stop": "Stop presenting",

src/frontend/src/locales/en/settings.json

@@ -100,6 +100,11 @@
       }
     }
   },
+  "shortcuts": {
+    "listLabel": "Keyboard shortcuts",
+    "columnAction": "Action",
+    "columnShortcut": "Shortcut"
+  },
   "dialog": {
     "heading": "Settings"
   },
@@ -120,6 +125,7 @@
     "general": "General",
     "notifications": "Notifications",
     "accessibility": "Accessibility",
-    "transcription": "Transcription"
+    "transcription": "Transcription",
+    "shortcuts": "Shortcuts"
   }
 }

src/frontend/src/locales/fr/global.json

@@ -52,6 +52,7 @@
       "label": "OK"
     }
   },
+  "skipLink": "Aller au contenu principal",
   "clipboardContent": {
     "url": "Pour participer à la visioconférence, cliquez sur ce lien : {{roomUrl}}",
     "numberAndPin": "Pour participer par téléphone, composez le {{phoneNumber}} et saisissez ce code : {{pinCode}}"

src/frontend/src/locales/fr/home.json

@@ -30,14 +30,18 @@
     }
   },
   "introSlider": {
+    "carouselLabel": "Diaporama de présentation",
     "previous": {
-      "label": "précédent",
-      "tooltip": "précédent"
+      "label": "Diapositive précédente",
+      "labelWithPosition": "Diapositive précédente ({{current}} sur {{total}})",
+      "tooltip": "Diapositive précédente"
     },
     "next": {
-      "label": "suivant",
-      "tooltip": "suivant"
+      "label": "Diapositive suivante",
+      "labelWithPosition": "Diapositive suivante ({{current}} sur {{total}})",
+      "tooltip": "Diapositive suivante"
     },
+    "slidePosition": "Diapositive {{current}} sur {{total}}",
     "beta": {
       "text": "Essayer la beta",
       "tooltip": "Accéder au formulaire"

src/frontend/src/locales/fr/rooms.json

@@ -22,6 +22,8 @@
       "permissionsNeeded": "Choisir la webcam - autorisations nécessaires",
       "disable": "Désactiver la webcam",
       "enable": "Activer la webcam",
+      "turnedOff": "Webcam désactivée",
+      "turnedOn": "Webcam activée",
       "label": "Webcam",
       "placeholder": "Activez la webcam pour prévisualiser l'affichage"
     },
@@ -30,6 +32,8 @@
       "permissionsNeeded": "Choisir le micro - autorisations nécessaires",
       "disable": "Désactiver le micro",
       "enable": "Activer le micro",
+      "turnedOff": "Micro désactivé",
+      "turnedOn": "Micro activé",
       "label": "Microphone"
     },
     "audiooutput": {
@@ -586,7 +590,7 @@
   },
   "participantTileFocus": {
     "containerLabel": "Options pour {{name}}",
-    "toolbarHint": "F2 : raccourci barre d'outils en bas.",
+    "toolbarHint": "Ctrl+Shift+/ : accéder directement aux raccourcis.",
     "pin": {
       "enable": "Épingler",
       "disable": "Annuler l'épinglage"
@@ -595,6 +599,41 @@
     "muteParticipant": "Couper le micro de {{name}}",
     "fullScreen": "Plein écran"
   },
+  "shortcutsPanel": {
+    "title": "Raccourcis clavier",
+    "categories": {
+      "navigation": "Navigation",
+      "media": "Média",
+      "interaction": "Interaction"
+    },
+    "actions": {
+      "open-shortcuts": "Ouvrir l’aide des raccourcis",
+      "focus-toolbar": "Mettre le focus sur la barre d’outils du bas",
+      "toggle-microphone": "Activer ou désactiver le micro",
+      "toggle-camera": "Activer ou désactiver la caméra",
+      "push-to-talk": "Appuyer pour parler (maintenir pour réactiver)",
+      "reaction": "Panneau des réactions",
+      "fullscreen": "Basculer en plein écran",
+      "recording": "Basculer le panneau d’enregistrement",
+      "raise-hand": "Lever ou baisser la main",
+      "toggle-chat": "Afficher/Masquer le chat",
+      "toggle-participants": "Afficher/Masquer les participants",
+      "open-shortcuts-settings": "Ouvrir les réglages des raccourcis"
+    },
+    "sr": {
+      "control": "Contrôle",
+      "command": "Commande",
+      "alt": "Alt",
+      "option": "Option",
+      "shift": "Majuscule",
+      "plus": "plus",
+      "hold": "Maintenir {{key}}",
+      "noShortcut": "Aucun raccourci"
+    },
+    "visual": {
+      "hold": "Maintenir {{key}}"
+    }
+  },
   "fullScreenWarning": {
     "message": "Pour éviter l'affichage en boucle infinie, ne partagez pas l'intégralité de votre écran. Partagez plutôt un onglet ou une autre fenêtre.",
     "stop": "Arrêter la présentation",

