fix: refactor securityContext

This commit aim at adding a securityContext for
pod and container in Deployment and Job,
it include livekit pods as well

It adds 2 values :
- podSecurityContext : for pods
- securityContext : for containers

Please note that `celeryBackend` Deployment does
not have any values defined in `values.meet.yaml` at the moment.

.github/workflows/docker-hub.yml

@@ -48,12 +48,12 @@ jobs:
         with:
           username: ${{ secrets.DOCKER_HUB_USER }}
           password: ${{ secrets.DOCKER_HUB_PASSWORD }}
-#      -
-#        name: Run trivy scan
-#        uses: numerique-gouv/action-trivy-cache@main
-#        with:
-#          docker-build-args: '--target backend-production -f Dockerfile'
-#          docker-image-name: '${{ env.DOCKER_CONTAINER_REGISTRY_HOSTNAME }}/${{ env.DOCKER_CONTAINER_REGISTRY_NAMESPACE }}/meet-backend:${{ github.sha }}'
+      -
+        name: Run trivy scan
+        uses: numerique-gouv/action-trivy-cache@main
+        with:
+          docker-build-args: '--target backend-production -f Dockerfile'
+          docker-image-name: '${{ env.DOCKER_CONTAINER_REGISTRY_HOSTNAME }}/${{ env.DOCKER_CONTAINER_REGISTRY_NAMESPACE }}/meet-backend:${{ github.sha }}'
       -
         name: Build and push
         uses: docker/build-push-action@v6
@@ -93,12 +93,12 @@ jobs:
         with:
           username: ${{ secrets.DOCKER_HUB_USER }}
           password: ${{ secrets.DOCKER_HUB_PASSWORD }}
-#      -
-#        name: Run trivy scan
-#        uses: numerique-gouv/action-trivy-cache@main
-#        with:
-#          docker-build-args: '-f src/frontend/Dockerfile --target frontend-production'
-#          docker-image-name: '${{ env.DOCKER_CONTAINER_REGISTRY_HOSTNAME }}/${{ env.DOCKER_CONTAINER_REGISTRY_NAMESPACE }}/meet-frontend:${{ github.sha }}'
+      -
+        name: Run trivy scan
+        uses: numerique-gouv/action-trivy-cache@main
+        with:
+          docker-build-args: '-f src/frontend/Dockerfile --target frontend-production'
+          docker-image-name: '${{ env.DOCKER_CONTAINER_REGISTRY_HOSTNAME }}/${{ env.DOCKER_CONTAINER_REGISTRY_NAMESPACE }}/meet-frontend:${{ github.sha }}'
       -
         name: Build and push
         uses: docker/build-push-action@v6
@@ -139,12 +139,12 @@ jobs:
         with:
           username: ${{ secrets.DOCKER_HUB_USER }}
           password: ${{ secrets.DOCKER_HUB_PASSWORD }}
-#      -
-#        name: Run trivy scan
-#        uses: numerique-gouv/action-trivy-cache@main
-#        with:
-#          docker-build-args: '-f docker/dinum-frontend/Dockerfile --target frontend-production'
-#          docker-image-name: '${{ env.DOCKER_CONTAINER_REGISTRY_HOSTNAME }}/${{ env.DOCKER_CONTAINER_REGISTRY_NAMESPACE }}/meet-frontend-dinum:${{ github.sha }}'
+      -
+        name: Run trivy scan
+        uses: numerique-gouv/action-trivy-cache@main
+        with:
+          docker-build-args: '-f docker/dinum-frontend/Dockerfile --target frontend-production'
+          docker-image-name: '${{ env.DOCKER_CONTAINER_REGISTRY_HOSTNAME }}/${{ env.DOCKER_CONTAINER_REGISTRY_NAMESPACE }}/meet-frontend-dinum:${{ github.sha }}'
       -
         name: Build and push
         uses: docker/build-push-action@v6
@@ -185,13 +185,13 @@ jobs:
         with:
           username: ${{ secrets.DOCKER_HUB_USER }}
           password: ${{ secrets.DOCKER_HUB_PASSWORD }}
-#      -
-#        name: Run trivy scan
-#        uses: numerique-gouv/action-trivy-cache@main
-#        continue-on-error: true
-#        with:
-#          docker-build-args: '-f src/summary/Dockerfile --target production'
-#          docker-image-name: '${{ env.DOCKER_CONTAINER_REGISTRY_HOSTNAME }}/${{ env.DOCKER_CONTAINER_REGISTRY_NAMESPACE }}/meet-summary:${{ github.sha }}'
+      -
+        name: Run trivy scan
+        uses: numerique-gouv/action-trivy-cache@main
+        continue-on-error: true
+        with:
+          docker-build-args: '-f src/summary/Dockerfile --target production'
+          docker-image-name: '${{ env.DOCKER_CONTAINER_REGISTRY_HOSTNAME }}/${{ env.DOCKER_CONTAINER_REGISTRY_NAMESPACE }}/meet-summary:${{ github.sha }}'
           docker-context: './src/summary'
       -
         name: Build and push
@@ -233,14 +233,14 @@ jobs:
         with:
           username: ${{ secrets.DOCKER_HUB_USER }}
           password: ${{ secrets.DOCKER_HUB_PASSWORD }}
-#      -
-#        name: Run trivy scan
-#        uses: numerique-gouv/action-trivy-cache@main
-#        continue-on-error: true
-#        with:
-#          docker-build-args: '-f src/agents/Dockerfile --target production'
-#          docker-image-name: '${{ env.DOCKER_CONTAINER_REGISTRY_HOSTNAME }}/${{ env.DOCKER_CONTAINER_REGISTRY_NAMESPACE }}/meet-agents:${{ github.sha }}'
-#          docker-context: './src/agents'
+      -
+        name: Run trivy scan
+        uses: numerique-gouv/action-trivy-cache@main
+        continue-on-error: true
+        with:
+          docker-build-args: '-f src/agents/Dockerfile --target production'
+          docker-image-name: '${{ env.DOCKER_CONTAINER_REGISTRY_HOSTNAME }}/${{ env.DOCKER_CONTAINER_REGISTRY_NAMESPACE }}/meet-agents:${{ github.sha }}'
+          docker-context: './src/agents'
       -
         name: Build and push
         uses: docker/build-push-action@v6

.github/workflows/meet.yml

@@ -297,6 +297,46 @@ jobs:
       - name: Run tests
         run: uv run pytest -n 2
 
+  test-summary:
+    runs-on: ubuntu-latest
+    permissions:
+      contents: read
+    defaults:
+      run:
+        working-directory: src/summary
+
+    env:
+      APP_API_TOKEN: "test-api-token"
+      AWS_STORAGE_BUCKET_NAME: "http://meet-media-storage"
+      AWS_S3_ENDPOINT_URL: "minio:9000"
+      AWS_S3_ACCESS_KEY_ID: "meet"
+      AWS_S3_SECRET_ACCESS_KEY: "password"
+      WHISPERX_BASE_URL: "https://configure-your-url.com"
+      WHISPERX_ASR_MODEL: "large-v2"
+      WHISPERX_API_KEY: "test-whisperx-secret"
+      WHISPERX_DEFAULT_LANGUAGE: "fr"
+      LLM_BASE_URL: "https://configure-your-url.com"
+      LLM_API_KEY: "test-llm-secret"
+      LLM_MODEL: "test-llm-model"
+      WEBHOOK_API_TOKEN: "test-webhook-secret"
+      WEBHOOK_URL: "https://configure-your-url.com"
+
+    steps:
+      - name: Checkout repository
+        uses: actions/checkout@v6
+
+      - name: Install Python
+        uses: actions/setup-python@v6
+        with:
+          python-version: "3.13"
+          cache: "pip"
+
+      - name: Install development dependencies
+        run: pip install --user .[dev]
+
+      - name: Run summary tests
+        run: ~/.local/bin/pytest
+
   lint-front:
     runs-on: ubuntu-latest
     permissions:

CHANGELOG.md

@@ -8,6 +8,31 @@ and this project adheres to
 
 ## [Unreleased]
 
+### Changed
+
+- ⚡️(helm) Add pod and container securityContext #4805
+- ♻️(backend) configurable SESSION_ENGINE #1038 #1154
+- ♿️(frontend) fix sidepanel accessibility aria-label #1182
+- ♿️(frontend) fix more tools heading hierarchy #1181
+- ♿️(fronted) improve button descriptions for More tools actions #1184
+- 💄(spinner) enforce spinner height #1183
+- 💄(custom-background) add upload indicator with preview #1183
+- ♿️(backend) improve logo accessibility in recording email notification #1092
+- ♿️(summary) improve accessibility of transcription download link #1187
+- 💄(frontend) show OS-specific shortcut in participant tile hint #1193
+- ⬆️(frontend) bump flatted from 3.3.1 to 3.4.2 in /src/frontend #1188
+- ⬆️️️(frontend) bump undici from 6.23.0 to 6.24.1 in /src/frontend
+- ⬆️️️(frontend) bump hono from 4.12.2 to 4.12.7 in /src/frontend
+- ⬆️️️(frontend) bump dompurify from 3.3.1 to 3.3.2 in /src/frontend
+
+### Fixed
+
+- 🐛(frontend) disable personal custom background while deleting #1183
+- 🐛(frontend) auto-select new custom background when not logged in #1183
+- 🐛(frontend) fix device selection not applying during conference #1156
+
+## [1.11.0] - 2026-03-19
+
 ### Added
 
 - ✨(helm) support celery with our Django backend #1124
@@ -15,20 +40,24 @@ and this project adheres to
 - ✨(backend) add authenticated user rate throttling on request-entry #1129
 - ✨(backend) expose `is_active` field for Application in Django admin #1133
 - ✨(file-upload) disable by default & limit count by user #1141
+- ✨(frontend) custom background #1067
 
 ### Changed
 
 - ♿️(frontend) Caption text size setting for accessibility #1062
 - ♿️(frontend) sync html lang attribute with i18n for screen readers #1111
 - ♿️(frontend) improve MoreLink a11y and UX on home page #1112
-- ♿(frontend) improve chat toast a11y for screen readers #1109
-- ♿(frontend) improve ui and aria labels for help article links #1108
+- ♿️(frontend) improve chat toast a11y for screen readers #1109
+- ♿️(frontend) improve ui and aria labels for help article links #1108
 - 🌐(frontend) improve German translation #1125
 - 🔨(python-env) migrate meet main app to UV #1120
 - ♻️(backend) align Application model field with `is_active` convention #1133
 - 🔐(backend) avoids revealing the inactive status of an application #1135
 - ⚡️(helm) reduce initialDelaySeconds and add periods seconds #1139
 - 🔒️(backend) avoid information exposure through exception messages #1144
+- ⬆️(dependencies) update PyJWT to v2.12.0 [SECURITY] #1151
+- 📌(agents) unpin OpenSSL and related dependencies #1167
+- ♿️(frontend) add caption font and background color customization #1122
 
 ### Fixed
 
@@ -36,6 +65,7 @@ and this project adheres to
 - 🩹(backend) add page_size to pagination for room endpoints #1131
 - 🐛(backend) refactor lobby throttling to use participant id #1129
 - 🩹(backend) ignore non-recording uploads in storage webhook handler #1142
+- 🐛(frontend) fix dimension mismatch in BackgroundCustomProcessor #1116
 
 ## [1.10.0] - 2026-03-05
 

Makefile

@@ -191,6 +191,7 @@ lint-pylint: ## lint back-end python sources with pylint only on changed files f
 
 test: ## run project tests
 	@$(MAKE) test-back-parallel
+	@$(MAKE) test-summary
 .PHONY: test
 
 test-back: ## run back-end tests
@@ -203,6 +204,11 @@ test-back-parallel: ## run all back-end tests in parallel
 	bin/pytest -n auto $${args:-${1}}
 .PHONY: test-back-parallel
 
+test-summary: ## run summary tests
+	@args="$(filter-out $@,$(MAKECMDGOALS))" && \
+	bin/pytest-summary $${args:-${1}}
+.PHONY: test-summary
+
 makemigrations:  ## run django makemigrations for the Meet project.
 	@echo "$(BOLD)Running makemigrations$(RESET)"
 	@$(COMPOSE) up -d postgresql

bin/pytest-summary

@@ -0,0 +1,7 @@
+#!/usr/bin/env bash
+
+source "$(dirname "${BASH_SOURCE[0]}")/_config.sh"
+
+_dc_run \
+    app-summary-dev \
+    python -m pytest "$@"

