♿️(a11y) improve settings dialog screen reader support

Add aria labels, initial focus and accessible heading to dialog
♿️(a11y) fix focus ring on tab container components
2026-02-24 15:45:32 +01:00 · 2026-02-24 14:37:49 +01:00 · 2026-02-24 12:23:22 +01:00 · 2026-02-24 09:16:16 +01:00 · 2026-02-24 09:13:03 +01:00 · 2026-02-24 09:06:53 +01:00
119 changed files with 6681 additions and 2108 deletions
@@ -13,7 +13,7 @@ jobs:
    runs-on: ubuntu-latest
    steps:
      - name: Checkout
-        uses: actions/checkout@v4
+        uses: actions/checkout@v6

      - name: Download Crowdin files
        uses: crowdin/github-action@v2
@@ -23,7 +23,13 @@ jobs:
    steps:
      -
        name: Checkout repository
-        uses: actions/checkout@v4
+        uses: actions/checkout@v6
+      -
+        name: Set up QEMU
+        uses: docker/setup-qemu-action@v3
+      -
+        name: Set up Docker Buildx
+        uses: docker/setup-buildx-action@v3
      -
        name: Docker meta
        id: meta
@@ -49,6 +55,7 @@ jobs:
        with:
          context: .
          target: backend-production
+          platforms: linux/amd64,linux/arm64
          build-args: DOCKER_USER=${{ env.DOCKER_USER }}:-1000
          push: ${{ github.event_name != 'pull_request' }}
          tags: ${{ steps.meta.outputs.tags }}
@@ -59,7 +66,13 @@ jobs:
    steps:
      -
        name: Checkout repository
-        uses: actions/checkout@v4
+        uses: actions/checkout@v6
+      -
+        name: Set up QEMU
+        uses: docker/setup-qemu-action@v3
+      -
+        name: Set up Docker Buildx
+        uses: docker/setup-buildx-action@v3
      -
        name: Docker meta
        id: meta
@@ -86,6 +99,7 @@ jobs:
          context: .
          file: ./src/frontend/Dockerfile
          target: frontend-production
+          platforms: linux/amd64,linux/arm64
          build-args: DOCKER_USER=${{ env.DOCKER_USER }}:-1000
          push: ${{ github.event_name != 'pull_request' }}
          tags: ${{ steps.meta.outputs.tags }}
@@ -96,7 +110,13 @@ jobs:
    steps:
      -
        name: Checkout repository
-        uses: actions/checkout@v4
+        uses: actions/checkout@v6
+      -
+        name: Set up QEMU
+        uses: docker/setup-qemu-action@v3
+      -
+        name: Set up Docker Buildx
+        uses: docker/setup-buildx-action@v3
      -
        name: Docker meta
        id: meta
@@ -123,6 +143,7 @@ jobs:
          context: .
          file: ./docker/dinum-frontend/Dockerfile
          target: frontend-production
+          platforms: linux/amd64,linux/arm64
          build-args: DOCKER_USER=${{ env.DOCKER_USER }}:-1000
          push: ${{ github.event_name != 'pull_request' }}
          tags: ${{ steps.meta.outputs.tags }}
@@ -133,7 +154,13 @@ jobs:
    steps:
      -
        name: Checkout repository
-        uses: actions/checkout@v4
+        uses: actions/checkout@v6
+      -
+        name: Set up QEMU
+        uses: docker/setup-qemu-action@v3
+      -
+        name: Set up Docker Buildx
+        uses: docker/setup-buildx-action@v3
      -
        name: Docker meta
        id: meta
@@ -162,6 +189,7 @@ jobs:
          context: ./src/summary
          file: ./src/summary/Dockerfile
          target: production
+          platforms: linux/amd64,linux/arm64
          build-args: DOCKER_USER=${{ env.DOCKER_USER }}:-1000
          push: ${{ github.event_name != 'pull_request' }}
          tags: ${{ steps.meta.outputs.tags }}
@@ -172,7 +200,13 @@ jobs:
    steps:
      -
        name: Checkout repository
-        uses: actions/checkout@v4
+        uses: actions/checkout@v6
+      -
+        name: Set up QEMU
+        uses: docker/setup-qemu-action@v3
+      -
+        name: Set up Docker Buildx
+        uses: docker/setup-buildx-action@v3
      -
        name: Docker meta
        id: meta
@@ -201,6 +235,7 @@ jobs:
          context: ./src/agents
          file: ./src/agents/Dockerfile
          target: production
+          platforms: linux/amd64,linux/arm64
          build-args: DOCKER_USER=${{ env.DOCKER_USER }}:-1000
          push: ${{ github.event_name != 'pull_request' }}
          tags: ${{ steps.meta.outputs.tags }}
@@ -7,14 +7,18 @@ on:
  pull_request:
    branches:
      - "*"
+permissions:
+  contents: read

 jobs:
  lint-git:
    runs-on: ubuntu-latest
    if: github.event_name == 'pull_request' # Makes sense only for pull requests
+    permissions:
+      contents: read
    steps:
      - name: Checkout repository
-        uses: actions/checkout@v4
+        uses: actions/checkout@v6
        with:
          fetch-depth: 0
      - name: show
@@ -39,9 +43,11 @@ jobs:
    if: |
      contains(github.event.pull_request.labels.*.name, 'noChangeLog') == false &&
      github.event_name == 'pull_request'
+    permissions:
+        contents: read
    steps:
      - name: Checkout repository
-        uses: actions/checkout@v4
+        uses: actions/checkout@v6
        with:
          fetch-depth: 50
      - name: Check that the CHANGELOG has been modified in the current branch
@@ -49,9 +55,11 @@ jobs:

  lint-changelog:
    runs-on: ubuntu-latest
+    permissions:
+      contents: read
    steps:
      - name: Checkout repository
-        uses: actions/checkout@v4
+        uses: actions/checkout@v6
      - name: Check CHANGELOG max line length
        run: |
          max_line_length=$(cat CHANGELOG.md | grep -Ev "^\[.*\]: https://github.com" | wc -L)
@@ -62,20 +70,22 @@ jobs:

  build-mails:
    runs-on: ubuntu-latest
+    permissions:
+      contents: read
    defaults:
      run:
        working-directory: src/mail
    steps:
      - name: Checkout repository
-        uses: actions/checkout@v4
+        uses: actions/checkout@v6

      - name: Install Node.js
-        uses: actions/setup-node@v4
+        uses: actions/setup-node@v6
        with:
          node-version: "18"

      - name: Restore the mail templates
-        uses: actions/cache@v4
+        uses: actions/cache@v5
        id: mail-templates
        with:
          path: "src/backend/core/templates/mail"
@@ -95,21 +105,23 @@ jobs:

      - name: Cache mail templates
        if: steps.mail-templates.outputs.cache-hit != 'true'
-        uses: actions/cache@v4
+        uses: actions/cache@v5
        with:
          path: "src/backend/core/templates/mail"
          key: mail-templates-${{ hashFiles('src/mail/mjml') }}

  lint-back:
    runs-on: ubuntu-latest
+    permissions:
+      contents: read
    defaults:
      run:
        working-directory: src/backend
    steps:
      - name: Checkout repository
-        uses: actions/checkout@v4
+        uses: actions/checkout@v6
      - name: Install Python
-        uses: actions/setup-python@v5
+        uses: actions/setup-python@v6
        with:
          python-version: "3.13"
          cache: "pip"
@@ -124,14 +136,16 @@ jobs:

  lint-agents:
    runs-on: ubuntu-latest
+    permissions:
+      contents: read
    defaults:
      run:
        working-directory: src/agents
    steps:
      - name: Checkout repository
-        uses: actions/checkout@v4
+        uses: actions/checkout@v6
      - name: Install Python
-        uses: actions/setup-python@v5
+        uses: actions/setup-python@v6
        with:
          python-version: "3.13"
          cache: "pip"
@@ -144,14 +158,16 @@ jobs:

  lint-summary:
    runs-on: ubuntu-latest
+    permissions:
+      contents: read
    defaults:
      run:
        working-directory: src/summary
    steps:
      - name: Checkout repository
-        uses: actions/checkout@v4
+        uses: actions/checkout@v6
      - name: Install Python
-        uses: actions/setup-python@v5
+        uses: actions/setup-python@v6
        with:
          python-version: "3.13"
          cache: "pip"
@@ -165,7 +181,8 @@ jobs:
  test-back:
    runs-on: ubuntu-latest
    needs: build-mails
-
+    permissions:
+      contents: read
    defaults:
      run:
        working-directory: src/backend
@@ -216,7 +233,7 @@ jobs:

    steps:
      - name: Checkout repository
-        uses: actions/checkout@v4
+        uses: actions/checkout@v6

      - name: Create writable /data
        run: |
@@ -224,7 +241,7 @@ jobs:
          sudo mkdir -p /data/static

      - name: Restore the mail templates
-        uses: actions/cache@v4
+        uses: actions/cache@v5
        id: mail-templates
        with:
          path: "src/backend/core/templates/mail"
@@ -258,7 +275,7 @@ jobs:
            mc mb meet/meet-media-storage"

      - name: Install Python
-        uses: actions/setup-python@v5
+        uses: actions/setup-python@v6
        with:
          python-version: "3.13"
          cache: "pip"
@@ -279,9 +296,11 @@ jobs:

  lint-front:
    runs-on: ubuntu-latest
+    permissions:
+      contents: read
    steps:
      - name: Checkout repository
-        uses: actions/checkout@v4
+        uses: actions/checkout@v6

      - name: Install dependencies
        run: cd src/frontend/ && npm ci
@@ -294,12 +313,14 @@ jobs:

  lint-sdk:
    runs-on: ubuntu-latest
+    permissions:
+      contents: read
    defaults:
      run:
        working-directory: src/sdk/library
    steps:
      - name: Checkout repository
-        uses: actions/checkout@v4
+        uses: actions/checkout@v6

      - name: Install dependencies
        run: npm ci
@@ -312,13 +333,15 @@ jobs:

  build-sdk:
    runs-on: ubuntu-latest
+    permissions:
+      contents: read
    needs: lint-sdk
    defaults:
      run:
        working-directory: src/sdk/library
    steps:
      - name: Checkout repository
-        uses: actions/checkout@v4
+        uses: actions/checkout@v6

      - name: Install dependencies
        run: npm ci
@@ -13,7 +13,7 @@ jobs:
    runs-on: ubuntu-latest
    steps:
      - name: Checkout
-        uses: actions/checkout@v4
+        uses: actions/checkout@v6
        with:
          fetch-depth: 0

@@ -8,6 +8,86 @@ and this project adheres to

 ## [Unreleased]

+### Added
+
+- 👷(docker) add arm64 platform support for image builds
+
+### Changed
+
+- ♻️(frontend) replace custom reactions toolbar with react aria popover #985
+- 🔒️(frontend) uninstall curl from the frontend production image #987
+- 💄(frontend) add focus ring to reaction emoji buttons
+- ✨(frontend) introduce a shortcut settings tab #975
+- 🚚(frontend) rename "wellknown" directory to "well-known" #1009
+- 🌐(frontend) localize SR modifier labels #1010
+- ⬆️(backend) update python dependencies #1011
+- ♿️(a11y) fix focus ring on tab container components
+
+
+## [1.8.0] - 2026-02-20
+
+### Changed
+
+- 🔒️(agents) uninstall pip from the agents image
+- 🔒️(summary) switch to Alpine base image
+- 🔒️(backend) uninstall pip in the production image
+
+### Fixed
+
+- 🔒️(agents) upgrade OpenSSL to address CVE-2025-15467
+- 📌(agents) pin protobuf to 6.33.5 to fix CVE-2026-0994
+
+## [1.7.0] - 2026-02-19
+
+### Added
+
+- ✨(frontend) expose Windows app web link #976
+- ✨(frontend) support additional shortcuts to broaden accessibility
+
+### Changed
+
+- ✨(frontend) add clickable settings general link in idle modal #974
+
+## [1.6.0] - 2026-02-10
+
+### Added
+
+- ✨(backend) monitor throttling rate failure through sentry #964
+- 🚀(paas) add PaaS deployment scripts, tested on Scalingo #957
+
+### Changed
+
+- ♿️(frontend) improve spinner reduced‑motion fallback #931
+- ♿️(frontend) fix form labels and autocomplete wiring #932
+- 🥅(summary) catch file-related exceptions when handling recording #944
+- 📝(frontend) update legal terms #956
+- ⚡️(backend) enhance django admin's loading performance #954
+- 🌐(frontend) add missing DE translation for accessibility settings
+
+### Fixed
+
+- 🔐(backend) enforce object-level permission checks on room endpoint #959
+- 🔒️(backend) add application validation when consuming external JWT #963
+
+## [1.5.0] - 2026-01-28
+
+### Changed
+
+- ♿️(frontend) adjust visual-only tooltip a11y labels #910
+- ♿️(frontend) sr pin/unpin announcements with dedicated messages #898
+- ♿(frontend) adjust sr announcements for idle disconnect timer #908
+- ♿️(frontend) add global screen reader announcer#922
+
+### Fixed
+
+- 🔒️(frontend) fix an XSS vulnerability on the recording page #911
+
+## [1.4.0] - 2026-01-25
+
+### Added
+
+- ✨(frontend) add configurable redirect for unauthenticated users #904
+
 ### Changed

 - ♿️(frontend) add accessible back button in side panel #881
@@ -24,6 +104,7 @@ and this project adheres to
 - 📝(frontend) align close dialog label in rooms locale #878
 - 🩹(backend) use case-insensitive email matching in the external api #887
 - 🐛(frontend) ensure transcript segments are sorted by their timestamp #899
+- 🐛(frontend) scope scrollbar gutter override to video rooms #882

 ## [1.3.0] - 2026-01-13

@@ -127,6 +127,9 @@ ARG MEET_STATIC_ROOT=/data/static
 RUN mkdir -p /usr/local/etc/gunicorn
 COPY docker/files/usr/local/etc/gunicorn/meet.py /usr/local/etc/gunicorn/meet.py

+# Remove pip to reduce attack surface in production
+RUN pip uninstall -y pip
+
 # Un-privileged user running the application
 ARG DOCKER_USER
 USER ${DOCKER_USER}
@@ -0,0 +1,2 @@
+web: bin/buildpack_start.sh
+postdeploy: python manage.py migrate
@@ -50,6 +50,9 @@ La Suite Meet is fully self-hostable and released under the MIT License, ensurin

 We’re continuously adding new features to enhance your experience, with the latest updates coming soon!

+### 🚀 Major roll out to all French public servants
+
+On the 25th of January 2026, David Amiel, France’s Minister for Civil Service and State Reform, announced the full deployment of Visio—the French government’s dedicated Meet platform—to all public servants. ([Source in French](https://www.latribune.fr/article/la-tribune-dimanche/politique/73157688099661/david-amiel-ministre-delegue-de-la-fonction-publique-nous-allons-sortir-de-la-dependance-aux-outils-americains))

 ## Table of Contents

@@ -86,7 +89,7 @@ We hope to see many more, here is an incomplete list of public La Suite Meet ins
 | [visio.numerique.gouv.fr](https://visio.numerique.gouv.fr/)   | DINUM    | French public agents working for the central administration and the extended public sphere. ProConnect is required to login in or sign up|
 | [visio.suite.anct.gouv.fr](https://visio.suite.anct.gouv.fr/) | ANCT    | French public agents working for the territorial administration and the extended public sphere. ProConnect is required to login in or sign up|
 | [visio.lasuite.coop](https://visio.lasuite.coop/)             | lasuite.coop    | Free and open demo to all. Content and accounts are reset after one month |
-| [meet.demo.mosacloud.eu](https://meet.demo.mosacloud.eu/)     | mosa.cloud    | Demo instance of mosa.cloud, a dutch company providing services around La Suite apps. |
+| [mosacloud.cloud](https://mosa.cloud/)                        | mosa.cloud    | Demo instance of mosa.cloud, a dutch company providing services around La Suite apps. |


 ## Contributing
@@ -18,6 +18,7 @@ docker_build(
    'localhost:5001/meet-backend:latest',
    context='..',
    dockerfile='../Dockerfile',
+    build_args={'DOCKER_USER': '1001:127'},
    only=['./src/backend', './src/mail', './docker'],
    target = 'backend-production',
    live_update=[
@@ -33,6 +34,7 @@ clean_old_images('localhost:5001/meet-backend')
 docker_build(
    'localhost:5001/meet-frontend-dinum:latest',
    context='..',
+    build_args={'DOCKER_USER': '1001:127'},
    dockerfile='../docker/dinum-frontend/Dockerfile',
    only=['./src/frontend', './docker', './.dockerignore'],
    target = 'frontend-production',
@@ -57,6 +59,7 @@ clean_old_images('localhost:5001/meet-frontend-generic')
 docker_build(
    'localhost:5001/meet-summary:latest',
    context='../src/summary',
+    build_args={'DOCKER_USER': '1001:127'},
    dockerfile='../src/summary/Dockerfile',
    only=['.'],
    target = 'production',
@@ -69,8 +72,9 @@ clean_old_images('localhost:5001/meet-summary')
 docker_build(
    'localhost:5001/meet-agents:latest',
    context='../src/agents',
+    build_args={'DOCKER_USER': '1001:127'},
    dockerfile='../src/agents/Dockerfile',
-   only=['.'],
+    only=['.'],
    target = 'production',
    live_update=[
        sync('../src/agents', '/app'),
@@ -0,0 +1,9 @@
+#!/bin/bash
+
+set -o errexit    # always exit on error
+set -o pipefail   # don't ignore exit codes when piping output
+
+echo "-----> Running post-compile script"
+
+# Cleanup
+rm -rf docker docs env.d gitlint
@@ -0,0 +1,50 @@
+#!/bin/bash
+
+set -o errexit    # always exit on error
+set -o pipefail   # don't ignore exit codes when piping output
+
+echo "-----> Running post-frontend script"
+
+# Move the frontend build to the nginx root and clean up
+mkdir -p build/
+mv src/frontend/dist build/frontend-out
+
+ASSETS_DIR=build/frontend-out/assets
+if [ -n "$CUSTOM_LOGO_URL" ]; then
+    # Ensure https
+    [[ ! "$CUSTOM_LOGO_URL" =~ ^https:// ]] && echo "[custom-logo] ERROR: URL must use HTTPS" >&2 && exit 1
+
+    # Prevent SSRF
+    HOSTNAME=$(echo "$CUSTOM_LOGO_URL" | sed -E 's|^https://([^/:]+).*|\1|')
+    [[ "$HOSTNAME" =~ ^(localhost|127\.|10\.|172\.(1[6-9]|2[0-9]|3[01])\.|192\.168\.|0\.0\.0\.0|\[::1\]) ]] && echo "[custom-logo] ERROR: SSRF blocked: $HOSTNAME" >&2 && exit 1
+
+    LOGO_FILE="${ASSETS_DIR}/logo.svg"
+    TMP_FILE=$(mktemp "${LOGO_FILE}.XXXXXX.tmp")
+
+    # Actual download
+    echo "[custom-logo] INFO: Downloading custom logo from: $CUSTOM_LOGO_URL"
+    curl -fsSL --tlsv1.2 -o "$TMP_FILE" "$CUSTOM_LOGO_URL"
+
+    # Validate filesize
+    FILESIZE=$(stat -c%s "$TMP_FILE" 2>/dev/null || stat -f%z "$TMP_FILE")
+    [[ "$FILESIZE" -eq 0 ]] && echo "[custom-logo] ERROR: empty file" >&2 && exit 1
+    [[ "$FILESIZE" -gt 5242880 ]] && echo "[custom-logo] ERROR: file too large (${FILESIZE}B > 5MB)" >&2 && exit 1
+
+    # Validate file type
+    IS_SVG=false
+
+    HEADER=$(head -c 100 "$TMP_FILE" | tr -d '\0' | tr '[:upper:]' '[:lower:]')
+    [[ "$HEADER" =~ ^.*"<svg".*$ ]] && IS_SVG=true
+    [[ "$HEADER" =~ ^.*"<?xml".*"<svg".*$ ]] && IS_SVG=true
+
+    [[ "$IS_SVG" == false ]] && echo "[custom-logo] ERROR: not a valid SVG file" >&2 && exit 1
+
+    mv -f "$TMP_FILE" "$LOGO_FILE"
+    echo "[custom-logo] INFO: Custom logo downloaded successfuly"
+fi
+
+mv src/backend/* ./
+mv deploy/paas/* ./
+
+echo "3.13" > .python-version
+echo "." > requirements.txt
@@ -0,0 +1,15 @@
+#!/bin/bash
+
+# Start the Django backend server
+gunicorn -b 0.0.0.0:8000 meet.wsgi:application --log-file - &
+
+# Start the Nginx server
+bin/run &
+
+# if the current shell is killed, also terminate all its children     
+trap "pkill SIGTERM -P $$" SIGTERM
+
+# wait for a single child to finish,
+wait -n
+# then kill all the other tasks
+pkill -P $$
@@ -0,0 +1,52 @@
+# ERB templated nginx configuration
+# see https://doc.scalingo.com/platform/deployment/buildpacks/nginx
+
+upstream backend_server {
+	server localhost:8000 fail_timeout=0;
+}
+
+server {
+  listen <%= ENV["PORT"] %>;
+  server_name _;
+  server_tokens off;
+
+  root /app/build/frontend-out;
+
+  # Django rest framework
+  location ^~ /api/ {
+      proxy_set_header X-Forwarded-Proto https;
+      proxy_set_header Host $http_host;
+      proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
+
+      proxy_redirect off;
+      proxy_pass http://backend_server;
+  }
+
+  # Django admin
+  location ^~ /admin/ {
+      proxy_set_header X-Forwarded-Proto https;
+      proxy_set_header Host $http_host;
+      proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
+
+      proxy_redirect off;
+      proxy_pass http://backend_server;
+  }
+
+  # Serve static files with caching
+  location ~* ^/assets/.*\.(css|js|json|png|jpg|jpeg|gif|ico|svg|woff|woff2|ttf|eot)$ {
+      expires 30d;
+      add_header Cache-Control "public, max-age=2592000";
+  }
+
+  # Serve static files
+  location / {
+      try_files $uri $uri/ /index.html;
+      # Add no-cache headers
+      add_header Cache-Control "no-cache, no-store, must-revalidate";
+      add_header Pragma "no-cache";  # HTTP 1.0 header for backward compatibility
+      add_header Expires 0;
+  }
+
+  # Optionally, handle 404 errors by redirecting to index.html
+  error_page 404 =200 /index.html;
+}
@@ -1,9 +1,9 @@
 upstream meet_backend {
-    server ${BACKEND_HOST}:8000 fail_timeout=0;
+    server ${BACKEND_INTERNAL_HOST}:8000 fail_timeout=0;
 }

 upstream meet_frontend {
-    server ${FRONTEND_HOST}:8080 fail_timeout=0;
+    server ${FRONTEND_INTERNAL_HOST}:8080 fail_timeout=0;
 }

 server {
@@ -1,4 +1,4 @@
-FROM livekit/livekit-server:v1.9.0
+FROM livekit/livekit-server:v1.9.4

 # We inject the nip.io certificate manually because the livekit chart doesn't support volume mounting
 COPY rootCA.pem /etc/ssl/certs/
@@ -3,3 +3,8 @@ redis:
  address: redis:6379
 keys:
  devkey: secret
+
+webhook:
+  api_key: devkey
+  urls:
+      - http://app-dev:8000/api/v1.0/rooms/webhooks-livekit/
@@ -10,7 +10,7 @@ services:
    - env.d/postgresql
    - env.d/common
    volumes:
-    - ./data/databases/backend:/var/lib/postgresql/data/pgdata
+    - ./data/databases/backend:/var/lib/postgresql/data