src/frontend/src/locales/fr/settings.json

@@ -100,6 +100,11 @@
       }
     }
   },
+  "shortcuts": {
+    "listLabel": "Liste des raccourcis clavier",
+    "columnAction": "Action",
+    "columnShortcut": "Raccourci"
+  },
   "dialog": {
     "heading": "Paramètres"
   },
@@ -120,6 +125,7 @@
     "general": "Général",
     "notifications": "Notifications",
     "accessibility": "Accessibilité",
-    "transcription": "Transcription"
+    "transcription": "Transcription",
+    "shortcuts": "Raccourcis"
   }
 }

src/frontend/src/locales/nl/global.json

@@ -51,6 +51,7 @@
       "label": "OK"
     }
   },
+  "skipLink": "Naar de hoofdinhoud gaan",
   "clipboardContent": {
     "url": "Klik op deze link om deel te nemen aan de videoconferentie: {{roomUrl}}",
     "numberAndPin": "Bel {{phoneNumber}} en voer deze code in om telefonisch deel te nemen: {{pinCode}}"

src/frontend/src/locales/nl/home.json

@@ -31,12 +31,14 @@
   },
   "introSlider": {
     "previous": {
-      "label": "vorige",
-      "tooltip": "vorige"
+      "label": "Vorige dia",
+      "labelWithPosition": "Vorige dia ({{current}} van {{total}})",
+      "tooltip": "Vorige dia"
     },
     "next": {
-      "label": "volgende",
-      "tooltip": "volgende"
+      "label": "Volgende dia",
+      "labelWithPosition": "Volgende dia ({{current}} van {{total}})",
+      "tooltip": "Volgende dia"
     },
     "beta": {
       "text": "Word lid van de bèta",
@@ -53,6 +55,8 @@
     "slide3": {
       "title": "Transformeer uw vergaderingen met AI",
       "body": "Krijg nauwkeurige en bruikbare transcripties om uw productiviteit te stimuleren. Deze mogelijkheid is in bèta, probeer het nu!"
-    }
+    },
+    "carouselLabel": "Introductie-diavoorstelling",
+    "slidePosition": "Dia {{current}} van {{total}}"
   }
 }

src/frontend/src/locales/nl/rooms.json

@@ -22,6 +22,8 @@
       "permissionsNeeded": "Selecteer camera - Toestemming vereist",
       "disable": "Camera uitschakelen",
       "enable": "Camera inschakelen",
+      "turnedOff": "Camera uitgeschakeld",
+      "turnedOn": "Camera ingeschakeld",
       "label": "Camera",
       "placeholder": "Schakel de camera in om de preview te zien"
     },
@@ -30,6 +32,8 @@
       "permissionsNeeded": "Selecteer microfoon - Toestemming vereist",
       "disable": "Microfoon dempen",
       "enable": "Microfoon dempen opheffen",
+      "turnedOff": "Microfoon uitgeschakeld",
+      "turnedOn": "Microfoon ingeschakeld",
       "label": "Microfoon"
     },
     "audiooutput": {
@@ -586,7 +590,7 @@
   },
   "participantTileFocus": {
     "containerLabel": "Opties voor {{name}}",
-    "toolbarHint": "F2: naar de werkbalk onderaan.",
+    "toolbarHint": "Ctrl+Shift+/: direct toegang tot de sneltoetsen.",
     "pin": {
       "enable": "Pinnen",
       "disable": "Losmaken"
@@ -595,6 +599,41 @@
     "muteParticipant": "Demp {{name}}",
     "fullScreen": "Volledig scherm"
   },
+  "shortcutsPanel": {
+    "title": "Sneltoetsen",
+    "categories": {
+      "navigation": "Navigatie",
+      "media": "Media",
+      "interaction": "Interactie"
+    },
+    "actions": {
+      "open-shortcuts": "Sneltoetsenhulp openen",
+      "focus-toolbar": "Focus op de onderste werkbalk",
+      "toggle-microphone": "Microfoon aan/uit",
+      "toggle-camera": "Camera aan/uit",
+      "push-to-talk": "Push-to-talk (ingedrukt houden om te activeren)",
+      "reaction": "Reactiepaneel",
+      "fullscreen": "Volledig scherm wisselen",
+      "recording": "Opnamepaneel wisselen",
+      "raise-hand": "Hand opsteken of laten zakken",
+      "toggle-chat": "Chat tonen/verbergen",
+      "toggle-participants": "Deelnemers tonen/verbergen",
+      "open-shortcuts-settings": "Sneltoets-instellingen openen"
+    },
+    "sr": {
+      "control": "Control",
+      "command": "Command",
+      "alt": "Alt",
+      "option": "Option",
+      "shift": "Shift",
+      "plus": "plus",
+      "hold": "Houd {{key}} ingedrukt",
+      "noShortcut": "Geen sneltoets"
+    },
+    "visual": {
+      "hold": "Houd {{key}} ingedrukt"
+    }
+  },
   "fullScreenWarning": {
     "message": "Om niet oneindige uw scherm in zichzelf te delen, kunt u beter niet het hele scherm delen. Deel in plaats daarvan een tab of een ander venster.",
     "stop": "Stop met presenteren",