docs/examples/compose/keycloak/README.md

@@ -61,11 +61,10 @@ services:
 `docker compose up -d`
 ```
 
-Your keycloak instance is now available on https://doc.yourdomain.tld
+Your keycloak instance is now available on https://id.yourdomain.tld
 
 > [!CAUTION]
 > Version of the images are set to latest, you should pin it to the desired version to avoid unwanted upgrades when pulling latest image. You can find available versions on [Keycloak registry](https://quay.io/repository/keycloak/keycloak?tab=tags).
-```
 
 ## Creating an OIDC Client for Meet Application
 
@@ -76,7 +75,7 @@ Your keycloak instance is now available on https://doc.yourdomain.tld
 3. Enter the name of the realm  - `meet`.
 4. Click "Create".
 
-#### Step 2: Create a New Client
+### Step 2: Create a New Client
 
 1. Navigate to the "Clients" tab.
 2. Click on the "Create client" button.
@@ -86,7 +85,7 @@ Your keycloak instance is now available on https://doc.yourdomain.tld
 1. Set the "Web Origins" to the URL of your meet application - e.g. `https://meet.example.com`.
 1. Click "Save".
 
-#### Step 3: Get Client Credentials
+### Step 3: Get Client Credentials
 
 1. Go to the "Credentials" tab.
 2. Copy the client ID (`meet` in this example) and the client secret.

env.d/development/common.dist

@@ -27,7 +27,7 @@ AWS_S3_DOMAIN_REPLACE=http://localhost:9000
 AWS_S3_ENDPOINT_URL=http://minio:9000
 AWS_S3_ACCESS_KEY_ID=meet
 AWS_S3_SECRET_ACCESS_KEY=password
-MEDIA_BASE_URL=http://localhost:8083
+MEDIA_BASE_URL=http://localhost:3000
 FILE_UPLOAD_ENABLED=True
 
 # OIDC

src/agents/Dockerfile

@@ -4,8 +4,6 @@ FROM python:3.13-slim AS base
 RUN apt-get update && apt-get install -y \
     libglib2.0-0 \
     libgobject-2.0-0 \
-    "openssl=3.5.4-1~deb13u2" \
-    "libssl3t64=3.5.4-1~deb13u2" \
     && rm -rf /var/lib/apt/lists/*
 
 FROM base AS builder

src/agents/pyproject.toml

@@ -1,7 +1,7 @@
 
 [project]
 name = "agents"
-version = "1.10.0"
+version = "1.11.0"
 requires-python = ">=3.12"
 dependencies = [
     "livekit-agents==1.3.10",

src/backend/meet/settings.py

@@ -452,7 +452,11 @@ class Base(Configuration):
     CELERY_BROKER_TRANSPORT_OPTIONS = values.DictValue({}, environ_prefix=None)
 
     # Session
-    SESSION_ENGINE = "django.contrib.sessions.backends.cache"
+    SESSION_ENGINE = values.Value(
+        default="django.contrib.sessions.backends.cache",
+        environ_name="SESSION_ENGINE",
+        environ_prefix=None,
+    )
     SESSION_CACHE_ALIAS = "default"
     SESSION_COOKIE_AGE = values.PositiveIntegerValue(
         default=60 * 60 * 12, environ_name="SESSION_COOKIE_AGE", environ_prefix=None

src/backend/pyproject.toml

@@ -7,7 +7,7 @@ build-backend = "uv_build"
 
 [project]
 name = "meet"
-version = "1.10.0"
+version = "1.11.0"
 authors = [{ "name" = "DINUM", "email" = "dev@mail.numerique.gouv.fr" }]
 classifiers = [
     "Development Status :: 5 - Production/Stable",
@@ -52,7 +52,7 @@ dependencies = [
     "nested-multipart-parser==1.6.0",
     "psycopg[binary]==3.3.2",
     "pydantic==2.12.4",
-    "PyJWT==2.11.0",
+    "PyJWT==2.12.0",
     "python-frontmatter==1.1.0",
     "python-magic==0.4.27",
     "requests==2.32.5",

src/backend/uv.lock

@@ -1157,7 +1157,7 @@ wheels = [
 
 [[package]]
 name = "meet"
-version = "1.10.0"
+version = "1.11.0"
 source = { editable = "." }
 dependencies = [
     { name = "aiohttp" },
@@ -1251,7 +1251,7 @@ requires-dist = [
     { name = "nested-multipart-parser", specifier = "==1.6.0" },
     { name = "psycopg", extras = ["binary"], specifier = "==3.3.2" },
     { name = "pydantic", specifier = "==2.12.4" },
-    { name = "pyjwt", specifier = "==2.11.0" },
+    { name = "pyjwt", specifier = "==2.12.0" },
     { name = "python-frontmatter", specifier = "==1.1.0" },
     { name = "python-magic", specifier = "==0.4.27" },
     { name = "redis", specifier = "==5.2.1" },
@@ -1754,11 +1754,11 @@ wheels = [
 
 [[package]]
 name = "pyjwt"
-version = "2.11.0"
+version = "2.12.0"
 source = { registry = "https://pypi.org/simple" }
-sdist = { url = "https://files.pythonhosted.org/packages/5c/5a/b46fa56bf322901eee5b0454a34343cdbdae202cd421775a8ee4e42fd519/pyjwt-2.11.0.tar.gz", hash = "sha256:35f95c1f0fbe5d5ba6e43f00271c275f7a1a4db1dab27bf708073b75318ea623", size = 98019, upload-time = "2026-01-30T19:59:55.694Z" }
+sdist = { url = "https://files.pythonhosted.org/packages/a8/10/e8192be5f38f3e8e7e046716de4cae33d56fd5ae08927a823bb916be36c1/pyjwt-2.12.0.tar.gz", hash = "sha256:2f62390b667cd8257de560b850bb5a883102a388829274147f1d724453f8fb02", size = 102511, upload-time = "2026-03-12T17:15:30.831Z" }
 wheels = [
-    { url = "https://files.pythonhosted.org/packages/6f/01/c26ce75ba460d5cd503da9e13b21a33804d38c2165dec7b716d06b13010c/pyjwt-2.11.0-py3-none-any.whl", hash = "sha256:94a6bde30eb5c8e04fee991062b534071fd1439ef58d2adc9ccb823e7bcd0469", size = 28224, upload-time = "2026-01-30T19:59:54.539Z" },
+    { url = "https://files.pythonhosted.org/packages/15/70/70f895f404d363d291dcf62c12c85fdd47619ad9674ac0f53364d035925a/pyjwt-2.12.0-py3-none-any.whl", hash = "sha256:9bb459d1bdd0387967d287f5656bf7ec2b9a26645d1961628cda1764e087fd6e", size = 29700, upload-time = "2026-03-12T17:15:29.257Z" },
 ]
 
 [[package]]

src/frontend/Dockerfile

@@ -1,14 +1,16 @@
 FROM node:20-alpine AS frontend-deps
 
+USER node
+
 WORKDIR /home/frontend/
 
-COPY ./src/frontend/package.json ./package.json
-COPY ./src/frontend/package-lock.json ./package-lock.json
+COPY --chown=node:node ./src/frontend/package.json ./package.json
+COPY --chown=node:node ./src/frontend/package-lock.json ./package-lock.json
 
 RUN npm ci
 
-COPY .dockerignore ./.dockerignore
-COPY ./src/frontend/ .
+COPY --chown=node:node .dockerignore ./.dockerignore
+COPY --chown=node:node ./src/frontend/ .
 
 ### ---- Front-end builder image ----
 FROM frontend-deps AS meet
@@ -17,6 +19,8 @@ WORKDIR /home/frontend
 
 FROM frontend-deps AS meet-dev
 
+USER node
+
 WORKDIR /home/frontend
 
 EXPOSE 8080

src/frontend/package-lock.json

@@ -1,12 +1,12 @@
 {
   "name": "meet",
-  "version": "1.10.0",
+  "version": "1.11.0",
   "lockfileVersion": 3,
   "requires": true,
   "packages": {
     "": {
       "name": "meet",
-      "version": "1.10.0",
+      "version": "1.11.0",
       "dependencies": {
         "@fontsource-variable/material-symbols-outlined": "5.2.34",
         "@fontsource/material-icons-outlined": "5.2.6",
@@ -6269,10 +6269,13 @@
       }
     },
     "node_modules/dompurify": {
-      "version": "3.3.1",
-      "resolved": "https://registry.npmjs.org/dompurify/-/dompurify-3.3.1.tgz",
-      "integrity": "sha512-qkdCKzLNtrgPFP1Vo+98FRzJnBRGe4ffyCea9IwHB1fyxPOeNTHpLKYGd4Uk9xvNoH0ZoOjwZxNptyMwqrId1Q==",
+      "version": "3.3.2",
+      "resolved": "https://registry.npmjs.org/dompurify/-/dompurify-3.3.2.tgz",
+      "integrity": "sha512-6obghkliLdmKa56xdbLOpUZ43pAR6xFy1uOrxBaIDjT+yaRuuybLjGS9eVBoSR/UPU5fq3OXClEHLJNGvbxKpQ==",
       "license": "(MPL-2.0 OR Apache-2.0)",
+      "engines": {
+        "node": ">=20"
+      },
       "optionalDependencies": {
         "@types/trusted-types": "^2.0.7"
       }
@@ -7158,10 +7161,11 @@
       }
     },
     "node_modules/flatted": {
-      "version": "3.3.1",
-      "resolved": "https://registry.npmjs.org/flatted/-/flatted-3.3.1.tgz",
-      "integrity": "sha512-X8cqMLLie7KsNUDSdzeN8FYK9rEt4Dt67OsG/DNGnYTSDBG4uFAJFBnUeiV+zCVAvwFy56IjM9sH51jVaEhNxw==",
-      "dev": true
+      "version": "3.4.2",
+      "resolved": "https://registry.npmjs.org/flatted/-/flatted-3.4.2.tgz",
+      "integrity": "sha512-PjDse7RzhcPkIJwy5t7KPWQSZ9cAbzQXcafsetQoD7sOJRQlGikNbx7yZp2OotDnJyrDcbyRq3Ttb18iYOqkxA==",
+      "dev": true,
+      "license": "ISC"
     },
     "node_modules/for-each": {
       "version": "0.3.3",
@@ -7628,9 +7632,9 @@
       "integrity": "sha512-Rf4YVNYpKjZ6ASAmibcwTNciQ5Co5Ztq6iZPEykHpkoflnD/K5ryE/rHehFsTm4NJj8nKDhbi3eKBWGogmNnkg=="
     },
     "node_modules/hono": {
-      "version": "4.12.2",
-      "resolved": "https://registry.npmjs.org/hono/-/hono-4.12.2.tgz",
-      "integrity": "sha512-gJnaDHXKDayjt8ue0n8Gs0A007yKXj4Xzb8+cNjZeYsSzzwKc0Lr+OZgYwVfB0pHfUs17EPoLvrOsEaJ9mj+Tg==",
+      "version": "4.12.8",
+      "resolved": "https://registry.npmjs.org/hono/-/hono-4.12.8.tgz",
+      "integrity": "sha512-VJCEvtrezO1IAR+kqEYnxUOoStaQPGrCmX3j4wDTNOcD1uRPFpGlwQUIW8niPuvHXaTUxeOUl5MMDGrl+tmO9A==",
       "dev": true,
       "license": "MIT",
       "engines": {
@@ -11107,9 +11111,9 @@
       }
     },
     "node_modules/undici": {
-      "version": "6.23.0",
-      "resolved": "https://registry.npmjs.org/undici/-/undici-6.23.0.tgz",
-      "integrity": "sha512-VfQPToRA5FZs/qJxLIinmU59u0r7LXqoJkCzinq3ckNJp3vKEh7jTWN589YQ5+aoAC/TGRLyJLCPKcLQbM8r9g==",
+      "version": "6.24.1",
+      "resolved": "https://registry.npmjs.org/undici/-/undici-6.24.1.tgz",
+      "integrity": "sha512-sC+b0tB1whOCzbtlx20fx3WgCXwkW627p4EA9uM+/tNNPkSS+eSEld6pAs9nDv7WbY1UUljBMYPtu9BCOrCWKA==",
       "license": "MIT",
       "engines": {
         "node": ">=18.17"

src/frontend/package.json

@@ -1,7 +1,7 @@
 {
   "name": "meet",
   "private": true,
-  "version": "1.10.0",
+  "version": "1.11.0",
   "type": "module",
   "scripts": {
     "dev": "panda codegen && vite",

src/frontend/src/api/fetchApi.ts

@@ -15,7 +15,19 @@ export const fetchApi = async <T = Record<string, unknown>>(
       ...options?.headers,
     },
   })
-  const result = await response.json()
+
+  let result: T
+  if (response.status === 204) {
+    result = undefined as T
+  } else {
+    const contentType = response.headers.get('content-type') ?? ''
+    if (!contentType.includes('application/json')) {
+      result = undefined as T
+    } else {
+      result = (await response.json()) as T
+    }
+  }
+
   if (!response.ok) {
     throw new ApiError(response.status, result)
   }

src/frontend/src/api/queryKeys.ts

@@ -5,4 +5,5 @@ export const keys = {
   requestEntry: 'requestEntry',
   waitingParticipants: 'waitingParticipants',
   roomCreationCallback: 'roomCreationCallback',
+  files: 'files',
 }

src/frontend/src/api/useConfig.ts

@@ -30,6 +30,13 @@ export interface ApiConfig {
     expiration_days?: number
     max_duration?: number
   }
+  background_image: {
+    upload_is_enabled: boolean
+    max_size: number
+    max_count_by_user: number
+    allowed_extensions: string[]
+    allowed_mimetypes: string[]
+  }
   subtitle: {
     enabled: boolean
   }

src/frontend/src/features/files/api/createFile.ts

@@ -0,0 +1,93 @@
+import { fetchApi } from '@/api/fetchApi'
+import { useMutation } from '@tanstack/react-query'
+import { ApiFileItem } from '@/features/files/api/types.ts'
+import { keys } from '@/api/queryKeys.ts'
+import { queryClient } from '@/api/queryClient.ts'
+
+/**
+ * Upload a file, using XHR so we can report on progress through a handler.
+ *
+ * @param url The URL to PUT the file to.
+ * @param file The file to upload.
+ * @param progressHandler A handler that receives progress updates as a single integer `0 <= x <= 100`.
+ */
+export const uploadFile = (
+  url: string,
+  file: File,
+  progressHandler: (progress: number) => void
+) =>
+  new Promise((resolve, reject) => {
+    const xhr = new XMLHttpRequest()
+    xhr.open('PUT', url)
+    xhr.setRequestHeader('X-amz-acl', 'private')
+    xhr.setRequestHeader('Content-Type', file.type)
+
+    xhr.addEventListener('error', reject)
+    xhr.addEventListener('abort', reject)
+
+    xhr.addEventListener('readystatechange', () => {
+      if (xhr.readyState === 4) {
+        if (xhr.status === 200) {
+          // Make sure to always set the progress to 100% when the upload is done.
+          // Because 'progress' event listener is not called when the file size is 0.
+          progressHandler(100)
+          return resolve(true)
+        }
+        reject(new Error(`Failed to perform the upload on ${url}.`))
+      }
+    })
+
+    xhr.upload.addEventListener('progress', (progressEvent) => {
+      if (progressEvent.lengthComputable) {
+        progressHandler(
+          Math.floor((progressEvent.loaded / progressEvent.total) * 100)
+        )
+      }
+    })
+
+    xhr.send(file)
+  })
+
+/**
+ * Asynchronously creates a new file and uploads it to the server.
+ *
+ * @param {object} params - The parameters for the file creation and upload process.
+ * @param {File} params.file - The file object to be uploaded.
+ * @param {function} params.onProgress - A callback function that receives the upload progress as a number (0 to 100).
+ * @returns {Promise<ApiFileItem>} A promise that resolves when the file has been successfully uploaded and the server process is completed.
+ */
+export const createFile = async ({
+  file,
+  onProgress,
+}: {
+  file: File
+  onProgress: (progress: number) => void
+}): Promise<ApiFileItem> => {
+  const res = await fetchApi<ApiFileItem>(`/files/`, {
+    method: 'POST',
+    body: JSON.stringify({ filename: file.name, type: 'background_image' }),
+  })
+  if (res.upload_state !== 'pending') {
+    throw new Error('State should be pending right after creation')
+  }
+  const policy = res.policy
+  await uploadFile(policy, file, onProgress)
+  const createdFile = await fetchApi<ApiFileItem>(
+    `/files/${res.id}/upload-ended/`,
+    {
+      method: 'POST',
+    }
+  )
+
+  // We invalidate the files query to make sure the new file is immediately available.
+  await queryClient.invalidateQueries({
+    queryKey: [keys.files],
+  })
+  return createdFile