  redis:
    image: redis:5
@@ -20,8 +20,8 @@ services:
    user: ${DOCKER_USER:-1000}
    restart: always
    env_file:
+    - .env
    - env.d/common
-    - env.d/backend
    - env.d/postgresql
    healthcheck:
      test: ["CMD", "python", "manage.py", "check"]
@@ -45,6 +45,7 @@ services:
    - /docker-entrypoint.sh
    command: ["nginx", "-g", "daemon off;"]
    env_file:
+    - .env
    - env.d/common
    # Uncomment and set your values if using our nginx proxy example
    # environment:
@@ -8,7 +8,7 @@
 ### Step 1: Prepare your working environment:

 ```bash
-mkdir keycloak/env.d && cd keycloak
+mkdir -p keycloak/env.d && cd keycloak
 curl -o compose.yaml https://raw.githubusercontent.com/suitenumerique/meet/refs/heads/main/docs/examples/compose/keycloak/compose.yaml
 curl -o env.d/kc_postgresql https://raw.githubusercontent.com/suitenumerique/meet/refs/heads/main/env.d/production.dist/kc_postgresql
 curl -o env.d/keycloak https://raw.githubusercontent.com/suitenumerique/meet/refs/heads/main/env.d/production.dist/keycloak
@@ -89,4 +89,4 @@ Your keycloak instance is now available on https://doc.yourdomain.tld
 #### Step 3: Get Client Credentials

 1. Go to the "Credentials" tab.
-2. Copy the client ID (`meet` in this example) and the client secret.
+2. Copy the client ID (`meet` in this example) and the client secret.
@@ -9,6 +9,10 @@ La Suite Meet maintainers use only the Kubernetes deployment method in productio
 We understand that not everyone has a Kubernetes cluster available, please follow the instructions provided [here](/docs/installation/compose.md) to set up a docker compose instance.
 We also provide [Docker images](https://hub.docker.com/u/lasuite?page=1&search=meet) that can be deployed using Compose.

+## Scalingo
+
+La Suite Meet can be deployed on Scalingo PaaS using the Suite Numérique buildpack. See the [Scalingo deployment guide](./scalingo.md) for detailed instructions.
+
 ## Other ways to install La Suite Meet
 Community members have contributed alternative ways to install La Suite Meet 🙏. While maintainers may not provide direct support, we help keep these instructions up to date, and you can reach out to contributors or the community for assistance.

@@ -47,7 +47,7 @@ curl -o default.conf.template https://raw.githubusercontent.com/suitenumerique/m

 ## Step 2: Configuration

-Meet configuration is achieved through environment variables. We provide a [detailed description of all variables](../env.md).
+Meet configuration is achieved through environment variables. We provide a [detailed description of all variables](../../src/helm/meet/README.md).

 In this example, we assume the following services:

@@ -129,7 +129,7 @@ The following ports will need to be opened:
 - 7881/tcp - WebRTC ICE over TCP
 - 7882/udp - for WebRTC multiplexing over UDP

-If you are using ufw, enter the follwoing:
+If you are using ufw, enter the following:
 ```
 ufw allow 80/tcp
 ufw allow 443/tcp
@@ -177,6 +177,15 @@ You will need to uncomment the environment and network sections in compose file
 #    external: true
 ```

+#### Caddy Reverse Proxy
+Expose the Frontend port to the host
+```yaml
+frontend:
+  …
+  ports:
+    - "8086:8086"
+```
+
 ## Step 5: Start Meet

 You are ready to start your Meet application !
@@ -198,7 +207,7 @@ Replace `<admin email>` with the email of your admin user and generate a secure

 Your Meet instance is now available on the domain you defined, https://meet.yourdomain.tld.

-THe admin interface is available on https://meet.yourdomain.tld/admin with the admin user you just created.
+The admin interface is available on https://meet.yourdomain.tld/admin with the admin user you just created.

 ## How to upgrade your Meet application

@@ -0,0 +1,185 @@
+# Deployment on Scalingo
+
+This guide explains how to deploy La Suite Meet on [Scalingo](https://scalingo.com/) using the [Suite Numérique buildpack](https://github.com/suitenumerique/buildpack).
+
+## Overview
+
+Scalingo is a Platform-as-a-Service (PaaS) that simplifies application deployment. This setup uses a custom buildpack to handle both the frontend (Vite) and backend (Django) builds, serving them through Nginx.
+
+## Prerequisites
+
+- A Scalingo account
+- Scalingo CLI installed (optional but recommended)
+- A PostgreSQL database addon
+- A Redis addon (for caching and sessions)
+
+## Step 1: Create Your App
+
+Create a new app on Scalingo using `scalingo` cli or using the [Scalingo dashboard](https://dashboard.scalingo.com/).
+
+## Step 2: Provision Addons
+
+Add the required PostgreSQL and Redis services.
+
+This will set the following environment variables automatically:
+- `SCALINGO_POSTGRESQL_URL` - Database connection string
+- `SCALINGO_REDIS_URL` - Redis connection string
+
+## Step 3: Configure Environment Variables
+
+Set the following environment variables in your Scalingo app:
+
+### Buildpack Configuration
+
+```bash
+scalingo env-set BUILDPACK_URL="https://github.com/suitenumerique/buildpack#main"
+scalingo env-set LASUITE_APP_NAME="meet"
+scalingo env-set LASUITE_BACKEND_DIR="."
+scalingo env-set LASUITE_FRONTEND_DIR="src/frontend/"
+scalingo env-set LASUITE_NGINX_DIR="."
+scalingo env-set LASUITE_SCRIPT_POSTCOMPILE="bin/buildpack_postcompile.sh"
+scalingo env-set LASUITE_SCRIPT_POSTFRONTEND="bin/buildpack_postfrontend.sh"
+```
+
+### Database and Cache
+
+```bash
+scalingo env-set DATABASE_URL="\$SCALINGO_POSTGRESQL_URL"
+scalingo env-set REDIS_URL="\$SCALINGO_REDIS_URL"
+```
+
+### Django Settings
+
+```bash
+scalingo env-set DJANGO_SETTINGS_MODULE="meet.settings"
+scalingo env-set DJANGO_CONFIGURATION="Production"
+scalingo env-set DJANGO_SECRET_KEY="<generate-a-secure-secret-key>"
+scalingo env-set DJANGO_ALLOWED_HOSTS="my-meet-app.osc-fr1.scalingo.io"
+```
+
+### OIDC Authentication
+
+Configure your OIDC provider (e.g., Keycloak, Authentik):
+
+```bash
+scalingo env-set OIDC_OP_BASE_URL="https://auth.yourdomain.com/realms/meet"
+scalingo env-set OIDC_RP_CLIENT_ID="meet-client-id"
+scalingo env-set OIDC_RP_CLIENT_SECRET="<your-client-secret>"
+scalingo env-set OIDC_RP_SIGN_ALGO="RS256"
+```
+
+### LiveKit Configuration
+
+Meet requires a LiveKit server for video conferencing:
+
+```bash
+scalingo env-set LIVEKIT_API_URL="wss://livekit.yourdomain.com"
+scalingo env-set LIVEKIT_API_KEY="<your-livekit-api-key>"
+scalingo env-set LIVEKIT_API_SECRET="<your-livekit-api-secret>"
+```
+
+### Email Configuration (Optional)
+
+For email notifications see https://doc.scalingo.com/platform/app/sending-emails:
+
+```bash
+scalingo env-set DJANGO_EMAIL_HOST="smtp.example.org"
+scalingo env-set DJANGO_EMAIL_PORT="587"
+scalingo env-set DJANGO_EMAIL_HOST_USER="<smtp-user>"
+scalingo env-set DJANGO_EMAIL_HOST_PASSWORD="<smtp-password>"
+scalingo env-set DJANGO_EMAIL_USE_TLS="True"
+scalingo env-set DJANGO_EMAIL_FROM="meet@yourdomain.com"
+```
+
+## Step 4: Deploy
+
+Deploy your application:
+
+```bash
+git push scalingo main
+```
+
+The Procfile will automatically:
+1. Build the frontend (Vite)
+2. Build the backend (Django)
+3. Run the post-compile script (cleanup)
+4. Run the post-frontend script (move assets and prepare for deployment)
+5. Start Nginx and Gunicorn
+6. Run django migrations
+
+## Step 5: Create superuser
+
+After the first deployment, create an admin user:
+
+```bash
+scalingo run python manage.py createsuperuser
+```
+
+## Custom Domain (Optional)
+
+To use a custom domain:
+
+1. Add the domain in Scalingo dashboard
+2. Update `DJANGO_ALLOWED_HOSTS` with your custom domain
+3. Configure your DNS to point to Scalingo
+
+```bash
+scalingo domains-add meet.yourdomain.com
+scalingo env-set DJANGO_ALLOWED_HOSTS="meet.yourdomain.com,my-meet-app.osc-fr1.scalingo.io"
+```
+
+## Custom Logo (Optional)
+
+To use a custom logo, set the `CUSTOM_LOGO_URL` environment variable with an HTTPS URL pointing to an SVG item (max 5MB):
+
+```bash
+scalingo env-set CUSTOM_LOGO_URL="https://cdn.yourdomain.com/logo.svg"
+```
+
+## Troubleshooting
+
+### Check Logs
+
+```bash
+scalingo logs --tail
+```
+
+### Common Issues
+
+1. **Build fails**: Check that all required environment variables are set
+2. **Database connection error**: Verify `DATABASE_URL` is correctly set to `$SCALINGO_POSTGRESQL_URL`
+3. **Static files not served**: Ensure the buildpack post-frontend script ran successfully
+4. **OIDC errors**: Verify your OIDC provider configuration and callback URLs
+
+### Useful Commands
+
+```bash
+# Open a console
+scalingo run bash
+
+# Restart the app
+scalingo restart
+
+# Scale containers
+scalingo scale web:2
+
+# One-off command
+scalingo run python manage.py shell
+```
+
+## Architecture
+
+On Scalingo, the application runs as follows:
+
+1. **Build Phase**: The buildpack compiles both frontend and backend
+2. **Runtime**:
+   - Nginx serves static files and proxies to the backend
+   - Gunicorn runs the Django WSGI application
+   - Both processes are managed by the `bin/buildpack_start.sh` script
+
+## Additional Resources
+
+- [Scalingo Documentation](https://doc.scalingo.com/)
+- [Suite Numérique Buildpack](https://github.com/suitenumerique/buildpack)
+- [Meet Environment Variables](../../src/helm/meet/README.md)
+- [Django Configurations Documentation](https://django-configurations.readthedocs.io/)
@@ -20,7 +20,7 @@ DJANGO_EMAIL_FROM=<your email address>
 #DJANGO_EMAIL_USE_SSL=true # A flag to enable or disable SSL for email sending.

 DJANGO_EMAIL_BRAND_NAME="La Suite Numérique" 
-DJANGO_EMAIL_LOGO_IMG="https://${meet_HOST}/assets/logo-suite-numerique.png"
+DJANGO_EMAIL_LOGO_IMG="https://${MEET_HOST}/assets/logo-suite-numerique.png"

 # Backend url
 MEET_BASE_URL="https://${MEET_HOST}"
@@ -4,6 +4,8 @@ FROM python:3.13-slim AS base
 RUN apt-get update && apt-get install -y \
    libglib2.0-0 \
    libgobject-2.0-0 \
+    "openssl=3.5.4-1~deb13u2" \
+    "libssl3t64=3.5.4-1~deb13u2" \
    && rm -rf /var/lib/apt/lists/*

 FROM base AS builder
@@ -19,6 +21,9 @@ FROM base AS production

 WORKDIR /app

+# Remove pip to reduce attack surface in production
+RUN pip uninstall -y pip
+
 ARG DOCKER_USER
 USER ${DOCKER_USER}

@@ -1,14 +1,15 @@

 [project]
 name = "agents"
-version = "1.3.0"
+version = "1.8.0"
 requires-python = ">=3.12"
 dependencies = [
    "livekit-agents==1.3.10",
    "livekit-plugins-deepgram==1.3.10",
    "livekit-plugins-silero==1.3.10",
    "livekit-plugins-kyutai-lasuite==0.0.6",
-    "python-dotenv==1.2.1"
+    "python-dotenv==1.2.1",
+    "protobuf==6.33.5"
 ]

 [project.optional-dependencies]
@@ -115,6 +115,10 @@ class RoomAdmin(admin.ModelAdmin):
    list_filter = ["access_level", "created_at"]
    readonly_fields = ["id", "created_at", "updated_at"]

+    def get_queryset(self, request):
+        """Optimize queries by prefetching related access and user data to avoid N+1 queries."""
+        return super().get_queryset(request).prefetch_related("accesses__user")
+
    def get_owner(self, obj):
        """Return the owner of the room for display in the admin list."""

@@ -138,6 +142,7 @@ class RecordingAccessInline(admin.TabularInline):

    model = models.RecordingAccess
    extra = 0
+    autocomplete_fields = ["user"]


@admin.action(description=_("Resend notification to external service"))
@@ -207,8 +212,18 @@ class RecordingAdmin(admin.ModelAdmin):
        "created_at",
        "worker_id",
    )
-    list_filter = ["status", "room", "created_at"]
-    readonly_fields = ["id", "created_at", "updated_at"]
+    list_filter = ["created_at"]
+    list_select_related = ("room",)
+    readonly_fields = (
+        "id",
+        "created_at",
+        "options",
+        "mode",
+        "room",
+        "status",
+        "updated_at",
+        "worker_id",
+    )
    actions = [resend_notification]

    def get_queryset(self, request):
@@ -0,0 +1,26 @@
+"""Throttling modules for the API."""
+
+from lasuite.drf.throttling import MonitoredThrottleMixin
+from rest_framework.throttling import AnonRateThrottle
+from sentry_sdk import capture_message
+
+
+def sentry_monitoring_throttle_failure(message):
+    """Log when a failure occurs to detect rate limiting issues."""
+    capture_message(message, "warning")
+
+
+class MonitoredAnonRateThrottle(MonitoredThrottleMixin, AnonRateThrottle):
+    """Throttle for the monitored scoped rate throttle."""
+
+
+class RequestEntryAnonRateThrottle(MonitoredAnonRateThrottle):
+    """Throttle Anonymous user requesting room entry"""
+
+    scope = "request_entry"
+
+
+class CreationCallbackAnonRateThrottle(MonitoredAnonRateThrottle):
+    """Throttle Anonymous user requesting room generation callback"""
+
+    scope = "creation_callback"
@@ -10,7 +10,7 @@ from django.http import Http404
 from django.shortcuts import get_object_or_404
 from django.utils.text import slugify

-from rest_framework import decorators, mixins, pagination, throttling, viewsets
+from rest_framework import decorators, mixins, pagination, viewsets
 from rest_framework import (
    exceptions as drf_exceptions,
 )
@@ -58,7 +58,7 @@ from core.services.room_creation import RoomCreation
 from core.services.subtitle import SubtitleException, SubtitleService

 from ..authentication.livekit import LiveKitTokenAuthentication
-from . import permissions, serializers
+from . import permissions, serializers, throttling
 from .feature_flag import FeatureFlag

 # pylint: disable=too-many-ancestors
@@ -191,18 +191,6 @@ class UserViewSet(
        )


-class RequestEntryAnonRateThrottle(throttling.AnonRateThrottle):
-    """Throttle Anonymous user requesting room entry"""
-
-    scope = "request_entry"
-
-
-class CreationCallbackAnonRateThrottle(throttling.AnonRateThrottle):
-    """Throttle Anonymous user requesting room generation callback"""
-
-    scope = "creation_callback"
-
-
 class RoomViewSet(
    mixins.CreateModelMixin,
    mixins.DestroyModelMixin,
@@ -379,7 +367,7 @@ class RoomViewSet(
        methods=["post"],
        url_path="request-entry",
        permission_classes=[],
-        throttle_classes=[RequestEntryAnonRateThrottle],
+        throttle_classes=[throttling.RequestEntryAnonRateThrottle],
    )
    def request_entry(self, request, pk=None):  # pylint: disable=unused-argument
        """Request entry to a room"""
@@ -489,7 +477,7 @@ class RoomViewSet(
        methods=["post"],
        url_path="creation-callback",
        permission_classes=[],
-        throttle_classes=[CreationCallbackAnonRateThrottle],
+        throttle_classes=[throttling.CreationCallbackAnonRateThrottle],
    )
    def creation_callback(self, request):
        """Retrieve cached room data via an unauthenticated request with a unique ID.
@@ -10,6 +10,8 @@ import jwt as pyJwt
 from lasuite.oidc_resource_server.backend import ResourceServerBackend as LaSuiteBackend
 from rest_framework import authentication, exceptions

+from core.models import Application
+
 User = get_user_model()
 logger = logging.getLogger(__name__)

@@ -94,6 +96,18 @@ class ApplicationJWTAuthentication(authentication.BaseAuthentication):
            logger.warning("Missing 'client_id' in JWT payload")
            raise exceptions.AuthenticationFailed("Invalid token claims.")

+        try:
+            application = Application.objects.get(client_id=client_id)
+        except Application.DoesNotExist as e:
+            logger.warning("Application not found: %s", client_id)
+            raise exceptions.AuthenticationFailed("Application not found.") from e
+
+        if not application.active:
+            logger.warning(
+                "Inactive application attempted authentication: %s", client_id
+            )
+            raise exceptions.AuthenticationFailed("Application is disabled.")
+
        if not is_delegated:
            logger.warning("Token is not marked as delegated")
            raise exceptions.AuthenticationFailed("Invalid token type.")
@@ -33,12 +33,11 @@ class BaseScopePermission(permissions.BasePermission):
        Raises:
            PermissionDenied: If required scope is missing from token
        """
-        # Get the current action (e.g., 'list', 'create')
+        # Get the current action (e.g., 'list', 'create'), if None let DRF handle it
        action = getattr(view, "action", None)
        if not action:
-            raise exceptions.PermissionDenied(
-                "Insufficient permissions. Unknown action."
-            )
+            # DRF routers return a 405 for unsupported methods
+            return True

        required_scope = self.scope_map.get(action)
        if not required_scope:
@@ -57,9 +56,12 @@ class BaseScopePermission(permissions.BasePermission):
        if isinstance(token_scopes, str):
            token_scopes = token_scopes.split()

+        # Ensure scopes is a deduplicated list (preserving order) and lowercase all scopes
+        token_scopes = list(dict.fromkeys(scope.lower() for scope in token_scopes))
+
        if settings.OIDC_RS_SCOPES_PREFIX:
            token_scopes = [
-                scope.replace(f"{settings.OIDC_RS_SCOPES_PREFIX}:", "")
+                scope.removeprefix(f"{settings.OIDC_RS_SCOPES_PREFIX}:")
                for scope in token_scopes
            ]

@@ -82,3 +84,23 @@ class HasRequiredRoomScope(BaseScopePermission):
        "partial_update": models.ApplicationScope.ROOMS_UPDATE,
        "destroy": models.ApplicationScope.ROOMS_DELETE,
    }
+
+
+class RoomPermissions(permissions.BasePermission):
+    """Permissions applying to the room API endpoint."""
+
+    def has_permission(self, request, view):
+        """Allow access only to authenticated users."""
+        return request.user.is_authenticated
+
+    def has_object_permission(self, request, view, obj):
+        """Enforce role-based access: read=any role, delete=owner, write=admin or owner."""
+        user = request.user
+
+        if request.method in permissions.SAFE_METHODS:
+            return obj.has_any_role(user)
+
+        if request.method == "DELETE":
+            return obj.is_owner(user)
+
+        return obj.is_administrator_or_owner(user)
@@ -28,7 +28,7 @@ from . import authentication, permissions, serializers
 logger = getLogger(__name__)


-class ApplicationViewSet(viewsets.GenericViewSet):
+class ApplicationViewSet(viewsets.ViewSet):
    """API endpoints for application authentication and token generation."""

    @decorators.action(
@@ -182,7 +182,9 @@ class RoomViewSet(
        ResourceServerAuthentication,
    ]
    permission_classes = [
-        api.permissions.IsAuthenticated & permissions.HasRequiredRoomScope
+        api.permissions.IsAuthenticated
+        & permissions.HasRequiredRoomScope
+        & permissions.RoomPermissions
    ]
    queryset = models.Room.objects.all()
    serializer_class = serializers.RoomSerializer
@@ -292,6 +292,10 @@ class Resource(BaseModel):
                role = RoleChoices.MEMBER
        return role

+    def has_any_role(self, user):
+        """Check if a user has any role on the resource."""
+        return self.get_role(user) is not None
+
    def is_administrator_or_owner(self, user):
        """
        Check if a user is administrator or owner of the resource."""
@@ -102,6 +102,7 @@ def test_notify_user_by_email_success(mocked_current_site, settings):
    settings.EMAIL_SUPPORT_EMAIL = "support@acme.com"
    settings.EMAIL_LOGO_IMG = "https://acme.com/logo"
    settings.SCREEN_RECORDING_BASE_URL = "https://acme.com/recordings"
+    settings.RECORDING_DOWNLOAD_BASE_URL = None
    settings.EMAIL_FROM = "notifications@acme.com"

    recording = factories.RecordingFactory(room__name="Conference Room A")
@@ -2,21 +2,21 @@
 Tests for external API /room endpoint
 """

-# pylint: disable=W0621
+# pylint: disable=W0621,C0302

+import uuid
 from datetime import datetime, timedelta, timezone
+from unittest import mock

 from django.conf import settings

 import jwt
 import pytest
 import responses
+from lasuite.oidc_resource_server.authentication import ResourceServerAuthentication
 from rest_framework.test import APIClient

-from core.factories import (
-    RoomFactory,
-    UserFactory,
-)
+from core.factories import ApplicationFactory, RoomFactory, UserFactory
 from core.models import ApplicationScope, RoleChoices, Room, RoomAccessLevel, User

 pytestmark = pytest.mark.django_db
@@ -27,12 +27,14 @@ def generate_test_token(user, scopes):
    now = datetime.now(timezone.utc)
    scope_string = " ".join(scopes)

+    application = ApplicationFactory()
+
    payload = {
        "iss": settings.APPLICATION_JWT_ISSUER,
        "aud": settings.APPLICATION_JWT_AUDIENCE,
        "iat": now,
        "exp": now + timedelta(seconds=settings.APPLICATION_JWT_EXPIRATION_SECONDS),
-        "client_id": "test-client-id",
+        "client_id": str(application.client_id),
        "scope": scope_string,
        "user_id": str(user.id),
        "delegated": True,
@@ -53,6 +55,23 @@ def test_api_rooms_list_requires_authentication():
    assert response.status_code == 401


+def test_api_rooms_list_inactive_user(settings):
+    """List should return 401 if user is inactive."""
+    settings.APPLICATION_JWT_SECRET_KEY = "devKey"
+
+    user1 = UserFactory(is_active=False)
+    RoomFactory(users=[(user1, RoleChoices.OWNER)])
+
+    token = generate_test_token(user1, [ApplicationScope.ROOMS_LIST])
+
+    client = APIClient()
+    client.credentials(HTTP_AUTHORIZATION=f"Bearer {token}")
+    response = client.get("/external-api/v1.0/rooms/")
+
+    assert response.status_code == 401
+    assert "user account is disabled" in str(response.data).lower()
+
+
 def test_api_rooms_list_with_valid_token(settings):
    """Listing rooms with valid token should succeed."""

@@ -73,6 +92,24 @@ def test_api_rooms_list_with_valid_token(settings):
    assert response.data["results"][0]["id"] == str(room.id)


+def test_api_rooms_list_with_no_rooms(settings):
+    """Listing rooms with a valid token returns an empty list when there are no rooms."""
+    settings.APPLICATION_JWT_SECRET_KEY = "devKey"
+
+    user = UserFactory()
+
+    # Generate valid token
+    token = generate_test_token(user, [ApplicationScope.ROOMS_LIST])
+
+    client = APIClient()
+    client.credentials(HTTP_AUTHORIZATION=f"Bearer {token}")
+    response = client.get("/external-api/v1.0/rooms/")
+
+    assert response.status_code == 200
+    assert response.data["count"] == 0
+    assert response.data["results"] == []
+
+
 def test_api_rooms_list_with_expired_token(settings):
    """Listing rooms with expired token should return 401."""
    settings.APPLICATION_JWT_SECRET_KEY = "devKey"
@@ -92,8 +129,8 @@ def test_api_rooms_list_with_expired_token(settings):


@responses.activate
-def test_api_rooms_list_with_invalid_token(settings):
-    """Listing rooms with invalid token should return 400."""
+def test_api_rooms_list_with_invalid_rs_token(settings):
+    """Listing rooms with invalid resource server token should return 400."""

    settings.OIDC_OP_INTROSPECTION_ENDPOINT = "https://oidc.example.com/introspect"
    settings.OIDC_OP_URL = "https://oidc.example.com"
@@ -130,7 +167,27 @@ def test_api_rooms_list_missing_scope(settings):
    response = client.get("/external-api/v1.0/rooms/")

    assert response.status_code == 403
-    assert "Insufficient permissions. Required scope: rooms:list" in str(response.data)
+    assert (
+        "insufficient permissions. required scope: rooms:list"
+        in str(response.data).lower()
+    )
+
+
+def test_api_rooms_list_no_scope(settings):
+    """Listing rooms without any scope should return 403."""
+    settings.APPLICATION_JWT_SECRET_KEY = "devKey"
+
+    user = UserFactory()
+
+    # Token without scope
+    token = generate_test_token(user, [])
+
+    client = APIClient()
+    client.credentials(HTTP_AUTHORIZATION=f"Bearer {token}")
+    response = client.get("/external-api/v1.0/rooms/")
+
+    assert response.status_code == 403
+    assert "insufficient permissions." in str(response.data).lower()


 def test_api_rooms_list_filters_by_user(settings):
@@ -144,7 +201,9 @@ def test_api_rooms_list_filters_by_user(settings):
    room2 = RoomFactory(users=[(user2, RoleChoices.OWNER)])
    room3 = RoomFactory(users=[(user1, RoleChoices.MEMBER)])

-    token = generate_test_token(user1, [ApplicationScope.ROOMS_LIST])
+    token = generate_test_token(
+        user1, [ApplicationScope.ROOMS_LIST, ApplicationScope.ROOMS_CREATE]
+    )

    client = APIClient()
    client.credentials(HTTP_AUTHORIZATION=f"Bearer {token}")
@@ -158,6 +217,84 @@ def test_api_rooms_list_filters_by_user(settings):
    assert str(room2.id) not in returned_ids


+def test_api_rooms_retrieve_requires_authentication(settings):
+    """Retrieving rooms without authentication should return 401."""
+
+    settings.APPLICATION_JWT_SECRET_KEY = "devKey"
+
+    user1 = UserFactory()
+    room1 = RoomFactory(users=[(user1, RoleChoices.OWNER)])
+
+    client = APIClient()
+    response = client.get(f"/external-api/v1.0/rooms/{room1.id}/")
+
+    assert response.status_code == 401
+
+
+def test_api_rooms_retrieve_inactive_user(settings):
+    """Retrieve should return 401 if user is inactive."""
+    settings.APPLICATION_JWT_SECRET_KEY = "devKey"
+
+    user1 = UserFactory(is_active=False)
+    room1 = RoomFactory(users=[(user1, RoleChoices.OWNER)])
+
+    token = generate_test_token(user1, [ApplicationScope.ROOMS_LIST])
+
+    client = APIClient()
+    client.credentials(HTTP_AUTHORIZATION=f"Bearer {token}")
+    response = client.get(f"/external-api/v1.0/rooms/{room1.id}/")
+
+    assert response.status_code == 401
+    assert "user account is disabled" in str(response.data).lower()
+
+
+def test_api_rooms_retrieve_with_expired_token(settings):
+    """Retrieving rooms with expired token should return 401."""
+    settings.APPLICATION_JWT_SECRET_KEY = "devKey"
+    settings.APPLICATION_JWT_EXPIRATION_SECONDS = 0
+
+    user = UserFactory()
+    room = RoomFactory(users=[(user, RoleChoices.OWNER)])
+
+    # Generate expired token
+    token = generate_test_token(user, [ApplicationScope.ROOMS_CREATE])
+
+    client = APIClient()
+    client.credentials(HTTP_AUTHORIZATION=f"Bearer {token}")
+    response = client.get(f"/external-api/v1.0/rooms/{room.id}/")
+
+    assert response.status_code == 401
+    assert "expired" in str(response.data).lower()
+
+
+@responses.activate
+def test_api_rooms_retrieve_with_invalid_rs_token(settings):
+    """Retrieving rooms with invalid resource server token should return 400."""
+
+    settings.OIDC_OP_INTROSPECTION_ENDPOINT = "https://oidc.example.com/introspect"
+    settings.OIDC_OP_URL = "https://oidc.example.com"
+
+    responses.add(
+        responses.POST,
+        "https://oidc.example.com/introspect",