src/frontend/src/locales/nl/settings.json

@@ -100,6 +100,11 @@
       }
     }
   },
+  "shortcuts": {
+    "listLabel": "Sneltoetsen",
+    "columnAction": "Actie",
+    "columnShortcut": "Sneltoets"
+  },
   "dialog": {
     "heading": "Instellingen"
   },
@@ -114,6 +119,7 @@
     "video": "Video",
     "general": "Algemeen",
     "notifications": "Meldingen",
-    "transcription": "Transcriptie"
+    "transcription": "Transcriptie",
+    "shortcuts": "Sneltoetsen"
   }
 }

src/frontend/src/primitives/Tabs.tsx

@@ -24,6 +24,9 @@ const StyledTabs = styled(RACTabs, {
       flexDirection: 'row',
       '--vertical': '3px',
     },
+    '&[data-focus-visible]': {
+      outline: 'none!',
+    },
   },
 })
 
@@ -102,6 +105,9 @@ const StyledTabList = styled(RACTabList, {
     '&[data-orientation=vertical]': {
       flexDirection: 'column',
     },
+    '&[data-focus-visible]': {
+      outline: 'none!',
+    },
   },
   variants: {
     border: {
@@ -147,9 +153,8 @@ const StyledTabPanel = styled(RACTabPanel, {
   base: {
     marginTop: '4px',
     borderRadius: '4px',
-    outline: 'none',
     '&[data-focus-visible]': {
-      outline: '2px solid red',
+      outline: 'none!',
     },
   },
   variants: {

src/frontend/src/primitives/buttonRecipe.ts

@@ -199,6 +199,11 @@ export const buttonRecipe = cva({
           backgroundColor: 'primaryDark.700',
           color: 'primaryDark.100',
         },
+        '&[data-focus-visible]': {
+          outline: '2px solid',
+          outlineColor: 'focusRing',
+          outlineOffset: '2px',
+        },
       },
       quaternaryText: {
         backgroundColor: 'transparent',

src/frontend/src/routes.ts

@@ -11,6 +11,8 @@ import { CreatePopup } from '@/features/sdk/routes/CreatePopup'
 import { CreateMeetingButton } from '@/features/sdk/routes/CreateMeetingButton'
 import { RecordingDownloadRoute } from '@/features/recording'
 
+const roomIdRegex = new RegExp(`^[/](?<roomId>${flexibleRoomIdPattern})$`)
+
 export const routes: Record<
   | 'home'
   | 'room'
@@ -37,7 +39,7 @@ export const routes: Record<
   room: {
     name: 'room',
     to: (roomId: string) => `/${roomId.trim()}`,
-    path: new RegExp(`^[/](?<roomId>${flexibleRoomIdPattern})$`),
+    path: roomIdRegex,
     Component: RoomRoute,
   },
   feedback: {

src/frontend/src/styles/index.css

@@ -22,6 +22,11 @@ body,
   outline: 2px solid transparent;
 }
 
+main#main-content :is(h1, h2, h3)[tabindex='-1']:focus {
+  outline: 2px solid var(--colors-focus-ring);
+  outline-offset: 2px;
+}
+
 [data-rac][data-focus-visible]:not(label, .react-aria-Select),
 :is(a, button, input[type='text'], select, textarea):not(
     [data-rac]

src/frontend/src/styles/livekit.css

@@ -151,3 +151,24 @@
 [data-lk-theme] .lk-participant-tile {
   box-shadow: var(--lk-box-shadow);
 }
+
+/* Participant name ellipsis: truncate when overflowing */
+.lk-participant-metadata {
+  gap: 1rem;
+}
+.lk-participant-metadata > *:first-child {
+  min-width: 0;
+}
+.lk-participant-metadata > *:first-child {
+  flex: 1;
+}
+.lk-participant-metadata > *:first-child .lk-participant-metadata-item,
+.lk-participant-metadata
+  .lk-participant-metadata-item
+  .lk-participant-name-wrapper {
+  min-width: 0;
+}
+.lk-participant-metadata > *:first-child .lk-participant-metadata-item {
+  display: flex;
+  align-items: center;
+}

src/frontend/src/utils/languages.ts

@@ -1,12 +1,13 @@
 // Map frontend language codes to backend language codes
 
-export type BackendLanguage = 'en-us' | 'fr-fr' | 'nl-nl'
-export type FrontendLanguage = 'en' | 'fr' | 'nl'
+export type BackendLanguage = 'en-us' | 'fr-fr' | 'nl-nl' | 'de-de'
+export type FrontendLanguage = 'en' | 'fr' | 'nl' | 'de'
 
 const frontendToBackendMap: Record<FrontendLanguage, BackendLanguage> = {
   en: 'en-us',
   fr: 'fr-fr',
   nl: 'nl-nl',
+  de: 'de-de',
 }
 
 export const convertToBackendLanguage = (