+}
+
+export const useCreateFile = () => {
+  return useMutation({
+    mutationFn: createFile,
+  })
+}

src/frontend/src/features/files/api/deleteFile.ts

@@ -0,0 +1,33 @@
+import { fetchApi } from '@/api/fetchApi'
+import { useMutation, useQueryClient } from '@tanstack/react-query'
+import { keys } from '@/api/queryKeys.ts'
+
+/**
+ * Deletes a file specified by its unique identifier.
+ *
+ * @param {Object} params - The parameters required for deleting the file.
+ * @param {string} params.fileId - The unique identifier of the file to be deleted.
+ * @returns {Promise<void>} A promise that resolves when the file is successfully deleted.
+ */
+export const deleteFile = async ({
+  fileId,
+}: {
+  fileId: string
+}): Promise<void> => {
+  await fetchApi<void>(`/files/${fileId}/`, {
+    method: 'DELETE',
+  })
+}
+
+export const useDeleteFile = () => {
+  const queryClient = useQueryClient()
+
+  return useMutation({
+    mutationFn: deleteFile,
+    onSuccess: async () => {
+      await queryClient.invalidateQueries({
+        queryKey: [keys.files],
+      })
+    },
+  })
+}

src/frontend/src/features/files/api/listFiles.ts

@@ -0,0 +1,70 @@
+import { fetchApi } from '@/api/fetchApi'
+import { keepPreviousData, useQuery } from '@tanstack/react-query'
+import { keys } from '@/api/queryKeys'
+import {
+  ApiFileItem,
+  ApiFileType,
+  ApiFileUploadState,
+} from '@/features/files/api/types.ts'
+import { useUser } from '@/features/auth'
+import { useConfig } from '@/api/useConfig.ts'
+
+type ListFilesResponse = {
+  count: number
+  next: string | null
+  previous: string | null
+  results: ApiFileItem[]
+}
+
+type ListFilesFilters = {
+  is_creator_me?: boolean
+  type?: ApiFileType
+  upload_state?: ApiFileUploadState
+  is_deleted?: boolean
+}
+
+export type ListFilesParams = {
+  filters?: ListFilesFilters
+  pagination: {
+    page: number
+    pageSize: number
+  }
+}
+
+export const listMyFiles = async ({
+  filters = {},
+  pagination: { page, pageSize },
+}: ListFilesParams): Promise<ListFilesResponse> => {
+  const query = new URLSearchParams()
+  query.append('page', page.toString())
+  query.append('page_size', pageSize.toString())
+  if (filters?.is_creator_me ?? true) {
+    query.append('is_creator_me', 'true')
+  }
+  if (filters?.type) {
+    query.append('type', filters.type)
+  }
+  if (filters?.upload_state) {
+    query.append('upload_state', filters.upload_state)
+  }
+  if (typeof filters?.is_deleted === 'boolean') {
+    query.append('is_deleted', filters.is_deleted ? 'true' : 'false')
+  }
+
+  return fetchApi<ListFilesResponse>(`/files?${query.toString()}`, {
+    method: 'GET',
+  })
+}
+
+export const useListMyFiles = (params: Parameters<typeof listMyFiles>[0]) => {
+  const { isLoggedIn } = useUser()
+  const { data: appConfig } = useConfig()
+  return useQuery({
+    queryKey: [keys.files, params],
+    queryFn: () => listMyFiles(params),
+    refetchOnMount: 'always',
+    placeholderData: keepPreviousData,
+    enabled:
+      isLoggedIn && appConfig?.background_image?.upload_is_enabled === true,
+  })
+}

src/frontend/src/features/files/api/types.ts

@@ -0,0 +1,34 @@
+export type ApiFileCreator = {
+  id: string // UUID
+  full_name: string | null
+  short_name: string | null
+}
+
+export type ApiFileType = 'background_image'
+export type ApiFileUploadState = 'pending' | 'ready'
+
+export type ApiFileItem = {
+  id: string // UUID
+  created_at: string // ISO datetime string
+  updated_at: string // ISO datetime string
+  title: string
+  type: ApiFileType
+  creator: ApiFileCreator
+  deleted_at: string | null
+  hard_deleted_at: string | null
+  filename: string
+  upload_state: ApiFileUploadState
+  mimetype: string // e.g. "image/png"
+  size: number // file size in bytes
+  description: string | null
+} & (
+  | {
+      upload_state: 'ready'
+      url: string
+    }
+  | {
+      upload_state: 'pending'
+      policy: string
+      url: null
+    }
+)

src/frontend/src/features/rooms/components/Conference.tsx

@@ -215,8 +215,8 @@ export const Conference = ({
           audio={userConfig.audioEnabled}
           video={
             userConfig.videoEnabled && {
-              processor: BackgroundProcessorFactory.deserializeProcessor(
-                userConfig.processorSerialized
+              processor: BackgroundProcessorFactory.fromProcessorConfig(
+                userConfig.processorConfig
               ),
             }
           }

src/frontend/src/features/rooms/components/Join.tsx

@@ -4,15 +4,15 @@ import { css } from '@/styled-system/css'
 import { Screen } from '@/layout/Screen'
 import { useEffect, useMemo, useRef, useState } from 'react'
 import {
-  createLocalVideoTrack,
   createLocalAudioTrack,
+  createLocalVideoTrack,
   LocalAudioTrack,
   LocalVideoTrack,
   Track,
 } from 'livekit-client'
 import { H } from '@/primitives/H'
 import { Field } from '@/primitives/Field'
-import { Button, Dialog, Text, Form } from '@/primitives'
+import { Button, Dialog, Form, Text } from '@/primitives'
 import { VStack } from '@/styled-system/jsx'
 import { Heading } from 'react-aria-components'
 import { RiImageCircleAiFill } from '@remixicon/react'
@@ -44,8 +44,7 @@ const onError = (e: Error) => console.error('ERROR', e)
 
 const Effects = ({
   videoTrack,
-  onSubmit,
-}: Pick<EffectsConfigurationProps, 'videoTrack' | 'onSubmit'>) => {
+}: Pick<EffectsConfigurationProps, 'videoTrack'>) => {
   const { t } = useTranslation('rooms', { keyPrefix: 'join.effects' })
   const [isDialogOpen, setIsDialogOpen] = useState(false)
   const openDialog = () => setIsDialogOpen(true)
@@ -81,7 +80,7 @@ const Effects = ({
         >
           {t('subTitle')}
         </Text>
-        <EffectsConfiguration videoTrack={videoTrack} onSubmit={onSubmit} />
+        <EffectsConfiguration videoTrack={videoTrack} />
       </Dialog>
       <Button
         variant="whiteCircle"
@@ -111,7 +110,7 @@ export const Join = ({
       audioDeviceId,
       audioOutputDeviceId,
       videoDeviceId,
-      processorSerialized,
+      processorConfig,
       username,
     },
     saveAudioInputEnabled,
@@ -120,7 +119,6 @@ export const Join = ({
     saveAudioInputDeviceId,
     saveVideoInputDeviceId,
     saveUsername,
-    saveProcessorSerialized,
   } = usePersistentUserChoices()
 
   const initialUserChoices = useRef<LocalUserChoices | null>(null)
@@ -132,7 +130,7 @@ export const Join = ({
       audioDeviceId,
       audioOutputDeviceId,
       videoDeviceId,
-      processorSerialized,
+      processorConfig,
       username,
     }
   }
@@ -146,8 +144,8 @@ export const Join = ({
       video: !!initialUserChoices.current &&
         initialUserChoices.current?.videoEnabled && {
           deviceId: initialUserChoices.current.videoDeviceId,
-          processor: BackgroundProcessorFactory.deserializeProcessor(
-            initialUserChoices.current.processorSerialized
+          processor: BackgroundProcessorFactory.fromProcessorConfig(
+            initialUserChoices.current.processorConfig
           ),
         },
     },
@@ -186,9 +184,7 @@ export const Join = ({
         const track = await createLocalVideoTrack({
           deviceId: { exact: videoDeviceId },
           processor:
-            BackgroundProcessorFactory.deserializeProcessor(
-              processorSerialized
-            ),
+            BackgroundProcessorFactory.fromProcessorConfig(processorConfig),
         })
         setDynamicVideoTrack(track)
       } catch (error) {
@@ -207,7 +203,7 @@ export const Join = ({
   }, [
     videoEnabled,
     videoDeviceId,
-    processorSerialized,
+    processorConfig,
     previewVideoTrack,
     dynamicVideoTrack,
   ])
@@ -690,12 +686,7 @@ export const Join = ({
                     zIndex: '1',
                   })}
                 >
-                  <Effects
-                    videoTrack={videoTrack}
-                    onSubmit={(processor) =>
-                      saveProcessorSerialized(processor?.serialize())
-                    }
-                  />
+                  <Effects videoTrack={videoTrack} />
                 </div>
               </div>
             </div>

src/frontend/src/features/rooms/livekit/components/ParticipantTile.tsx

@@ -31,6 +31,8 @@ import { FullScreenShareWarning } from './FullScreenShareWarning'
 import { ParticipantName } from './ParticipantName'
 import { getParticipantName } from '@/features/rooms/utils/getParticipantName'
 import { useTranslation } from 'react-i18next'
+import { getShortcutDescriptorById } from '@/features/shortcuts/catalog'
+import { formatShortcutLabel } from '@/features/shortcuts/formatLabels'
 import { KeyboardShortcutHint } from './KeyboardShortcutHint'
 
 export function TrackRefContextIfNeeded(
@@ -237,7 +239,13 @@ export const ParticipantTile: (
           )}
         </ParticipantContextIfNeeded>
       </TrackRefContextIfNeeded>
-      <KeyboardShortcutHint>{t('toolbarHint')}</KeyboardShortcutHint>
+      <KeyboardShortcutHint>
+        {t('toolbarHint', {
+          shortcut: formatShortcutLabel(
+            getShortcutDescriptorById('open-shortcuts')?.shortcut
+          ),
+        })}
+      </KeyboardShortcutHint>
     </div>
   )
 })

src/frontend/src/features/rooms/livekit/components/SidePanel.tsx

@@ -149,11 +149,12 @@ export const SidePanel = () => {
     activeSubPanelId,
   } = useSidePanel()
   const { t } = useTranslation('rooms', { keyPrefix: 'sidePanel' })
+  const title = t(`heading.${activeSubPanelId || activePanelId}`)
 
   return (
     <StyledSidePanel
-      title={t(`heading.${activeSubPanelId || activePanelId}`)}
-      ariaLabel={t('ariaLabel')}
+      title={title}
+      ariaLabel={t('ariaLabel', { title })}
       onClose={() => {
         layoutStore.activePanelId = null
         layoutStore.activeSubPanelId = null

src/frontend/src/features/rooms/livekit/components/Tools.tsx

@@ -65,7 +65,7 @@ const ToolButton = ({
       <div>
         <Text
           margin={false}
-          as="h3"
+          as="h2"
           className={css({
             display: 'flex',
             gap: 0.25,

src/frontend/src/features/rooms/livekit/components/blur/BackgroundCustomProcessor.ts

@@ -11,11 +11,7 @@ import {
   TIMEOUT_TICK,
   timerWorkerScript,
 } from './TimerWorker'
-import {
-  BackgroundProcessorInterface,
-  BackgroundOptions,
-  ProcessorType,
-} from '.'
+import { BackgroundProcessorInterface, ProcessorConfig, ProcessorType } from '.'
 
 const PROCESSING_WIDTH = 256
 const PROCESSING_HEIGHT = 144
@@ -33,7 +29,7 @@ const DEFAULT_BLUR = '10'
  * MediaStreamTrackProcessor.
  */
 export class BackgroundCustomProcessor implements BackgroundProcessorInterface {
-  options: BackgroundOptions
+  options: ProcessorConfig
   name: string
   processedTrack?: MediaStreamTrack | undefined
 
@@ -64,15 +60,10 @@ export class BackgroundCustomProcessor implements BackgroundProcessorInterface {
   type: ProcessorType
   virtualBackgroundImage?: HTMLImageElement
 
-  constructor(opts: BackgroundOptions) {
+  constructor(opts: ProcessorConfig) {
     this.name = 'blur'
     this.options = opts
-
-    if (this.options.blurRadius) {
-      this.type = ProcessorType.BLUR
-    } else {
-      this.type = ProcessorType.VIRTUAL
-    }
+    this.type = opts.type
   }
 
   static get isSupported() {
@@ -107,6 +98,12 @@ export class BackgroundCustomProcessor implements BackgroundProcessorInterface {
   }
 
   _initVirtualBackgroundImage() {
+    if (this.options.type !== 'virtual') {
+      throw new Error(
+        'Virtual background is only supported for virtual background'
+      )
+    }
+
     const needsUpdate =
       this.options.imagePath &&
       this.virtualBackgroundImage &&
@@ -118,7 +115,7 @@ export class BackgroundCustomProcessor implements BackgroundProcessorInterface {
     }
   }
 
-  async update(opts: BackgroundOptions): Promise<void> {
+  async update(opts: ProcessorConfig): Promise<void> {
     this.options = opts
     this._initVirtualBackgroundImage()
   }
@@ -187,7 +184,7 @@ export class BackgroundCustomProcessor implements BackgroundProcessorInterface {
       0,
       0,
       PROCESSING_WIDTH,
-      PROCESSING_WIDTH
+      PROCESSING_HEIGHT
     )
   }
 
@@ -212,6 +209,9 @@ export class BackgroundCustomProcessor implements BackgroundProcessorInterface {
    * TODO: future improvement with WebGL.
    */
   async blur() {
+    if (this.options.type !== 'blur') {
+      throw new Error('Blurring is only supported for blur background')
+    }
     const mask = this.imageSegmenterResult!.categoryMask!.getAsUint8Array()
     for (let i = 0; i < mask.length; ++i) {
       this.segmentationMask!.data[i * 4 + 3] = 255 - mask[i]
@@ -293,7 +293,7 @@ export class BackgroundCustomProcessor implements BackgroundProcessorInterface {
     await this.sizeSource()
     await this.segment()
 
-    if (this.options.blurRadius) {
+    if (this.options.type === 'blur') {
       await this.blur()
     } else {
       await this.drawVirtualBackground()
@@ -354,15 +354,4 @@ export class BackgroundCustomProcessor implements BackgroundProcessorInterface {
     this.timerWorker?.terminate()
     this.imageSegmenter?.close()
   }
-
-  clone() {
-    return new BackgroundCustomProcessor(this.options)
-  }
-
-  serialize() {
-    return {
-      type: this.type,
-      options: this.options,
-    }
-  }
 }

src/frontend/src/features/rooms/livekit/components/blur/FaceLandmarksProcessor.ts