+        json={
+            "iss": "https://oidc.example.com",
+            "active": False,
+        },
+    )
+
+    user = UserFactory()
+    room = RoomFactory(users=[(user, RoleChoices.OWNER)])
+
+    client = APIClient()
+    client.credentials(HTTP_AUTHORIZATION="Bearer invalid-token-123")
+    response = client.get(f"/external-api/v1.0/rooms/{room.id}/")
+
+    # Return 400 instead of 401 because ResourceServerAuthentication raises
+    # SuspiciousOperation when the introspected user is not active
+    assert response.status_code == 400
+
+
 def test_api_rooms_retrieve_requires_scope(settings):
    """Retrieving a room requires ROOMS_RETRIEVE scope."""
    settings.APPLICATION_JWT_SECRET_KEY = "devKey"
@@ -178,6 +315,24 @@ def test_api_rooms_retrieve_requires_scope(settings):
    )


+def test_api_rooms_retrieve_no_scope(settings):
+    """Retrieving rooms without any scope should return 403."""
+    settings.APPLICATION_JWT_SECRET_KEY = "devKey"
+
+    user = UserFactory()
+
+    # Token without scope
+    token = generate_test_token(user, [])
+    room = RoomFactory(users=[(user, RoleChoices.OWNER)])
+
+    client = APIClient()
+    client.credentials(HTTP_AUTHORIZATION=f"Bearer {token}")
+    response = client.get(f"/external-api/v1.0/rooms/{room.id}/")
+
+    assert response.status_code == 403
+    assert "insufficient permissions." in str(response.data).lower()
+
+
 def test_api_rooms_retrieve_success(settings):
    """Retrieving a room with correct scope should succeed."""
    settings.APPLICATION_JWT_SECRET_KEY = "devKey"
@@ -212,6 +367,132 @@ def test_api_rooms_retrieve_success(settings):
    }


+def test_api_rooms_retrieve_success_by_user(settings):
+    """Retrieve should only return rooms accessible to the authenticated user."""
+    settings.APPLICATION_JWT_SECRET_KEY = "devKey"
+
+    user1 = UserFactory()
+    user2 = UserFactory()
+
+    room1 = RoomFactory(users=[(user1, RoleChoices.OWNER)])
+    room2 = RoomFactory(users=[(user2, RoleChoices.OWNER)])
+    room3 = RoomFactory(users=[(user1, RoleChoices.MEMBER)])
+    room4 = RoomFactory(users=[(user1, RoleChoices.ADMIN)])
+
+    token = generate_test_token(
+        user1, [ApplicationScope.ROOMS_RETRIEVE, ApplicationScope.ROOMS_LIST]
+    )
+
+    client = APIClient()
+    client.credentials(HTTP_AUTHORIZATION=f"Bearer {token}")
+    response = client.get(f"/external-api/v1.0/rooms/{room2.id}/")
+
+    assert response.status_code == 403
+
+    client = APIClient()
+    client.credentials(HTTP_AUTHORIZATION=f"Bearer {token}")
+    response = client.get(f"/external-api/v1.0/rooms/{room1.id}/")
+
+    assert response.status_code == 200
+
+    client = APIClient()
+    client.credentials(HTTP_AUTHORIZATION=f"Bearer {token}")
+    response = client.get(f"/external-api/v1.0/rooms/{room3.id}/")
+
+    assert response.status_code == 200
+
+    client = APIClient()
+    client.credentials(HTTP_AUTHORIZATION=f"Bearer {token}")
+    response = client.get(f"/external-api/v1.0/rooms/{room4.id}/")
+
+    assert response.status_code == 200
+
+
+def test_api_rooms_retrieve_not_found(settings):
+    """Retrieving a non-existing room with correct scope should return a 404."""
+    settings.APPLICATION_JWT_SECRET_KEY = "devKey"
+
+    user = UserFactory()
+    token = generate_test_token(user, [ApplicationScope.ROOMS_RETRIEVE])
+
+    client = APIClient()
+    client.credentials(HTTP_AUTHORIZATION=f"Bearer {token}")
+    response = client.get(f"/external-api/v1.0/rooms/{uuid.uuid4()}/")
+
+    assert response.status_code == 404
+    assert "no room matches the given query." in str(response.data).lower()
+
+
+def test_api_rooms_create_requires_authentication(settings):
+    """Creating rooms without authentication should return 401."""
+
+    settings.APPLICATION_JWT_SECRET_KEY = "devKey"
+
+    client = APIClient()
+    response = client.post("/external-api/v1.0/rooms/")
+
+    assert response.status_code == 401
+
+
+def test_api_rooms_create_with_expired_token(settings):
+    """Creating rooms with expired token should return 401."""
+    settings.APPLICATION_JWT_SECRET_KEY = "devKey"
+    settings.APPLICATION_JWT_EXPIRATION_SECONDS = 0
+
+    user = UserFactory()
+
+    # Generate expired token
+    token = generate_test_token(user, [ApplicationScope.ROOMS_CREATE])
+
+    client = APIClient()
+    client.credentials(HTTP_AUTHORIZATION=f"Bearer {token}")
+    response = client.post("/external-api/v1.0/rooms/")
+
+    assert response.status_code == 401
+    assert "expired" in str(response.data).lower()
+
+
+@responses.activate
+def test_api_rooms_create_with_invalid_rs_token(settings):
+    """Creating rooms with invalid resource server token should return 400."""
+
+    settings.OIDC_OP_INTROSPECTION_ENDPOINT = "https://oidc.example.com/introspect"
+    settings.OIDC_OP_URL = "https://oidc.example.com"
+
+    responses.add(
+        responses.POST,
+        "https://oidc.example.com/introspect",
+        json={
+            "iss": "https://oidc.example.com",
+            "active": False,
+        },
+    )
+
+    client = APIClient()
+    client.credentials(HTTP_AUTHORIZATION="Bearer invalid-token-123")
+    response = client.post("/external-api/v1.0/rooms/")
+
+    # Return 400 instead of 401 because ResourceServerAuthentication raises
+    # SuspiciousOperation when the introspected user is not active
+    assert response.status_code == 400
+
+
+def test_api_rooms_create_inactive_user(settings):
+    """Create should return 401 if user is inactive."""
+    settings.APPLICATION_JWT_SECRET_KEY = "devKey"
+
+    user1 = UserFactory(is_active=False)
+
+    token = generate_test_token(user1, [ApplicationScope.ROOMS_CREATE])
+
+    client = APIClient()
+    client.credentials(HTTP_AUTHORIZATION=f"Bearer {token}")
+    response = client.post("/external-api/v1.0/rooms/")
+
+    assert response.status_code == 401
+    assert "user account is disabled" in str(response.data).lower()
+
+
 def test_api_rooms_create_requires_scope(settings):
    """Creating a room requires ROOMS_CREATE scope."""
    settings.APPLICATION_JWT_SECRET_KEY = "devKey"
@@ -225,18 +506,38 @@ def test_api_rooms_create_requires_scope(settings):
    response = client.post("/external-api/v1.0/rooms/", {}, format="json")

    assert response.status_code == 403
-    assert "Insufficient permissions. Required scope: rooms:create" in str(
-        response.data
+    assert (
+        "insufficient permissions. required scope: rooms:create"
+        in str(response.data).lower()
    )


+def test_api_rooms_create_no_scope(settings):
+    """Creating rooms without any scope should return 403."""
+    settings.APPLICATION_JWT_SECRET_KEY = "devKey"
+
+    user = UserFactory()
+
+    # Token without scope
+    token = generate_test_token(user, [])
+
+    client = APIClient()
+    client.credentials(HTTP_AUTHORIZATION=f"Bearer {token}")
+    response = client.post("/external-api/v1.0/rooms/")
+
+    assert response.status_code == 403
+    assert "insufficient permissions." in str(response.data).lower()
+
+
 def test_api_rooms_create_success(settings):
    """Creating a room with correct scope should succeed."""
    settings.APPLICATION_JWT_SECRET_KEY = "devKey"

    user = UserFactory()

-    token = generate_test_token(user, [ApplicationScope.ROOMS_CREATE])
+    token = generate_test_token(
+        user, [ApplicationScope.ROOMS_CREATE, ApplicationScope.ROOMS_LIST]
+    )

    client = APIClient()
    client.credentials(HTTP_AUTHORIZATION=f"Bearer {token}")
@@ -245,6 +546,8 @@ def test_api_rooms_create_success(settings):
    assert response.status_code == 201
    assert "id" in response.data
    assert "slug" in response.data
+    assert "name" in response.data
+    assert response.data["name"] == response.data["slug"]

    # Verify room was created with user as owner
    room = Room.objects.get(id=response.data["id"])
@@ -252,6 +555,72 @@ def test_api_rooms_create_success(settings):
    assert room.access_level == "trusted"


+def test_api_rooms_create_readonly_enforcement(settings):
+    """Creating a room succeeds and any provided read-only fields are ignored."""
+    settings.APPLICATION_JWT_SECRET_KEY = "devKey"
+
+    user = UserFactory()
+
+    token = generate_test_token(user, [ApplicationScope.ROOMS_CREATE])
+
+    client = APIClient()
+    client.credentials(HTTP_AUTHORIZATION=f"Bearer {token}")
+    response = client.post(
+        "/external-api/v1.0/rooms/",
+        {
+            "id": "fake-id",
+            "slug": "fake-slug",
+            "name": "fake-name",
+            "access_level": "public",
+        },
+        format="json",
+    )
+
+    assert response.status_code == 201
+    assert "slug" in response.data
+    assert response.data["id"] != "fake-id"
+    assert "name" in response.data
+    assert response.data["slug"] != "fake-slug"
+    assert "id" in response.data
+    assert response.data["name"] != "fake-name"
+
+    # Verify room was created with user as owner
+    room = Room.objects.get(id=response.data["id"])
+    assert room.get_role(user) == RoleChoices.OWNER
+    assert room.access_level == "trusted"
+
+
+def test_api_rooms_unknown_actions(settings):
+    """Updating or deleting a room are not supported yet."""
+    settings.APPLICATION_JWT_SECRET_KEY = "devKey"
+
+    user = UserFactory()
+    room = RoomFactory(users=[(user, RoleChoices.OWNER)])
+
+    token = generate_test_token(
+        user,
+        [
+            ApplicationScope.ROOMS_RETRIEVE,
+            ApplicationScope.ROOMS_DELETE,
+            ApplicationScope.ROOMS_UPDATE,
+        ],
+    )
+
+    client = APIClient()
+    client.credentials(HTTP_AUTHORIZATION=f"Bearer {token}")
+    response = client.delete(f"/external-api/v1.0/rooms/{room.id}/")
+
+    assert response.status_code == 405
+    assert 'method "delete" not allowed.' in str(response.data).lower()
+
+    client = APIClient()
+    client.credentials(HTTP_AUTHORIZATION=f"Bearer {token}")
+    response = client.patch(f"/external-api/v1.0/rooms/{room.id}/")
+
+    assert response.status_code == 405
+    assert 'method "patch" not allowed.' in str(response.data).lower()
+
+
 def test_api_rooms_response_no_url(settings):
    """Response should not include url field when APPLICATION_BASE_URL is None."""
    settings.APPLICATION_JWT_SECRET_KEY = "devKey"
@@ -290,10 +659,43 @@ def test_api_rooms_response_no_telephony(settings):
    assert response.data["id"] == str(room.id)


+def test_api_rooms_token_scope_case_insensitive(settings):
+    """Token's scope should be case-insensitive."""
+    settings.APPLICATION_JWT_SECRET_KEY = "devKey"
+    user = UserFactory()
+    application = ApplicationFactory()
+
+    # Generate token with mixed-case scope "Rooms:List" to verify that scope
+    # validation is case-insensitive (should match "rooms:list")
+    now = datetime.now(timezone.utc)
+    payload = {
+        "iss": settings.APPLICATION_JWT_ISSUER,
+        "aud": settings.APPLICATION_JWT_AUDIENCE,
+        "iat": now,
+        "exp": now + timedelta(hours=1),
+        "client_id": str(application.client_id),
+        "scope": "Rooms:List",  # Mixed case - should be accepted as "rooms:list"
+        "user_id": str(user.id),
+        "delegated": True,
+    }
+    token = jwt.encode(
+        payload,
+        settings.APPLICATION_JWT_SECRET_KEY,
+        algorithm=settings.APPLICATION_JWT_ALG,
+    )
+
+    client = APIClient()
+    client.credentials(HTTP_AUTHORIZATION=f"Bearer {token}")
+    response = client.get("/external-api/v1.0/rooms/")
+
+    assert response.status_code == 200
+
+
 def test_api_rooms_token_without_delegated_flag(settings):
    """Token without delegated flag should be rejected."""
    settings.APPLICATION_JWT_SECRET_KEY = "devKey"
    user = UserFactory()
+    application = ApplicationFactory()

    # Generate token without delegated flag
    now = datetime.now(timezone.utc)
@@ -302,7 +704,7 @@ def test_api_rooms_token_without_delegated_flag(settings):
        "aud": settings.APPLICATION_JWT_AUDIENCE,
        "iat": now,
        "exp": now + timedelta(hours=1),
-        "client_id": "test-client",
+        "client_id": str(application.client_id),
        "scope": "rooms:list",
        "user_id": str(user.id),
        "delegated": False,  # Not delegated
@@ -318,7 +720,73 @@ def test_api_rooms_token_without_delegated_flag(settings):
    response = client.get("/external-api/v1.0/rooms/")

    assert response.status_code == 401
-    assert "Invalid token type." in str(response.data)
+    assert "invalid token type." in str(response.data).lower()
+
+
+@mock.patch.object(ResourceServerAuthentication, "authenticate", return_value=None)
+def test_api_rooms_token_invalid_signature(mock_rs_authenticate, settings):
+    """Token signed with an invalid key should defer to the next authentication."""
+    settings.APPLICATION_JWT_SECRET_KEY = "devKey"
+    user = UserFactory()
+    application = ApplicationFactory()
+
+    # Generate token without delegated flag
+    now = datetime.now(timezone.utc)
+    payload = {
+        "iss": settings.APPLICATION_JWT_ISSUER,
+        "aud": settings.APPLICATION_JWT_AUDIENCE,
+        "iat": now,
+        "exp": now + timedelta(hours=1),
+        "client_id": str(application.client_id),
+        "scope": "rooms:list",
+        "user_id": str(user.id),
+        "delegated": True,
+    }
+    token = jwt.encode(
+        payload,
+        "invalid-private-key",
+        algorithm=settings.APPLICATION_JWT_ALG,
+    )
+
+    client = APIClient()
+    client.credentials(HTTP_AUTHORIZATION=f"Bearer {token}")
+    response = client.get("/external-api/v1.0/rooms/")
+
+    mock_rs_authenticate.assert_called()
+    assert response.status_code == 401
+
+
+@mock.patch.object(ResourceServerAuthentication, "authenticate", return_value=None)
+def test_api_rooms_token_invalid_alg(mock_rs_authenticate, settings):
+    """Token signed with an invalid alg should defer to the next authentication."""
+    settings.APPLICATION_JWT_SECRET_KEY = "devKey"
+    settings.APPLICATION_JWT_ALG = "RS256"
+    user = UserFactory()
+
+    # Generate token without delegated flag
+    now = datetime.now(timezone.utc)
+    payload = {
+        "iss": settings.APPLICATION_JWT_ISSUER,
+        "aud": settings.APPLICATION_JWT_AUDIENCE,
+        "iat": now,
+        "exp": now + timedelta(hours=1),
+        "client_id": "test-client",
+        "scope": "rooms:list",
+        "user_id": str(user.id),
+        "delegated": True,
+    }
+    token = jwt.encode(
+        payload,
+        settings.APPLICATION_JWT_SECRET_KEY,
+        algorithm="HS256",  # different value
+    )
+
+    client = APIClient()
+    client.credentials(HTTP_AUTHORIZATION=f"Bearer {token}")
+    response = client.get("/external-api/v1.0/rooms/")
+
+    mock_rs_authenticate.assert_called()
+    assert response.status_code == 401


 def test_api_rooms_token_missing_client_id(settings):
@@ -348,7 +816,157 @@ def test_api_rooms_token_missing_client_id(settings):
    response = client.get("/external-api/v1.0/rooms/")

    assert response.status_code == 401
-    assert "Invalid token claims." in str(response.data)
+    assert "invalid token claims." in str(response.data).lower()
+
+
+def test_api_rooms_token_missing_user_id(settings):
+    """Token without user_id should be rejected."""
+    settings.APPLICATION_JWT_SECRET_KEY = "devKey"
+    application = ApplicationFactory()
+
+    now = datetime.now(timezone.utc)
+    payload = {
+        "iss": settings.APPLICATION_JWT_ISSUER,
+        "aud": settings.APPLICATION_JWT_AUDIENCE,
+        "iat": now,
+        "exp": now + timedelta(hours=1),
+        "client_id": str(application.client_id),
+        "scope": "rooms:list",
+        "delegated": True,
+        # Missing user_id
+    }
+    token = jwt.encode(
+        payload,
+        settings.APPLICATION_JWT_SECRET_KEY,
+        algorithm=settings.APPLICATION_JWT_ALG,
+    )
+
+    client = APIClient()
+    client.credentials(HTTP_AUTHORIZATION=f"Bearer {token}")
+    response = client.get("/external-api/v1.0/rooms/")
+
+    assert response.status_code == 401
+    assert "invalid token claims." in str(response.data).lower()
+
+
+def test_api_rooms_token_invalid_audience(settings):
+    """Token with an invalid audience should be rejected."""
+    settings.APPLICATION_JWT_SECRET_KEY = "devKey"
+    user = UserFactory()
+    application = ApplicationFactory()
+
+    now = datetime.now(timezone.utc)
+    payload = {
+        "iss": settings.APPLICATION_JWT_ISSUER,
+        "aud": "invalid-audience",
+        "iat": now,
+        "exp": now + timedelta(hours=1),
+        "client_id": str(application.client_id),
+        "user_id": str(user.id),
+        "scope": "rooms:list",
+        "delegated": True,
+    }
+    token = jwt.encode(
+        payload,
+        settings.APPLICATION_JWT_SECRET_KEY,
+        algorithm=settings.APPLICATION_JWT_ALG,
+    )
+
+    client = APIClient()
+    client.credentials(HTTP_AUTHORIZATION=f"Bearer {token}")
+    response = client.get("/external-api/v1.0/rooms/")
+
+    assert response.status_code == 401
+    assert "invalid token." in str(response.data).lower()
+
+
+def test_api_rooms_token_unknown_user(settings):
+    """Token for unknown user should be rejected."""
+    settings.APPLICATION_JWT_SECRET_KEY = "devKey"
+    application = ApplicationFactory()
+
+    now = datetime.now(timezone.utc)
+    payload = {
+        "iss": settings.APPLICATION_JWT_ISSUER,
+        "aud": settings.APPLICATION_JWT_AUDIENCE,
+        "iat": now,
+        "exp": now + timedelta(hours=1),
+        "client_id": str(application.client_id),
+        "user_id": str(uuid.uuid4()),
+        "scope": "rooms:list",
+        "delegated": True,
+    }
+    token = jwt.encode(
+        payload,
+        settings.APPLICATION_JWT_SECRET_KEY,
+        algorithm=settings.APPLICATION_JWT_ALG,
+    )
+
+    client = APIClient()
+    client.credentials(HTTP_AUTHORIZATION=f"Bearer {token}")
+    response = client.get("/external-api/v1.0/rooms/")
+
+    assert response.status_code == 401
+    assert "user not found." in str(response.data).lower()
+
+
+def test_api_rooms_token_unknown_application(settings):
+    """Token for unknown application should be rejected."""
+    settings.APPLICATION_JWT_SECRET_KEY = "devKey"
+
+    now = datetime.now(timezone.utc)
+    payload = {
+        "iss": settings.APPLICATION_JWT_ISSUER,
+        "aud": settings.APPLICATION_JWT_AUDIENCE,
+        "iat": now,
+        "exp": now + timedelta(hours=1),
+        "client_id": "unknown-client-id",
+        "user_id": str(uuid.uuid4()),
+        "scope": "rooms:list",
+        "delegated": True,
+    }
+    token = jwt.encode(
+        payload,
+        settings.APPLICATION_JWT_SECRET_KEY,
+        algorithm=settings.APPLICATION_JWT_ALG,
+    )
+
+    client = APIClient()
+    client.credentials(HTTP_AUTHORIZATION=f"Bearer {token}")
+    response = client.get("/external-api/v1.0/rooms/")
+
+    assert response.status_code == 401
+    assert "application not found." in str(response.data).lower()
+
+
+def test_api_rooms_token_inactive_application(settings):
+    """Token for inactive application should be rejected."""
+    settings.APPLICATION_JWT_SECRET_KEY = "devKey"
+    application = ApplicationFactory(active=False)
+
+    now = datetime.now(timezone.utc)
+    payload = {
+        "iss": settings.APPLICATION_JWT_ISSUER,
+        "aud": settings.APPLICATION_JWT_AUDIENCE,
+        "iat": now,
+        "exp": now + timedelta(hours=1),
+        "client_id": str(application.client_id),
+        "user_id": str(uuid.uuid4()),
+        "scope": "rooms:list",
+        "delegated": True,
+    }
+    token = jwt.encode(
+        payload,
+        settings.APPLICATION_JWT_SECRET_KEY,
+        algorithm=settings.APPLICATION_JWT_ALG,
+    )
+
+    client = APIClient()
+    client.credentials(HTTP_AUTHORIZATION=f"Bearer {token}")
+    response = client.get("/external-api/v1.0/rooms/")
+
+    assert response.status_code == 401
+    assert "application is disabled." in str(response.data).lower()


@responses.activate
@@ -507,7 +1125,7 @@ def test_resource_server_authentication_successful(settings):
            "aud": "some_client_id",  # settings.OIDC_RS_CLIENT_ID
            "sub": "very-specific-sub",
            "client_id": "some_service_provider",
-            "scope": "openid lasuite_meet lasuite_meet:rooms:list",
+            "scope": "openid lasuite_meet lasuite_meet:rooms:list lasuite_meet:rooms:retrieve",
            "active": True,
        },
    )
@@ -18,6 +18,7 @@ from socket import gethostbyname, gethostname

 from django.utils.translation import gettext_lazy as _

+import dj_database_url
 import sentry_sdk
 from configurations import Configuration, values
 from lasuite.configuration.values import SecretFileValue
@@ -92,7 +93,11 @@ class Base(Configuration):

    # Database
    DATABASES = {
-        "default": {
+        "default": dj_database_url.config()
+        if values.DatabaseURLValue(
+            None, environ_name="DATABASE_URL", environ_prefix=None
+        )
+        else {
            "ENGINE": values.Value(
                "django.db.backends.postgresql_psycopg2",
                environ_name="DB_ENGINE",
@@ -292,6 +297,9 @@ class Base(Configuration):
            ),
        },
    }
+    MONITORED_THROTTLE_FAILURE_CALLBACK = (
+        "core.api.throttling.sentry_monitoring_throttle_failure"
+    )

    SPECTACULAR_SETTINGS = {
        "TITLE": "Meet API",
@@ -336,6 +344,9 @@ class Base(Configuration):
        "feedback": values.DictValue(
            {}, environ_name="FRONTEND_FEEDBACK", environ_prefix=None
        ),
+        "external_home_url": values.Value(
+            None, environ_name="FRONTEND_EXTERNAL_HOME_URL", environ_prefix=None
+        ),
        "use_french_gov_footer": values.BooleanValue(
            False, environ_name="FRONTEND_USE_FRENCH_GOV_FOOTER", environ_prefix=None
        ),
@@ -656,7 +667,7 @@ class Base(Configuration):
        [],
        environ_name="BREVO_API_CONTACT_LIST_IDS",
        environ_prefix=None,
-        converter=lambda x: int(x),  # pylint: disable=unnecessary-lambda
+        converter=int,
    )
    BREVO_API_CONTACT_ATTRIBUTES = values.DictValue({"VISIO_USER": True})
    BREVO_API_TIMEOUT = values.PositiveIntegerValue(
@@ -7,7 +7,7 @@ build-backend = "setuptools.build_meta"

 [project]
 name = "meet"
-version = "1.3.0"
+version = "1.8.0"
 authors = [{ "name" = "DINUM", "email" = "dev@mail.numerique.gouv.fr" }]
 classifiers = [
    "Development Status :: 5 - Production/Stable",
@@ -25,37 +25,38 @@ license = { file = "LICENSE" }
 readme = "README.md"
 requires-python = ">=3.10"
 dependencies = [
-    "boto3==1.40.69",
+    "boto3==1.42.49",
    "Brotli==1.2.0",
    "brevo-python==1.2.0",
-    "celery[redis]==5.5.3",
+    "celery[redis]==5.6.2",
+    "dj-database-url==3.1.0",
    "django-configurations==2.5.1",
    "django-cors-headers==4.9.0",
-    "django-countries==8.0.0",
-    "django-lasuite[all]==0.0.19",
+    "django-countries==8.2.0",
+    "django-lasuite[all]==0.0.24",
    "django-parler==2.3",
    "redis==5.2.1",
    "django-redis==6.0.0",
    "django-storages[s3]==1.14.6",
    "django-timezone-field>=5.1",
-    "django==5.2.9",
+    "django==5.2.11",
    "djangorestframework==3.16.1",
    "drf_spectacular==0.29.0",
-    "dockerflow==2024.4.2",
+    "dockerflow==2026.1.26",
    "easy_thumbnails==2.10.1",
    "factory_boy==3.3.3",
-    "gunicorn==23.0.0",
-    "jsonschema==4.25.1",
-    "markdown==3.10",
+    "gunicorn==25.1.0",
+    "jsonschema==4.26.0",
+    "markdown==3.10.2",
    "nested-multipart-parser==1.6.0",
-    "psycopg[binary]==3.2.12",
-    "PyJWT==2.10.1",
+    "psycopg[binary]==3.3.2",
+    "PyJWT==2.11.0",
    "python-frontmatter==1.1.0",
    "requests==2.32.5",
-    "sentry-sdk==2.43.0",
+    "sentry-sdk==2.53.0",
    "whitenoise==6.11.0",
-    "mozilla-django-oidc==4.0.1",
-    "livekit-api==1.0.7",
+    "mozilla-django-oidc==5.0.2",
+    "livekit-api==1.1.0",
    "aiohttp==3.13.3",
 ]

@@ -68,21 +69,21 @@ dependencies = [
 [project.optional-dependencies]
 dev = [
    "django-extensions==4.1",
-    "drf-spectacular-sidecar==2025.10.1",
+    "drf-spectacular-sidecar==2026.1.1",
    "freezegun==1.5.5",
    "ipdb==0.13.13",
-    "ipython==9.7.0",
-    "pyfakefs==5.10.2",
-    "pylint-django==2.6.1",
+    "ipython==9.10.0",
+    "pyfakefs==6.1.1",
+    "pylint-django==2.7.0",
    "pylint<4.0.0",
    "pytest-cov==7.0.0",
-    "pytest-django==4.11.1",
-    "pytest==9.0.0",
+    "pytest-django==4.12.0",
+    "pytest==9.0.2",
    "pytest-icdiff==0.9",
    "pytest-xdist==3.8.0",
    "responses==0.25.8",
-    "ruff==0.14.4",
-    "types-requests==2.32.4.20250913",
+    "ruff==0.15.1",
+    "types-requests==2.32.4.20260107",
 ]

 [tool.setuptools]
@@ -43,7 +43,8 @@ RUN apk update && apk upgrade libssl3 \
    libxml2>=2.12.7-r2 \
    libxslt>=1.1.39-r2 \
    libexpat>=2.7.2-r0 \
-    libpng>=1.6.53-r0
+    libpng>=1.6.53-r0 \
+    && apk del curl

 USER nginx

@@ -5,6 +5,12 @@ server {

  root /usr/share/nginx/html;

+  location = /.well-known/windows-app-web-link {
+      default_type application/json;
+      alias /usr/share/nginx/html/.well-known/windows-app-web-link;
+      add_header Content-Disposition "attachment; filename=windows-app-web-link";
+  }
+
  # Serve static files with caching
  location ~* ^/assets/.*\.(css|js|json|png|jpg|jpeg|gif|ico|svg|woff|woff2|ttf|eot)$ {
      expires 30d;
@@ -1,7 +1,7 @@
 {
  "name": "meet",
  "private": true,
-  "version": "1.3.0",
+  "version": "1.8.0",
  "type": "module",
  "scripts": {
    "dev": "panda codegen && vite",
@@ -13,56 +13,56 @@
    "check": "prettier --check ./src"
  },
  "dependencies": {
-    "@fontsource-variable/material-symbols-outlined": "5.2.30",
+    "@fontsource-variable/material-symbols-outlined": "5.2.34",
    "@fontsource/material-icons-outlined": "5.2.6",
-    "@livekit/components-react": "2.9.13",
-    "@livekit/components-styles": "1.1.6",
-    "@livekit/track-processors": "0.6.1",
-    "@pandacss/preset-panda": "0.54.0",
-    "@react-aria/toast": "3.0.5",
-    "@react-types/overlays": "3.9.0",
+    "@livekit/components-react": "2.9.19",
+    "@livekit/components-styles": "1.2.0",
+    "@livekit/track-processors": "0.7.0",
+    "@pandacss/preset-panda": "1.8.2",
+    "@react-aria/toast": "3.0.10",
+    "@react-types/overlays": "3.9.3",
    "@remixicon/react": "4.6.0",
-    "@tanstack/react-query": "5.81.5",
+    "@tanstack/react-query": "5.90.21",
    "@timephy/rnnoise-wasm": "1.0.0",
-    "crisp-sdk-web": "1.0.25",
+    "crisp-sdk-web": "1.0.27",
    "derive-valtio": "0.2.0",
    "hoofd": "1.7.3",
-    "humanize-duration": "3.33.0",
-    "i18next": "25.3.1",
-    "i18next-browser-languagedetector": "8.2.0",
+    "humanize-duration": "3.33.2",
+    "i18next": "25.8.8",
+    "i18next-browser-languagedetector": "8.2.1",
    "i18next-parser": "9.3.0",
    "i18next-resources-to-backend": "1.2.1",
    "libphonenumber-js": "1.12.10",
-    "livekit-client": "2.15.7",
-    "posthog-js": "1.256.2",
+    "livekit-client": "2.17.1",
+    "posthog-js": "1.342.1",
    "react": "18.3.1",
    "react-aria-components": "1.10.1",
    "react-dom": "18.3.1",
    "react-i18next": "15.1.1",
    "use-sound": "5.0.0",
-    "valtio": "2.1.5",
-    "wouter": "3.7.1"
+    "valtio": "2.3.0",
+    "wouter": "3.9.0"
  },
  "devDependencies": {
-    "@pandacss/dev": "0.54.0",
-    "@tanstack/eslint-plugin-query": "5.81.2",
-    "@tanstack/react-query-devtools": "5.81.5",
+    "@pandacss/dev": "1.8.2",
+    "@tanstack/eslint-plugin-query": "5.91.4",
+    "@tanstack/react-query-devtools": "5.91.3",
    "@types/humanize-duration": "3.27.4",
    "@types/node": "22.16.0",
    "@types/react": "18.3.12",
    "@types/react-dom": "18.3.1",
    "@typescript-eslint/eslint-plugin": "8.35.1",
    "@typescript-eslint/parser": "8.35.1",
-    "@vitejs/plugin-react": "4.6.0",
+    "@vitejs/plugin-react": "5.1.4",
    "eslint": "8.57.0",
    "eslint-config-prettier": "10.1.5",
    "eslint-plugin-jsx-a11y": "6.10.2",
    "eslint-plugin-react-hooks": "5.2.0",
    "eslint-plugin-react-refresh": "0.4.20",
    "postcss": "8.5.6",
-    "prettier": "3.6.2",
+    "prettier": "3.8.1",
    "typescript": "5.8.3",
-    "vite": "7.0.8",
-    "vite-tsconfig-paths": "5.1.4"
+    "vite": "7.3.1",
+    "vite-tsconfig-paths": "6.1.1"
  }
 }
@@ -0,0 +1,6 @@
+[
+{
+  "packageFamilyName" : "Visio_g3z6ba6vek6vg",
+  "paths" : [ "*" ]
+}
+]
@@ -17,6 +17,7 @@ export interface ApiConfig {
  feedback: {
    url: string
  }
+  external_home_url?: string
  silence_livekit_debug_logs?: boolean
  is_silent_login_enabled?: boolean
  custom_css_url?: string
@@ -11,7 +11,7 @@ import { RiAddLine, RiLink } from '@remixicon/react'
 import { LaterMeetingDialog } from '@/features/home/components/LaterMeetingDialog'
 import { IntroSlider } from '@/features/home/components/IntroSlider'
 import { MoreLink } from '@/features/home/components/MoreLink'
-import { ReactNode, useState } from 'react'
+import { ReactNode, useEffect, useState } from 'react'

 import { css } from '@/styled-system/css'
 import { menuRecipe } from '@/primitives/menuRecipe.ts'
@@ -19,6 +19,7 @@ import { usePersistentUserChoices } from '@/features/rooms/livekit/hooks/usePers
 import { useConfig } from '@/api/useConfig'
 import { LoginButton } from '@/components/LoginButton'
 import { ApiRoom } from '@/features/rooms/api/ApiRoom'
+import { LoadingScreen } from '@/components/LoadingScreen'

 const Columns = ({ children }: { children?: ReactNode }) => {
  return (
@@ -155,9 +156,34 @@ export const Home = () => {

  const { mutateAsync: createRoom } = useCreateRoom()
  const [laterRoom, setLaterRoom] = useState<null | ApiRoom>(null)
+  const [redirectFailed, setRedirectFailed] = useState(false)

  const { data } = useConfig()

+  useEffect(() => {
+    const checkSiteAndRedirect = async () => {
+      if (!data?.external_home_url) return
+      if (isLoggedIn === false) {
+        try {
+          await fetch(data.external_home_url, {
+            method: 'HEAD', // Use HEAD to avoid downloading the full page
+            mode: 'no-cors', // Needed for cross-origin requests
+          })
+          window.location.replace(data.external_home_url)
+        } catch (error) {
+          setRedirectFailed(true)
+          console.error('Site is not reachable:', error)
+        }
+      }
+    }
+
+    checkSiteAndRedirect()
+  }, [isLoggedIn, data])
+
+  if (data?.external_home_url && isLoggedIn == false && !redirectFailed) {
+    return <LoadingScreen header={false} footer={false} delay={0} />
+  }
+
  return (
    <UserAware>
      <Screen>
@@ -25,15 +25,27 @@ export const TermsOfServiceRoute = () => {
        {/* Article 2 */}
        <H lvl={2}>{t('articles.article2.title')}</H>
        <P>{t('articles.article2.content')}</P>
-        <P>{t('articles.article2.purposes')}</P>
+        {ensureArray(
+          t('articles.article2.paragraphs', {
+            returnObjects: true,
+          })
+        ).map((paragraph, index) => (
+          <P key={index}>{paragraph}</P>
+        ))}

        {/* Article 3 */}
        <H lvl={2}>{t('articles.article3.title')}</H>
-        <P>{t('articles.article3.definition')}</P>
+        {ensureArray(
+          t('articles.article3.paragraphs', {
+            returnObjects: true,
+          })
+        ).map((paragraph, index) => (
+          <P key={index}>{paragraph}</P>
+        ))}

        {/* Article 4 */}
        <H lvl={2}>{t('articles.article4.title')}</H>
-        <P>{t('articles.article4.content')}</P>
+        <P>{t('articles.article4.definition')}</P>

        {/* Article 5 */}
        <H lvl={2} margin={false}>
@@ -62,6 +74,7 @@ export const TermsOfServiceRoute = () => {
            __html: t('articles.article5.sections.section1.paragraph3'),
          }}
        ></P>
+        <P>{t('articles.article5.sections.section1.paragraph4')}</P>

        {/* Section 5.2 */}
        <H lvl={3} bold>
@@ -112,7 +125,6 @@ export const TermsOfServiceRoute = () => {

        {/* Article 7 */}
        <H lvl={2}>{t('articles.article7.title')}</H>
-        <P>{t('articles.article7.content')}</P>

        {/* Section 7.1 */}
        <H lvl={3} bold>
@@ -1,6 +1,6 @@
 import { css } from '@/styled-system/css'
 import { useTranslation } from 'react-i18next'
-import { useMemo, useRef, useState, useEffect } from 'react'
+import { useMemo, useRef, useEffect } from 'react'
 import { Text } from '@/primitives'
 import {
  RecordingMode,
@@ -13,6 +13,7 @@ import { useSidePanel } from '@/features/rooms/livekit/hooks/useSidePanel'
 import { useRoomMetadata } from '../hooks/useRoomMetadata'
 import { RecordingStatusIcon } from './RecordingStatusIcon'
 import { useIsRecording } from '@livekit/components-react'
+import { useScreenReaderAnnounce } from '@/hooks/useScreenReaderAnnounce'

 export const RecordingStateToast = () => {
  const { t } = useTranslation('rooms', {
@@ -21,8 +22,8 @@ export const RecordingStateToast = () => {

  const { openTranscript, openScreenRecording } = useSidePanel()

-  const [srMessage, setSrMessage] = useState('')
  const lastKeyRef = useRef('')
+  const announce = useScreenReaderAnnounce()

  const hasTranscriptAccess = useHasRecordingAccess(
    RecordingMode.Transcript,
@@ -76,16 +77,9 @@ export const RecordingStateToast = () => {
    if (key && key !== lastKeyRef.current) {
      lastKeyRef.current = key
      const message = t(key)
-      setSrMessage(message)
-
-      // Clear message after 3 seconds to prevent it from being announced again
-      const timer = setTimeout(() => {
-        setSrMessage('')
-      }, 3000)
-
-      return () => clearTimeout(timer)
+      announce(message)
    }
-  }, [key, t])
+  }, [announce, key, t])

  if (!key) return null

@@ -95,15 +89,6 @@ export const RecordingStateToast = () => {

  return (
    <>
-      {/* Screen reader only message to announce state changes once */}
-      <div
-        role="status"
-        aria-live="polite"
-        aria-atomic="true"
-        className="sr-only"
-      >
-        {srMessage}
-      </div>
      {/* Visual banner (without aria-live to avoid duplicate announcements) */}
      <div
        className={css({
@@ -104,14 +104,12 @@ export const RecordingDownload = () => {
              {t('success.title')}
            </H>
            <Text centered margin="md" wrap={'balance'}>
-              <span
-                dangerouslySetInnerHTML={{
-                  __html: t('success.body', {
-                    room: data.room.name,
-                    created_at: formatDate(data.created_at, 'YYYY-MM-DD HH:mm'),
-                  }),
-                }}
-              />
+              <span>
+                {t('success.body', {
+                  room: data.room.name,
+                  created_at: formatDate(data.created_at, 'YYYY-MM-DD HH:mm'),
+                })}
+              </span>
              <span>
                {configData?.recording?.expiration_days && (
                  <>
@@ -446,16 +446,14 @@ export const Join = ({
                type="text"
                onChange={saveUsername}
                label={t('usernameLabel')}
-                aria-label={t('usernameLabel')}
+                id="input-name"
                defaultValue={username}
                validate={(value) => !value && t('errors.usernameEmpty')}
                wrapperProps={{
                  noMargin: true,
                  fullWidth: true,
                }}
-                labelProps={{
-                  center: true,
-                }}
+                autoComplete="name"
                maxLength={50}
              />
            </VStack>
@@ -1,21 +1,29 @@
-import { Button, Dialog, H, P } from '@/primitives'
+import { A, Button, Dialog, H, P, ScreenReaderAnnouncer } from '@/primitives'
 import { useTranslation } from 'react-i18next'
 import { css } from '@/styled-system/css'
 import { useSnapshot } from 'valtio'
 import { connectionObserverStore } from '@/stores/connectionObserver'
 import { HStack } from '@/styled-system/jsx'
-import { useEffect, useState } from 'react'
+import { useEffect, useRef, useState } from 'react'
 import { navigateTo } from '@/navigation/navigateTo'
 import humanizeDuration from 'humanize-duration'
 import i18n from 'i18next'
+import { useScreenReaderAnnounce } from '@/hooks/useScreenReaderAnnounce'
+import { useSettingsDialog } from '@/features/settings/hook/useSettingsDialog'
+import { SettingsDialogExtendedKey } from '@/features/settings/type'

 const IDLE_DISCONNECT_TIMEOUT_MS = 120000 // 2 minutes
+const COUNTDOWN_ANNOUNCEMENT_SECONDS = [90, 60, 30]
+const FINAL_COUNTDOWN_SECONDS = 10

 export const IsIdleDisconnectModal = () => {
  const connectionObserverSnap = useSnapshot(connectionObserverStore)
  const [timeRemaining, setTimeRemaining] = useState(IDLE_DISCONNECT_TIMEOUT_MS)
+  const lastAnnouncementRef = useRef<number | null>(null)
+  const { openSettingsDialog } = useSettingsDialog()

  const { t } = useTranslation('rooms', { keyPrefix: 'isIdleDisconnectModal' })
+  const announce = useScreenReaderAnnounce()

  useEffect(() => {
    if (connectionObserverSnap.isIdleDisconnectModalOpen) {
@@ -35,10 +43,42 @@ export const IsIdleDisconnectModal = () => {
    }
  }, [connectionObserverSnap.isIdleDisconnectModalOpen])

-  const minutes = Math.floor(timeRemaining / 1000 / 60)
-  const seconds = (timeRemaining / 1000) % 60
+  useEffect(() => {
+    if (!connectionObserverSnap.isIdleDisconnectModalOpen) {
+      lastAnnouncementRef.current = null
+    }
+  }, [connectionObserverSnap.isIdleDisconnectModalOpen])
+
+  const remainingSeconds = Math.floor(timeRemaining / 1000)
+  const minutes = Math.floor(remainingSeconds / 60)
+  const seconds = remainingSeconds % 60
  const formattedTime = `${minutes}:${seconds.toString().padStart(2, '0')}`

+  useEffect(() => {
+    if (!connectionObserverSnap.isIdleDisconnectModalOpen) return
+
+    const shouldAnnounce =
+      COUNTDOWN_ANNOUNCEMENT_SECONDS.includes(remainingSeconds) ||
+      remainingSeconds <= FINAL_COUNTDOWN_SECONDS
+
+    if (shouldAnnounce && remainingSeconds !== lastAnnouncementRef.current) {
+      lastAnnouncementRef.current = remainingSeconds
+      const message = t('countdownAnnouncement', {
+        duration: humanizeDuration(remainingSeconds * 1000, {
+          language: i18n.language,
+          round: false,
+          largest: 2,
+        }),
+      })
+      announce(message, 'assertive', 'idle')
+    }
+  }, [
+    announce,
+    connectionObserverSnap.isIdleDisconnectModalOpen,
+    remainingSeconds,
+    t,
+  ])
+
  return (
    <Dialog
      isOpen={connectionObserverSnap.isIdleDisconnectModalOpen}
@@ -52,6 +92,7 @@ export const IsIdleDisconnectModal = () => {
      {({ close }) => {
        return (
          <div>
+            <ScreenReaderAnnouncer channel="idle" />
            <div
              className={css({
                height: '50px',
@@ -65,6 +106,7 @@ export const IsIdleDisconnectModal = () => {
                color: 'blue.800',
                margin: 'auto',
              })}
+              aria-hidden="true"
            >
              {formattedTime}
            </div>
@@ -78,7 +120,19 @@ export const IsIdleDisconnectModal = () => {
                }),
              })}
            </P>
-            <P>{t('settings')}</P>
+            <P>
+              {t('settingsPrefix')}{' '}
+              <A
+                color="primary"
+                onPress={() => {
+                  connectionObserverStore.isIdleDisconnectModalOpen = false
+                  openSettingsDialog(SettingsDialogExtendedKey.GENERAL)
+                }}
+              >
+                {t('settingsLink')}
+              </A>
+              {t('settingsSuffix')}
+            </P>
            <HStack marginTop="2rem">
              <Button
                onPress={() => {
@@ -8,6 +8,7 @@ import { Reaction } from '@/features/rooms/livekit/components/controls/Reactions
 import { getEmojiLabel } from '@/features/rooms/livekit/utils/reactionUtils'
 import { accessibilityStore } from '@/stores/accessibility'
 import { useSnapshot } from 'valtio'
+import { useScreenReaderAnnounce } from '@/hooks/useScreenReaderAnnounce'

 export const ANIMATION_DURATION = 3000
 export const ANIMATION_DISTANCE = 300
@@ -146,15 +147,14 @@ export function ReactionPortal({
 export const ReactionPortals = ({ reactions }: { reactions: Reaction[] }) => {
  const { t } = useTranslation('rooms', { keyPrefix: 'controls.reactions' })
  const { announceReactions } = useSnapshot(accessibilityStore)
-  const [announcement, setAnnouncement] = useState<string | null>(null)
  const [lastAnnouncedId, setLastAnnouncedId] = useState<number | null>(null)
+  const announce = useScreenReaderAnnounce()

  const latestReaction =
    reactions.length > 0 ? reactions[reactions.length - 1] : undefined

  useEffect(() => {
    if (!announceReactions) {
-      setAnnouncement(null)
      return
    }
    if (!latestReaction) return
@@ -166,12 +166,9 @@ export const ReactionPortals = ({ reactions }: { reactions: Reaction[] }) => {
      ? t('you')
      : latestReaction.participant?.name?.trim() ||
        t('someone', { defaultValue: 'Someone' })
-    setAnnouncement(t('announce', { name: participantName, emoji: emojiLabel }))
+    announce(t('announce', { name: participantName, emoji: emojiLabel }))
    setLastAnnouncedId(latestReaction.id)
-
-    const timer = setTimeout(() => setAnnouncement(null), 1200)
-    return () => clearTimeout(timer)
-  }, [latestReaction, lastAnnouncedId, announceReactions, t])
+  }, [announce, latestReaction, lastAnnouncedId, announceReactions, t])

  return (
    <>
@@ -182,14 +179,6 @@ export const ReactionPortals = ({ reactions }: { reactions: Reaction[] }) => {
          participant={instance.participant}
        />
      ))}
-      <div
-        role="status"
-        aria-live="polite"
-        aria-atomic="true"
-        className="sr-only"
-      >
-        {announcement ?? ''}
-      </div>
    </>
  )
 }
@@ -11,9 +11,7 @@ import {
  ProcessorType,
 } from '.'

-export class UnifiedBackgroundTrackProcessor
-  implements BackgroundProcessorInterface
-{
+export class UnifiedBackgroundTrackProcessor implements BackgroundProcessorInterface {
  processor: ProcessorWrapper<BackgroundOptions>
  opts: BackgroundOptions
  processorType: ProcessorType
@@ -13,8 +13,7 @@ export interface ProcessorSerialized {
  options: BackgroundOptions
 }

-export interface BackgroundProcessorInterface
-  extends TrackProcessor<Track.Kind> {
+export interface BackgroundProcessorInterface extends TrackProcessor<Track.Kind> {
  update(opts: BackgroundOptions): Promise<void>
  options: BackgroundOptions
  clone(): BackgroundProcessorInterface
@@ -6,6 +6,7 @@ import { ToggleButton } from '@/primitives'
 import { chatStore } from '@/stores/chat'
 import { useSidePanel } from '../../hooks/useSidePanel'
 import { ToggleButtonProps } from '@/primitives/ToggleButton'
+import { useRegisterKeyboardShortcut } from '@/features/shortcuts/useRegisterKeyboardShortcut'

 export const ChatToggle = ({
  onPress,
@@ -18,6 +19,11 @@ export const ChatToggle = ({
  const { isChatOpen, toggleChat } = useSidePanel()
  const tooltipLabel = isChatOpen ? 'open' : 'closed'

+  useRegisterKeyboardShortcut({
+    id: 'toggle-chat',
+    handler: toggleChat,
+  })
+
  return (
    <div
      className={css({
@@ -18,6 +18,7 @@ import { useCannotUseDevice } from '../../../hooks/useCannotUseDevice'
 import { useDeviceIcons } from '../../../hooks/useDeviceIcons'
 import { useDeviceShortcut } from '../../../hooks/useDeviceShortcut'
 import { ToggleSource, CaptureOptionsBySource } from '@livekit/components-core'
+import { getShortcutDescriptorById } from '@/features/shortcuts/catalog'

 type ToggleDeviceStyleProps = {
  variant?: NonNullable<ButtonRecipeProps>['variant']
@@ -88,12 +89,14 @@ export const ToggleDevice = <T extends ToggleSource>({
  const deviceShortcut = useDeviceShortcut(kind)

  useRegisterKeyboardShortcut({
-    shortcut: deviceShortcut,
+    id: deviceShortcut?.id,
    handler: async () => await toggle(),
    isDisabled: cannotUseDevice,
  })
+
+  const pushToTalkShortcut = getShortcutDescriptorById('push-to-talk')
  useLongPress({
-    keyCode: kind === 'audioinput' ? 'KeyV' : undefined,
+    keyCode: kind === 'audioinput' ? pushToTalkShortcut?.code : undefined,
    onKeyDown,
    onKeyUp,
    isDisabled: cannotUseDevice,
@@ -103,7 +106,9 @@ export const ToggleDevice = <T extends ToggleSource>({
    const label = t(enabled ? 'disable' : 'enable', {
      keyPrefix: `selectDevice.${kind}`,
    })
-    return deviceShortcut ? appendShortcutLabel(label, deviceShortcut) : label
+    return deviceShortcut?.shortcut
+      ? appendShortcutLabel(label, deviceShortcut.shortcut)
+      : label
  }, [enabled, kind, deviceShortcut, t])

  const Icon =
@@ -9,6 +9,7 @@ import {
  closeLowerHandToasts,
  showLowerHandToast,
 } from '@/features/notifications/utils'
+import { useRegisterKeyboardShortcut } from '@/features/shortcuts/useRegisterKeyboardShortcut'

 const SPEAKING_DETECTION_DELAY = 3000

@@ -33,6 +34,16 @@ export const HandToggle = () => {
    closeLowerHandToasts()
  }, [isHandRaised])

+  const handleToggle = () => {
+    toggleRaisedHand()
+    resetToastState()
+  }
+
+  useRegisterKeyboardShortcut({
+    id: 'raise-hand',
+    handler: handleToggle,
+  })
+
  useEffect(() => {
    const shouldShowToast = isSpeaking && isHandRaised && !hasShownToast

@@ -68,10 +79,7 @@ export const HandToggle = () => {
        aria-label={t(tooltipLabel)}
        tooltip={t(tooltipLabel)}
        isSelected={isHandRaised}
-        onPress={() => {
-          toggleRaisedHand()
-          resetToastState()
-        }}
+        onPress={handleToggle}
        data-attr={`controls-hand-${tooltipLabel}`}
      >
        <RiHand />
@@ -6,6 +6,7 @@ import { css } from '@/styled-system/css'
 import { useParticipants } from '@livekit/components-react'
 import { useSidePanel } from '../../../hooks/useSidePanel'
 import { ToggleButtonProps } from '@/primitives/ToggleButton'
+import { useRegisterKeyboardShortcut } from '@/features/shortcuts/useRegisterKeyboardShortcut'

 export const ParticipantsToggle = ({
  onPress,
@@ -27,6 +28,11 @@ export const ParticipantsToggle = ({

  const tooltipLabel = isParticipantsOpen ? 'open' : 'closed'

+  useRegisterKeyboardShortcut({
+    id: 'toggle-participants',
+    handler: toggleParticipants,
+  })
+
  return (
    <div
      className={css({
@@ -1,6 +1,6 @@
 import { useTranslation } from 'react-i18next'
 import { RiEmotionLine } from '@remixicon/react'
-import { useState, useRef, useEffect } from 'react'
+import { useState, useRef } from 'react'
 import { css } from '@/styled-system/css'
 import { useRoomContext } from '@livekit/components-react'
 import { ToggleButton, Button } from '@/primitives'
@@ -11,7 +11,13 @@ import {
  ReactionPortals,
 } from '@/features/rooms/livekit/components/ReactionPortal'
 import { getEmojiLabel } from '@/features/rooms/livekit/utils/reactionUtils'
-import { Toolbar as RACToolbar } from 'react-aria-components'
+import { useRegisterKeyboardShortcut } from '@/features/shortcuts/useRegisterKeyboardShortcut'
+import {
+  Popover as RACPopover,
+  Dialog,
+  DialogTrigger,
+} from 'react-aria-components'
+import { FocusScope } from '@react-aria/focus'
 import { Participant } from 'livekit-client'
 import useRateLimiter from '@/hooks/useRateLimiter'

@@ -39,7 +45,12 @@ export const ReactionsToggle = () => {
  const instanceIdRef = useRef(0)
  const room = useRoomContext()

-  const [isVisible, setIsVisible] = useState(false)
+  const [isOpen, setIsOpen] = useState(false)
+
+  useRegisterKeyboardShortcut({
+    id: 'reaction',
+    handler: () => setIsOpen((prev) => !prev),
+  })

  const sendReaction = async (emoji: string) => {
    const encoder = new TextEncoder()
@@ -73,100 +84,76 @@ export const ReactionsToggle = () => {
    windowMs: 1000,
  })

-  // Custom animation implementation for the emoji toolbar
-  // Could not use a menu and its animation, because a menu would make the toolbar inaccessible by keyboard
-  // animation isn't perfect
-  const [isRendered, setIsRendered] = useState(isVisible)
-  const [opacity, setOpacity] = useState(isVisible ? 1 : 0)
-
-  useEffect(() => {
-    if (isVisible) {
-      // Show: first render, then animate in
-      setIsRendered(true)
-      // Need to delay setting opacity to ensure CSS transition works
-      // (using requestAnimationFrame to ensure DOM has updated)
-      requestAnimationFrame(() => {
-        requestAnimationFrame(() => {
-          setOpacity(1)
-        })
-      })
-    } else if (isRendered) {
-      // Hide: first animate out, then unrender
-      setOpacity(0)
-
-      // Wait for animation to complete before removing from DOM
-      const timer = setTimeout(() => {
-        setIsRendered(false)
-      }, 200) // Match this to your animation duration
-      return () => clearTimeout(timer)
-    }
-  }, [isVisible, isRendered])
-
  return (
    <>
-      <div
-        className={css({
-          position: 'relative',
-        })}
-      >
-        <ToggleButton
-          square
-          variant="primaryDark"
-          aria-label={t('button')}
-          tooltip={t('button')}
-          onPress={() => setIsVisible(!isVisible)}
-        >
-          <RiEmotionLine />
-        </ToggleButton>
-        {isRendered && (
-          <div
+      <div className={css({ position: 'relative' })}>
+        <DialogTrigger isOpen={isOpen} onOpenChange={setIsOpen}>
+          <ToggleButton
+            square
+            variant="primaryDark"
+            aria-label={t('button')}
+            tooltip={t('button')}
+            isSelected={isOpen}
+            onChange={setIsOpen}
+          >
+            <RiEmotionLine />
+          </ToggleButton>
+          <RACPopover
+            placement="top"
+            offset={8}
+            isNonModal
+            shouldCloseOnInteractOutside={() => false}
            className={css({
-              position: 'absolute',
-              top: -63,
-              left: -162,
              borderRadius: '8px',
              padding: '0.35rem',
              backgroundColor: 'primaryDark.50',
-              opacity: opacity,
-              transition: 'opacity 0.2s ease',
+              '&[data-entering]': {
+                animation: 'fade 200ms ease',
+              },
+              '&[data-exiting]': {
+                animation: 'fade 200ms ease-in reverse',
+              },
            })}
-            onTransitionEnd={() => {
-              if (!isVisible) {
-                setIsRendered(false)
-              }
-            }}
          >
-            <RACToolbar
-              className={css({
-                display: 'flex',
-                gap: '0.5rem',
-              })}
-            >
-              {Object.values(Emoji).map((emoji, index) => (
-                <Button
-                  key={index}
-                  onPress={() => debouncedSendReaction(emoji)}
-                  aria-label={t('send', { emoji: getEmojiLabel(emoji, t) })}
-                  variant="primaryTextDark"
-                  size="sm"
-                  square
-                  data-attr={`send-reaction-${emoji}`}
+            <Dialog className={css({ outline: 'none' })}>
+              {/* eslint-disable-next-line jsx-a11y/no-autofocus -- FocusScope autoFocus is programmatic focus for overlays, not the HTML autofocus attribute */}
+              <FocusScope contain autoFocus restoreFocus>
+                <div
+                  role="toolbar"
+                  aria-orientation="horizontal"
+                  aria-label={t('button')}
+                  className={css({
+                    display: 'flex',
+                    gap: '0.5rem',
+                  })}
                >
-                  <img
-                    src={`/assets/reactions/${emoji}.png`}
-                    alt=""
-                    className={css({
-                      minHeight: '28px',
-                      minWidth: '28px',
-                      pointerEvents: 'none',
-                      userSelect: 'none',
-                    })}
-                  />
-                </Button>
-              ))}
-            </RACToolbar>
-          </div>
-        )}
+                  {Object.values(Emoji).map((emoji, index) => (
+                    <Button
+                      key={index}
+                      onPress={() => debouncedSendReaction(emoji)}
+                      aria-label={t('send', { emoji: getEmojiLabel(emoji, t) })}
+                      variant="primaryTextDark"
+                      size="sm"
+                      square
+                      data-attr={`send-reaction-${emoji}`}
+                    >
+                      <img
+                        src={`/assets/reactions/${emoji}.png`}
+                        alt=""
+                        className={css({
+                          width: '28px',
+                          height: '28px',
+                          pointerEvents: 'none',
+                          userSelect: 'none',
+                        })}