@@ -332,15 +332,4 @@ export class FaceLandmarksProcessor implements TrackProcessor<Track.Kind> {
     this.timerWorker?.terminate()
     this.faceLandmarker?.close()
   }
-
-  clone() {
-    return new FaceLandmarksProcessor(this.options)
-  }
-
-  serialize() {
-    return {
-      type: this.type,
-      options: this.options,
-    }
-  }
 }

src/frontend/src/features/rooms/livekit/components/blur/UnifiedBackgroundTrackProcessor.ts

@@ -1,28 +1,23 @@
 import { ProcessorOptions, Track } from 'livekit-client'
 import {
   BackgroundBlur,
-  BackgroundTransformer,
   ProcessorWrapper,
   VirtualBackground,
 } from '@livekit/track-processors'
-import {
-  BackgroundOptions,
-  BackgroundProcessorInterface,
-  ProcessorType,
-} from '.'
+import { ProcessorConfig, BackgroundProcessorInterface, ProcessorType } from '.'
 
 export class UnifiedBackgroundTrackProcessor implements BackgroundProcessorInterface {
-  processor: ProcessorWrapper<BackgroundOptions>
-  opts: BackgroundOptions
+  processor: ProcessorWrapper<{ imagePath?: string; blurRadius?: number }>
+  opts: ProcessorConfig
   processorType: ProcessorType
 
-  constructor(opts: BackgroundOptions) {
+  constructor(opts: ProcessorConfig) {
     this.opts = opts
 
-    if (opts.imagePath) {
+    if (opts.type === 'virtual') {
       this.processorType = ProcessorType.VIRTUAL
       this.processor = VirtualBackground(opts.imagePath)
-    } else if (opts.blurRadius !== undefined) {
+    } else if (opts.type === 'blur') {
       this.processorType = ProcessorType.BLUR
       this.processor = BackgroundBlur(opts.blurRadius)
     } else {
@@ -44,24 +39,23 @@ export class UnifiedBackgroundTrackProcessor implements BackgroundProcessorInter
     return this.processor.destroy()
   }
 
-  async update(opts: BackgroundOptions): Promise<void> {
-    const newProcessorType = opts.imagePath
-      ? ProcessorType.VIRTUAL
-      : ProcessorType.BLUR
+  async update(opts: ProcessorConfig): Promise<void> {
+    this.opts = opts
+
+    const newProcessorType =
+      opts.type === 'virtual' ? ProcessorType.VIRTUAL : ProcessorType.BLUR
 
-    let processedOpts = opts
     if (newProcessorType !== this.processorType) {
       this.processorType = newProcessorType
       if (newProcessorType === ProcessorType.VIRTUAL) {
         this.processor.name = 'virtual-background'
-        processedOpts = { ...opts, blurRadius: undefined }
       } else {
         this.processor.name = 'background-blur'
-        processedOpts = { ...opts, imagePath: undefined }
       }
     }
-    await this.processor.updateTransformerOptions(processedOpts)
-    this.opts = processedOpts
+    await this.processor.updateTransformerOptions(
+      opts as { imagePath?: string; blurRadius?: number }
+    )
   }
 
   get name() {
@@ -73,17 +67,6 @@ export class UnifiedBackgroundTrackProcessor implements BackgroundProcessorInter
   }
 
   get options() {
-    return (this.processor.transformer as BackgroundTransformer).options
-  }
-
-  clone() {
-    return new UnifiedBackgroundTrackProcessor(this.options || this.opts)
-  }
-
-  serialize() {
-    return {
-      type: this.processorType,
-      options: this.options,
-    }
+    return this.opts
   }
 }

src/frontend/src/features/rooms/livekit/components/blur/index.ts

@@ -2,23 +2,7 @@ import { ProcessorWrapper } from '@livekit/track-processors'
 import { Track, TrackProcessor } from 'livekit-client'
 import { BackgroundCustomProcessor } from './BackgroundCustomProcessor'
 import { UnifiedBackgroundTrackProcessor } from './UnifiedBackgroundTrackProcessor'
-
-export type BackgroundOptions = {
-  blurRadius?: number
-  imagePath?: string
-}
-
-export interface ProcessorSerialized {
-  type: ProcessorType
-  options: BackgroundOptions
-}
-
-export interface BackgroundProcessorInterface extends TrackProcessor<Track.Kind> {
-  update(opts: BackgroundOptions): Promise<void>
-  options: BackgroundOptions
-  clone(): BackgroundProcessorInterface
-  serialize(): ProcessorSerialized
-}
+import { FaceLandmarksOptions } from './FaceLandmarksProcessor'
 
 export enum ProcessorType {
   BLUR = 'blur',
@@ -26,6 +10,16 @@ export enum ProcessorType {
   FACE_LANDMARKS = 'faceLandmarks',
 }
 
+export type ProcessorConfig =
+  | { type: ProcessorType.BLUR; blurRadius: number }
+  | { type: ProcessorType.VIRTUAL; imagePath: string; fileId?: string }
+  | ({ type: ProcessorType.FACE_LANDMARKS } & FaceLandmarksOptions)
+
+export interface BackgroundProcessorInterface extends TrackProcessor<Track.Kind> {
+  update(opts: ProcessorConfig): Promise<void>
+  options: ProcessorConfig
+}
+
 export class BackgroundProcessorFactory {
   static hasModernApiSupport() {
     return ProcessorWrapper.hasModernApiSupport
@@ -36,28 +30,27 @@ export class BackgroundProcessorFactory {
   }
 
   static getProcessor(
-    type: ProcessorType,
-    opts: BackgroundOptions
+    config: ProcessorConfig
   ): BackgroundProcessorInterface | undefined {
-    const isBlur = type === ProcessorType.BLUR
-    const isVirtual = type === ProcessorType.VIRTUAL
+    const isBlur = config.type === ProcessorType.BLUR
+    const isVirtual = config.type === ProcessorType.VIRTUAL
 
     if (!isBlur && !isVirtual) return undefined
 
     if (ProcessorWrapper.isSupported) {
-      return new UnifiedBackgroundTrackProcessor(opts)
+      return new UnifiedBackgroundTrackProcessor(config)
     }
 
     if (BackgroundCustomProcessor.isSupported) {
-      return new BackgroundCustomProcessor(opts)
+      return new BackgroundCustomProcessor(config)
     }
 
     return undefined
   }
 
-  static deserializeProcessor(data?: ProcessorSerialized) {
-    if (data?.type) {
-      return BackgroundProcessorFactory.getProcessor(data?.type, data?.options)
+  static fromProcessorConfig(data?: ProcessorConfig) {
+    if (data) {
+      return BackgroundProcessorFactory.getProcessor(data)
     }
     return undefined
   }

src/frontend/src/features/rooms/livekit/components/controls/Device/SelectDevice.tsx

@@ -69,10 +69,10 @@ const SelectDevicePermissions = <T extends string | number>({
       iconComponent={iconComponent}
       placeholder={items.length === 0 ? t('loading') : t('select')}
       selectedKey={selectedKey}
-      onSelectionChange={(key) => {
+      onSelectionChange={async (key) => {
         if (key === selectedKey) return
+        await setActiveMediaDevice(key as string)
         onSubmit?.(key as string)
-        setActiveMediaDevice(key as string)
       }}
       {...props}
     />

src/frontend/src/features/rooms/livekit/components/controls/Device/VideoDeviceControl.tsx

@@ -82,8 +82,8 @@ export const VideoDeviceControl = ({
      *
      * See https://github.com/numerique-gouv/meet/pull/309#issuecomment-2622404121
      */
-    const processor = BackgroundProcessorFactory.deserializeProcessor(
-      userChoices.processorSerialized
+    const processor = BackgroundProcessorFactory.fromProcessorConfig(
+      userChoices.processorConfig
     )
 
     const toggle = trackProps.toggle as (

src/frontend/src/features/rooms/livekit/components/effects/Effects.tsx

@@ -2,14 +2,12 @@ import { useLocalParticipant } from '@livekit/components-react'
 import { LocalVideoTrack } from 'livekit-client'
 import { css } from '@/styled-system/css'
 import { EffectsConfiguration } from './EffectsConfiguration'
-import { usePersistentUserChoices } from '../../hooks/usePersistentUserChoices'
 import { useCanPublishTrack } from '@/features/rooms/livekit/hooks/useCanPublishTrack'
 import { TrackSource } from '@livekit/protocol'
 
 export const Effects = () => {
   const { cameraTrack } = useLocalParticipant()
   const localCameraTrack = cameraTrack?.track as LocalVideoTrack
-  const { saveProcessorSerialized } = usePersistentUserChoices()
 
   const canPublishCamera = useCanPublishTrack(TrackSource.CAMERA)
 
@@ -24,9 +22,6 @@ export const Effects = () => {
         isDisabled={!canPublishCamera}
         videoTrack={localCameraTrack}
         layout="vertical"
-        onSubmit={(processor) =>
-          saveProcessorSerialized(processor?.serialize())
-        }
       />
     </div>
   )

src/frontend/src/features/rooms/livekit/components/effects/FunnyEffects.tsx

@@ -27,7 +27,7 @@ export const FunnyEffects = ({
         showFrench: false,
       }
     }
-    return processor.serialize().options
+    return { ...processor.options }
   }
 
   const options = getOptions()

src/frontend/src/features/rooms/livekit/hooks/usePersistentUserChoices.ts

@@ -1,7 +1,7 @@
 import { useSnapshot } from 'valtio'
 import { userChoicesStore } from '@/stores/userChoices'
 import type { VideoResolution } from '@/stores/userChoices'
-import { ProcessorSerialized } from '@/features/rooms/livekit/components/blur'
+import { ProcessorConfig } from '@/features/rooms/livekit/components/blur'
 import type { VideoQuality } from 'livekit-client'
 
 export function usePersistentUserChoices() {
@@ -36,10 +36,8 @@ export function usePersistentUserChoices() {
     saveNoiseReductionEnabled: (enabled: boolean) => {
       userChoicesStore.noiseReductionEnabled = enabled
     },
-    saveProcessorSerialized: (
-      processorSerialized: ProcessorSerialized | undefined
-    ) => {
-      userChoicesStore.processorSerialized = processorSerialized
+    saveProcessorConfig: (processorConfig: ProcessorConfig | undefined) => {
+      userChoicesStore.processorConfig = processorConfig
     },
   }
 }

src/frontend/src/features/settings/components/tabs/VideoTab.tsx

@@ -31,7 +31,7 @@ export const VideoTab = ({ id }: VideoTabProps) => {
   const {
     userChoices: {
       videoDeviceId,
-      processorSerialized,
+      processorConfig,
       videoPublishResolution,
       videoSubscribeQuality,
     },
@@ -78,7 +78,7 @@ export const VideoTab = ({ id }: VideoTabProps) => {
         resolution: VideoPresets[key].resolution,
         deviceId: { exact: videoDeviceId },
         processor:
-          BackgroundProcessorFactory.deserializeProcessor(processorSerialized),
+          BackgroundProcessorFactory.fromProcessorConfig(processorConfig),
       })
     }
   }

src/frontend/src/features/subtitle/component/CaptionsSettings.tsx

@@ -6,8 +6,11 @@ import { useSnapshot } from 'valtio'
 import {
   accessibilityStore,
   type CaptionTextSize,
+  type CaptionColor,
   CAPTION_TEXT_SIZE_OPTIONS,
+  CAPTION_COLOR_OPTIONS,
 } from '@/stores/accessibility'
+import { useAreSubtitlesAvailable } from '../hooks/useAreSubtitlesAvailable'
 
 export const CaptionsSettings = () => {
   const { t } = useTranslation('settings', {
@@ -24,6 +27,27 @@ export const CaptionsSettings = () => {
     [t]
   )
 
+  const captionFontColorItems = useMemo(
+    () =>
+      CAPTION_COLOR_OPTIONS.map((color) => ({
+        value: color,
+        label: t(`fontColor.options.${color}`),
+      })),
+    [t]
+  )
+
+  const captionBackgroundColorItems = useMemo(
+    () =>
+      CAPTION_COLOR_OPTIONS.map((color) => ({
+        value: color,
+        label: t(`backgroundColor.options.${color}`),
+      })),
+    [t]
+  )
+
+  const areSubtitlesAvailable = useAreSubtitlesAvailable()
+  if (!areSubtitlesAvailable) return null
+
   return (
     <li>
       <H
@@ -34,16 +58,44 @@ export const CaptionsSettings = () => {
       >
         {t('heading')}
       </H>
-      <Field
-        type="select"
-        label={t('textSize.label')}
-        items={captionTextSizeItems}
-        selectedKey={snap.captionTextSize}
-        onSelectionChange={(key) => {
-          accessibilityStore.captionTextSize = key as CaptionTextSize
-        }}
-        wrapperProps={{ noMargin: true, fullWidth: true }}
-      />
+      <div
+        className={css({
+          display: 'flex',
+          flexDirection: 'column',
+          gap: '0.75rem',
+        })}
+      >
+        <Field
+          type="select"
+          label={t('textSize.label')}
+          items={captionTextSizeItems}
+          selectedKey={snap.captionTextSize}
+          onSelectionChange={(key) => {
+            accessibilityStore.captionTextSize = key as CaptionTextSize
+          }}
+          wrapperProps={{ noMargin: true, fullWidth: true }}
+        />
+        <Field
+          type="select"
+          label={t('fontColor.label')}
+          items={captionFontColorItems}
+          selectedKey={snap.captionFontColor}
+          onSelectionChange={(key) => {
+            accessibilityStore.captionFontColor = key as CaptionColor
+          }}
+          wrapperProps={{ noMargin: true, fullWidth: true }}
+        />
+        <Field
+          type="select"
+          label={t('backgroundColor.label')}
+          items={captionBackgroundColorItems}
+          selectedKey={snap.captionBackgroundColor}
+          onSelectionChange={(key) => {
+            accessibilityStore.captionBackgroundColor = key as CaptionColor
+          }}
+          wrapperProps={{ noMargin: true, fullWidth: true }}
+        />
+      </div>
     </li>
   )
 }

src/frontend/src/features/subtitle/component/Subtitles.tsx

@@ -12,6 +12,8 @@ import { useSnapshot } from 'valtio'
 import {
   accessibilityStore,
   CAPTION_TEXT_SIZE_OPTIONS,
+  CAPTION_FONT_COLOR_VALUES,
+  CAPTION_BACKGROUND_COLOR_VALUES,
   type CaptionTextSize,
 } from '@/stores/accessibility'
 
@@ -92,10 +94,14 @@ const useTranscriptionState = () => {
 }
 
 const Transcription = ({ row }: { row: TranscriptionRow }) => {
-  const { captionTextSize } = useSnapshot(accessibilityStore)