+                      />
+                    </Button>
+                  ))}
+                </div>
+              </FocusScope>
+            </Dialog>
+          </RACPopover>
+        </DialogTrigger>
      </div>
      <ReactionPortals reactions={reactions} />
    </>
@@ -6,8 +6,7 @@ import {
 import React from 'react'

 /** @public */
-export interface AllowMediaPlaybackProps
-  extends React.ButtonHTMLAttributes<HTMLButtonElement> {
+export interface AllowMediaPlaybackProps extends React.ButtonHTMLAttributes<HTMLButtonElement> {
  label?: string
 }

@@ -18,6 +18,7 @@ import { Loader } from '@/primitives/Loader'
 import { useSyncAfterDelay } from '@/hooks/useSyncAfterDelay'
 import { FunnyEffects } from './FunnyEffects'
 import { useHasFunnyEffectsAccess } from '../../hooks/useHasFunnyEffectsAccess'
+import { useScreenReaderAnnounce } from '@/hooks/useScreenReaderAnnounce'

 enum BlurRadius {
  NONE = 0,
@@ -56,7 +57,7 @@ export const EffectsConfiguration = ({
  const [processorPending, setProcessorPending] = useState(false)
  const processorPendingReveal = useSyncAfterDelay(processorPending)
  const hasFunnyEffectsAccess = useHasFunnyEffectsAccess()
-  const [effectStatusMessage, setEffectStatusMessage] = useState('')
+  const announce = useScreenReaderAnnounce()
  const effectAnnouncementTimeout = useRef<ReturnType<
    typeof setTimeout
  > | null>(null)
@@ -104,12 +105,9 @@ export const EffectsConfiguration = ({
      clearTimeout(effectAnnouncementTimeout.current)
    }

-    // Clear the region first so screen readers drop queued announcements.
-    setEffectStatusMessage('')
-
    effectAnnouncementTimeout.current = setTimeout(() => {
      if (currentId !== effectAnnouncementId.current) return
-      setEffectStatusMessage(message)
+      announce(message)
    }, 80)
  }

@@ -423,9 +421,6 @@ export const EffectsConfiguration = ({
                    <BlurOnStrong />
                  </ToggleButton>
                </div>
-                <div aria-live="polite" className="sr-only">
-                  {effectStatusMessage}
-                </div>
              </div>
              <div
                className={css({
@@ -11,8 +11,7 @@ const ASPECT_RATIO = 16 / 10
 const ASPECT_RATIO_INVERT = (1 - ASPECT_RATIO) * -1

 /** @public */
-export interface CarouselLayoutProps
-  extends React.HTMLAttributes<HTMLMediaElement> {
+export interface CarouselLayoutProps extends React.HTMLAttributes<HTMLMediaElement> {
  tracks: TrackReferenceOrPlaceholder[]
  children: React.ReactNode
  /** Place the tiles vertically or horizontally next to each other.
@@ -13,7 +13,8 @@ import { PaginationControl } from '../controls/PaginationControl'

 /** @public */
 export interface GridLayoutProps
-  extends React.HTMLAttributes<HTMLDivElement>,
+  extends
+    React.HTMLAttributes<HTMLDivElement>,
    Pick<UseParticipantsOptions, 'updateOnlyOn'> {
  children: React.ReactNode
  tracks: TrackReferenceOrPlaceholder[]
@@ -12,6 +12,6 @@ export function useCanPublishTrack(trackSource: TrackSource): boolean {

  return Boolean(
    permissions?.canPublish &&
-      permissions?.canPublishSources?.includes(trackSource)
+    permissions?.canPublishSources?.includes(trackSource)
  )
 }
@@ -1,19 +1,16 @@
 import { useMemo } from 'react'
-import { Shortcut } from '@/features/shortcuts/types'
+import {
+  getShortcutDescriptorById,
+  ShortcutDescriptor,
+} from '@/features/shortcuts/catalog'

 export const useDeviceShortcut = (kind: MediaDeviceKind) => {
-  return useMemo<Shortcut | undefined>(() => {
+  return useMemo<ShortcutDescriptor | undefined>(() => {
    switch (kind) {
      case 'audioinput':
-        return {
-          key: 'd',
-          ctrlKey: true,
-        }
+        return getShortcutDescriptorById('toggle-microphone')
      case 'videoinput':
-        return {
-          key: 'e',
-          ctrlKey: true,
-        }
+        return getShortcutDescriptorById('toggle-camera')
      default:
        return undefined
    }
@@ -18,8 +18,7 @@ import { css } from '@/styled-system/css'
 import { useRestoreFocus } from '@/hooks/useRestoreFocus'

 export interface ChatProps
-  extends React.HTMLAttributes<HTMLDivElement>,
-    ChatOptions {}
+  extends React.HTMLAttributes<HTMLDivElement>, ChatOptions {}

 /**
 * The Chat component adds a basis chat functionality to the LiveKit room. The messages are distributed to all participants
@@ -22,7 +22,7 @@ export function DesktopControlBar({
  const desktopControlBarEl = useRef<HTMLDivElement>(null)

  useRegisterKeyboardShortcut({
-    shortcut: { key: 'F2' },
+    id: 'focus-toolbar',
    handler: () => {
      const root = desktopControlBarEl.current
      if (!root) return
@@ -5,9 +5,8 @@ import {
  isWeb,
  log,
 } from '@livekit/components-core'
-import { RoomEvent, Track } from 'livekit-client'
-import * as React from 'react'
-import { useState } from 'react'
+import { Participant, RoomEvent, Track } from 'livekit-client'
+import React, { useCallback, useRef, useState, useEffect } from 'react'
 import {
  ConnectionStateToast,
  FocusLayoutContainer,
@@ -16,7 +15,9 @@ import {
  usePinnedTracks,
  useTracks,
  useCreateLayoutContext,
+  useRoomContext,
 } from '@livekit/components-react'
+import { useTranslation } from 'react-i18next'

 import { ControlBar } from './ControlBar/ControlBar'
 import { styled } from '@/styled-system/jsx'
@@ -37,6 +38,8 @@ import { Subtitles } from '@/features/subtitle/component/Subtitles'
 import { CarouselLayout } from '../components/layout/CarouselLayout'
 import { GridLayout } from '../components/layout/GridLayout'
 import { IsIdleDisconnectModal } from '../components/IsIdleDisconnectModal'
+import { getParticipantName } from '@/features/rooms/utils/getParticipantName'
+import { useScreenReaderAnnounce } from '@/hooks/useScreenReaderAnnounce'

 const LayoutWrapper = styled(
  'div',
@@ -63,8 +66,7 @@ const LayoutWrapper = styled(
 /**
 * @public
 */
-export interface VideoConferenceProps
-  extends React.HTMLAttributes<HTMLDivElement> {
+export interface VideoConferenceProps extends React.HTMLAttributes<HTMLDivElement> {
  /** @alpha */
  SettingsComponent?: React.ComponentType
 }
@@ -89,7 +91,22 @@ export interface VideoConferenceProps
 */
 export function VideoConference({ ...props }: VideoConferenceProps) {
  const lastAutoFocusedScreenShareTrack =
-    React.useRef<TrackReferenceOrPlaceholder | null>(null)
+    useRef<TrackReferenceOrPlaceholder | null>(null)
+  const lastPinnedParticipantIdentityRef = useRef<string | null>(null)
+  const { t } = useTranslation('rooms', { keyPrefix: 'pinAnnouncements' })
+  const { t: tRooms } = useTranslation('rooms')
+  const room = useRoomContext()
+  const announce = useScreenReaderAnnounce()
+
+  const getAnnouncementName = useCallback(
+    (participant?: Participant | null) => {
+      if (!participant) return tRooms('participants.unknown')
+      return participant.isLocal
+        ? tRooms('participants.you')
+        : getParticipantName(participant)
+    },
+    [tRooms]
+  )

  useConnectionObserver()
  useVideoResolutionSubscription()
@@ -115,9 +132,62 @@ export function VideoConference({ ...props }: VideoConferenceProps) {
    (track) => !isEqualTrackRef(track, focusTrack)
  )

+  // handle pin announcements
+
+  useEffect(() => {
+    const participant = focusTrack?.participant
+
+    // 1. unpin
+    if (!participant) {
+      if (!lastPinnedParticipantIdentityRef.current) return
+
+      const lastIdentity = lastPinnedParticipantIdentityRef.current
+      const lastParticipant =
+        room.localParticipant.identity === lastIdentity
+          ? room.localParticipant
+          : room.remoteParticipants.get(lastIdentity)
+      const announcementName = getAnnouncementName(lastParticipant)
+
+      announce(
+        lastParticipant?.isLocal
+          ? t('self.unpin')
+          : t('unpin', {
+              name: announcementName,
+            })
+      )
+
+      lastPinnedParticipantIdentityRef.current = null
+      return
+    }
+
+    // 2. same pin → do nothing
+    if (lastPinnedParticipantIdentityRef.current === participant.identity) {
+      return
+    }
+
+    // 3. new pin
+    const participantName = participant.isLocal
+      ? tRooms('participants.you')
+      : getParticipantName(participant)
+
+    lastPinnedParticipantIdentityRef.current = participant.identity
+
+    announce(
+      participant.isLocal ? t('self.pin') : t('pin', { name: participantName })
+    )
+  }, [
+    announce,
+    focusTrack,
+    getAnnouncementName,
+    room.localParticipant,
+    room.remoteParticipants,
+    t,
+    tRooms,
+  ])
+
  /* eslint-disable react-hooks/exhaustive-deps */
  // Code duplicated from LiveKit; this warning will be addressed in the refactoring.
-  React.useEffect(() => {
+  useEffect(() => {
    // If screen share tracks are published, and no pin is set explicitly, auto set the screen share.
    if (
      screenShareTracks.some((track) => track.publication.isSubscribed) &&
@@ -9,8 +9,7 @@ import NoiseSuppressorWorklet from '@timephy/rnnoise-wasm/NoiseSuppressorWorklet
 // and suspend/resume it as needed to manage audio state
 let audioContext: AudioContext

-export interface AudioProcessorInterface
-  extends TrackProcessor<Track.Kind.Audio> {
+export interface AudioProcessorInterface extends TrackProcessor<Track.Kind.Audio> {
  name: string
 }

@@ -12,6 +12,7 @@ import {
  RiSpeakerLine,
  RiVideoOnLine,
  RiEyeLine,
+  RiKeyboardBoxLine,
 } from '@remixicon/react'
 import { AccountTab } from './tabs/AccountTab'
 import { NotificationsTab } from './tabs/NotificationsTab'
@@ -19,11 +20,12 @@ import { GeneralTab } from './tabs/GeneralTab'
 import { AudioTab } from './tabs/AudioTab'
 import { VideoTab } from './tabs/VideoTab'
 import { TranscriptionTab } from './tabs/TranscriptionTab'
-import { useRef } from 'react'
+import { ShortcutTab } from './tabs/ShortcutTab'
+import { useEffect, useRef } from 'react'
 import { useMediaQuery } from '@/features/rooms/livekit/hooks/useMediaQuery'
 import { SettingsDialogExtendedKey } from '@/features/settings/type'
 import { useIsAdminOrOwner } from '@/features/rooms/livekit/hooks/useIsAdminOrOwner'
-import AccessibilityTab from './tabs/AccessibilityTab'
+import { AccessibilityTab } from './tabs/AccessibilityTab'

 const tabsStyle = css({
  maxHeight: '40.625rem', // fixme size copied from meet settings modal
@@ -39,6 +41,7 @@ const tabListContainerStyle = css({
  flexDirection: 'column',
  borderRight: '1px solid lightGray', // fixme poor color management
  paddingY: '1rem',
+  paddingLeft: '0.2rem',
  paddingRight: '1.5rem',
 })

@@ -65,6 +68,17 @@ export const SettingsDialogExtended = (props: SettingsDialogExtended) => {

  const isAdminOrOwner = useIsAdminOrOwner()

+  useEffect(() => {
+    if (!props.isOpen) return
+    const timer = setTimeout(() => {
+      const selectedTab = dialogEl.current?.querySelector(
+        '[role="tab"][data-selected]'
+      ) as HTMLElement | null
+      selectedTab?.focus()
+    }, 200)
+    return () => clearTimeout(timer)
+  }, [props.isOpen])
+
  return (
    <Dialog innerRef={dialogEl} {...props} role="dialog" type="flex">
      <Tabs
@@ -80,42 +94,53 @@ export const SettingsDialogExtended = (props: SettingsDialogExtended) => {
            paddingRight: !isWideScreen ? '1rem' : undefined,
          }}
        >
-          {isWideScreen && (
-            <Heading slot="title" level={1} className={text({ variant: 'h1' })}>
-              {t('dialog.heading')}
-            </Heading>
-          )}
-          <TabList border={false}>
-            <Tab icon highlight id={SettingsDialogExtendedKey.ACCOUNT}>
-              <RiAccountCircleLine />
+          <Heading
+            slot="title"
+            level={1}
+            className={
+              isWideScreen ? text({ variant: 'h1' }) : 'sr-only'
+            }
+          >
+            {t('dialog.heading')}
+          </Heading>
+          <TabList
+            border={false}
+            aria-label={t('dialog.tablistLabel')}
+          >
+            <Tab icon highlight id={SettingsDialogExtendedKey.ACCOUNT} aria-label={t(`tabs.${SettingsDialogExtendedKey.ACCOUNT}`)}>
+              <RiAccountCircleLine aria-hidden="true" />
              {isWideScreen && t(`tabs.${SettingsDialogExtendedKey.ACCOUNT}`)}
            </Tab>
-            <Tab icon highlight id={SettingsDialogExtendedKey.AUDIO}>
-              <RiSpeakerLine />
+            <Tab icon highlight id={SettingsDialogExtendedKey.AUDIO} aria-label={t(`tabs.${SettingsDialogExtendedKey.AUDIO}`)}>
+              <RiSpeakerLine aria-hidden="true" />
              {isWideScreen && t(`tabs.${SettingsDialogExtendedKey.AUDIO}`)}
            </Tab>
-            <Tab icon highlight id={SettingsDialogExtendedKey.VIDEO}>
-              <RiVideoOnLine />
+            <Tab icon highlight id={SettingsDialogExtendedKey.VIDEO} aria-label={t(`tabs.${SettingsDialogExtendedKey.VIDEO}`)}>
+              <RiVideoOnLine aria-hidden="true" />
              {isWideScreen && t(`tabs.${SettingsDialogExtendedKey.VIDEO}`)}
            </Tab>
-            <Tab icon highlight id={SettingsDialogExtendedKey.GENERAL}>
-              <RiSettings3Line />
+            <Tab icon highlight id={SettingsDialogExtendedKey.GENERAL} aria-label={t(`tabs.${SettingsDialogExtendedKey.GENERAL}`)}>
+              <RiSettings3Line aria-hidden="true" />
              {isWideScreen && t(`tabs.${SettingsDialogExtendedKey.GENERAL}`)}
            </Tab>
-            <Tab icon highlight id={SettingsDialogExtendedKey.NOTIFICATIONS}>
-              <RiNotification3Line />
+            <Tab icon highlight id={SettingsDialogExtendedKey.NOTIFICATIONS} aria-label={t(`tabs.${SettingsDialogExtendedKey.NOTIFICATIONS}`)}>
+              <RiNotification3Line aria-hidden="true" />
              {isWideScreen &&
                t(`tabs.${SettingsDialogExtendedKey.NOTIFICATIONS}`)}
            </Tab>
+            <Tab icon highlight id={SettingsDialogExtendedKey.SHORTCUTS} aria-label={t(`tabs.${SettingsDialogExtendedKey.SHORTCUTS}`)}>
+              <RiKeyboardBoxLine aria-hidden="true" />
+              {isWideScreen && t(`tabs.${SettingsDialogExtendedKey.SHORTCUTS}`)}
+            </Tab>
            {isAdminOrOwner && (
-              <Tab icon highlight id={SettingsDialogExtendedKey.TRANSCRIPTION}>
+              <Tab icon highlight id={SettingsDialogExtendedKey.TRANSCRIPTION} aria-label={t(`tabs.${SettingsDialogExtendedKey.TRANSCRIPTION}`)}>
                <Icon type="symbols" name="speech_to_text" />
                {isWideScreen &&
                  t(`tabs.${SettingsDialogExtendedKey.TRANSCRIPTION}`)}
              </Tab>
            )}
-            <Tab icon highlight id={SettingsDialogExtendedKey.ACCESSIBILITY}>
-              <RiEyeLine />
+            <Tab icon highlight id={SettingsDialogExtendedKey.ACCESSIBILITY} aria-label={t(`tabs.${SettingsDialogExtendedKey.ACCESSIBILITY}`)}>
+              <RiEyeLine aria-hidden="true" />
              {isWideScreen &&
                t(`tabs.${SettingsDialogExtendedKey.ACCESSIBILITY}`)}
            </Tab>
@@ -130,6 +155,7 @@ export const SettingsDialogExtended = (props: SettingsDialogExtended) => {
          <VideoTab id={SettingsDialogExtendedKey.VIDEO} />
          <GeneralTab id={SettingsDialogExtendedKey.GENERAL} />
          <NotificationsTab id={SettingsDialogExtendedKey.NOTIFICATIONS} />
+          <ShortcutTab id={SettingsDialogExtendedKey.SHORTCUTS} />
          {/* Transcription tab won't be accessible if the tab is not active in the tab list */}
          <TranscriptionTab id={SettingsDialogExtendedKey.TRANSCRIPTION} />
          <AccessibilityTab id={SettingsDialogExtendedKey.ACCESSIBILITY} />
@@ -36,5 +36,3 @@ export const AccessibilityTab = ({ id }: AccessibilityTabProps) => {
    </TabPanel>
  )
 }
-
-export default AccessibilityTab
@@ -0,0 +1,51 @@
+import { shortcutCatalog } from '@/features/shortcuts/catalog'
+import { ShortcutRow } from '@/features/shortcuts/components/ShortcutRow'
+import { css } from '@/styled-system/css'
+import { useTranslation } from 'react-i18next'
+import { TabPanel, type TabPanelProps } from '@/primitives/Tabs'
+import { H } from '@/primitives'
+
+const tableStyle = css({
+  width: '100%',
+  borderCollapse: 'collapse',
+  overflowY: 'auto',
+  '& th, & td': {
+    padding: '0.65rem 0',
+    textAlign: 'left',
+  },
+  '& tbody tr': {
+    borderBottom: '1px solid rgba(255,255,255,0.08)',
+  },
+})
+
+export const ShortcutTab = ({ id }: Pick<TabPanelProps, 'id'>) => {
+  const { t } = useTranslation(['settings', 'rooms'])
+
+  return (
+    <TabPanel
+      id={id}
+      padding="md"
+      flex
+      className={css({
+        display: 'flex',
+        flexDirection: 'column',
+        gap: '0.75rem',
+      })}
+    >
+      <H lvl={2}>{t('shortcuts.listLabel')}</H>
+      <table className={tableStyle}>
+        <thead className="sr-only">
+          <tr>
+            <th scope="col">{t('shortcuts.columnAction')}</th>
+            <th scope="col">{t('shortcuts.columnShortcut')}</th>
+          </tr>
+        </thead>
+        <tbody>
+          {shortcutCatalog.map((item) => (
+            <ShortcutRow key={item?.id} descriptor={item} />
+          ))}
+        </tbody>
+      </table>
+    </TabPanel>
+  )
+}
@@ -5,5 +5,6 @@ export enum SettingsDialogExtendedKey {
  GENERAL = 'general',
  NOTIFICATIONS = 'notifications',
  TRANSCRIPTION = 'transcription',
+  SHORTCUTS = 'shortcuts',
  ACCESSIBILITY = 'accessibility',
 }
@@ -0,0 +1,83 @@
+import { Shortcut } from './types'
+
+// Central list of current keyboard shortcuts.
+// Keep a single source of truth for display and, later, customization
+export type ShortcutCategory = 'navigation' | 'media' | 'interaction'
+
+export type ShortcutId =
+  | 'focus-toolbar'
+  | 'toggle-microphone'
+  | 'toggle-camera'
+  | 'push-to-talk'
+  | 'toggle-chat'
+  | 'toggle-participants'
+  | 'raise-hand'
+  | 'recording'
+  | 'reaction'
+  | 'fullscreen'
+
+export const getShortcutDescriptorById = (id: ShortcutId) =>
+  shortcutCatalog.find((item) => item.id === id)
+
+export type ShortcutDescriptor = {
+  id: ShortcutId
+  category: ShortcutCategory
+  shortcut?: Shortcut
+  kind?: 'press' | 'longPress'
+  code?: string // used when kind === 'longPress' (KeyboardEvent.code)
+  description?: string
+}
+
+export const shortcutCatalog: ShortcutDescriptor[] = [
+  {
+    id: 'focus-toolbar',
+    category: 'navigation',
+    shortcut: { key: 'F2' },
+  },
+  {
+    id: 'toggle-microphone',
+    category: 'media',
+    shortcut: { key: 'd', ctrlKey: true },
+  },
+  {
+    id: 'toggle-camera',
+    category: 'media',
+    shortcut: { key: 'e', ctrlKey: true },
+  },
+  {
+    id: 'push-to-talk',
+    category: 'media',
+    kind: 'longPress',
+    code: 'KeyV',
+  },
+  {
+    id: 'reaction',
+    category: 'interaction',
+    shortcut: { key: 'E', ctrlKey: true, shiftKey: true },
+  },
+  {
+    id: 'fullscreen',
+    category: 'interaction',
+    shortcut: { key: 'F', ctrlKey: true, shiftKey: true },
+  },
+  {
+    id: 'recording',
+    category: 'interaction',
+    shortcut: { key: 'L', ctrlKey: true, shiftKey: true },
+  },
+  {
+    id: 'raise-hand',
+    category: 'interaction',
+    shortcut: { key: 'H', ctrlKey: true, shiftKey: true },
+  },
+  {
+    id: 'toggle-chat',
+    category: 'interaction',
+    shortcut: { key: 'M', ctrlKey: true, shiftKey: true },
+  },
+  {
+    id: 'toggle-participants',
+    category: 'interaction',
+    shortcut: { key: 'P', ctrlKey: true, shiftKey: true },
+  },
+]
@@ -0,0 +1,34 @@
+import React from 'react'
+import { css, cx } from '@/styled-system/css'
+
+type ShortcutBadgeProps = {
+  visualLabel: string
+  srLabel?: string
+  className?: string
+}
+
+const badgeStyle = css({
+  fontFamily: 'monospace',
+  backgroundColor: 'rgba(255,255,255,0.12)',
+  paddingInline: '0.4rem',
+  paddingBlock: '0.2rem',
+  borderRadius: '6px',
+  whiteSpace: 'nowrap',
+  minWidth: '5.5rem',
+  textAlign: 'center',
+})
+
+export const ShortcutBadge: React.FC<ShortcutBadgeProps> = ({
+  visualLabel,
+  srLabel,
+  className,
+}) => {
+  return (
+    <>
+      <div className={cx(badgeStyle, className)} aria-hidden="true">
+        <span>{visualLabel}</span>
+      </div>
+      {srLabel && <span className="sr-only">{srLabel}</span>}
+    </>
+  )
+}
@@ -0,0 +1,42 @@
+import React from 'react'
+import { css } from '@/styled-system/css'
+import { text } from '@/primitives/Text'
+import { ShortcutDescriptor } from '../catalog'
+import { ShortcutBadge } from './ShortcutBadge'
+import { useShortcutFormatting } from '../hooks/useShortcutFormatting'
+import { useTranslation } from 'react-i18next'
+
+type ShortcutRowProps = {
+  descriptor: ShortcutDescriptor
+}
+
+const shortcutCellStyle = css({
+  textAlign: 'right',
+})
+
+export const ShortcutRow: React.FC<ShortcutRowProps> = ({ descriptor }) => {
+  const { t } = useTranslation('rooms', { keyPrefix: 'shortcutsPanel' })
+  const { formatVisual, formatForSR } = useShortcutFormatting()
+
+  const visualShortcut = formatVisual(
+    descriptor.shortcut,
+    descriptor.code,
+    descriptor.kind
+  )
+  const srShortcut = formatForSR(
+    descriptor.shortcut,
+    descriptor.code,
+    descriptor.kind
+  )
+
+  return (
+    <tr>
+      <td className={text({ variant: 'body' })}>
+        {t(`actions.${descriptor.id}`)}
+      </td>
+      <td className={shortcutCellStyle}>
+        <ShortcutBadge visualLabel={visualShortcut} srLabel={srShortcut} />
+      </td>
+    </tr>
+  )
+}
@@ -0,0 +1,59 @@
+import { Shortcut } from './types'
+import { isMacintosh } from '@/utils/livekit'
+
+// Visible label for a shortcut (uses ⌘/Ctrl prefix when needed).
+export const formatShortcutLabel = (shortcut?: Shortcut) => {
+  if (!shortcut) return '—'
+  const key = shortcut.key?.toUpperCase()
+  if (!key) return '—'
+  const parts: string[] = []
+  if (shortcut.ctrlKey) parts.push(isMacintosh() ? '⌘' : 'Ctrl')
+  if (shortcut.altKey) parts.push(isMacintosh() ? '⌥' : 'Alt')
+  if (shortcut.shiftKey) parts.push('Shift')
+  parts.push(key)
+  return parts.join('+')
+}
+
+// SR-friendly label for a shortcut (reads "Control plus D").
+export const formatShortcutLabelForSR = (
+  shortcut: Shortcut | undefined,
+  {
+    controlLabel,
+    commandLabel,
+    altLabel,
+    optionLabel,
+    shiftLabel,
+    plusLabel,
+    noShortcutLabel,
+  }: {
+    controlLabel: string
+    commandLabel: string
+    altLabel: string
+    optionLabel: string
+    shiftLabel: string
+    plusLabel: string
+    noShortcutLabel: string
+  }
+) => {
+  if (!shortcut) return noShortcutLabel
+  const key = shortcut.key?.toUpperCase()
+  if (!key) return noShortcutLabel
+  const ctrlWord = isMacintosh() ? commandLabel : controlLabel
+  const altWord = isMacintosh() ? optionLabel : altLabel
+  const parts: string[] = []
+  if (shortcut.ctrlKey) parts.push(ctrlWord)
+  if (shortcut.altKey) parts.push(altWord)
+  if (shortcut.shiftKey) parts.push(shiftLabel)
+  parts.push(key)
+  return parts.join(` ${plusLabel} `)
+}
+
+// Extract displayable key name from KeyboardEvent.code (ex: KeyV -> V).
+export const getKeyLabelFromCode = (code?: string) => {
+  if (!code) return ''
+  if (code.startsWith('Key') && code.length === 4) return code.slice(3)
+  if (code.startsWith('Digit') && code.length === 6) return code.slice(5)
+  if (code === 'Space') return '␣'
+  if (code.startsWith('Arrow')) return code.slice(5) // Up, Down, Left, Right
+  return code
+}
@@ -0,0 +1,47 @@
+import { useCallback } from 'react'
+import { useTranslation } from 'react-i18next'
+import { Shortcut } from '../types'
+import {
+  formatShortcutLabel,
+  formatShortcutLabelForSR,
+  getKeyLabelFromCode,
+} from '../formatLabels'
+
+export const useShortcutFormatting = () => {
+  const { t } = useTranslation('rooms')
+
+  const formatVisual = useCallback(
+    (shortcut?: Shortcut, code?: string, kind?: string) => {
+      if (code && kind === 'longPress') {
+        const label = getKeyLabelFromCode(code)
+        return t('shortcutsPanel.visual.hold', { key: label || '?' })
+      }
+      return formatShortcutLabel(shortcut)
+    },
+    [t]
+  )
+
+  const formatForSR = useCallback(
+    (shortcut?: Shortcut, code?: string, kind?: string) => {
+      if (code && kind === 'longPress') {
+        const label = getKeyLabelFromCode(code)
+        return t('shortcutsPanel.sr.hold', { key: label || '?' })
+      }
+      return formatShortcutLabelForSR(shortcut, {
+        controlLabel: t('shortcutsPanel.sr.control'),
+        commandLabel: t('shortcutsPanel.sr.command'),
+        altLabel: t('shortcutsPanel.sr.alt'),
+        optionLabel: t('shortcutsPanel.sr.option'),
+        shiftLabel: t('shortcutsPanel.sr.shift'),
+        plusLabel: t('shortcutsPanel.sr.plus'),
+        noShortcutLabel: t('shortcutsPanel.sr.noShortcut'),
+      })
+    },
+    [t]
+  )
+
+  return {
+    formatVisual,
+    formatForSR,
+  }
+}
@@ -1,4 +1,6 @@
 export type Shortcut = {
  key: string
  ctrlKey?: boolean
+  shiftKey?: boolean
+  altKey?: boolean
 }
@@ -11,11 +11,13 @@ export const useKeyboardShortcuts = () => {
    // This approach handles basic shortcuts but isn't comprehensive.
    // Issues might occur. First draft.
    const onKeyDown = async (e: KeyboardEvent) => {
-      const { key, metaKey, ctrlKey } = e
+      const { key, metaKey, ctrlKey, shiftKey, altKey } = e
      if (!key) return
      const shortcutKey = formatShortcutKey({
        key,
        ctrlKey: ctrlKey || (isMacintosh() && metaKey),
+        shiftKey,
+        altKey,
      })
      const shortcut = shortcutsSnap.shortcuts.get(shortcutKey)
      if (!shortcut) return
@@ -1,26 +1,28 @@
 import { useEffect } from 'react'
 import { keyboardShortcutsStore } from '@/stores/keyboardShortcuts'
 import { formatShortcutKey } from '@/features/shortcuts/utils'
-import { Shortcut } from '@/features/shortcuts/types'
+import { ShortcutId, getShortcutDescriptorById } from './catalog'

 export type useRegisterKeyboardShortcutProps = {
-  shortcut?: Shortcut
+  id?: ShortcutId
  handler: () => Promise<void | boolean | undefined> | void
  isDisabled?: boolean
 }

 export const useRegisterKeyboardShortcut = ({
-  shortcut,
+  id,
  handler,
  isDisabled = false,
 }: useRegisterKeyboardShortcutProps) => {
  useEffect(() => {
-    if (!shortcut) return
-    const formattedKey = formatShortcutKey(shortcut)
+    if (!id) return
+    const descriptor = getShortcutDescriptorById(id)
+    if (!descriptor?.shortcut) return
+    const formattedKey = formatShortcutKey(descriptor.shortcut)
    if (isDisabled) {