+  const { captionTextSize, captionFontColor, captionBackgroundColor } =
+    useSnapshot(accessibilityStore)
   const participantColor = getParticipantColor(row.participant)
   const participantName = getParticipantName(row.participant)
   const { fontSize, lineHeight } = CAPTION_FONT_SIZES[captionTextSize]
+  const fontColor = CAPTION_FONT_COLOR_VALUES[captionFontColor]
+  const backgroundColor =
+    CAPTION_BACKGROUND_COLOR_VALUES[captionBackgroundColor]
 
   const getDisplayText = (row: TranscriptionRow): string => {
     return row.segments
@@ -128,9 +134,9 @@ const Transcription = ({ row }: { row: TranscriptionRow }) => {
         />
         <div
           className={css({
-            color: 'white',
             width: '100%',
           })}
+          style={{ color: fontColor }}
         >
           <Text variant="h3" margin={false}>
             {participantName}
@@ -138,8 +144,10 @@ const Transcription = ({ row }: { row: TranscriptionRow }) => {
           <p
             className={css({
               fontWeight: '400',
+              borderRadius: '4px',
+              padding: '0.125rem 0.25rem',
             })}
-            style={{ fontSize, lineHeight }}
+            style={{ fontSize, lineHeight, backgroundColor }}
           >
             {displayText}
           </p>

src/frontend/src/locales/de/rooms.json

@@ -273,17 +273,40 @@
       "title": "Virtueller Hintergrund",
       "selectedLabel": "Hintergrund angewendet:",
       "apply": "Ersetze deinen Hintergrund:",
-      "descriptions": {
-        "0": "Gerilltes Holzmöbel",
-        "1": "Besprechungsraum",
-        "2": "Loft mit schwarzer Glaswand",
-        "3": "Esszimmer",
-        "4": "Holzregale",
-        "5": "Holztreppe",
-        "6": "Graue Bibliothek",
-        "7": "Kaffeetheke"
+      "personal": {
+        "title": "Meine Hintergründe",
+        "selectFileTooltip": "Wähle ein Bild aus, das als persönlicher Hintergrund verwendet werden soll",
+        "notLoggedInWarning": "Du bist nicht angemeldet, der persönliche Hintergrund wird nicht von einem Meeting zum anderen gespeichert.",
+        "warningUploadDisabled": "Persönliche Hintergründe werden derzeit nicht von einem Meeting zum anderen gespeichert.",
+        "uploadLimitReached": "Du kannst keine weiteren persönlichen Hintergründe hinzufügen.",
+        "uploadInProgress": "Datei wird hochgeladen…",
+        "errors": {
+          "close": "Schließen",
+          "file_too_large": {
+            "title": "Datei zu groß",
+            "description": "Die Datei ist zu groß. Bitte wähle eine Datei mit weniger als {{maxSize, number}} MB."
+          },
+          "invalid_file_type": {
+            "title": "Ungültiger Dateityp",
+            "description": "Der Dateityp wird nicht unterstützt. Bitte wähle eine {{allowedExtension}}-Datei."
+          }
+        }
+      },
+      "presets": {
+        "title": "Vorschläge",
+        "descriptions": {
+          "0": "Gerilltes Holzmöbel",
+          "1": "Besprechungsraum",
+          "2": "Loft mit schwarzer Glaswand",
+          "3": "Esszimmer",
+          "4": "Holzregale",
+          "5": "Holztreppe",
+          "6": "Graue Bibliothek",
+          "7": "Kaffeetheke"
+        }
       }
     },
+
     "faceLandmarks": {
       "title": "Visuelle Effekte",
       "glasses": {
@@ -297,7 +320,7 @@
     }
   },
   "sidePanel": {
-    "ariaLabel": "Seitenleiste",
+    "ariaLabel": "Seitenleiste - {{title}}",
     "backToTools": "Zurück zu den Meeting-Tools",
     "heading": {
       "participants": "Teilnehmende",
@@ -332,11 +355,11 @@
     "tools": {
       "transcript": {
         "title": "Transkribieren",
-        "body": "Das Gespräch aufzeichnen."
+        "body": "Wandelt Meetings in Text um."
       },
       "screenRecording": {
-        "title": "Aufzeichnen",
-        "body": "Das Meeting aufzeichnen."
+        "title": "Aufnehmen",
+        "body": "Speichert Meetings als Video."
       }
     }
   },
@@ -597,7 +620,7 @@
   },
   "participantTileFocus": {
     "containerLabel": "Optionen für {{name}}",
-    "toolbarHint": "Ctrl+Shift+/: Direkt auf die Tastenkürzel zugreifen.",
+    "toolbarHint": "{{shortcut}}: Direkt auf die Tastenkürzel zugreifen.",
     "pin": {
       "enable": "Anheften",
       "disable": "Lösen"

src/frontend/src/locales/de/settings.json

@@ -126,6 +126,34 @@
           "medium": "Mittel",
           "large": "Groß"
         }
+      },
+      "fontColor": {
+        "label": "Schriftfarbe",
+        "options": {
+          "default": "Standard",
+          "white": "Weiß",
+          "black": "Schwarz",
+          "blue": "Blau",
+          "green": "Grün",
+          "red": "Rot",
+          "yellow": "Gelb",
+          "cyan": "Cyan",
+          "magenta": "Magenta"
+        }
+      },
+      "backgroundColor": {
+        "label": "Hintergrundfarbe",
+        "options": {
+          "default": "Standard",
+          "white": "Weiß",
+          "black": "Schwarz",
+          "blue": "Blau",
+          "green": "Grün",
+          "red": "Rot",
+          "yellow": "Gelb",
+          "cyan": "Cyan",
+          "magenta": "Magenta"
+        }
       }
     }
   },

src/frontend/src/locales/en/rooms.json

@@ -270,18 +270,40 @@
       }
     },
     "virtual": {
-      "title": "Virtual background",
+      "title": "Virtual backgrounds",
       "selectedLabel": "Background applied:",
       "apply": "Replace your background:",
-      "descriptions": {
-        "0": "Fluted wooden furniture",
-        "1": "Meeting room",
-        "2": "Loft with black glass partition",
-        "3": "Dining room",
-        "4": "Wooden shelves",
-        "5": "Wooden staircase",
-        "6": "Gray library",
-        "7": "Coffee counter"
+      "personal": {
+        "title": "My backgrounds",
+        "selectFileTooltip": "Select an image file to use as a personal background",
+        "notLoggedInWarning": "You are not logged-in, personal backgrounds won't be saved from one meeting to the other.",
+        "warningUploadDisabled": "Personal backgrounds are currently not saved from one meeting to the other.",
+        "uploadLimitReached": "You cannot upload more personal backgrounds.",
+        "uploadInProgress": "Image is being uploaded…",
+        "errors": {
+          "close": "Close",
+          "file_too_large": {
+            "title": "File too large",
+            "description": "The file is too large. Please choose a file smaller than {{maxSize, number}} MB."
+          },
+          "invalid_file_type": {
+            "title": "Invalid file type",
+            "description": "The file type is not supported. Please choose a {{allowedExtension, list(type: 'disjunction')}} file."
+          }
+        }
+      },
+      "presets": {
+        "title": "Suggestions",
+        "descriptions": {
+          "0": "Fluted wooden furniture",
+          "1": "Meeting room",
+          "2": "Loft with black glass partition",
+          "3": "Dining room",
+          "4": "Wooden shelves",
+          "5": "Wooden staircase",
+          "6": "Gray library",
+          "7": "Coffee counter"
+        }
       }
     },
     "faceLandmarks": {
@@ -297,7 +319,7 @@
     }
   },
   "sidePanel": {
-    "ariaLabel": "Sidepanel",
+    "ariaLabel": "Sidepanel - {{title}}",
     "backToTools": "Back to meeting tools",
     "heading": {
       "participants": "Participants",
@@ -332,11 +354,11 @@
     "tools": {
       "transcript": {
         "title": "Transcribe",
-        "body": "Record the conversation."
+        "body": "Turn meetings into text."
       },
       "screenRecording": {
         "title": "Record",
-        "body": "Record the meeting."
+        "body": "Save meetings as video."
       }
     }
   },
@@ -597,7 +619,7 @@
   },
   "participantTileFocus": {
     "containerLabel": "Options for {{name}}",
-    "toolbarHint": "Ctrl+Shift+/: access shortcuts directly.",
+    "toolbarHint": "{{shortcut}}: access shortcuts directly.",
     "pin": {
       "enable": "Pin",
       "disable": "Unpin"

src/frontend/src/locales/en/settings.json

@@ -126,6 +126,34 @@
           "medium": "Medium",
           "large": "Large"
         }
+      },
+      "fontColor": {
+        "label": "Font color",
+        "options": {
+          "default": "Default",
+          "white": "White",
+          "black": "Black",
+          "blue": "Blue",
+          "green": "Green",
+          "red": "Red",
+          "yellow": "Yellow",
+          "cyan": "Cyan",
+          "magenta": "Magenta"
+        }
+      },
+      "backgroundColor": {
+        "label": "Background color",
+        "options": {
+          "default": "Default",
+          "white": "White",
+          "black": "Black",
+          "blue": "Blue",
+          "green": "Green",
+          "red": "Red",
+          "yellow": "Yellow",
+          "cyan": "Cyan",
+          "magenta": "Magenta"
+        }
       }
     }
   },

src/frontend/src/locales/fr/rooms.json

@@ -270,18 +270,40 @@
       }
     },
     "virtual": {
-      "title": "Arrière-plan virtuel",
+      "title": "Arrière-plans virtuels",
       "selectedLabel": "Arrière-plan appliqué :",
       "apply": "Remplacer votre arrière plan :",
-      "descriptions": {
-        "0": "Meuble cannelé en bois",
-        "1": "Salle de réunion",
-        "2": "Loft avec verrière noire",
-        "3": "Salle à manger",
-        "4": "Étagères en bois",
-        "5": "Escalier en bois",
-        "6": "Bibliothèque grise",
-        "7": "Comptoir de café"
+      "personal": {
+        "title": "Mes arrière-plans",
+        "selectFileTooltip": "Sélectionnez une image à utiliser comme arrière-plan",
+        "notLoggedInWarning": "Vous n'êtes pas connecté, l'arrière-plan personnel ne sera pas sauvegardé d'une réunion à l'autre.",
+        "warningUploadDisabled": "Les arrière-plans personnels ne sont actuellement pas sauvegardés d'une réunion à l'autre.",
+        "uploadLimitReached": "Vous ne pouvez pas ajouter plus d'arrière-plans personnels.",
+        "uploadInProgress": "Image en cours d'envoi…",
+        "errors": {
+          "close": "Fermer",
+          "file_too_large": {
+            "title": "Fichier trop volumineux",
+            "description": "Le fichier est trop volumineux. Veuillez choisir un fichier de moins de {{maxSize, number}} Mo."
+          },
+          "invalid_file_type": {
+            "title": "Type de fichier non valide",
+            "description": "Le type de fichier n'est pas pris en charge. Veuillez choisir un fichier {{allowedExtension}}."
+          }
+        }
+      },
+      "presets": {
+        "title": "Suggestions",
+        "descriptions": {
+          "0": "Meuble cannelé en bois",
+          "1": "Salle de réunion",
+          "2": "Loft avec verrière noire",
+          "3": "Salle à manger",
+          "4": "Étagères en bois",
+          "5": "Escalier en bois",
+          "6": "Bibliothèque grise",
+          "7": "Comptoir de café"
+        }
       }
     },
     "faceLandmarks": {
@@ -297,7 +319,7 @@
     }
   },
   "sidePanel": {
-    "ariaLabel": "Panneau latéral",
+    "ariaLabel": "Panneau latéral - {{title}}",
     "backToTools": "Retour aux outils de réunion",
     "heading": {
       "participants": "Participants",
@@ -332,11 +354,11 @@
     "tools": {
       "transcript": {
         "title": "Transcrire",
-        "body": "Enregistrer la conversation."
+        "body": "Transcrire la réunion."
       },
       "screenRecording": {
         "title": "Enregistrer",
-        "body": "Enregistrer la réunion."
+        "body": "Enregistrer la réunion en vidéo."
       }
     }
   },
@@ -597,7 +619,7 @@
   },
   "participantTileFocus": {
     "containerLabel": "Options pour {{name}}",
-    "toolbarHint": "Ctrl+Shift+/ : accéder directement aux raccourcis.",
+    "toolbarHint": "{{shortcut}} : accéder directement aux raccourcis.",
     "pin": {
       "enable": "Épingler",
       "disable": "Annuler l'épinglage"

src/frontend/src/locales/fr/settings.json

@@ -126,6 +126,34 @@
           "medium": "Moyen",
           "large": "Grand"
         }
+      },
+      "fontColor": {
+        "label": "Couleur du texte",
+        "options": {
+          "default": "Par défaut",
+          "white": "Blanc",
+          "black": "Noir",
+          "blue": "Bleu",
+          "green": "Vert",
+          "red": "Rouge",
+          "yellow": "Jaune",
+          "cyan": "Cyan",
+          "magenta": "Magenta"
+        }
+      },
+      "backgroundColor": {
+        "label": "Couleur de fond",
+        "options": {
+          "default": "Par défaut",
+          "white": "Blanc",
+          "black": "Noir",
+          "blue": "Bleu",
+          "green": "Vert",
+          "red": "Rouge",
+          "yellow": "Jaune",
+          "cyan": "Cyan",
+          "magenta": "Magenta"
+        }
       }
     }
   },

src/frontend/src/locales/nl/rooms.json

@@ -273,15 +273,37 @@
       "title": "Virtuele achtergrond",
       "selectedLabel": "Achtergrond toegepast:",
       "apply": "Vervang je achtergrond:",
-      "descriptions": {
-        "0": "Geprofileerd houten meubel",
-        "1": "Vergaderruimte",
-        "2": "Loft met zwarte glaswand",
-        "3": "Eetkamer",
-        "4": "Houten planken",
-        "5": "Houten trap",
-        "6": "Grijze bibliotheek",
-        "7": "Koffiebar"
+      "personal": {
+        "title": "Mijn achtergronden",