      keyboardShortcutsStore.shortcuts.delete(formattedKey)
    } else {
      keyboardShortcutsStore.shortcuts.set(formattedKey, handler)
    }
-  }, [handler, shortcut, isDisabled])
+  }, [handler, id, isDisabled])
 }
@@ -4,15 +4,27 @@ import { Shortcut } from '@/features/shortcuts/types'
 export const CTRL = 'ctrl'

 export const formatShortcutKey = (shortcut: Shortcut) => {
-  if (shortcut.ctrlKey) return `${CTRL}+${shortcut.key.toUpperCase()}`
-  return shortcut.key.toUpperCase()
+  const parts = []
+  if (shortcut.ctrlKey) parts.push(CTRL)
+  if (shortcut.altKey) parts.push('alt')
+  if (shortcut.shiftKey) parts.push('shift')
+  parts.push(shortcut.key.toUpperCase())
+  return parts.join('+')
 }

 export const appendShortcutLabel = (label: string, shortcut: Shortcut) => {
  if (!shortcut.key) return
-  let formattedKeyLabel = shortcut.key.toLowerCase()
+  const parts: string[] = []
  if (shortcut.ctrlKey) {
-    formattedKeyLabel = `${isMacintosh() ? '⌘' : 'Ctrl'}+${formattedKeyLabel}`
+    parts.push(isMacintosh() ? '⌘' : 'Ctrl')
  }
+  if (shortcut.altKey) {
+    parts.push(isMacintosh() ? '⌥' : 'Alt')
+  }
+  if (shortcut.shiftKey) {
+    parts.push('Shift')
+  }
+  parts.push(shortcut.key.toLowerCase())
+  const formattedKeyLabel = parts.join('+')
  return `${label} (${formattedKeyLabel})`
 }
@@ -1,4 +1,4 @@
-import { useEffect, useState } from 'react'
+import { useEffect, useMemo, useState } from 'react'
 import { useSubtitles } from '../hooks/useSubtitles'
 import { css, cva } from '@/styled-system/css'
 import { styled } from '@/styled-system/jsx'
@@ -20,6 +20,10 @@ export interface TranscriptionSegment {
  lastReceivedTime: number
 }

+export interface TranscriptionSegmentWithParticipant extends TranscriptionSegment {
+  participant: Participant
+}
+
 export interface TranscriptionRow {
  id: string
  participant: Participant
@@ -30,88 +34,41 @@ export interface TranscriptionRow {
 }

 const useTranscriptionState = () => {
-  const [transcriptionRows, setTranscriptionRows] = useState<
-    TranscriptionRow[]
+  const [transcriptionSegments, setTranscriptionSegments] = useState<
+    TranscriptionSegmentWithParticipant[]
  >([])
-  const [lastActiveParticipantIdentity, setLastActiveParticipantIdentity] =
-    useState<string | null>(null)

-  const updateTranscriptions = (
+  const updateTranscriptionSegments = (
    segments: TranscriptionSegment[],
    participant?: Participant
  ) => {
    console.log(participant, segments)
+
    if (!participant || segments.length === 0) return

-    setTranscriptionRows((prevRows) => {
-      const updatedRows = [...prevRows]
-      const now = Date.now()
+    if (segments.length > 1) {
+      console.warn('Unexpected error more segments')
+      return
+    }

-      const shouldAppendToLastRow =
-        lastActiveParticipantIdentity === participant.identity &&
-        updatedRows.length > 0
+    const segment = segments[0]

-      if (shouldAppendToLastRow) {
-        const lastRowIndex = updatedRows.length - 1
-        const lastRow = updatedRows[lastRowIndex]
-
-        const existingSegmentIds = new Set(lastRow.segments.map((s) => s.id))
-        const newSegments = segments.filter(
-          (segment) => !existingSegmentIds.has(segment.id)
-        )
-        const updatedSegments = lastRow.segments.map((existing) => {
-          const update = segments.find((s) => s.id === existing.id)
-          return update && update.final ? update : existing
-        })
-
-        updatedRows[lastRowIndex] = {
-          ...lastRow,
-          segments: [...updatedSegments, ...newSegments],
-          lastUpdateTime: now,
-        }
-      } else {
-        const newRow: TranscriptionRow = {
-          id: `${participant.identity}-${now}`,
-          participant,
-          segments: [...segments],
-          lastReceivedTime: Math.min(
-            ...segments.map((s) => s.lastReceivedTime)
-          ),
-          lastUpdateTime: now,
-        }
-        updatedRows.push(newRow)
-      }
-
-      return updatedRows
-    })
-
-    setLastActiveParticipantIdentity(participant.identity)
-  }
-
-  const clearTranscriptions = () => {
-    setTranscriptionRows([])
-    setLastActiveParticipantIdentity(null)
-  }
-
-  const updateParticipant = (_name: string, participant: Participant) => {
-    setTranscriptionRows((prevRows) => {
-      return prevRows.map((row) => {
-        if (row.participant.identity === participant.identity) {
-          return {
-            ...row,
-            participant,
-          }
-        }
-        return row
-      })
+    setTranscriptionSegments((prevSegments) => {
+      const existingSegmentIds = new Set(prevSegments.map((s) => s.id))
+      if (existingSegmentIds.has(segment.id)) return prevSegments
+      return [
+        ...prevSegments,
+        {
+          participant: participant,
+          ...segment,
+        },
+      ]
    })
  }

  return {
-    transcriptionRows,
-    updateTranscriptions,
-    clearTranscriptions,
-    updateParticipant,
+    updateTranscriptionSegments,
+    transcriptionSegments,
  }
 }

@@ -196,24 +153,54 @@ const SubtitlesWrapper = styled(
 export const Subtitles = () => {
  const { areSubtitlesOpen } = useSubtitles()
  const room = useRoomContext()
-  const { transcriptionRows, updateTranscriptions, updateParticipant } =
+
+  const { transcriptionSegments, updateTranscriptionSegments } =
    useTranscriptionState()

  useEffect(() => {
    if (!room) return
-    room.on(RoomEvent.TranscriptionReceived, updateTranscriptions)
+    room.on(RoomEvent.TranscriptionReceived, updateTranscriptionSegments)
    return () => {
-      room.off(RoomEvent.TranscriptionReceived, updateTranscriptions)
+      room.off(RoomEvent.TranscriptionReceived, updateTranscriptionSegments)
    }
-  }, [room, updateTranscriptions])
+  }, [room, updateTranscriptionSegments])

-  useEffect(() => {
-    if (!room) return
-    room.on(RoomEvent.ParticipantNameChanged, updateParticipant)
-    return () => {
-      room.off(RoomEvent.ParticipantNameChanged, updateParticipant)
+  const transcriptionRows = useMemo(() => {
+    if (transcriptionSegments.length === 0) return []
+
+    const rows: TranscriptionRow[] = []
+    let currentRow: TranscriptionRow | null = null
+
+    for (const segment of transcriptionSegments) {
+      const shouldStartNewRow =
+        !currentRow ||
+        currentRow.participant.identity !== segment.participant.identity
+
+      if (shouldStartNewRow) {
+        currentRow = {
+          id: `${segment.participant.identity}-${segment.firstReceivedTime}`,
+          participant: segment.participant,
+          segments: [segment],
+          startTime: segment.startTime,
+          lastUpdateTime: segment.lastReceivedTime,
+          lastReceivedTime: segment.lastReceivedTime,
+        }
+        rows.push(currentRow)
+      } else if (currentRow) {
+        currentRow.segments.push(segment)
+        currentRow.lastUpdateTime = Math.max(
+          currentRow.lastUpdateTime,
+          segment.lastReceivedTime
+        )
+        currentRow.lastReceivedTime = Math.max(
+          currentRow.lastReceivedTime,
+          segment.lastReceivedTime
+        )
+      }
    }
-  }, [room, updateParticipant])
+
+    return rows
+  }, [transcriptionSegments])

  return (
    <SubtitlesWrapper areOpen={areSubtitlesOpen}>
@@ -232,11 +219,7 @@ export const Subtitles = () => {
      >
        {transcriptionRows
          .slice()
-          .sort(
-            (a, b) =>
-              (b.startTime ?? b.lastUpdateTime) -
-              (a.startTime ?? a.lastUpdateTime)
-          )
+          .reverse()
          .map((row) => (
            <Transcription key={row.id} row={row} />
          ))}
@@ -0,0 +1,19 @@
+import { useCallback } from 'react'
+import {
+  announceToScreenReader,
+  type Politeness,
+  type ScreenReaderChannel,
+} from '@/stores/screenReaderAnnouncer'
+
+export const useScreenReaderAnnounce = () => {
+  return useCallback(
+    (
+      message: string,
+      politeness: Politeness = 'polite',
+      channel: ScreenReaderChannel = 'global'
+    ) => {
+      announceToScreenReader(message, politeness, channel)
+    },
+    []
+  )
+}
@@ -10,6 +10,7 @@ import { FeedbackBanner } from '@/components/FeedbackBanner'
 import { Menu } from '@/primitives/Menu'
 import { MenuList } from '@/primitives/MenuList'
 import { LoginButton } from '@/components/LoginButton'
+import { VisualOnlyTooltip } from '@/primitives/VisualOnlyTooltip'

 import { useLoginHint } from '@/hooks/useLoginHint'

@@ -90,6 +91,11 @@ export const Header = () => {
  const isTermsOfService = useMatchesRoute('termsOfService')
  const isRoom = useMatchesRoute('room')
  const { user, isLoggedIn, logout } = useUser()
+  const userLabel = user?.full_name || user?.email
+  const loggedInTooltip = t('loggedInUserTooltip')
+  const loggedInAriaLabel = userLabel
+    ? `${loggedInTooltip} ${userLabel}`
+    : loggedInTooltip

  return (
    <>
@@ -153,23 +159,24 @@ export const Header = () => {
                )}
              {!!user && (
                <Menu>
-                  <Button
-                    size="sm"
-                    variant="secondaryText"
-                    tooltip={t('loggedInUserTooltip')}
-                    tooltipType="delayed"
-                  >
-                    <span
-                      className={css({
-                        overflow: 'hidden',
-                        textOverflow: 'ellipsis',
-                        whiteSpace: 'nowrap',
-                        maxWidth: '350px',
-                        display: { base: 'none', xsm: 'block' },
-                      })}
+                  <Button size="sm" variant="secondaryText">
+                    <VisualOnlyTooltip
+                      tooltip={loggedInTooltip}
+                      ariaLabel={loggedInAriaLabel}
+                      tooltipPosition="bottom"
                    >
-                      {user?.full_name || user?.email}
-                    </span>
+                      <span
+                        className={css({
+                          overflow: 'hidden',
+                          textOverflow: 'ellipsis',
+                          whiteSpace: 'nowrap',
+                          maxWidth: '350px',
+                          display: { base: 'none', xsm: 'block' },
+                        })}
+                      >
+                        {user?.full_name || user?.email}
+                      </span>
+                    </VisualOnlyTooltip>
                  </Button>
                  <MenuList
                    variant={'light'}
@@ -4,6 +4,7 @@ import { Header } from './Header'
 import { layoutStore } from '@/stores/layout'
 import { useSnapshot } from 'valtio'
 import { Footer } from '@/layout/Footer'
+import { ScreenReaderAnnouncer } from '@/primitives'

 export type Layout = 'fullpage' | 'centered'

@@ -41,6 +42,7 @@ export const Layout = ({ children }: { children: ReactNode }) => {
            flexDirection: 'column',
          })}
        >
+          <ScreenReaderAnnouncer />
          {children}
        </main>
      </div>
@@ -17,7 +17,7 @@
  },
  "success": {
    "title": "Ihre Aufzeichnung ist bereit!",
-    "body": "Aufzeichnung des Treffens <b>{{room}}</b> vom {{created_at}}.",
+    "body": "Aufzeichnung des Treffens {{room}} vom {{created_at}}.",
    "expiration": "Achtung, diese Aufzeichnung wird nach {{expiration_days}} Tag(en) gelöscht.",
    "button": "Herunterladen",
    "warning": {
@@ -154,9 +154,12 @@
  "isIdleDisconnectModal": {
    "title": "Bist du noch da?",
    "body": "Du bist der einzige Teilnehmer. Dieses Gespräch endet in {{duration}}. Möchtest du das Gespräch fortsetzen?",
-    "settings": "Um diese Nachricht nicht mehr zu sehen, gehe zu Einstellungen > Allgemein.",
+    "settingsPrefix": "Um diese Nachricht nicht mehr zu sehen, gehe zu",
+    "settingsLink": "Einstellungen > Allgemein",
+    "settingsSuffix": ".",
    "stayButton": "Gespräch fortsetzen",
-    "leaveButton": "Jetzt verlassen"
+    "leaveButton": "Jetzt verlassen",
+    "countdownAnnouncement": "Das Gespräch endet in {{duration}}."
  },
  "controls": {
    "microphone": "Mikrofon",
@@ -504,6 +507,7 @@
  "participants": {
    "subheading": "Im Raum",
    "you": "Du",
+    "unknown": "Unbekannter Teilnehmer",
    "host": "Host",
    "contributors": "Mitwirkende",
    "collapsable": {
@@ -551,6 +555,14 @@
      "ariaLabel": "Hefte {{name}} an"
    }
  },
+  "pinAnnouncements": {
+    "pin": "Das Video von {{name}} ist angeheftet.",
+    "unpin": "Das Video von {{name}} ist nicht mehr angeheftet.",
+    "self": {
+      "pin": "Dein Video ist angeheftet.",
+      "unpin": "Dein Video ist nicht mehr angeheftet."
+    }
+  },
  "recordingStateToast": {
    "transcript": {
      "started": "Transkription läuft",
@@ -583,6 +595,41 @@
    "muteParticipant": "{{name}} stummschalten",
    "fullScreen": "Vollbild"
  },
+  "shortcutsPanel": {
+    "title": "Tastenkombinationen",
+    "categories": {
+      "navigation": "Navigation",
+      "media": "Medien",
+      "interaction": "Interaktion"
+    },
+    "actions": {
+      "open-shortcuts": "Tastenkürzel-Hilfe öffnen",
+      "focus-toolbar": "Fokus auf die untere Symbolleiste",
+      "toggle-microphone": "Mikrofon umschalten",
+      "toggle-camera": "Kamera umschalten",
+      "push-to-talk": "Push-to-talk (gedrückt halten zum Einschalten)",
+      "reaction": "Reaktionspanel",
+      "fullscreen": "Vollbild umschalten",
+      "recording": "Aufnahmepanel umschalten",
+      "raise-hand": "Hand heben oder senken",
+      "toggle-chat": "Chat anzeigen/ausblenden",
+      "toggle-participants": "Teilnehmer anzeigen/ausblenden",
+      "open-shortcuts-settings": "Tastenkürzel-Einstellungen öffnen"
+    },
+    "sr": {
+      "control": "Steuerung",
+      "command": "Befehl",
+      "alt": "Alt",
+      "option": "Option",
+      "shift": "Umschalt",
+      "plus": "plus",
+      "hold": "Halte {{key}} gedrückt",
+      "noShortcut": "Kein Tastenkürzel"
+    },
+    "visual": {
+      "hold": "Halte {{key}} gedrückt"
+    }
+  },
  "fullScreenWarning": {
    "message": "Um eine Endlosschleife zu vermeiden, teile nicht deinen gesamten Bildschirm. Teile stattdessen einen Tab oder ein anderes Fenster.",
    "stop": "Präsentation beenden",
@@ -100,6 +100,11 @@
      }
    }
  },
+  "shortcuts": {
+    "listLabel": "Tastenkürzel",
+    "columnAction": "Aktion",
+    "columnShortcut": "Tastenkürzel"
+  },
  "dialog": {
    "heading": "Einstellungen"
  },
@@ -108,12 +113,19 @@
    "label": "Sprache"
  },
  "settingsButtonLabel": "Einstellungen",
+  "accessibility": {
+    "announceReactions": {
+      "label": "Reaktionen vorlesen"
+    }
+  },
  "tabs": {
    "account": "Profil",
    "audio": "Audio",
    "video": "Video",
    "general": "Allgemein",
    "notifications": "Benachrichtigungen",
-    "transcription": "Transkription"
+    "accessibility": "Barrierefreiheit",
+    "transcription": "Transkription",
+    "shortcuts": "Tastenkürzel"
  }
 }
@@ -3,115 +3,127 @@
  "articles": {
    "article1": {
      "title": "1. Geltungsbereich",
-      "content": "Dieses Dokument definiert die Nutzungsbedingungen für Visio, den Videokonferenzdienst der Verwaltung."
+      "content": "Dieses Dokument legt die Nutzungsbedingungen für Visio (nachfolgend „Visio“ oder „die Anwendung“) fest, eine Videokonferenzanwendung, die speziell für staatliche Verwaltungen und ihnen unterstellte Einrichtungen entwickelt wurde."
    },
    "article2": {
-      "title": "2. Zweck der Plattform",
-      "content": "Der Dienst fördert die Zusammenarbeit im Team und das Arbeiten aus der Ferne und erleichtert die Organisation von Besprechungen, Konferenzen oder Schulungen.",
-      "purposes": "Visio wird von DINUM entwickelt und betrieben. Jede Nutzung des Dienstes muss mit diesen Nutzungsbedingungen übereinstimmen."
+      "title": "2. Zweck der Anwendung",
+      "content": "Visio fördert die Zusammenarbeit der Teams staatlicher Verwaltungen und ihnen unterstellter Einrichtungen, unterstützt die Arbeit auf Distanz und erleichtert die Organisation von Besprechungen, Konferenzen oder Schulungen.",
+      "paragraphs": [
+        "Visio wird von der Interministeriellen Direktion für Digitales (DINUM) entwickelt und betrieben.",
+        "Die Anwendung wird von der DINUM staatlichen Verwaltungen und ihnen unterstellten Einrichtungen für deren Mitarbeitende, Partner und eingeladene Dienstleister zur Verfügung gestellt.",
+        "Jede Nutzung von Visio muss diesen Nutzungsbedingungen sowie gegebenenfalls den Nutzungsvorgaben der zuständigen Verwaltung entsprechen."
+      ]
    },
    "article3": {
-      "title": "3. Zugang zum Dienst",
-      "definition": "Visio wird öffentlichen Bediensteten zur Verfügung gestellt, die über ProConnect verbunden sind, um einen Videokonferenzraum zu verwalten. Der verbundene öffentliche Bedienstete kann dann einen Link übermitteln, der den Zugang zum Raum unter seiner Verantwortung ermöglicht."
+      "title": "3. Begriffsbestimmungen",
+      "paragraphs": [
+        "Visio ist das Produkt, dessen Nutzung in diesen Bedingungen beschrieben wird und das auf der folgenden Seite vorgestellt ist: https://visio.numerique.gouv.fr.",
+        "Nutzerinnen und Nutzer von Visio sind alle Personen, die Visio zu Zwecken der Videokommunikation verwenden, unabhängig davon, ob sie Mitarbeitende, Partner oder Dienstleister der zuständigen Verwaltungen sind. Die zuständige Verwaltung ist die staatliche Verwaltung oder ihr unterstellte Einrichtung, die Visio ihren Mitarbeitenden, Partnern oder Dienstleistern zur Verfügung stellt.",
+        "Raumorganisatorinnen und -organisatoren sind Nutzerinnen und Nutzer, die nach Anmeldung über ProConnect für einen Videokonferenzraum verantwortlich sind."
+      ]
    },
    "article4": {
-      "title": "4. Nutzung",
-      "content": "Die Nutzung des Dienstes ist kostenlos. Um einen Videokonferenzraum zu verwalten, ist eine Verbindung über ProConnect erforderlich."
+      "title": "4. Zugang zur Anwendung",
+      "definition": "Visio wird den Nutzerinnen und Nutzern von ihrer zuständigen Verwaltung zur Verfügung gestellt. Organisatorinnen und Organisatoren können anschließend unter eigener Verantwortung einen Zugangslink zum Raum an beliebige Personen weitergeben."
    },
    "article5": {
      "title": "5. Funktionen",
      "sections": {
        "section1": {
-          "title": "5.1. Funktionen für öffentliche Bedienstete",
-          "content": "Visio bietet öffentlichen Bediensteten die Möglichkeit, von einem Standardarbeitsplatz aus einen Videokonferenzraum zu erstellen, der mit ihrem ProConnect-Konto verknüpft ist.",
-          "paragraph1": "Jeder Staatsbedienstete, dessen Tätigkeiten mit der Nutzung von Visio vereinbar sind oder der keinen spezifischen Vertraulichkeitsverpflichtungen oder dem Berufsgeheimnis unterliegt, kann eine Videokonferenz erstellen. Er kann dann den Besprechungslink mit anderen Teilnehmern teilen, unabhängig davon, ob sie Teil der Verwaltung sind oder nicht.",
-          "paragraph2": "Zu diesem Zweck kann jeder Raumorganisator:",
+          "title": "5.1. Funktionen für Organisatorinnen und Organisatoren",
+          "content": "Visio ermöglicht Mitarbeitenden staatlicher Verwaltungen und ihnen unterstellter Einrichtungen, von einem Standardarbeitsplatz aus einen Videokonferenzraum zu erstellen, der mit ihrem ProConnect-Konto verknüpft ist.",
+          "paragraph1": "Jede Mitarbeiterin und jeder Mitarbeiter des Staates oder einer ihm unterstellten Einrichtung, deren Tätigkeiten mit der Nutzung von Visio vereinbar sind oder die keinen besonderen Vertraulichkeits- oder Berufsgeheimnispflichten unterliegen, kann eine Videokonferenz erstellen und organisieren. Der Einladungslink kann anschließend mit anderen Personen, Nutzerinnen und Nutzern, innerhalb oder außerhalb der Verwaltung geteilt werden.",
+          "paragraph2": "Zu diesem Zweck kann jede Raumorganisatorin bzw. jeder Raumorganisator:",
          "capabilities": [
-            "Den Zugang zum Raum mit einem Warteraum schützen;",
-            "Den Eintritt jedes Teilnehmers in den Raum autorisieren;",
-            "Die Mikrofone und Kameras der Teilnehmer stummschalten;",
-            "Einen Teilnehmer aus dem Raum entfernen."
+            "den Zugang zum Raum durch einen Warteraum schützen;",
+            "den Zutritt jeder Nutzerin und jedes Nutzers zum Raum zulassen;",
+            "Mikrofone und Kameras der Nutzerinnen und Nutzer stummschalten;",
+            "eine Nutzerin oder einen Nutzer aus dem Raum entfernen;",
+            "das Transkriptionstool der Sitzung nach Einholung der Zustimmung der Nutzerinnen und Nutzer unter eigener Verantwortung verwenden."
          ],
-          "paragraph3": "Nur Bedienstete, deren Tätigkeitsbereich zur Nutzung von Visio berechtigt ist oder die <u>keinen spezifischen Vertraulichkeitsverpflichtungen oder dem Berufsgeheimnis unterliegen</u>, dürfen diesen Dienst und seine Funktionen nutzen oder kontrollieren."
+          "paragraph3": "Nur Mitarbeitende, deren ProConnect-Konto zu einer zur Raumorganisation in Visio berechtigten Domäne gehört oder die keiner besonderen Vertraulichkeits- oder Berufsgeheimnispflicht unterliegen, dürfen die Anwendung und ihre Funktionen nutzen oder kontrollieren.",
+          "paragraph4": "Das automatische Transkriptionstool kann von Organisatorinnen und Organisatoren über das Einstellungsmenü des Raums genutzt werden. Es liegt in ihrer Verantwortung, die Zustimmung der an der transkribierten Sitzung teilnehmenden Nutzerinnen und Nutzer sicherzustellen. Die Transkriptionssprache kann im selben Menü geändert werden. Am Ende der Sitzung erhält die Organisatorin bzw. der Organisator einen Link zum Zugriff auf die im von der DINUM betriebenen Tool „Docs“ gespeicherte Transkription."
        },
        "section2": {
-          "title": "5.2. Funktionen für Nutzer",
-          "content": "Visio ermöglicht es jedem Nutzer, ob öffentlicher Bediensteter oder nicht, an jedem Visio-Raum teilzunehmen, zu dem er von einem Staatsbediensteten eingeladen wurde, und alle Funktionen zu nutzen.",
-          "paragraph": "Zu diesem Zweck kann jeder Teilnehmer:",
+          "title": "5.2. Funktionen für Nutzerinnen und Nutzer",
+          "content": "Visio ermöglicht es jeder Nutzerin und jedem Nutzer, unabhängig davon, ob sie oder er dem öffentlichen Dienst angehört oder nicht, an jedem Visio-Raum teilzunehmen, zu dem sie oder er von einer Organisatorin oder einem Organisator eingeladen wurde, und die Funktionen zu nutzen.",
+          "paragraph": "Zu diesem Zweck kann jede Nutzerin und jeder Nutzer:",
          "capabilities": [
-            "Seine angezeigte Identität beim Betreten des Raums festlegen;",
-            "Über Audio und/oder Video aus der Ferne kommunizieren;",
-            "Seinen Bildschirm teilen;",
-            "Während der Sitzung öffentlich mit allen Nachrichten austauschen;",
-            "Informationen über die Konferenz einsehen;",
-            "Seine Kamera und/oder sein Mikrofon jederzeit ein- oder ausschalten;",
-            "Die Privatsphäre seines Arbeitsplatzes schützen, indem er vor dem Betreten des Raums oder sogar während der Videokonferenz einen Hintergrund auswählt und aktiviert."
+            "beim Betreten des Raums einen Anzeigenamen angeben;",
+            "per Audio und/oder Video aus der Ferne kommunizieren;",
+            "den eigenen Bildschirm teilen;",
+            "während der Sitzung öffentliche Nachrichten mit allen Nutzerinnen und Nutzern des Raums austauschen;",
+            "auf technische Informationen zum Raum und Barrierefreiheitsfunktionen zugreifen;",
+            "Kamera und/oder Mikrofon jederzeit ein- oder ausschalten;",
+            "die Privatsphäre der eigenen Umgebung bei aktivierter Kamera schützen, indem vor oder während der Videokonferenz ein Hintergrund ausgewählt und aktiviert wird."
          ]
        }
      }
    },
    "article6": {
-      "title": "6. Verpflichtungen und Verantwortlichkeiten der Nutzer",
+      "title": "6. Verpflichtungen und Verantwortlichkeiten der Nutzerinnen und Nutzer",
      "sections": {
        "section1": {
-          "title": "6.1. Konforme Nutzung",
+          "title": "6.1 Zulässige Nutzung",
          "paragraphs": [
-            "Der Dienst wird öffentlichen Bediensteten über ProConnect zur Verfügung gestellt.",
-            "Der Nutzer ist für die Daten oder Inhalte verantwortlich, die er im Nachrichtendienst des Videokonferenzraums eingibt. Er muss sicherstellen, dass er nur angemessene Nachrichten eingibt."
+            "Visio wird bereitgestellt, um den beruflichen Austausch zwischen Mitarbeitenden staatlicher Verwaltungen und ihnen unterstellter Einrichtungen sowie externen Mitarbeitenden zu erleichtern.",
+            "Nutzerinnen und Nutzer sind verantwortlich für die Bilder und Töne, die sie im Videokonferenzraum zugänglich machen. Diese Verantwortung gilt sowohl für das, was Kamera oder Mikrofon übertragen, als auch für das, was ihr Endgerät Dritten zugänglich machen kann. Daher ist die Anwendung in einem professionellen Umfeld zu nutzen, und es dürfen keine Informationen, die der beruflichen Verschwiegenheitspflicht unterliegen, an Dritte weitergegeben werden (z. B. durch Nutzung von Sichtschutzfiltern, Kopfhörern usw.).",
+            "Nutzerinnen und Nutzer sind für die Daten oder Inhalte verantwortlich, die sie in den Nachrichtenbereich des Raums eingeben. Es dürfen nur angemessene Nachrichten eingegeben werden."
          ]
        },
        "section2": {
-          "title": "6.2. Verbotene Nutzung",
+          "title": "6.2 Unzulässige Nutzung",
          "paragraphs": [
-            "Der Nutzer verpflichtet sich, keine Inhalte oder Informationen in den Nachrichtendienst des Visio-Raums einzugeben, die gegen geltende gesetzliche und regulatorische Bestimmungen verstoßen."
+            "Nutzerinnen und Nutzer verpflichten sich, im Nachrichtenbereich von Visio oder über Bild oder Ton keine Inhalte oder Informationen zugänglich zu machen, die gegen geltende gesetzliche oder regulatorische Bestimmungen verstoßen."
          ]
        }
      }
    },
    "article7": {
-      "title": "7. Verpflichtungen und Verantwortlichkeiten von DINUM",
-      "content": "DINUM ist für die allgemeine Verwaltung des Dienstes verantwortlich. Sie stellt den Bediensteten alle erforderlichen Informationen zur Verfügung, um die Nutzung zu erleichtern. Sie bietet technische und funktionale Unterstützung, um den ordnungsgemäßen Betrieb des Dienstes sicherzustellen. Sie informiert die Nutzer auf jede zumutbare Weise über jede Schwierigkeit, die diesen ordnungsgemäßen Betrieb beeinträchtigen könnte.",