+        "selectFileTooltip": "Selecteer een afbeeldingsbestand om te gebruiken als persoonlijke achtergrond",
+        "notLoggedInWarning": "U bent niet ingelogd, persoonlijke achtergronden worden niet opgeslagen van de ene vergadering naar de andere.",
+        "warningUploadDisabled": "Persoonlijke achtergronden worden momenteel niet opgeslagen van de ene vergadering naar de andere.",
+        "uploadLimitReached": "U kunt geen persoonlijke achtergronden meer uploaden.",
+        "uploadInProgress": "Afbeelding wordt geüpload…",
+        "errors": {
+          "close": "Sluiten",
+          "file_too_large": {
+            "title": "Bestand te groot",
+            "description": "Het bestand is te groot. Kies een bestand kleiner dan {{maxSize, number}} MB."
+          },
+          "invalid_file_type": {
+            "title": "Ongeldig bestandstype",
+            "description": "Het bestandstype wordt niet ondersteund. Kies een {{allowedExtension, list(type: 'disjunction')}} bestand."
+          }
+        }
+      },
+      "presets": {
+        "title": "Suggesties",
+        "descriptions": {
+          "0": "Geprofileerd houten meubel",
+          "1": "Vergaderruimte",
+          "2": "Loft met zwarte glaswand",
+          "3": "Eetkamer",
+          "4": "Houten planken",
+          "5": "Houten trap",
+          "6": "Grijze bibliotheek",
+          "7": "Koffiebar"
+        }
       }
     },
     "faceLandmarks": {
@@ -297,7 +319,7 @@
     }
   },
   "sidePanel": {
-    "ariaLabel": "Zijbalk",
+    "ariaLabel": "Zijbalk - {{title}}",
     "backToTools": "Terug naar vergadertools",
     "heading": {
       "participants": "Deelnemers",
@@ -332,11 +354,11 @@
     "tools": {
       "transcript": {
         "title": "Transcriberen",
-        "body": "Het gesprek opnemen."
+        "body": "Zet vergaderingen om in tekst."
       },
       "screenRecording": {
         "title": "Opnemen",
-        "body": "De vergadering opnemen."
+        "body": "Sla vergaderingen op als video."
       }
     }
   },
@@ -597,7 +619,7 @@
   },
   "participantTileFocus": {
     "containerLabel": "Opties voor {{name}}",
-    "toolbarHint": "Ctrl+Shift+/: direct toegang tot de sneltoetsen.",
+    "toolbarHint": "{{shortcut}}: direct toegang tot de sneltoetsen.",
     "pin": {
       "enable": "Pinnen",
       "disable": "Losmaken"

src/frontend/src/locales/nl/settings.json

@@ -126,6 +126,34 @@
           "medium": "Gemiddeld",
           "large": "Groot"
         }
+      },
+      "fontColor": {
+        "label": "Tekstkleur",
+        "options": {
+          "default": "Standaard",
+          "white": "Wit",
+          "black": "Zwart",
+          "blue": "Blauw",
+          "green": "Groen",
+          "red": "Rood",
+          "yellow": "Geel",
+          "cyan": "Cyaan",
+          "magenta": "Magenta"
+        }
+      },
+      "backgroundColor": {
+        "label": "Achtergrondkleur",
+        "options": {
+          "default": "Standaard",
+          "white": "Wit",
+          "black": "Zwart",
+          "blue": "Blauw",
+          "green": "Groen",
+          "red": "Rood",
+          "yellow": "Geel",
+          "cyan": "Cyaan",
+          "magenta": "Magenta"
+        }
       }
     }
   },

src/frontend/src/primitives/Spinner.tsx

@@ -20,7 +20,11 @@ export const Spinner = ({
   const r = 14 - strokeWidth
   const c = 2 * r * Math.PI
   return (
-    <ProgressBar aria-label="Loading..." value={30}>
+    <ProgressBar
+      aria-label="Loading..."
+      value={30}
+      style={{ height: size, width: size }}
+    >
       {({ percentage }) => (
         <div
           className={css({

src/frontend/src/primitives/Text.tsx

@@ -36,6 +36,10 @@ export const text = cva({
         textStyle: 'body',
         fontWeight: 'bold',
       },
+      bodyXsMedium: {
+        textStyle: 'body',
+        fontWeight: 'medium',
+      },
       body: {
         textStyle: 'body',
       },

src/frontend/src/stores/accessibility.ts

@@ -10,14 +10,65 @@ export const CAPTION_TEXT_SIZE_OPTIONS: CaptionTextSize[] = [
   'large',
 ]
 
+export type CaptionColor =
+  | 'default'
+  | 'white'
+  | 'black'
+  | 'blue'
+  | 'green'
+  | 'red'
+  | 'yellow'
+  | 'cyan'
+  | 'magenta'
+
+export const CAPTION_COLOR_OPTIONS: CaptionColor[] = [
+  'default',
+  'white',
+  'black',
+  'blue',
+  'green',
+  'red',
+  'yellow',
+  'cyan',
+  'magenta',
+]
+
+export const CAPTION_FONT_COLOR_VALUES: Record<CaptionColor, string> = {
+  default: '#FFFFFF',
+  white: '#FFFFFF',
+  black: '#000000',
+  blue: '#0000FF',
+  green: '#00FF00',
+  red: '#FF0000',
+  yellow: '#FFFF00',
+  cyan: '#00FFFF',
+  magenta: '#FF00FF',
+}
+
+export const CAPTION_BACKGROUND_COLOR_VALUES: Record<CaptionColor, string> = {
+  default: 'rgba(0, 0, 0, 0.75)',
+  black: 'rgba(0, 0, 0, 0.75)',
+  white: 'rgba(255, 255, 255, 0.75)',
+  blue: 'rgba(0, 0, 255, 0.75)',
+  green: 'rgba(0, 255, 0, 0.75)',
+  red: 'rgba(255, 0, 0, 0.75)',
+  yellow: 'rgba(255, 255, 0, 0.75)',
+  cyan: 'rgba(0, 255, 255, 0.75)',
+  magenta: 'rgba(255, 0, 255, 0.75)',
+}
+
 type AccessibilityState = {
   announceReactions: boolean
   captionTextSize: CaptionTextSize
+  captionFontColor: CaptionColor
+  captionBackgroundColor: CaptionColor
 }
 
 const DEFAULT_STATE: AccessibilityState = {
   announceReactions: false,
   captionTextSize: 'medium',
+  captionFontColor: 'default',
+  captionBackgroundColor: 'default',
 }
 
 function getAccessibilityState(): AccessibilityState {
@@ -25,10 +76,21 @@ function getAccessibilityState(): AccessibilityState {
     const stored = localStorage.getItem(STORAGE_KEYS.ACCESSIBILITY)
     if (stored) {
       const parsed = JSON.parse(stored)
-      const validCaptionSizes = CAPTION_TEXT_SIZE_OPTIONS
-      const captionTextSize = validCaptionSizes.includes(parsed.captionTextSize)
+      const captionTextSize = CAPTION_TEXT_SIZE_OPTIONS.includes(
+        parsed.captionTextSize
+      )
         ? parsed.captionTextSize
         : DEFAULT_STATE.captionTextSize
+      const captionFontColor = CAPTION_COLOR_OPTIONS.includes(
+        parsed.captionFontColor
+      )
+        ? parsed.captionFontColor
+        : DEFAULT_STATE.captionFontColor
+      const captionBackgroundColor = CAPTION_COLOR_OPTIONS.includes(
+        parsed.captionBackgroundColor
+      )
+        ? parsed.captionBackgroundColor
+        : DEFAULT_STATE.captionBackgroundColor
       return {
         ...DEFAULT_STATE,
         ...parsed,
@@ -37,6 +99,8 @@ function getAccessibilityState(): AccessibilityState {
             ? parsed.announceReactions
             : DEFAULT_STATE.announceReactions,
         captionTextSize,
+        captionFontColor,
+        captionBackgroundColor,
       }
     }
 

src/frontend/src/stores/userChoices.ts

@@ -1,16 +1,19 @@
 import { proxy, subscribe } from 'valtio'
-import { ProcessorSerialized } from '@/features/rooms/livekit/components/blur'
+import {
+  ProcessorConfig,
+  ProcessorType,
+} from '@/features/rooms/livekit/components/blur'
 import {
   loadUserChoices,
-  saveUserChoices,
   LocalUserChoices as LocalUserChoicesLK,
+  saveUserChoices,
 } from '@livekit/components-core'
 import { VideoQuality } from 'livekit-client'
 
 export type VideoResolution = 'h720' | 'h360' | 'h180'
 
 export type LocalUserChoices = LocalUserChoicesLK & {
-  processorSerialized?: ProcessorSerialized
+  processorConfig?: ProcessorConfig
   noiseReductionEnabled?: boolean
   audioOutputDeviceId?: string
   videoPublishResolution?: VideoResolution
@@ -28,7 +31,33 @@ function getUserChoicesState(): LocalUserChoices {
 }
 
 export const userChoicesStore = proxy<LocalUserChoices>(getUserChoicesState())
-
 subscribe(userChoicesStore, () => {
   saveUserChoices(userChoicesStore, false)
 })
+
+// we run some logic on store loading to check if the processor config is still valid
+if (userChoicesStore.processorConfig?.type === ProcessorType.VIRTUAL) {
+  if (userChoicesStore.processorConfig.imagePath.startsWith('blob:')) {
+    // this happens when a not authenticated user had changed their background image
+    // we restore clear the processor config to avoid displaying a black screen.
+    userChoicesStore.processorConfig = undefined
+  } else if (userChoicesStore.processorConfig.fileId) {
+    // Checking if the image is still available / accessible
+    await fetch(userChoicesStore.processorConfig.imagePath, {
+      // We bypass the cache to ensure we have access
+      cache: 'reload',
+    })
+      .then((response) => {
+        // if we cannot fetch the image (likely a 401 from the backend because
+        // the user is not logged in anymore, etc.),
+        // we clear the processor config to avoid displaying a black screen.
+        // This can happen when the user logs out for instance, etc.
+        if (!response.ok) {
+          userChoicesStore.processorConfig = undefined
+        }
+      })
+      .catch(() => {
+        userChoicesStore.processorConfig = undefined
+      })
+  }
+}

src/frontend/src/styles/index.css

@@ -95,3 +95,14 @@ html:has(.lk-video-conference) {
     U+0304, U+0308, U+0329, U+2000-206F, U+2074, U+20AC, U+2122, U+2191, U+2193,
     U+2212, U+2215, U+FEFF, U+FFFD;
 }
+
+.hoverGroup .hoverGroupChild {
+  opacity: 0;
+  pointer-events: none;
+}
+
+.hoverGroup:hover .hoverGroupChild,
+.hoverGroup:focus-within .hoverGroupChild {
+  opacity: 1;
+  pointer-events: auto;
+}

src/frontend/vite.config.ts

@@ -14,6 +14,14 @@ export default defineConfig(({ mode }) => {
       port: parseInt(env.VITE_PORT) || 3000,
       host: env.VITE_HOST ?? 'localhost',
       allowedHosts: ['.nip.io'],
+      // In a local dev setup, we proxy the media server ourselves to avoid CORS issues
+      proxy: {
+        '/media': {
+          target: 'http://localhost:8083',
+          changeOrigin: true,
+          secure: false
+        }
+      }
     },
   }
 })

src/helm/env.d/dev-dinum/values.egress.yaml.gotmpl

@@ -41,3 +41,15 @@ autoscaling:
 
 nodeSelector: {}
 resources: {}
+
+podSecurityContext:
+  fsGroup: 1000
+  fsGroupChangePolicy: "OnRootMismatch"
+
+securityContext:
+  allowPrivilegeEscalation: false
+  capabilities:
+    drop:
+      - ALL
+  seccompProfile:
+    type: RuntimeDefault

src/helm/env.d/dev-dinum/values.livekit.yaml.gotmpl

@@ -28,6 +28,16 @@ livekit:
     urls:
         - https://meet.127.0.0.1.nip.io/api/v1.0/rooms/webhooks-livekit/
 
+podSecurityContext:
+  fsGroup: 2000
+
+securityContext:
+  capabilities:
+    drop:
+    - ALL
+  readOnlyRootFilesystem: true
+  runAsNonRoot: true
+  runAsUser: 1000
 
 loadBalancer:
   type: nginx

src/helm/env.d/dev-dinum/values.meet.yaml.gotmpl

@@ -112,6 +112,21 @@ backend:
         - key: cacert.pem
           path: cacert.pem
 
+  podSecurityContext:
+    runAsUser: 1000
+    runAsGroup: 1000
+    fsGroup: 1000
+    fsGroupChangePolicy: "OnRootMismatch"
+    runAsNonRoot: true
+    seccompProfile:
+      type: RuntimeDefault
+
+  securityContext:
+    allowPrivilegeEscalation: false
+    capabilities:
+      drop:
+        - ALL
+
 frontend:
 
   replicas: 1
@@ -121,6 +136,21 @@ frontend:
     pullPolicy: Always
     tag: "latest"
 
+  podSecurityContext:
+    runAsUser: 1000
+    runAsGroup: 1000
+    fsGroup: 1000
+    fsGroupChangePolicy: "OnRootMismatch"
+    runAsNonRoot: true
+    seccompProfile:
+      type: RuntimeDefault
+
+  securityContext:
+    allowPrivilegeEscalation: false
+    capabilities:
+      drop:
+        - ALL
+
 ingress:
   enabled: true
   host: meet.127.0.0.1.nip.io
@@ -136,7 +166,7 @@ ingressWebhook:
 posthog:
   ingress:
     enabled: false
-  
+
   ingressAssets:
     enabled: false
 
@@ -160,12 +190,27 @@ summary:
     WEBHOOK_URL: https://www.mock-impress.com/webhook/
     CELERY_BROKER_URL: redis://default:pass@redis-master:6379/1
     CELERY_RESULT_BACKEND: redis://default:pass@redis-master:6379/1
-  
+
+  podSecurityContext:
+    runAsUser: 1000
+    runAsGroup: 1000
+    fsGroup: 1000
+    fsGroupChangePolicy: "OnRootMismatch"
+    runAsNonRoot: true
+    seccompProfile:
+      type: RuntimeDefault
+
+  securityContext:
+    allowPrivilegeEscalation: false
+    capabilities:
+      drop:
+        - ALL
+
   image:
     repository: localhost:5001/meet-summary
     pullPolicy: Always
     tag: "latest"
-  
+
   command:
     - "uvicorn"
     - "summary.main:app"
@@ -197,6 +242,21 @@ celeryTranscribe:
     CELERY_RESULT_BACKEND: redis://default:pass@redis-master:6379/1
     TASK_TRACKER_REDIS_URL: redis://default:pass@redis-master:6379/1
 
+  podSecurityContext:
+    runAsUser: 1000
+    runAsGroup: 1000
+    fsGroup: 1000
+    fsGroupChangePolicy: "OnRootMismatch"
+    runAsNonRoot: true
+    seccompProfile:
+      type: RuntimeDefault
+
+  securityContext:
+    allowPrivilegeEscalation: false
+    capabilities:
+      drop:
+        - ALL
+
   image:
     repository: localhost:5001/meet-summary
     pullPolicy: Always
@@ -233,6 +293,21 @@ celerySummarize:
     CELERY_RESULT_BACKEND: redis://default:pass@redis-master:6379/1
     TASK_TRACKER_REDIS_URL: redis://default:pass@redis-master:6379/1
 
+  podSecurityContext:
+    runAsUser: 1000
+    runAsGroup: 1000
+    fsGroup: 1000
+    fsGroupChangePolicy: "OnRootMismatch"
+    runAsNonRoot: true
+    seccompProfile:
+      type: RuntimeDefault
+
+  securityContext:
+    allowPrivilegeEscalation: false
+    capabilities:
+      drop:
+        - ALL
+
   image:
     repository: localhost:5001/meet-summary