+      "title": "7. Verpflichtungen und Verantwortlichkeiten der DINUM",
      "sections": {
        "section1": {
-          "title": "7.1. Verfügbarkeitsniveau",
+          "title": "7.1. Sicherheit der Anwendung",
          "paragraphs": [
-            "Der Dienst ist 24/7 verfügbar, vorbehaltlich Wartungszeiten.",
-            "DINUM verfolgt ein jährliches Verfügbarkeitsziel von 99,5 % (ohne geplante Ausfälle). Bei einem Vorfall oder einer Wartung strebt sie eine Wiederherstellungszeit von 72 Stunden außerhalb der Geschäftszeiten an.",
-            "Im Rahmen der Wartung der Ausführungsumgebung des Dienstes behält sich DINUM das Recht vor, den Betrieb des Dienstes vorübergehend auszusetzen. Sie informiert die Nutzer mindestens 48 Stunden im Voraus. In dringenden Fällen kann diese Aussetzung ohne Vorankündigung erfolgen.",
-            "Diese außergewöhnlichen Stillstände können beispielsweise für Maßnahmen zur Datenverwaltung im Back Office, Produktionsbereitstellungen oder Architekturänderungen erforderlich sein.",
-            "Eine Nichtverfügbarkeit des Dienstes begründet keinerlei Anspruch auf Entschädigung."
+            "DINUM verpflichtet sich zur Absicherung von Visio, insbesondere durch alle notwendigen Maßnahmen zur Gewährleistung der Sicherheit und Vertraulichkeit der Kommunikation.",
+            "Die Anwendung ist gemäß den Bedingungen des geänderten Dekrets Nr. 2010-112 zugelassen."
          ]
        },
        "section2": {
-          "title": "7.2. Sicherheit des Dienstes",
+          "title": "7.2. Zugang zur Anwendung",
          "paragraphs": [
-            "DINUM ergreift alle erforderlichen Vorsichtsmaßnahmen, um die Sicherheit der Plattform und der im Rahmen des Dienstes eingesetzten Werkzeuge zu gewährleisten, insbesondere in Bezug auf den Zugang zum Dienst, die Verwaltung der Nutzerkonten und die Verarbeitung der erhobenen Daten."
+            "DINUM verpflichtet sich, die notwendigen und angemessenen Mittel bereitzustellen, um einen kontinuierlichen Zugang zur Anwendung sicherzustellen.",
+            "Die Anwendung ist 24 Stunden am Tag, 7 Tage die Woche verfügbar, außer während Wartungszeiten.",
+            "DINUM strebt eine jährliche Verfügbarkeit der Anwendung von 99,5 % an, ausgenommen geplante Ausfälle. Im Falle eines Vorfalls oder einer Wartung wird eine Wiederherstellungszeit von 72 Stunden außerhalb der Geschäftszeiten angestrebt.",
+            "Im Rahmen von Wartungsarbeiten an der Laufzeitumgebung der Anwendung behält sich DINUM das Recht vor, den Betrieb vorübergehend auszusetzen. Soweit möglich, werden die Nutzerinnen und Nutzer mindestens 48 Stunden im Voraus informiert. In Notfällen kann die Aussetzung ohne Vorankündigung erfolgen.",
+            "Solche außergewöhnlichen Ausfälle können beispielsweise für Datenverwaltungsmaßnahmen, Produktivsetzungen oder Architekturänderungen erforderlich sein.",
+            "Eine Nichtverfügbarkeit der Anwendung begründet keinen Anspruch auf irgendeine Form von Entschädigung."
          ]
        },
        "section3": {
-          "title": "7.3. Support-Management",
+          "title": "7.3. Support",
          "paragraphs": [
-            "DINUM leistet First-Level-Support für die Nutzer, ausschließlich zu den technischen Teilen des Dienstes.",
-            "Dieser Support ist über unser Online-Kontaktformular erreichbar.",
-            "Die angestrebte Antwortzeit auf Anfragen beträgt zwei Werktage ab Absenden; dieser Zeitraum kann je nach Komplexität und Anzahl der zu bearbeitenden Anfragen variieren."
+            "DINUM bietet den Nutzerinnen und Nutzern Support der ersten Ebene, ausschließlich zu technischen Aspekten der Anwendung.",
+            "Dieser Support ist über das Online-Kontaktformular erreichbar.",
+            "Die angestrebte Antwortzeit beträgt zwei Arbeitstage ab Versand der Anfrage; dieser Zeitraum kann je nach Komplexität und Anzahl der Anfragen variieren."
          ]
        },
        "section4": {
-          "title": "7.4. Kontrolle der Dienstenutzung",
+          "title": "7.4. Kontrolle der Nutzung der Anwendung",
          "paragraphs": [
-            "DINUM behält sich das Recht vor, ein Agentenkonto zu sperren oder zu löschen, das gegen diese Nutzungsbedingungen verstoßen hat, unbeschadet etwaiger straf- und zivilrechtlicher Maßnahmen gegen den betreffenden Agenten.",
-            "Die Sperrung oder Aufhebung eines oder mehrerer Konten begründet keinen Anspruch auf irgendeine Entschädigung."
+            "DINUM behält sich das Recht vor, ein Nutzerkonto zu sperren oder zu löschen, wenn gegen diese Nutzungsbedingungen verstoßen wurde, unbeschadet möglicher straf- oder zivilrechtlicher Schritte gegen die betreffende Person. Informationen können an die zuständige Verwaltung übermittelt werden, die für die Bereitstellung der Anwendung verantwortlich ist.",
+            "Die Sperrung oder Löschung eines oder mehrerer Konten begründet keinen Anspruch auf Entschädigung irgendeiner Art."
          ]
        },
        "section5": {
          "title": "7.5. Open Source und Lizenzen",
-          "content": "Der Quellcode des Dienstes ist frei und hier verfügbar: https://github.com/suitenumerique/meet. Die von DINUM angebotenen Inhalte stehen unter einer Open License, mit Ausnahme von Logos sowie ikonografischen und fotografischen Darstellungen, die möglicherweise eigenen Lizenzen unterliegen."
+          "content": "Der Quellcode des Dienstes ist offen und hier verfügbar: https://github.com/suitenumerique/meet. Von DINUM bereitgestellte Inhalte stehen unter der Open License 2.0, mit Ausnahme von Logos sowie ikonografischen und fotografischen Darstellungen, die eigenen Lizenzen unterliegen können."
        }
      }
    },
    "article8": {
-      "title": "8. Änderung der Nutzungsbedingungen",
-      "content": "Die Bedingungen dieser Nutzungsbedingungen können jederzeit ohne Vorankündigung geändert oder ergänzt werden, abhängig von Änderungen am Dienst, Gesetzesänderungen oder aus anderen als notwendig erachteten Gründen.\nDiese Änderungen und Aktualisierungen sind für den Nutzer verbindlich, der daher regelmäßig diesen Abschnitt konsultieren muss, um die geltenden Bedingungen zu überprüfen."
+      "title": "8. Änderungen der Nutzungsbedingungen",
+      "content": "Die vorliegenden Nutzungsbedingungen können jederzeit und ohne Vorankündigung geändert oder ergänzt werden, insbesondere aufgrund von Änderungen am Dienst, gesetzlicher Entwicklungen oder aus anderen als notwendig erachteten Gründen.\nDiese Änderungen und Aktualisierungen sind für die Nutzerinnen und Nutzer verbindlich; sie sollten daher regelmäßig diesen Abschnitt konsultieren, um die geltenden Bedingungen zu überprüfen."
    }
  }
 }
@@ -13,7 +13,7 @@
    "heading": "You don't have the permission to view this page"
  },
  "loading": "Loading…",
-  "loggedInUserTooltip": "Logged in as…",
+  "loggedInUserTooltip": "Logged in as ",
  "login": {
    "buttonLabel": "Login",
    "proconnectButtonLabel": "Login with ProConnect",
@@ -17,7 +17,7 @@
  },
  "success": {
    "title": "Your recording is ready!",
-    "body": "Recording of the meeting <b>{{room}}</b> from {{created_at}}.",
+    "body": "Recording of the meeting {{room}} from {{created_at}}.",
    "expiration": "Attention, this recording will expire after {{expiration_days}} day(s).",
    "button": "Download",
    "warning": {
@@ -154,9 +154,12 @@
  "isIdleDisconnectModal": {
    "title": "Are you still there?",
    "body": "You are the only participant. This call will end in {{duration}}. Would you like to continue the call?",
-    "settings": "To stop seeing this message, go to Settings > General.",
+    "settingsPrefix": "To stop seeing this message, go to",
+    "settingsLink": "Settings > General",
+    "settingsSuffix": ".",
    "stayButton": "Continue the call",
-    "leaveButton": "Leave now"
+    "leaveButton": "Leave now",
+    "countdownAnnouncement": "Call ends in {{duration}}."
  },
  "controls": {
    "microphone": "Microphone",
@@ -504,6 +507,7 @@
  "participants": {
    "subheading": "In room",
    "you": "You",
+    "unknown": "Unknown participant",
    "host": "Host",
    "contributors": "Contributors",
    "collapsable": {
@@ -551,6 +555,14 @@
      "ariaLabel": "Pin {{name}}"
    }
  },
+  "pinAnnouncements": {
+    "pin": "The video of {{name}} is pinned.",
+    "unpin": "The video of {{name}} is no longer pinned.",
+    "self": {
+      "pin": "Your video is pinned.",
+      "unpin": "Your video is no longer pinned."
+    }
+  },
  "recordingStateToast": {
    "transcript": {
      "started": "Transcribing",
@@ -583,6 +595,41 @@
    "muteParticipant": "Mute {{name}}",
    "fullScreen": "Full screen"
  },
+  "shortcutsPanel": {
+    "title": "Keyboard shortcuts",
+    "categories": {
+      "navigation": "Navigation",
+      "media": "Media",
+      "interaction": "Interaction"
+    },
+    "actions": {
+      "open-shortcuts": "Open shortcuts help",
+      "focus-toolbar": "Focus bottom toolbar",
+      "toggle-microphone": "Toggle microphone",
+      "toggle-camera": "Toggle camera",
+      "push-to-talk": "Push-to-talk (hold to unmute)",
+      "reaction": "Emoji reaction panel",
+      "fullscreen": "Toggle fullscreen",
+      "recording": "Toggle recording panel",
+      "raise-hand": "Raise or lower hand",
+      "toggle-chat": "Toggle chat",
+      "toggle-participants": "Toggle participants",
+      "open-shortcuts-settings": "Open shortcuts settings"
+    },
+    "sr": {
+      "control": "Control",
+      "command": "Command",
+      "alt": "Alt",
+      "option": "Option",
+      "shift": "Shift",
+      "plus": "plus",
+      "hold": "Hold {{key}}",
+      "noShortcut": "No shortcut"
+    },
+    "visual": {
+      "hold": "Hold {{key}}"
+    }
+  },
  "fullScreenWarning": {
    "message": "To avoid infinite loop display, do not share your entire screen. Instead, share a tab or another window.",
    "stop": "Stop presenting",
@@ -100,8 +100,14 @@
      }
    }
  },
+  "shortcuts": {
+    "listLabel": "Keyboard shortcuts",
+    "columnAction": "Action",
+    "columnShortcut": "Shortcut"
+  },
  "dialog": {
-    "heading": "Settings"
+    "heading": "Settings",
+    "tablistLabel": "Sections"
  },
  "language": {
    "heading": "Language",
@@ -120,6 +126,7 @@
    "general": "General",
    "notifications": "Notifications",
    "accessibility": "Accessibility",
-    "transcription": "Transcription"
+    "transcription": "Transcription",
+    "shortcuts": "Shortcuts"
  }
 }
@@ -3,115 +3,127 @@
  "articles": {
    "article1": {
      "title": "1. Scope",
-      "content": "This document defines the terms of use for Visio, the videoconferencing service of the administration."
+      "content": "This document defines the terms of use of Visio (hereinafter “Visio” or “the application”), a videoconferencing application specifically designed for State administrations and the bodies under their supervision."
    },
    "article2": {
-      "title": "2. Purpose of the Platform",
-      "content": "The service promotes team cooperation and remote work, and facilitates the organization of meetings, conferences, or training sessions.",
-      "purposes": "Visio is developed and operated by DINUM. Any use of the service must comply with these terms of use."
+      "title": "2. Purpose of the application",
+      "content": "Visio helps foster cooperation among teams of State administrations and bodies under their supervision, supports remote work, and facilitates the organization of meetings, conferences, or training sessions.",
+      "paragraphs": [
+        "Visio is developed and operated by the Interministerial Directorate for Digital Affairs (DINUM).",
+        "The application is made available by DINUM to State administrations and bodies under their supervision, for use by their staff members, partners, and invited service providers.",
+        "Any use of Visio must comply with these terms of use and, where applicable, the usage policy of the relevant supervising administration."
+      ]
    },
    "article3": {
-      "title": "3. Access to the Service",
-      "definition": "Visio is made available to public agents connected through ProConnect for the purpose of administering a videoconference room. The connected public agent can then transmit a link allowing access to the room to any person, under their responsibility."
+      "title": "3. Definitions",
+      "paragraphs": [
+        "Visio is the product whose use is described in these terms and presented on the following page: https://visio.numerique.gouv.fr.",
+        "Users of Visio are any persons using Visio for videoconferencing communication purposes, whether they are staff members, partners, or service providers of the relevant administrations. The supervising administration is the State administration or body under its supervision that makes Visio available to its staff members, partners, or service providers.",
+        "Room organizers are users who are responsible for a videoconference room after logging in via ProConnect."
+      ]
    },
    "article4": {
-      "title": "4. Usage",
-      "content": "The use of the service is free of charge. To administer a videoconference room, it is necessary to connect through ProConnect."
+      "title": "4. Access to the application",
+      "definition": "Visio is made available to users by their supervising administration. Organizers may then share a link granting access to the room with any person, under their responsibility."
    },
    "article5": {
      "title": "5. Features",
      "sections": {
        "section1": {
-          "title": "5.1. Features Available to Public Agents",
-          "content": "Visio offers public agents the ability to create a videoconference room from a standard workstation, linked to their ProConnect account.",
-          "paragraph1": "Any State agent whose activities are compatible with the use of Visio or who is not subject to specific confidentiality obligations or professional secrecy, can create a videoconference. They can then share the meeting link with other participants, whether they are part of the administration or not.",
-          "paragraph2": "To this end, each room organizer can:",
+          "title": "5.1. Features available to organizers",
+          "content": "Visio allows staff of State administrations and bodies under their supervision to create a videoconference room from a standard workstation, linked to their ProConnect account.",
+          "paragraph1": "Any State staff member or staff member of a body under State supervision, whose activities are compatible with the use of Visio or who is not subject to specific confidentiality or professional secrecy obligations, may create and organize a videoconference. They may then share the meeting link with other persons, users, whether or not they belong to the administration.",
+          "paragraph2": "For this purpose, each room organizer may:",
          "capabilities": [
            "Protect access to the room with a waiting room;",
-            "Authorize the entry of each participant into the room;",
-            "Mute the microphones and cameras of participants;",
-            "Remove a participant from the room."
+            "Authorize each user’s entry into the room;",
+            "Mute users’ microphones and cameras;",
+            "Remove a user from the room;",
+            "Use the meeting transcription tool after obtaining the consent of users, under their responsibility."
          ],
-          "paragraph3": "Only agents whose field of activity is authorized to use Visio or who <u>are not subject to specific confidentiality obligations or professional secrecy</u>, may use or have control of this service and its features."
+          "paragraph3": "Only staff members whose ProConnect account belongs to a domain authorized to organize rooms on Visio or who are not subject to specific confidentiality or professional secrecy obligations may use or have control over the application and its features.",
+          "paragraph4": "The automatic transcription tool can be used by organizers from the room settings menu. Organizers are responsible for ensuring the consent of users participating in the transcribed meeting. The transcription language can be changed from the same menu. At the end of the meeting, a link is sent to the organizer to access the transcription stored in the tool called Docs operated by DINUM."
        },
        "section2": {
-          "title": "5.2. Features Available to Users",
-          "content": "Visio allows any user, whether a public agent or not, to participate in any Visio room to which they are invited by a State agent and to benefit from all its features.",
-          "paragraph": "To this end, each participant can:",
+          "title": "5.2. Features available to users",
+          "content": "Visio allows any user, whether a public official or not, to participate in any Visio room to which they are invited by an organizer and to benefit from its features.",
+          "paragraph": "For this purpose, each user may:",
          "capabilities": [
-            "Set their displayed identity when entering the room;",
+            "Provide a display name when entering the room;",
            "Communicate remotely via audio and/or video;",
            "Share their screen;",
-            "Exchange messages during the session publicly with everyone;",
-            "View information about the conference;",
-            "Enable or disable their camera and/or microphone at any time;",
-            "Protect the privacy of their workstation by selecting and activating a background before entering the room or even during the videoconference."
+            "Exchange messages during the session publicly with all users in the room;",
+            "Access technical information about the room and accessibility features;",
+            "Turn their camera and/or microphone on or off at any time;",
+            "Protect the privacy of their surroundings when the camera is on by selecting and activating a background before entering the room or during the videoconference."
          ]
        }
      }
    },
    "article6": {
-      "title": "6. User Commitments and Responsibilities",
+      "title": "6. Commitments and responsibilities of users",
      "sections": {
        "section1": {
-          "title": "6.1 Compliant Uses",
+          "title": "6.1 Permitted uses",
          "paragraphs": [
-            "The service is made available to public agents through ProConnect.",
-            "The user is responsible for the data or content they enter in the videoconference room's messaging service. They must ensure they only enter appropriate messages."
+            "Visio is provided to facilitate professional exchanges between staff of State administrations and bodies under their supervision and external collaborators.",
+            "Users are responsible for the images and sounds they make accessible in the videoconference room. This responsibility applies both to what their camera or microphone may broadcast and to what their device may make accessible to third parties. To this end, users must use the application in a professional environment and must not disclose any information covered by professional confidentiality obligations to third parties (for example: use of privacy filters, headphones, etc.).",
+            "Users are responsible for the data or content they enter into the room’s messaging service. They must ensure that only appropriate messages are entered."
          ]
        },
        "section2": {
-          "title": "6.2 Prohibited Uses",
+          "title": "6.2 Prohibited uses",
          "paragraphs": [
-            "The user agrees not to enter content or information in the Visio room's messaging service that is contrary to current legal and regulatory provisions."
+            "Users undertake not to enter into the Visio room messaging service, or make accessible via image or sound, any content or information that violates applicable laws and regulations."
          ]
        }
      }
    },
    "article7": {
-      "title": "7. DINUM Commitments and Responsibilities",
-      "content": "DINUM is responsible for the overall administration of the service. It provides agents with all necessary information to facilitate its use. It offers technical and functional assistance to ensure the proper operation of the service. It informs users by any reasonable means of any difficulty that may affect this proper operation.",
+      "title": "7. Commitments and responsibilities of DINUM",
      "sections": {
        "section1": {
-          "title": "7.1. Service Availability",
+          "title": "7.1. Application security",
          "paragraphs": [
-            "The service is available 24/7, except during maintenance windows.",
-            "DINUM targets an annual service availability of 99.5%, excluding planned outages. In case of an incident or maintenance, it aims for a recovery time of 72 hours outside business hours.",
-            "As part of maintaining the service runtime environment, DINUM reserves the right to temporarily suspend the operation of the service. It informs users at least 48 hours in advance. In emergencies, this suspension may occur without notice.",
-            "These exceptional stoppages may be necessary, for example, for back-office data management operations, production deployments, or architecture changes.",
-            "Service unavailability does not give rise to any compensation of any kind."
+            "DINUM undertakes to secure Visio, in particular by taking all necessary measures to ensure the security and confidentiality of exchanges.",
+            "The application is certified under the conditions provided for by amended Decree No. 2010-112."
          ]
        },
        "section2": {
-          "title": "7.2. Service Security",
+          "title": "7.2. Access to the application",
          "paragraphs": [
-            "DINUM takes all necessary precautions to preserve the security of the platform and the tools used within the service, particularly regarding access to the service, management of user accounts, and processing of collected data."
+            "DINUM undertakes to provide the necessary and reasonable means to ensure continuous access to the application.",
+            "The application is available 24/7, except during maintenance downtime.",
+            "DINUM aims for an annual application availability rate of 99.5%, excluding planned downtime. In the event of an incident or maintenance, it aims for a restoration time of 72 hours outside business hours.",
+            "As part of maintenance of the application’s runtime environment, DINUM reserves the right to temporarily suspend the operation of the application. Whenever possible, users will be informed at least 48 hours in advance. In emergencies, such suspension may occur without prior notice.",
+            "These exceptional outages may be required, for example, for data management operations, production releases, or architectural changes.",
+            "Application unavailability does not entitle users to any form of compensation."
          ]
        },
        "section3": {
-          "title": "7.3. Support Management",
+          "title": "7.3. Support management",
          "paragraphs": [
-            "DINUM provides first-level support to users, exclusively on the technical parts of the service.",
-            "This support can be reached via our online contact form.",
-            "The target response time to requests is two business days from submission; this timeframe may vary depending on the complexity and number of requests to be processed."
+            "DINUM provides first-level support to users, exclusively on the technical aspects of the application.",
+            "This support can be reached via the online contact form.",
+            "The target response time to requests is two business days from the sending of the email; this timeframe may vary depending on the complexity and number of requests to be processed."
          ]
        },
        "section4": {
-          "title": "7.4. Monitoring Service Use",
+          "title": "7.4. Monitoring application use",
          "paragraphs": [
-            "DINUM reserves the right to suspend or delete an agent account that has violated these terms of use, without prejudice to any potential criminal and civil liability actions that could be taken against the agent concerned.",
-            "The suspension or revocation of one or more accounts does not entitle the user to any compensation of any kind."
+            "DINUM reserves the right to suspend or delete a user account that has failed to comply with these terms of use, without prejudice to any criminal or civil liability actions that may be brought against the person concerned. Information may be transmitted to the user’s supervising administration, which is responsible for making the application available.",
+            "The suspension or revocation of one or more accounts does not give rise to any compensation of any kind."
          ]
        },
        "section5": {
          "title": "7.5. Open Source and Licenses",
-          "content": "The service source code is free and available here: https://github.com/suitenumerique/meet. The content offered by DINUM is under an Open License, with the exception of logos and iconographic and photographic representations that may be governed by their own licenses."
+          "content": "The source code of the service is open and available here: https://github.com/suitenumerique/meet. Content provided by DINUM is licensed under the Open License 2.0, with the exception of logos and iconographic or photographic representations, which may be governed by their own licenses."
        }
      }
    },
    "article8": {
-      "title": "8. Evolution of Terms of Use",
-      "content": "The terms of these terms of use may be modified or supplemented at any time, without notice, depending on changes made to the service, changes in legislation, or for any other reason deemed necessary.\nThese modifications and updates are binding on the user who must, consequently, regularly refer to this section to verify the terms in force."
+      "title": "8. Changes to the terms of use",
+      "content": "The terms of these conditions of use may be modified or supplemented at any time, without notice, depending on changes made to the service, developments in legislation, or for any other reason deemed necessary.\nThese changes and updates are binding on the user, who must therefore regularly refer to this section to verify the current terms."
    }
  }
 }
@@ -13,7 +13,7 @@
    "heading": "Accès interdit"
  },
  "loading": "Chargement…",
-  "loggedInUserTooltip": "Connecté en tant que…",
+  "loggedInUserTooltip": "Connecté en tant que ",
  "login": {
    "buttonLabel": "Se connecter",
    "proconnectButtonLabel": "S'identifier avec ProConnect",
@@ -17,7 +17,7 @@
  },
  "success": {
    "title": "Votre enregistrement est prêt !",
-    "body": "Enregistrement de la réunion <b>{{room}}</b> du {{created_at}}.",
+    "body": "Enregistrement de la réunion {{room}} du {{created_at}}.",
    "expiration": "Attention cet enregistrement expirera au bout de {{expiration_days}} jour(s).",
    "button": "Télécharger",
    "warning": {
@@ -154,9 +154,12 @@
  "isIdleDisconnectModal": {
    "title": "Êtes-vous toujours là ?",
    "body": "Vous êtes le seul participant. Cet appel va donc se terminer dans {{duration}}. Voulez-vous poursuivre l'appel ?",
-    "settings": "Pour ne plus voir ce message, accèder à Paramètres > Général.",
+    "settingsPrefix": "Pour ne plus voir ce message, allez dans",
+    "settingsLink": "Paramètres > Général",
+    "settingsSuffix": ".",
    "stayButton": "Poursuivre l'appel",
-    "leaveButton": "Quitter maintenant"
+    "leaveButton": "Quitter maintenant",
+    "countdownAnnouncement": "L'appel se termine dans {{duration}}."
  },
  "controls": {
    "microphone": "Microphone",
@@ -504,6 +507,7 @@
  "participants": {
    "subheading": "Dans la réunion",
    "you": "Vous",
+    "unknown": "Participant inconnu",
    "contributors": "Contributeurs",
    "host": "Organisateur de la réunion",
    "collapsable": {
@@ -551,6 +555,14 @@
      "ariaLabel": "Épingler {{name}}"
    }
  },
+  "pinAnnouncements": {
+    "pin": "La vidéo de {{name}} est épinglée.",
+    "unpin": "La vidéo de {{name}} n’est plus épinglée.",
+    "self": {
+      "pin": "Votre vidéo est épinglée.",
+      "unpin": "Votre vidéo n’est plus épinglée."
+    }
+  },
  "recordingStateToast": {
    "transcript": {
      "started": "Transcription en cours",
@@ -583,6 +595,41 @@
    "muteParticipant": "Couper le micro de {{name}}",
    "fullScreen": "Plein écran"
  },
+  "shortcutsPanel": {
+    "title": "Raccourcis clavier",
+    "categories": {
+      "navigation": "Navigation",
+      "media": "Média",
+      "interaction": "Interaction"
+    },
+    "actions": {
+      "open-shortcuts": "Ouvrir l’aide des raccourcis",
+      "focus-toolbar": "Mettre le focus sur la barre d’outils du bas",
+      "toggle-microphone": "Activer ou désactiver le micro",
+      "toggle-camera": "Activer ou désactiver la caméra",
+      "push-to-talk": "Appuyer pour parler (maintenir pour réactiver)",
+      "reaction": "Panneau des réactions",
+      "fullscreen": "Basculer en plein écran",
+      "recording": "Basculer le panneau d’enregistrement",
+      "raise-hand": "Lever ou baisser la main",
+      "toggle-chat": "Afficher/Masquer le chat",
+      "toggle-participants": "Afficher/Masquer les participants",
+      "open-shortcuts-settings": "Ouvrir les réglages des raccourcis"
+    },
+    "sr": {
+      "control": "Contrôle",
+      "command": "Commande",
+      "alt": "Alt",
+      "option": "Option",
+      "shift": "Majuscule",
+      "plus": "plus",
+      "hold": "Maintenir {{key}}",
+      "noShortcut": "Aucun raccourci"
+    },
+    "visual": {
+      "hold": "Maintenir {{key}}"
+    }
+  },
  "fullScreenWarning": {
    "message": "Pour éviter l'affichage en boucle infinie, ne partagez pas l'intégralité de votre écran. Partagez plutôt un onglet ou une autre fenêtre.",
    "stop": "Arrêter la présentation",
@@ -100,8 +100,14 @@
      }
    }
  },
+  "shortcuts": {
+    "listLabel": "Liste des raccourcis clavier",
+    "columnAction": "Action",
+    "columnShortcut": "Raccourci"
+  },
  "dialog": {
-    "heading": "Paramètres"
+    "heading": "Paramètres",
+    "tablistLabel": "Sections"
  },
  "language": {
    "heading": "Langue",
@@ -120,6 +126,7 @@
    "general": "Général",
    "notifications": "Notifications",
    "accessibility": "Accessibilité",
-    "transcription": "Transcription"
+    "transcription": "Transcription",
+    "shortcuts": "Raccourcis"
  }
 }
@@ -1,51 +1,61 @@
 {
-  "title": "Modalités d'utilisation de Visio",
+  "title": "Modalités d’utilisation de Visio",
  "articles": {
    "article1": {
-      "title": "1. Champ d'application",
-      "content": "Le présent document définit les modalités d'utilisation de Visio, le service de visioconférence de l'administration."
+      "title": "1. Champ d’application",
+      "content": "Le présent document définit les modalités d’utilisation de Visio (ci-après « Visio » ou « l’application »), une application de visioconférence spécialement conçue pour les administrations de l’Etat et les organismes sous sa tutelle."
    },
    "article2": {
-      "title": "2. Objet de la plateforme",
-      "content": "Le service permet de favoriser la coopération des équipes et le travail à distance et de faciliter l'organisation de réunions, conférences ou formations.",
-      "purposes": "Visio est développé et opéré par la DINUM. Toute utilisation du service doit respecter les présentes modalités d'utilisation."
+      "title": "2. Objet de l’application",
+      "content": "Visio permet de favoriser la coopération des équipes des administrations de l’Etat et des organismes sous sa tutelle et le travail à distance et de faciliter l’organisation de réunions, conférences ou formations.",
+      "paragraphs": [
+        "Visio est développée et opérée par la direction interministérielle du numérique (DINUM).",
+        "L’application est mise à disposition par la DINUM aux administrations de l’Etat et aux organismes sous sa tutelle, à destination de leurs agents, partenaires et prestataires invités.",
+        "Toute utilisation de Visio doit respecter les présentes modalités d’utilisation et, le cas échéant, la doctrine d’emploi de l’administration de rattachement."
+      ]
    },
    "article3": {
-      "title": "3. Accès au service",
-      "definition": "Visio est mis à disposition des agents publics connectés par ProConnect aux fins d'administrer un salon de visioconférence. L'agent public connecté peut ensuite transmettre un lien permettant d'accéder au salon à toute personne, sous sa responsabilité."
+      "title": "3. Définitions",
+      "paragraphs": [
+        "Visio est le produit dont l’utilisation est décrite dans les présentes modalités et présenté sur la page suivante : https://visio.numerique.gouv.fr.",
+        "Les utilisateurs et utilisatrices de Visio sont toute personne utilisant Visio à des fins de communication en visioconférence, qu’elles soient des agents, des partenaires ou des prestataires des administrations de rattachement. L’administration de rattachement est l’administration de l’Etat et des organismes sous sa tutelle qui met à disposition Visio à ses agents, partenaires ou prestataires.",
+        "Les organisateurs et organisatrices de salon sont des utilisateurs et utilisatrices qui sont responsables d’un salon de visioconférence après s’être connecté par ProConnect."
+      ]
    },
    "article4": {
-      "title": "4. Utilisation",
-      "content": "L'utilisation du service est libre et gratuite, pour administrer un salon de visioconférence, il est nécessaire de se connecter par ProConnect."
+      "title": "4. Accès à l’application",
+      "definition": "Visio est mis à disposition des utilisateurs et utilisatrices par leur administration de rattachement. Les organisateurs et organisatrices peuvent ensuite transmettre un lien permettant d’accéder au salon à toute personne, sous leur responsabilité."
    },
    "article5": {
      "title": "5. Fonctionnalités",
      "sections": {
        "section1": {
-          "title": "5.1. Fonctionnalités ouvertes aux agents publics",
-          "content": "Visio offre aux agents publics la possibilité de créer un salon de visioconférence depuis un poste de travail standard, lié à son compte ProConnect.",
-          "paragraph1": "Tout agent de l'État, dont les activités sont compatibles avec l'utilisation de Visio ou qui n'est pas soumis à des obligations particulières de confidentialité ou de secret professionnel, peut créer une visioconférence. Il peut ensuite partager le lien de la réunion avec d'autres participants, qu'ils fassent partie de l'administration ou non.",
-          "paragraph2": "A cet effet, chaque organisateur de salon peut :",
+          "title": "5.1. Fonctionnalités ouvertes aux organisateurs et organisatrices",
+          "content": "Visio offre aux agents des administrations de l’Etat et des organismes sous sa tutelle la possibilité de créer un salon de visioconférence depuis un poste de travail standard, lié à leur compte ProConnect.",
+          "paragraph1": "Tout agent de l’État ou d’un organisme sous sa tutelle, dont les activités sont compatibles avec l’utilisation de Visio ou qui n’est pas soumis à des obligations particulières de confidentialité ou de secret professionnel, peut créer et organiser une visioconférence. Il ou elle peut ensuite partager le lien de la réunion avec d’autres personnes, utilisateurs et utilisatrices, qu’elles fassent partie de l’administration ou non.",
+          "paragraph2": "A cet effet, chaque organisateur ou organisatrice de salon peut :",
          "capabilities": [
-            "Protéger l'accès au salon par une salle d'attente ;",
-            "Autoriser l'entrée de chaque participant dans le salon ;",
-            "Couper les micros et caméras des participants ;",
-            "Exclure un participant du salon."
+            "Protéger l’accès au salon par une salle d’attente ;",
+            "Autoriser l’entrée de chaque utilisateur et utilisatrice dans le salon ;",
+            "Couper les micros et caméras des utilisateurs et utilisatrices ;",
+            "Exclure un utilisateur ou utilisatrice du salon ;",
+            "Utiliser l’outil de transcription de la réunion après avoir obtenu l’aval des utilisateurs et des utilisatrices, sous sa responsabilité."
          ],
-          "paragraph3": "Seuls les agents, dont le domaine d'activité est autorisé à utiliser Visio ou qui <u>ne sont pas soumis à une obligation de confidentialité particulière ou de secret professionnel</u>, peuvent utiliser ou avoir la maîtrise de ce service et de ses fonctionnalités."
+          "paragraph3": "Seuls les agents, dont le compte ProConnect relève d’un domaine autorisé à organiser des salons sur Visio ou qui <u>ne sont pas soumis à une obligation de confidentialité particulière ou de secret professionnel</u>, peuvent utiliser ou avoir la maîtrise de l’application et de ses fonctionnalités.",
+          "paragraph4": "L’outil de transcription automatique peut être utilisé par les organisateurs et organisatrices depuis le menu des paramètres du salon. Il appartient aux organisateurs et organisatrices de s’assurer de l’aval des utilisateurs et utilisatrices participants à la réunion transcrite. La langue de transcription peut être modifiée depuis le même menu. À la fin de la réunion, un lien est transmis à l’organisateur ou l’organisatrice pour accéder à la transcription conservée sur l’outil intitulé Docs opéré par la DINUM."
        },
        "section2": {
          "title": "5.2. Fonctionnalités ouvertes aux utilisateurs et utilisatrices",
-          "content": "Visio permet à tout utilisateur et tout utilisatrice, agent public ou non de participer à tout salon de Visio auquel il est convié par un agent de l'Etat et de profiter de toutes ses fonctionnalités.",
-          "paragraph": "A cet effet, chaque participant et participante peut :",
+          "content": "Visio permet à tout utilisateur et tout utilisatrice, agent public ou non de participer à tout salon de Visio auquel il est convié par un organisateur ou une organisatrice et de profiter des fonctionnalités.",
+          "paragraph": "A cet effet, chaque utilisateur et utilisatrice peut :",
          "capabilities": [
-            "décliner son identité affichée en entrant dans le salon ;",
+            "fournir une identité affichée en entrant dans le salon ;",
            "échanger à distance en audio et/ou en vidéo ;",
            "partager son écran ;",
-            "échanger des messages durant le salon de manière publique avec tous ;",
-            "voir des informations sur la conférence ;",
+            "échanger des messages durant le salon de manière publique avec tous les utilisateurs et utilisatrices de celui-ci ;",
+            "accéder à des informations techniques sur le salon et des fonctionnalités d’accessibilité ;",
            "activer ou désactiver sa caméra et/ou son micro à tout instant ;",
-            "protéger l'intimité de son poste en sélectionnant puis en activant un fond d'écran avant d'entrer dans le salon ou même durant la visioconférence."
+            "protéger l’intimité de son environnement dans le cas d’une activation de la caméra en sélectionnant puis en activant un fond d’écran avant d’entrer dans le salon ou même durant la visioconférence."
          ]
        }
      }
@@ -56,62 +66,64 @@
        "section1": {
          "title": "6.1 Usages conformes",
          "paragraphs": [
-            "Le service est mis à disposition pour les agents publics par ProConnect.",
-            "L'utilisateur ou l'utilisatrice est responsable des données ou contenus qu'il ou elle saisit dans le service de messagerie du salon de visioconférence. Il ou elle veille à ne saisir que des messages appropriés."
+            "Visio est mis à disposition pour faciliter les échanges professionnels entre les agents des administrations de l’Etat et ses organismes sous tutelle et les collaborateurs extérieurs à l’administration.",
+            "L’utilisateur ou l’utilisatrice est responsable des images et sons qu’il ou elle rend accessible dans le salon de visioconférence. Cette responsabilité vaut autant pour ce que la caméra ou le micro peut diffuser que pour ce que son terminal peut rendre accessible à des tiers. A cette fin, l’utilisateur ou l’utilisatrice veille à utiliser l’application dans un environnement professionnel et à ne diffuser aucune information qui serait couverte par l’obligation de discrétion professionnelle à des tiers (par exemple : utilisation de filtre de confidentialité, d’écouteurs, etc.).",
+            "L’utilisateur ou l’utilisatrice est responsable des données ou contenus qu’il ou elle saisit dans le service de messagerie du salon de visioconférence. Il ou elle veille à ne saisir que des messages appropriés."
          ]
        },
        "section2": {
          "title": "6.2 Usages interdits",
          "paragraphs": [
-            "L'utilisateur ou l'utilisatrice s'engage à ne pas saisir dans le service de messagerie du salon de Visio des contenus ou informations contraires aux dispositions légales et réglementaires en vigueur."
+            "L’utilisateur ou l’utilisatrice s’engage à ne pas saisir dans le service de messagerie du salon de Visio ni rendre accessible par image ou son des contenus ou informations contraires aux dispositions légales et réglementaires en vigueur."
          ]
        }
      }
    },
    "article7": {
      "title": "7. Engagements et responsabilités de la DINUM",
-      "content": "La DINUM est responsable de l’administration générale du service. Elle transmet aux agents toutes les informations nécessaires pour faciliter son utilisation. Elle propose une assistance technique et fonctionnelle en vue d’assurer le bon fonctionnement du service. Elle informe par tout moyen raisonnable les utilisateurs de toute difficulté de nature à affecter ce bon fonctionnement.",
      "sections": {
        "section1": {
-          "title": "7.1. Niveau de disponibilité",
+          "title": "7.1. Sécurité de l’application",
          "paragraphs": [
-            "La plage d’ouverture du Service est 24h/24 7j/7, hors période d’indisponibilité pour maintenance.",
-            "La DINUM poursuit un objectif de disponibilité annuelle du service de 99,5%, hors indisponibilités planifiées. En cas d’incident ou de maintenance, elle vise un délai de rétablissement de 72h en heures non ouvrables.",
-            "Dans le cadre d’une maintenance de l’environnement d’exécution du service, La DINUM se réserve le droit de suspendre temporairement le fonctionnement du service. Elle tient informée les utilisateurs au minimum 48h à l’avance. En cas d’urgence, cette suspension peut intervenir sans préavis.",
-            "Ces arrêts exceptionnels peuvent être rendus nécessaires par exemple pour des opérations de gestion des données en back office, des opérations de mise en production ou des changements d’architecture.",
-            "L’indisponibilité du service n’ouvre droit à aucune compensation de quelque nature que ce soit."
+            "La DINUM s’engage à la sécurisation de Visio, notamment en prenant toutes les mesures nécessaires permettant de garantir la sécurité et la confidentialité des échanges.",
+            "L’application est homologuée dans les conditions prévues par le décret n° 2010-112 modifiée."
          ]
        },
        "section2": {
-          "title": "7.2. Sécurité du service",
+          "title": "7.2. Accès à l’application",
          "paragraphs": [
-            "La DINUM prend toutes les précautions utiles pour préserver la sécurité de la plateforme et des outils mis en œuvre dans le cadre du service, notamment s’agissant de l’accès au service, de la gestion des comptes utilisateurs et du traitement des données collectées."
+            "La DINUM s’engage à fournir les moyens nécesaires et raisonnables pour assurer un accès continu à l’application.",
+            "La plage d’ouverture de l’application est 24h/24 7j/7, hors période d’indisponibilité pour maintenance.",
+            "La DINUM poursuit un objectif de disponibilité annuelle de l’application de 99,5%, hors indisponibilités planifiées. En cas d’incident ou de maintenance, elle vise un délai de rétablissement de 72h en heures non ouvrables.",
+            "Dans le cadre d’une maintenance de l’environnement d’exécution de l’application, la DINUM se réserve le droit de suspendre temporairement le fonctionnement de l’application. Dans la mesure du possible, elle tient informée les utilisateurs au minimum 48h à l’avance. En cas d’urgence, cette suspension peut intervenir sans préavis.",
+            "Ces arrêts exceptionnels peuvent être rendus nécessaires par exemple pour des opérations de gestion des données, de mise en production ou des changements d’architecture.",
+            "L’indisponibilité de l’application n’ouvre droit à aucune compensation de quelque nature que ce soit."
          ]
        },
        "section3": {
          "title": "7.3. Gestion du support",
          "paragraphs": [
-            "La DINUM assure le support de premier niveau auprès des utilisateurs, exclusivement sur les parties techniques du service.",
-            "Ce support est joignable sur notre formulaire de contact en ligne.",
+            "La DINUM assure le support de premier niveau auprès des utilisateurs et utilisatrices, exclusivement sur les parties techniques de l’application.",
+            "Ce support est joignable par le formulaire de contact en ligne.",
            "L’objectif de réponse aux sollicitations est de deux jours ouvrés à compter de l’envoi du courriel, ce délai peut varier selon la complexité et le nombre de demandes à traiter."
          ]
        },
        "section4": {
-          "title": "7.4. Contrôle de l’utilisation du service",
+          "title": "7.4. Contrôle de l’utilisation de l’application",
          "paragraphs": [
-            "La DINUM se réserve le droit de suspendre ou supprimer un compte agent qui aurait méconnu les présentes modalités d’utilisation, sans préjudice des éventuelles actions en responsabilité pénale et civile qui pourraient être engagées à l’encontre de l’agent concerné.",
+            "La DINUM se réserve le droit de suspendre ou supprimer un compte d’utilisateur ou d’utilisatrice qui aurait méconnu les présentes modalités d’utilisation, sans préjudice des éventuelles actions en responsabilité pénale et civile qui pourraient être engagées à l’encontre la personne concernée. Les éléments pourraient être transmis à l’administration de rattachement de l’utilisatrice ou de l’utilisateur, celle-ci étant responsable de la mise à disposition de l’application.",
            "La suspension ou la révocation d’un ou plusieurs comptes ne donne lieu à aucune compensation d’aucune sorte."
          ]
        },
        "section5": {
          "title": "7.5. Open Source et Licences",
-          "content": "Le code source du service est libre et disponible ici : https://github.com/suitenumerique/meet. Les contenus proposés par la DINUM sont sous Licence Ouverte, à l’exception des logos et des représentations iconographiques et photographiques pouvant être régis par leurs licences propres."
+          "content": "Le code source du service est libre et disponible ici : https://github.com/suitenumerique/meet. Les contenus proposés par la DINUM sont sous Licence Ouverte 2.0, à l’exception des logos et des représentations iconographiques et photographiques pouvant être régis par leurs licences propres."
        }
      }
    },
    "article8": {
-      "title": "8. Évolution des modalités d'utilisation",
-      "content": "Les termes des présentes modalités d'utilisation peuvent être modifiés ou complétés à tout moment, sans préavis, en fonction des modifications apportées au service, de l'évolution de la législation ou pour tout autre motif jugé nécessaire.\nCes modifications et mises à jour s'imposent à l'utilisateur ou l'utilisatrice qui doit, en conséquence, se référer régulièrement à cette rubrique pour vérifier les modalités en vigueur."
+      "title": "8. Évolution des modalités d’utilisation",
+      "content": "Les termes des présentes modalités d’utilisation peuvent être modifiés ou complétés à tout moment, sans préavis, en fonction des modifications apportées au service, de l’évolution de la législation ou pour tout autre motif jugé nécessaire.\nCes modifications et mises à jour s’imposent à l’utilisateur ou l’utilisatrice qui doit, en conséquence, se référer régulièrement à cette rubrique pour vérifier les modalités en vigueur."
    }
  }
 }
@@ -13,7 +13,7 @@
    "heading": "U hebt geen toestemming om deze pagina te bekijken"
  },
  "loading": "Laden ...",
-  "loggedInUserTooltip": "Ingelogd als ...",
+  "loggedInUserTooltip": "Ingelogd als ",
  "login": {
    "buttonLabel": "Log in",
    "proconnectButtonLabel": "Log in met Proconnect",
@@ -17,7 +17,7 @@
  },
  "success": {
    "title": "Je opname is klaar!",
-    "body": "Opname van de vergadering <b>{{room}}</b> op {{created_at}}.",
+    "body": "Opname van de vergadering {{room}} op {{created_at}}.",
    "expiration": "Let op, deze opname verloopt na {{expiration_days}} dag(en).",
    "button": "Downloaden",
    "warning": {
@@ -154,9 +154,12 @@
  "isIdleDisconnectModal": {
    "title": "Ben je er nog?",
    "body": "Je bent de enige deelnemer. Dit gesprek wordt over {{duration}} beëindigd. Wil je het gesprek voortzetten?",
-    "settings": "Om dit bericht niet meer te zien, ga naar Instellingen > Algemeen.",
+    "settingsPrefix": "Om dit bericht niet meer te zien, ga naar",
+    "settingsLink": "Instellingen > Algemeen",
+    "settingsSuffix": ".",
    "stayButton": "Gesprek voortzetten",
-    "leaveButton": "Nu verlaten"
+    "leaveButton": "Nu verlaten",
+    "countdownAnnouncement": "Het gesprek eindigt over {{duration}}."
  },
  "controls": {
    "microphone": "Microfoon",
@@ -504,6 +507,7 @@
  "participants": {
    "subheading": "In de ruimte",
    "you": "U",
+    "unknown": "Onbekende deelnemer",
    "host": "Host",
    "contributors": "Deelnemers",
    "collapsable": {
@@ -551,6 +555,14 @@
      "ariaLabel": "Maak {{name}} vast"
    }
  },
+  "pinAnnouncements": {
+    "pin": "De video van {{name}} is vastgezet.",
+    "unpin": "De video van {{name}} is niet meer vastgezet.",
+    "self": {
+      "pin": "Uw video is vastgezet.",
+      "unpin": "Uw video is niet meer vastgezet."
+    }
+  },
  "recordingStateToast": {
    "transcript": {
      "started": "Transcriptie bezig",
@@ -583,6 +595,41 @@
    "muteParticipant": "Demp {{name}}",
    "fullScreen": "Volledig scherm"
  },
+  "shortcutsPanel": {
+    "title": "Sneltoetsen",
+    "categories": {
+      "navigation": "Navigatie",
+      "media": "Media",
+      "interaction": "Interactie"
+    },
+    "actions": {
+      "open-shortcuts": "Sneltoetsenhulp openen",
+      "focus-toolbar": "Focus op de onderste werkbalk",
+      "toggle-microphone": "Microfoon aan/uit",
+      "toggle-camera": "Camera aan/uit",
+      "push-to-talk": "Push-to-talk (ingedrukt houden om te activeren)",
+      "reaction": "Reactiepaneel",
+      "fullscreen": "Volledig scherm wisselen",
+      "recording": "Opnamepaneel wisselen",
+      "raise-hand": "Hand opsteken of laten zakken",
+      "toggle-chat": "Chat tonen/verbergen",
+      "toggle-participants": "Deelnemers tonen/verbergen",
+      "open-shortcuts-settings": "Sneltoets-instellingen openen"
+    },
+    "sr": {
+      "control": "Control",
+      "command": "Command",
+      "alt": "Alt",
+      "option": "Option",
+      "shift": "Shift",
+      "plus": "plus",
+      "hold": "Houd {{key}} ingedrukt",
+      "noShortcut": "Geen sneltoets"
+    },
+    "visual": {
+      "hold": "Houd {{key}} ingedrukt"
+    }
+  },
  "fullScreenWarning": {
    "message": "Om niet oneindige uw scherm in zichzelf te delen, kunt u beter niet het hele scherm delen. Deel in plaats daarvan een tab of een ander venster.",
    "stop": "Stop met presenteren",
@@ -100,6 +100,11 @@
      }
    }
  },
+  "shortcuts": {
+    "listLabel": "Sneltoetsen",
+    "columnAction": "Actie",
+    "columnShortcut": "Sneltoets"
+  },
  "dialog": {
    "heading": "Instellingen"
  },
@@ -114,6 +119,7 @@
    "video": "Video",
    "general": "Algemeen",
    "notifications": "Meldingen",
-    "transcription": "Transcriptie"
+    "transcription": "Transcriptie",
+    "shortcuts": "Sneltoetsen"
  }
 }
--- a/Show More
+++ b/Show More