     pullPolicy: Always

src/helm/env.d/dev-keycloak/values.egress.yaml.gotmpl

@@ -44,3 +44,15 @@ autoscaling:
 
 nodeSelector: {}
 resources: {}
+
+podSecurityContext:
+  fsGroup: 1000
+  fsGroupChangePolicy: "OnRootMismatch"
+
+securityContext:
+  allowPrivilegeEscalation: false
+  capabilities:
+    drop:
+      - ALL
+  seccompProfile:
+    type: RuntimeDefault

src/helm/env.d/dev-keycloak/values.livekit.yaml.gotmpl

@@ -28,6 +28,16 @@ livekit:
     urls:
         - https://meet.127.0.0.1.nip.io/api/v1.0/rooms/webhooks-livekit/
 
+podSecurityContext:
+  fsGroup: 2000
+
+securityContext:
+  capabilities:
+    drop:
+    - ALL
+  readOnlyRootFilesystem: true
+  runAsNonRoot: true
+  runAsUser: 1000
 
 loadBalancer:
   type: nginx

src/helm/env.d/dev-keycloak/values.meet.yaml.gotmpl

@@ -86,6 +86,20 @@ backend:
     CELERY_ENABLED: True
     CELERY_BROKER_URL: redis://default:pass@redis-master:6379/1
 
+  podSecurityContext:
+    runAsUser: 1000
+    runAsGroup: 1000
+    fsGroup: 1000
+    fsGroupChangePolicy: "OnRootMismatch"
+    runAsNonRoot: true
+    seccompProfile:
+      type: RuntimeDefault
+
+  securityContext:
+    allowPrivilegeEscalation: false
+    capabilities:
+      drop:
+        - ALL
 
   migrate:
     command:
@@ -134,6 +148,21 @@ frontend:
 
   replicas: 1
 
+  podSecurityContext:
+    runAsUser: 1000
+    runAsGroup: 1000
+    fsGroup: 1000
+    fsGroupChangePolicy: "OnRootMismatch"
+    runAsNonRoot: true
+    seccompProfile:
+      type: RuntimeDefault
+
+  securityContext:
+    allowPrivilegeEscalation: false
+    capabilities:
+      drop:
+        - ALL
+
   image:
     repository: localhost:5001/meet-frontend-generic
     pullPolicy: Always
@@ -154,7 +183,7 @@ ingressWebhook:
 posthog:
   ingress:
     enabled: false
-  
+
   ingressAssets:
     enabled: false
 
@@ -180,12 +209,27 @@ summary:
     CELERY_BROKER_URL: redis://default:pass@redis-master:6379/1
     CELERY_RESULT_BACKEND: redis://default:pass@redis-master:6379/1
     TASK_TRACKER_REDIS_URL: redis://default:pass@redis-master:6379/1
-  
+
+  podSecurityContext:
+    runAsUser: 1000
+    runAsGroup: 1000
+    fsGroup: 1000
+    fsGroupChangePolicy: "OnRootMismatch"
+    runAsNonRoot: true
+    seccompProfile:
+      type: RuntimeDefault
+
+  securityContext:
+    allowPrivilegeEscalation: false
+    capabilities:
+      drop:
+        - ALL
+
   image:
     repository: localhost:5001/meet-summary
     pullPolicy: Always
     tag: "latest"
-  
+
   command:
     - "uvicorn"
     - "summary.main:app"
@@ -217,7 +261,22 @@ celeryTranscribe:
     CELERY_BROKER_URL: redis://default:pass@redis-master:6379/1
     CELERY_RESULT_BACKEND: redis://default:pass@redis-master:6379/1
     TASK_TRACKER_REDIS_URL: redis://default:pass@redis-master:6379/1
-  
+
+  podSecurityContext:
+    runAsUser: 1000
+    runAsGroup: 1000
+    fsGroup: 1000
+    fsGroupChangePolicy: "OnRootMismatch"
+    runAsNonRoot: true
+    seccompProfile:
+      type: RuntimeDefault
+
+  securityContext:
+    allowPrivilegeEscalation: false
+    capabilities:
+      drop:
+        - ALL
+
   image:
     repository: localhost:5001/meet-summary
     pullPolicy: Always
@@ -256,6 +315,21 @@ celerySummarize:
     CELERY_RESULT_BACKEND: redis://default:pass@redis-master:6379/1
     TASK_TRACKER_REDIS_URL: redis://default:pass@redis-master:6379/1
 
+  podSecurityContext:
+    runAsUser: 1000
+    runAsGroup: 1000
+    fsGroup: 1000
+    fsGroupChangePolicy: "OnRootMismatch"
+    runAsNonRoot: true
+    seccompProfile:
+      type: RuntimeDefault
+
+  securityContext:
+    allowPrivilegeEscalation: false
+    capabilities:
+      drop:
+        - ALL
+
   image:
     repository: localhost:5001/meet-summary
     pullPolicy: Always
@@ -283,6 +357,21 @@ agents:
     {{- end }}
     ENABLE_SILERO_VAD: "false"
 
+  podSecurityContext:
+    runAsUser: 1000
+    runAsGroup: 1000
+    fsGroup: 1000
+    fsGroupChangePolicy: "OnRootMismatch"
+    runAsNonRoot: true
+    seccompProfile:
+      type: RuntimeDefault
+
+  securityContext:
+    allowPrivilegeEscalation: false
+    capabilities:
+      drop:
+        - ALL
+
   image:
     repository: localhost:5001/meet-agents
     pullPolicy: Always

src/helm/env.d/dev/values.egress.yaml.gotmpl

@@ -41,3 +41,15 @@ autoscaling:
 
 nodeSelector: {}
 resources: {}
+
+podSecurityContext:
+  fsGroup: 1000
+  fsGroupChangePolicy: "OnRootMismatch"
+
+securityContext:
+  allowPrivilegeEscalation: false
+  capabilities:
+    drop:
+      - ALL
+  seccompProfile:
+    type: RuntimeDefault

src/helm/env.d/dev/values.livekit.yaml.gotmpl

@@ -28,6 +28,17 @@ livekit:
     urls:
         - https://meet.127.0.0.1.nip.io/api/v1.0/rooms/webhooks-livekit/
 
+podSecurityContext:
+  fsGroup: 2000
+
+securityContext:
+  capabilities:
+    drop:
+    - ALL
+  readOnlyRootFilesystem: true
+  runAsNonRoot: true
+  runAsUser: 1000
+
 loadBalancer:
   type: nginx
   annotations:

src/helm/env.d/dev/values.meet.yaml.gotmpl

@@ -96,6 +96,20 @@ backend:
     ROOM_TELEPHONY_ENABLED: True
     SSL_CERT_FILE: /app/.venv/lib/python3.13/site-packages/certifi/cacert.pem
 
+  podSecurityContext:
+    runAsUser: 1000
+    runAsGroup: 1000
+    fsGroup: 1000
+    fsGroupChangePolicy: "OnRootMismatch"
+    runAsNonRoot: true
+    seccompProfile:
+      type: RuntimeDefault
+
+  securityContext:
+    allowPrivilegeEscalation: false
+    capabilities:
+      drop:
+        - ALL
 
   migrate:
     command:
@@ -144,6 +158,21 @@ frontend:
 
   replicas: 1
 
+  podSecurityContext:
+    runAsUser: 1000
+    runAsGroup: 1000
+    fsGroup: 1000
+    fsGroupChangePolicy: "OnRootMismatch"
+    runAsNonRoot: true
+    seccompProfile:
+      type: RuntimeDefault
+
+  securityContext:
+    allowPrivilegeEscalation: false
+    capabilities:
+      drop:
+        - ALL
+
   image:
     repository: localhost:5001/meet-frontend
     pullPolicy: Always
@@ -189,6 +218,21 @@ summary:
     CELERY_BROKER_URL: redis://default:pass@redis-master:6379/1
     CELERY_RESULT_BACKEND: redis://default:pass@redis-master:6379/1
 
+  podSecurityContext:
+    runAsUser: 1000
+    runAsGroup: 1000
+    fsGroup: 1000
+    fsGroupChangePolicy: "OnRootMismatch"
+    runAsNonRoot: true
+    seccompProfile:
+      type: RuntimeDefault
+
+  securityContext:
+    allowPrivilegeEscalation: false
+    capabilities:
+      drop:
+        - ALL
+
   image:
     repository: localhost:5001/meet-summary
     pullPolicy: Always
@@ -225,6 +269,21 @@ celeryTranscribe:
     CELERY_RESULT_BACKEND: redis://default:pass@redis-master:6379/1
     TASK_TRACKER_REDIS_URL: redis://default:pass@redis-master:6379/1
 
+  podSecurityContext:
+    runAsUser: 1000
+    runAsGroup: 1000
+    fsGroup: 1000
+    fsGroupChangePolicy: "OnRootMismatch"
+    runAsNonRoot: true
+    seccompProfile:
+      type: RuntimeDefault
+
+  securityContext:
+    allowPrivilegeEscalation: false
+    capabilities:
+      drop:
+        - ALL
+
   image:
     repository: localhost:5001/meet-summary
     pullPolicy: Always
@@ -261,6 +320,21 @@ celerySummarize:
     CELERY_RESULT_BACKEND: redis://default:pass@redis-master:6379/1
     TASK_TRACKER_REDIS_URL: redis://default:pass@redis-master:6379/1
 
+  podSecurityContext:
+    runAsUser: 1000
+    runAsGroup: 1000
+    fsGroup: 1000
+    fsGroupChangePolicy: "OnRootMismatch"
+    runAsNonRoot: true
+    seccompProfile:
+      type: RuntimeDefault
+
+  securityContext:
+    allowPrivilegeEscalation: false
+    capabilities:
+      drop:
+        - ALL
+
   image:
     repository: localhost:5001/meet-summary
     pullPolicy: Always

src/helm/meet/templates/agents_deployment.yaml

@@ -31,6 +31,10 @@ spec:
         - name: {{ include "meet.secret.dockerconfigjson.name" (dict "fullname" (include "meet.fullname" .) "imageCredentials" $.Values.image.credentials) }}
       {{- end }}
       shareProcessNamespace: {{ .Values.agents.shareProcessNamespace }}
+      {{- with .Values.agents.podSecurityContext }}
+      securityContext:
+        {{- toYaml . | nindent 8 }}
+      {{- end }}
       containers:
         {{- with .Values.agents.sidecars }}
           {{- toYaml . | nindent 8 }}

src/helm/meet/templates/backend_deployment.yaml

@@ -31,6 +31,10 @@ spec:
         - name: {{ include "meet.secret.dockerconfigjson.name" (dict "fullname" (include "meet.fullname" .) "imageCredentials" $.Values.image.credentials) }}
       {{- end }}
       shareProcessNamespace: {{ .Values.backend.shareProcessNamespace }}
+      {{- with .Values.backend.podSecurityContext }}
+      securityContext:
+        {{- toYaml . | nindent 8 }}
+      {{- end }}
       containers:
         {{- with .Values.backend.sidecars }}
           {{- toYaml . | nindent 8 }}

src/helm/meet/templates/backend_job_createsuperuser.yaml

@@ -30,6 +30,10 @@ spec:
         - name: {{ include "meet.secret.dockerconfigjson.name" (dict "fullname" (include "meet.fullname" .) "imageCredentials" $.Values.image.credentials) }}
       {{- end }}
       shareProcessNamespace: {{ .Values.backend.shareProcessNamespace }}
+      {{- with .Values.backend.podSecurityContext }}
+      securityContext:
+        {{- toYaml . | nindent 8 }}
+      {{- end }}
       containers:
         {{- with .Values.backend.sidecars }}
           {{- toYaml . | nindent 8 }}

src/helm/meet/templates/backend_job_migrate.yaml

@@ -30,6 +30,10 @@ spec:
         - name: {{ include "meet.secret.dockerconfigjson.name" (dict "fullname" (include "meet.fullname" .) "imageCredentials" $.Values.image.credentials) }}
       {{- end }}
       shareProcessNamespace: {{ .Values.backend.shareProcessNamespace }}
+      {{- with .Values.backend.podSecurityContext }}
+      securityContext:
+        {{- toYaml . | nindent 8 }}
+      {{- end }}
       containers:
         {{- with .Values.backend.sidecars }}
           {{- toYaml . | nindent 8 }}

src/helm/meet/templates/celery_backend_deployment.yaml

@@ -31,6 +31,10 @@ spec:
         - name: {{ include "meet.secret.dockerconfigjson.name" (dict "fullname" (include "meet.fullname" .) "imageCredentials" $.Values.image.credentials) }}
       {{- end }}
       shareProcessNamespace: {{ .Values.celeryBackend.shareProcessNamespace }}
+      {{- with .Values.celeryBackend.podSecurityContext }}
+      securityContext:
+        {{- toYaml . | nindent 8 }}
+      {{- end }}
       containers:
         {{- with .Values.celeryBackend.sidecars }}
           {{- toYaml . | nindent 8 }}

src/helm/meet/templates/celery_summarize_deployment.yaml

@@ -31,6 +31,10 @@ spec:
         - name: {{ include "meet.secret.dockerconfigjson.name" (dict "fullname" (include "meet.fullname" .) "imageCredentials" $.Values.image.credentials) }}
       {{- end }}
       shareProcessNamespace: {{ .Values.celerySummarize.shareProcessNamespace }}
+      {{- with .Values.celerySummarize.podSecurityContext }}
+      securityContext:
+        {{- toYaml . | nindent 8 }}
+      {{- end }}
       containers:
         {{- with .Values.celerySummarize.sidecars }}
           {{- toYaml . | nindent 8 }}

src/helm/meet/templates/celery_transcribe_deployment.yaml

@@ -31,6 +31,10 @@ spec:
         - name: {{ include "meet.secret.dockerconfigjson.name" (dict "fullname" (include "meet.fullname" .) "imageCredentials" $.Values.image.credentials) }}
       {{- end }}
       shareProcessNamespace: {{ .Values.celeryTranscribe.shareProcessNamespace }}
+      {{- with .Values.celeryTranscribe.podSecurityContext }}
+      securityContext:
+        {{- toYaml . | nindent 8 }}
+      {{- end }}
       containers:
         {{- with .Values.celeryTranscribe.sidecars }}
           {{- toYaml . | nindent 8 }}

src/helm/meet/templates/frontend_deployment.yaml

@@ -31,6 +31,10 @@ spec:
         - name: {{ include "meet.secret.dockerconfigjson.name" (dict "fullname" (include "meet.fullname" .) "imageCredentials" $.Values.image.credentials) }}
       {{- end }}
       shareProcessNamespace: {{ .Values.frontend.shareProcessNamespace }}
+      {{- with .Values.frontend.podSecurityContext }}
+      securityContext:
+        {{- toYaml . | nindent 8 }}
+      {{- end }}
       containers:
         {{- with .Values.frontend.sidecars }}
           {{- toYaml . | nindent 8 }}

src/helm/meet/templates/summary_deployment.yaml

@@ -31,6 +31,10 @@ spec:
         - name: {{ include "meet.secret.dockerconfigjson.name" (dict "fullname" (include "meet.fullname" .) "imageCredentials" $.Values.image.credentials) }}
       {{- end }}
       shareProcessNamespace: {{ .Values.summary.shareProcessNamespace }}
+      {{- with .Values.summary.podSecurityContext }}
+      securityContext:
+        {{- toYaml . | nindent 8 }}
+      {{- end }}
       containers:
         {{- with .Values.summary.sidecars }}
           {{- toYaml . | nindent 8 }}

src/helm/meet/values.yaml

@@ -216,9 +216,12 @@ backend:
     ttlSecondsAfterFinished: 30
     backoffLimit: 2
 
-  ## @param backend.securityContext Configure backend Pod security context
+  ## @param backend.securityContext Configure backend Container security context
   securityContext: null
 
+  ## @param backend.podSecurityContext Configure backend Pod security context
+  podSecurityContext: null
+
   ## @param backend.envVars Configure backend container environment variables
   ## @extra backend.envVars.BY_VALUE Example environment variable by setting value directly
   ## @extra backend.envVars.FROM_CONFIGMAP.configMapKeyRef.name Name of a ConfigMap when configuring env vars from a ConfigMap
@@ -359,9 +362,12 @@ frontend:
   ## @param frontend.sidecars Add sidecars containers to frontend deployment
   sidecars: []
 
-  ## @param frontend.securityContext Configure frontend Pod security context
+  ## @param frontend.securityContext Configure frontend Container security context
   securityContext: null
 
+  ## @param frontend.podSecurityContext Configure frontend Pod security context
+  podSecurityContext: null
+
   ## @param frontend.envVars Configure frontend container environment variables
   ## @extra frontend.envVars.BY_VALUE Example environment variable by setting value directly
   ## @extra frontend.envVars.FROM_CONFIGMAP.configMapKeyRef.name Name of a ConfigMap when configuring env vars from a ConfigMap
@@ -533,9 +539,12 @@ summary:
   ## @param summary.migrateJobAnnotations Annotations for the migrate job
   migrateJobAnnotations: {}
 
-  ## @param summary.securityContext Configure summary Pod security context
+  ## @param summary.securityContext Configure summary Container security context
   securityContext: null
 
+  ## @param summary.podSecurityContext Configure summary Pod security context
+  podSecurityContext: null
+
   ## @param summary.envVars Configure summary container environment variables
   ## @extra summary.envVars.BY_VALUE Example environment variable by setting value directly
   ## @extra summary.envVars.FROM_CONFIGMAP.configMapKeyRef.name Name of a ConfigMap when configuring env vars from a ConfigMap
@@ -646,9 +655,12 @@ celeryBackend:
   ## @param celeryBackend.migrateJobAnnotations Annotations for the migrate job
   migrateJobAnnotations: {}
 
-  ## @param celeryBackend.securityContext Configure celeryBackend Pod security context
+  ## @param celeryBackend.securityContext Configure celeryBackend Container security context
   securityContext: null
 
+  ## @param celeryBackend.podSecurityContext Configure celeryBackend Pod security context
+  podSecurityContext: null
+
   ## @param celeryBackend.envVars Configure celeryBackend container environment variables
   ## @extra celeryBackend.envVars.BY_VALUE Example environment variable by setting value directly
   ## @extra celeryBackend.envVars.FROM_CONFIGMAP.configMapKeyRef.name Name of a ConfigMap when configuring env vars from a ConfigMap
@@ -755,9 +767,12 @@ celeryTranscribe:
   ## @param celeryTranscribe.migrateJobAnnotations Annotations for the migrate job
   migrateJobAnnotations: {}
 
-  ## @param celeryTranscribe.securityContext Configure celeryTranscribe Pod security context
+  ## @param celeryTranscribe.securityContext Configure celeryTranscribe Container security context
   securityContext: null
 
+  ## @param celeryTranscribe.podSecurityContext Configure celeryTranscribe Pod security context
+  podSecurityContext: null
+
   ## @param celeryTranscribe.envVars Configure celeryTranscribe container environment variables
   ## @extra celeryTranscribe.envVars.BY_VALUE Example environment variable by setting value directly
   ## @extra celeryTranscribe.envVars.FROM_CONFIGMAP.configMapKeyRef.name Name of a ConfigMap when configuring env vars from a ConfigMap
@@ -864,9 +879,12 @@ celerySummarize:
   ## @param celerySummarize.migrateJobAnnotations Annotations for the migrate job
   migrateJobAnnotations: {}
 
-  ## @param celerySummarize.securityContext Configure celerySummarize Pod security context
+  ## @param celerySummarize.securityContext Configure celerySummarize Container security context
   securityContext: null
 
+  ## @param celerySummarize.podSecurityContext Configure celerySummarize Pod security context
+  podSecurityContext: null
+
   ## @param celerySummarize.envVars Configure celerySummarize container environment variables
   ## @extra celerySummarize.envVars.BY_VALUE Example environment variable by setting value directly
   ## @extra celerySummarize.envVars.FROM_CONFIGMAP.configMapKeyRef.name Name of a ConfigMap when configuring env vars from a ConfigMap
@@ -963,9 +981,12 @@ agents:
   ## @param agents.sidecars Add sidecars containers to agents deployment
   sidecars: []
 
-  ## @param agents.securityContext Configure agents Pod security context
+  ## @param agents.securityContext Configure agents Container security context
   securityContext: null
 
+  ## @param agents.podSecurityContext Configure agents Pod security context
+  podSecurityContext: null
+
   ## @param agents.envVars Configure agents container environment variables
   ## @extra agents.envVars.BY_VALUE Example environment variable by setting value directly
   ## @extra agents.envVars.FROM_CONFIGMAP.configMapKeyRef.name Name of a ConfigMap when configuring env vars from a ConfigMap

src/mail/mjml/screen_recording.mjml

@@ -9,7 +9,7 @@
             align="center"
             src="{{logo_img}}"
             width="320px"
-            alt="{%trans 'Logo email' %}"
+            alt="{%trans 'Logo email' %} {{brandname}}"
           />
         </mj-column>
       </mj-section>

src/mail/package-lock.json

@@ -1,12 +1,12 @@
 {
   "name": "mail_mjml",
-  "version": "1.10.0",
+  "version": "1.11.0",
   "lockfileVersion": 3,
   "requires": true,
   "packages": {
     "": {
       "name": "mail_mjml",
-      "version": "1.10.0",
+      "version": "1.11.0",
       "license": "MIT",
       "dependencies": {
         "@html-to/text-cli": "0.5.4",

src/mail/package.json

@@ -1,6 +1,6 @@
 {
   "name": "mail_mjml",
-  "version": "1.10.0",
+  "version": "1.11.0",
   "description": "An util to generate html and text django's templates from mjml templates",
   "type": "module",
   "dependencies": {

src/sdk/package-lock.json

@@ -1,12 +1,12 @@
 {
   "name": "sdk",
-  "version": "1.10.0",
+  "version": "1.11.0",
   "lockfileVersion": 3,
   "requires": true,
   "packages": {
     "": {
       "name": "sdk",
-      "version": "1.10.0",
+      "version": "1.11.0",
       "license": "ISC",
       "workspaces": [
         "./library",

src/sdk/package.json

@@ -1,6 +1,6 @@
 {
   "name": "sdk",
-  "version": "1.10.0",
+  "version": "1.11.0",
   "author": "",
   "license": "ISC",
   "description": "",

src/summary/pyproject.toml

@@ -1,7 +1,7 @@
 
 [project]
 name = "summary"
-version = "1.10.0"
+version = "1.11.0"
 dependencies = [
     "fastapi[standard]>=0.105.0",
     "uvicorn>=0.24.0",
@@ -21,8 +21,16 @@ dependencies = [
 [project.optional-dependencies]
 dev = [
     "ruff==0.14.4",
+    "pytest==9.0.2",
+    "responses>=0.25.8",
 ]
 
+[tool.pytest.ini_options]
+markers = [
+    "api: Test the API",
+]
+testpaths = ["tests"]
+
 [build-system]
 requires = ["setuptools>=61.0"]
 build-backend = "setuptools.build_meta"
@@ -49,6 +57,7 @@ select = [
     "T20", # flake8-print
     "W",  # pycodestyle warning
 ]
+ignore= ["PLR2004"]
 
 [tool.ruff.lint.per-file-ignores]
 "tests/*" = [

src/summary/summary/core/locales/de.py

@@ -23,8 +23,7 @@ Einige Punkte, die wir Ihnen empfehlen zu überprüfen:
 
 """,
     download_header_template=(
-        "\n*Laden Sie Ihre Aufnahme herunter, "
-        "indem Sie [diesem Link folgen]({download_link})*\n"
+        "\n*[Laden Sie hier Ihre Aufnahme herunter (externer Link)]({download_link})*\n"
     ),
     hallucination_replacement_text="[Text konnte nicht transkribiert werden]",
     document_default_title="Transkription",

src/summary/summary/core/locales/en.py

@@ -23,7 +23,7 @@ A few things we recommend you check:
 
 """,
     download_header_template=(
-        "\n*Download your recording by [following this link]({download_link})*\n"
+        "\n*[Download your recording (external link)]({download_link})*\n"
     ),
     hallucination_replacement_text="[Unable to transcribe text]",
     document_default_title="Transcription",

src/summary/summary/core/locales/fr.py

@@ -23,7 +23,7 @@ Quelques points que nous vous conseillons de vérifier :
 
 """,
     download_header_template=(
-        "\n*Télécharger votre enregistrement en [suivant ce lien]({download_link})*\n"
+        "\n*[Télécharger votre enregistrement (lien externe)]({download_link})*\n"
     ),
     hallucination_replacement_text="[Texte impossible à transcrire]",
     document_default_title="Transcription",

src/summary/summary/core/locales/nl.py

@@ -23,7 +23,7 @@ Een paar punten die wij u aanraden te controleren:
 
 """,
     download_header_template=(
-        "\n*Download uw opname door [deze link te volgen]({download_link})*\n"
+        "\n*[Download hier je opname (externe link)]({download_link})*\n"
     ),
     hallucination_replacement_text="[Tekst kon niet worden getranscribeerd]",
     document_default_title="Transcriptie",

src/summary/tests/__init__.py

@@ -0,0 +1 @@
+"""Tests for the summary service."""

src/summary/tests/api/__init__.py

@@ -0,0 +1 @@
+"""Tests for the API summary service."""

src/summary/tests/api/test_api_health.py

@@ -0,0 +1,21 @@
+"""Integration tests for the health check endpoints."""
+
+
+class TestHeartbeat:
+    """Tests for the /__heartbeat__ endpoint."""
+
+    def test_returns_200(self, client):
+        """The heartbeat endpoint responds with 200 OK without a token."""
+        response = client.get("/__heartbeat__")
+
+        assert response.status_code == 200
+
+
+class TestLBHeartbeat:
+    """Tests for the /__lbheartbeat__ endpoint."""
+
+    def test_returns_200(self, client):
+        """The load-balancer heartbeat endpoint responds with 200 OK without a token."""
+        response = client.get("/__lbheartbeat__")
+
+        assert response.status_code == 200

src/summary/tests/api/test_api_tasks.py

@@ -0,0 +1,88 @@
+"""Integration tests for the API tasks endpoints."""
+
+# tests/unit/test_api_tasks.py
+from unittest.mock import MagicMock, patch
+
+
+class TestTasks:
+    """Tests for the /tasks endpoint."""
+
+    @patch(
+        "summary.api.route.tasks.process_audio_transcribe_summarize_v2.apply_async",
+        return_value=MagicMock(id="task-id-abc"),
+    )
+    @patch("summary.api.route.tasks.time.time", return_value=1735725600.0)
+    def test_create_task_returns_task_id(self, mock_time, mock_apply_async, client):
+        """POST /tasks/ with valid payload returns id and dispatches Celery task."""
+        response = client.post(
+            "api/v1/tasks/",
+            headers={"Authorization": "Bearer test-api-token"},
+            json={
+                "owner_id": "owner-123",
+                "filename": "recording.mp4",
+                "email": "user@example.com",
+                "sub": "sub-123",
+                "room": "room-abc",
+                "recording_date": "2026-01-01",
+                "recording_time": "10:00:00",
+                "language": None,
+                "download_link": "http://example.com/file.mp4",
+            },
+        )
+
+        assert response.status_code == 200
+        assert response.json() == {"id": "task-id-abc", "message": "Task created"}
+
+        args = mock_apply_async.call_args.kwargs["args"]
+        assert args == [
+            "owner-123",  # owner_id
+            "recording.mp4",  # filename
+            "user@example.com",  # email
+            "sub-123",  # sub
+            1735725600.0,  # frozen time
+            "room-abc",  # room
+            "2026-01-01",  # recording_date
+            "10:00:00",  # recording_time
+            None,  # language
+            "http://example.com/file.mp4",  # download_link
+            None,  # context_language
+        ]
+
+    def test_create_task_invalid_language(self, client):
+        """POST /tasks/ with an unsupported language returns 422."""
+        payload = {"language": "klingon"}
+        response = client.post(
+            "/api/v1/tasks/",
+            headers={"Authorization": "Bearer test-api-token"},
+            json=payload,
+        )
+
+        assert response.status_code == 422
+
+    @patch(
+        "summary.api.route.tasks.AsyncResult",
+        return_value=MagicMock(status="PENDING"),
+    )
+    def test_get_task_status_pending(self, mock_result, client):
+        """GET /tasks/{id} returns PENDING status when the task has not started yet."""
+        response = client.get(
+            "/api/v1/tasks/task-id-abc",
+            headers={"Authorization": "Bearer test-api-token"},
+        )
+
+        assert response.status_code == 200
+        assert response.json() == {"id": "task-id-abc", "status": "PENDING"}
+
+    @patch(
+        "summary.api.route.tasks.AsyncResult",
+        return_value=MagicMock(status="SUCCESS"),
+    )
+    def test_get_task_status_success(self, mock_result, client):
+        """GET /tasks/{id} returns SUCCESS status when the task has completed."""
+        response = client.get(
+            "/api/v1/tasks/task-id-abc",
+            headers={"Authorization": "Bearer test-api-token"},
+        )
+
+        assert response.status_code == 200
+        assert response.json()["status"] == "SUCCESS"

src/summary/tests/conftest.py

@@ -0,0 +1,24 @@
+"""Integration test configuration. Provides shared fixtures."""
+
+import pytest
+from fastapi.testclient import TestClient
+from pydantic import SecretStr
+
+from summary.core.config import Settings, get_settings
+from summary.main import app
+
+
+def get_settings_override():
+    """Return settings for tests."""
+    return Settings(
+        app_api_token=SecretStr("test-api-token"),
+    )
+
+
+@pytest.fixture()
+def client():
+    """Provide a FastAPI TestClient for tests."""
+    client = TestClient(app)
+    app.dependency_overrides[get_settings] = get_settings_override
+
+    return client